Pc qui rame et bloque un peu tout
jojo
-
jojo -
jojo -
Bonjour,
Voila depuis quelque jour mon ordi et trés lent et bloque des que j'ouvre quelque chose.J'ai fait un rapport avec hijack quelqu'un peu m'aider svp!!!je suis perdu perdu
le raport de hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:28:59, on 06/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\sysregi.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [AliceSAV] "C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Nod32 Runtime] sysregi.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Windows UDP Control Center] ehSched.exe
O4 - HKLM\..\RunServices: [Nod32 Runtime] sysregi.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [gxxrjg] "c:\documents and settings\toto\local settings\application data\gxxrjg.exe" gxxrjg
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
Voila depuis quelque jour mon ordi et trés lent et bloque des que j'ouvre quelque chose.J'ai fait un rapport avec hijack quelqu'un peu m'aider svp!!!je suis perdu perdu
le raport de hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:28:59, on 06/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\sysregi.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [AliceSAV] "C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Nod32 Runtime] sysregi.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Windows UDP Control Center] ehSched.exe
O4 - HKLM\..\RunServices: [Nod32 Runtime] sysregi.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [gxxrjg] "c:\documents and settings\toto\local settings\application data\gxxrjg.exe" gxxrjg
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
A voir également:
- Pc qui rame et bloque un peu tout
- Pc qui rame - Guide
- Réinitialiser un pc - Guide
- Code puk bloqué - Guide
- Downloader for pc - Télécharger - Téléchargement & Transfert
- Formater un pc bloqué par administrateur - Guide
56 réponses
voila le rapport:
ComboFix 08-06-07.3 - toto 2008-06-08 20:19:47.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.52 [GMT 2:00]
Endroit: C:\Documents and Settings\toto\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_poof
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-08 to 2008-06-08 ))))))))))))))))))))))))))))))))))))
.
2008-06-08 17:32 . 2007-09-02 20:37 4,096 --a------ C:\WINDOWS\system32\drivers\KProcCheck.sys
2008-06-08 15:45 . 2008-06-08 16:40 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-06-07 19:51 . 2008-06-07 20:07 <REP> d-------- C:\Backups
2008-06-07 19:50 . 2008-06-08 19:11 <REP> d-------- C:\WINDOWS\ERUNT
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Documents and Settings\toto\Application Data\Malwarebytes
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-06 19:31 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-06 19:31 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-06 16:36 . 2008-06-06 16:36 <REP> d-------- C:\BackUpMSNCleaner
2008-06-06 13:00 . 2008-06-08 19:11 <REP> d-------- C:\Program Files\Trend Micro
2008-06-04 16:17 . 2008-06-04 16:17 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-06-04 15:35 . 2008-06-07 01:51 <REP> d--h----- C:\$AVG8.VAULT$
2008-06-04 00:35 . 2008-06-05 04:04 <REP> d-------- C:\Documents and Settings\toto\Application Data\AVGTOOLBAR
2008-06-04 00:33 . 2008-06-08 13:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-06-03 19:24 . 2008-06-03 19:41 417,792 --a------ C:\WINDOWS\39382.got
2008-06-03 18:01 . 2008-06-03 20:49 61,444 --a------ C:\WINDOWS\scvhost.MSNFix
2008-06-02 21:12 . 2008-06-04 13:34 61,566 --a------ C:\WINDOWS\images.MSNFix
2008-05-31 14:42 . 2008-05-31 14:42 <REP> d-------- C:\Documents and Settings\toto\Application Data\AVS4YOU
2008-05-31 14:42 . 2008-05-31 14:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-05-31 14:40 . 2008-05-31 14:41 <REP> d-------- C:\Program Files\Fichiers communs\AVSMedia
2008-05-31 14:40 . 2003-05-22 00:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2008-05-31 14:40 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-05-31 14:39 . 2008-06-01 13:39 <REP> d-------- C:\Program Files\AVS4YOU
2008-05-27 20:23 . 2008-06-03 00:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-27 20:20 . 2008-05-27 20:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-05-27 19:15 . 2008-05-27 19:15 <REP> d-------- C:\Program Files\Yahoo!
2008-05-27 19:14 . 2008-05-27 19:15 <REP> d-------- C:\Program Files\CCleaner
2008-05-26 19:56 . 2008-05-26 19:56 268 --ah----- C:\sqmdata15.sqm
2008-05-26 19:56 . 2008-05-26 19:56 244 --ah----- C:\sqmnoopt14.sqm
2008-05-26 14:41 . 2008-05-26 14:41 244 --ah----- C:\sqmnoopt12.sqm
2008-05-26 14:41 . 2008-05-26 14:41 232 --ah----- C:\sqmdata12.sqm
2008-05-26 14:41 . 2008-05-26 14:41 208 --ah----- C:\sqmdata14.sqm
2008-05-26 14:41 . 2008-05-26 14:41 172 --ah----- C:\sqmnoopt13.sqm
2008-05-26 14:41 . 2008-05-26 14:41 136 --ah----- C:\sqmdata13.sqm
2008-05-19 15:12 . 2008-05-19 15:12 354,560 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-19 15:12 . 2008-04-04 14:51 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-11 12:28 . 2008-05-11 12:28 268 --ah----- C:\sqmdata09.sqm
2008-05-11 12:28 . 2008-05-11 12:28 244 --ah----- C:\sqmnoopt09.sqm
2008-05-11 12:28 . 2008-05-11 12:28 160 --ah----- C:\sqmnoopt11.sqm
2008-05-11 12:28 . 2008-05-11 12:28 160 --ah----- C:\sqmdata10.sqm
2008-05-11 12:28 . 2008-05-11 12:28 148 --ah----- C:\sqmnoopt10.sqm
2008-05-11 12:28 . 2008-05-11 12:28 148 --ah----- C:\sqmdata11.sqm
2008-05-10 21:35 . 2008-05-10 21:35 268 --ah----- C:\sqmdata07.sqm
2008-05-10 21:35 . 2008-05-10 21:35 244 --ah----- C:\sqmnoopt08.sqm
2008-05-10 21:35 . 2008-05-10 21:35 244 --ah----- C:\sqmnoopt07.sqm
2008-05-10 21:35 . 2008-05-10 21:35 232 --ah----- C:\sqmdata08.sqm
2008-05-10 21:24 . 2008-05-10 21:24 244 --ah----- C:\sqmnoopt06.sqm
2008-05-10 21:24 . 2008-05-10 21:24 232 --ah----- C:\sqmdata06.sqm
2008-05-10 20:48 . 2008-05-10 20:48 244 --ah----- C:\sqmnoopt05.sqm
2008-05-10 20:48 . 2008-05-10 20:48 232 --ah----- C:\sqmdata05.sqm
2008-05-10 05:38 . 2008-05-10 05:38 <REP> d-------- C:\report
2008-05-10 05:38 . 2008-05-10 05:38 <REP> d-------- C:\cs
2008-05-09 03:38 . 2008-05-09 03:38 59 --a------ C:\WINDOWS\yesmessenger.ini
2008-05-09 03:36 . 2008-05-09 03:52 <REP> d-------- C:\Program Files\YesMessenger
2008-05-09 03:14 . 2008-05-09 03:14 <REP> d-------- C:\Documents and Settings\toto\Documents and Settings
2008-05-08 15:39 . 2008-05-08 15:39 144 --a------ C:\WINDOWS\wininit.ini
2008-05-08 13:43 . 2008-06-03 00:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-27 17:55 --------- d-----w C:\Documents and Settings\toto\Application Data\uTorrent
2008-05-19 13:14 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-05-15 16:22 --------- d-----w C:\Program Files\uTorrent
2008-05-07 21:04 --------- d-----w C:\Program Files\Free Easy Burner
2008-05-06 22:59 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-06 22:56 --------- d-----w C:\Documents and Settings\toto\Application Data\DNA
2008-05-06 22:45 --------- d-----w C:\Program Files\Lphant
2008-05-06 11:43 --------- d-----w C:\Program Files\Windows Live
2008-05-05 18:58 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-05-05 18:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-05 15:34 --------- d-----w C:\Program Files\mp3DirectCut
2008-05-05 10:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-03 21:36 164 ----a-w C:\install.dat
2008-05-02 21:33 --------- d-----w C:\Documents and Settings\toto\Application Data\PC Tools
2008-05-02 19:41 --------- d-----w C:\Documents and Settings\toto\Application Data\BitTorrent
2008-05-02 05:23 --------- d-----w C:\Program Files\DNA
2008-04-30 01:36 --------- d-----w C:\Program Files\Mp3 My Mp3 2.0
2008-04-23 23:25 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-23 23:04 --------- d-----w C:\Program Files\Alwil Software
2008-04-23 14:08 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-04-23 13:25 --------- d-----w C:\Documents and Settings\toto\Application Data\MSNInstaller
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 10:26 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-03-20 12:26 20480]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 12:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 18:47 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 18:37 217088]
"AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57 81408]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
C:\Program Files\Spyware Doctor\pctsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\PROGRA~1\WINDOW~4\MESSEN~1\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WeatherDPA]
C:\Program Files\Zango\bin\10.3.37.0\Weather.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINSOS VERIFY]
C:\Program Files\Winsos\WINSOS.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZangoSA]
C:\Program Files\Zango\bin\10.3.37.0\ZangoSA.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Lphant\\eLePhantClient.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\toto\\Mes documents\\VirtualDJ\\virtualdj.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"DEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ӟ"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:55]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-19 15:12]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-06-08 18:24:20 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 20:26:14
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-08 20:30:37 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-08 18:30:22
Pre-Run: 9,256,144,896 octets libres
Post-Run: 9,333,719,040 octets libres
184 --- E O F --- 2008-05-29 00:47:17
ComboFix 08-06-07.3 - toto 2008-06-08 20:19:47.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.52 [GMT 2:00]
Endroit: C:\Documents and Settings\toto\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_poof
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-08 to 2008-06-08 ))))))))))))))))))))))))))))))))))))
.
2008-06-08 17:32 . 2007-09-02 20:37 4,096 --a------ C:\WINDOWS\system32\drivers\KProcCheck.sys
2008-06-08 15:45 . 2008-06-08 16:40 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-06-07 19:51 . 2008-06-07 20:07 <REP> d-------- C:\Backups
2008-06-07 19:50 . 2008-06-08 19:11 <REP> d-------- C:\WINDOWS\ERUNT
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Documents and Settings\toto\Application Data\Malwarebytes
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-06 19:31 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-06 19:31 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-06 16:36 . 2008-06-06 16:36 <REP> d-------- C:\BackUpMSNCleaner
2008-06-06 13:00 . 2008-06-08 19:11 <REP> d-------- C:\Program Files\Trend Micro
2008-06-04 16:17 . 2008-06-04 16:17 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-06-04 15:35 . 2008-06-07 01:51 <REP> d--h----- C:\$AVG8.VAULT$
2008-06-04 00:35 . 2008-06-05 04:04 <REP> d-------- C:\Documents and Settings\toto\Application Data\AVGTOOLBAR
2008-06-04 00:33 . 2008-06-08 13:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-06-03 19:24 . 2008-06-03 19:41 417,792 --a------ C:\WINDOWS\39382.got
2008-06-03 18:01 . 2008-06-03 20:49 61,444 --a------ C:\WINDOWS\scvhost.MSNFix
2008-06-02 21:12 . 2008-06-04 13:34 61,566 --a------ C:\WINDOWS\images.MSNFix
2008-05-31 14:42 . 2008-05-31 14:42 <REP> d-------- C:\Documents and Settings\toto\Application Data\AVS4YOU
2008-05-31 14:42 . 2008-05-31 14:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-05-31 14:40 . 2008-05-31 14:41 <REP> d-------- C:\Program Files\Fichiers communs\AVSMedia
2008-05-31 14:40 . 2003-05-22 00:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2008-05-31 14:40 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-05-31 14:39 . 2008-06-01 13:39 <REP> d-------- C:\Program Files\AVS4YOU
2008-05-27 20:23 . 2008-06-03 00:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-27 20:20 . 2008-05-27 20:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-05-27 19:15 . 2008-05-27 19:15 <REP> d-------- C:\Program Files\Yahoo!
2008-05-27 19:14 . 2008-05-27 19:15 <REP> d-------- C:\Program Files\CCleaner
2008-05-26 19:56 . 2008-05-26 19:56 268 --ah----- C:\sqmdata15.sqm
2008-05-26 19:56 . 2008-05-26 19:56 244 --ah----- C:\sqmnoopt14.sqm
2008-05-26 14:41 . 2008-05-26 14:41 244 --ah----- C:\sqmnoopt12.sqm
2008-05-26 14:41 . 2008-05-26 14:41 232 --ah----- C:\sqmdata12.sqm
2008-05-26 14:41 . 2008-05-26 14:41 208 --ah----- C:\sqmdata14.sqm
2008-05-26 14:41 . 2008-05-26 14:41 172 --ah----- C:\sqmnoopt13.sqm
2008-05-26 14:41 . 2008-05-26 14:41 136 --ah----- C:\sqmdata13.sqm
2008-05-19 15:12 . 2008-05-19 15:12 354,560 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-19 15:12 . 2008-04-04 14:51 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-11 12:28 . 2008-05-11 12:28 268 --ah----- C:\sqmdata09.sqm
2008-05-11 12:28 . 2008-05-11 12:28 244 --ah----- C:\sqmnoopt09.sqm
2008-05-11 12:28 . 2008-05-11 12:28 160 --ah----- C:\sqmnoopt11.sqm
2008-05-11 12:28 . 2008-05-11 12:28 160 --ah----- C:\sqmdata10.sqm
2008-05-11 12:28 . 2008-05-11 12:28 148 --ah----- C:\sqmnoopt10.sqm
2008-05-11 12:28 . 2008-05-11 12:28 148 --ah----- C:\sqmdata11.sqm
2008-05-10 21:35 . 2008-05-10 21:35 268 --ah----- C:\sqmdata07.sqm
2008-05-10 21:35 . 2008-05-10 21:35 244 --ah----- C:\sqmnoopt08.sqm
2008-05-10 21:35 . 2008-05-10 21:35 244 --ah----- C:\sqmnoopt07.sqm
2008-05-10 21:35 . 2008-05-10 21:35 232 --ah----- C:\sqmdata08.sqm
2008-05-10 21:24 . 2008-05-10 21:24 244 --ah----- C:\sqmnoopt06.sqm
2008-05-10 21:24 . 2008-05-10 21:24 232 --ah----- C:\sqmdata06.sqm
2008-05-10 20:48 . 2008-05-10 20:48 244 --ah----- C:\sqmnoopt05.sqm
2008-05-10 20:48 . 2008-05-10 20:48 232 --ah----- C:\sqmdata05.sqm
2008-05-10 05:38 . 2008-05-10 05:38 <REP> d-------- C:\report
2008-05-10 05:38 . 2008-05-10 05:38 <REP> d-------- C:\cs
2008-05-09 03:38 . 2008-05-09 03:38 59 --a------ C:\WINDOWS\yesmessenger.ini
2008-05-09 03:36 . 2008-05-09 03:52 <REP> d-------- C:\Program Files\YesMessenger
2008-05-09 03:14 . 2008-05-09 03:14 <REP> d-------- C:\Documents and Settings\toto\Documents and Settings
2008-05-08 15:39 . 2008-05-08 15:39 144 --a------ C:\WINDOWS\wininit.ini
2008-05-08 13:43 . 2008-06-03 00:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-27 17:55 --------- d-----w C:\Documents and Settings\toto\Application Data\uTorrent
2008-05-19 13:14 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-05-15 16:22 --------- d-----w C:\Program Files\uTorrent
2008-05-07 21:04 --------- d-----w C:\Program Files\Free Easy Burner
2008-05-06 22:59 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-06 22:56 --------- d-----w C:\Documents and Settings\toto\Application Data\DNA
2008-05-06 22:45 --------- d-----w C:\Program Files\Lphant
2008-05-06 11:43 --------- d-----w C:\Program Files\Windows Live
2008-05-05 18:58 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-05-05 18:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-05 15:34 --------- d-----w C:\Program Files\mp3DirectCut
2008-05-05 10:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-03 21:36 164 ----a-w C:\install.dat
2008-05-02 21:33 --------- d-----w C:\Documents and Settings\toto\Application Data\PC Tools
2008-05-02 19:41 --------- d-----w C:\Documents and Settings\toto\Application Data\BitTorrent
2008-05-02 05:23 --------- d-----w C:\Program Files\DNA
2008-04-30 01:36 --------- d-----w C:\Program Files\Mp3 My Mp3 2.0
2008-04-23 23:25 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-23 23:04 --------- d-----w C:\Program Files\Alwil Software
2008-04-23 14:08 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-04-23 13:25 --------- d-----w C:\Documents and Settings\toto\Application Data\MSNInstaller
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 10:26 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-03-20 12:26 20480]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 12:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 18:47 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 18:37 217088]
"AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57 81408]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
C:\Program Files\Spyware Doctor\pctsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\PROGRA~1\WINDOW~4\MESSEN~1\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WeatherDPA]
C:\Program Files\Zango\bin\10.3.37.0\Weather.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINSOS VERIFY]
C:\Program Files\Winsos\WINSOS.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZangoSA]
C:\Program Files\Zango\bin\10.3.37.0\ZangoSA.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Lphant\\eLePhantClient.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\toto\\Mes documents\\VirtualDJ\\virtualdj.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"DEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ӟ"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:55]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-19 15:12]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-06-08 18:24:20 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 20:26:14
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-08 20:30:37 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-08 18:30:22
Pre-Run: 9,256,144,896 octets libres
Post-Run: 9,333,719,040 octets libres
184 --- E O F --- 2008-05-29 00:47:17
1-Crée un doc texte sur ton bureau :
pointes ta souris sur ton bureau , click droit : vas dans "nouveau" et choisis "document texte" .
Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de crée :
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WeatherDPA]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINSOS VERIFY]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZangoSA]
File::
C:\Program Files\Zango\bin\10.3.37.0\Weather.exe
C:\Program Files\Winsos\WINSOS.exe
C:\Program Files\Zango\bin\10.3.37.0\ZangoSA.exe
Folder::
C:\BackUpMSNCleaner
C:\$AVG8.VAULT$
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR
C:\Documents and Settings\All Users\Application Data\avg8
Puis vas dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi :
CFScript puis valides ...
2-Nettoyage :
!!Déconnectes toi,fermes toute tes application et désactive ton antivirus le temps de la manipe ( tu le réactiveras après ) !!
--->Sur ton bureau, fais un glisser avec ta souris le fichier CFScript sur l'icone de ComboFix.exe .
(Regarde ici : http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif )
Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tape 1 puis valide.
Puis patientes le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!)
!!Ne touche à rien tant que le scan n'est pas terminé !!
Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisses-le faire.
Une fois le scan achevé, un rapport va s'afficher : Postes le accompagné d' un nouveau rapport HijackThis pour analyse ...
( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )
pointes ta souris sur ton bureau , click droit : vas dans "nouveau" et choisis "document texte" .
Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de crée :
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WeatherDPA]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINSOS VERIFY]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZangoSA]
File::
C:\Program Files\Zango\bin\10.3.37.0\Weather.exe
C:\Program Files\Winsos\WINSOS.exe
C:\Program Files\Zango\bin\10.3.37.0\ZangoSA.exe
Folder::
C:\BackUpMSNCleaner
C:\$AVG8.VAULT$
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR
C:\Documents and Settings\All Users\Application Data\avg8
Puis vas dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi :
CFScript puis valides ...
2-Nettoyage :
!!Déconnectes toi,fermes toute tes application et désactive ton antivirus le temps de la manipe ( tu le réactiveras après ) !!
--->Sur ton bureau, fais un glisser avec ta souris le fichier CFScript sur l'icone de ComboFix.exe .
(Regarde ici : http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif )
Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tape 1 puis valide.
Puis patientes le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!)
!!Ne touche à rien tant que le scan n'est pas terminé !!
Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisses-le faire.
Une fois le scan achevé, un rapport va s'afficher : Postes le accompagné d' un nouveau rapport HijackThis pour analyse ...
( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )
Désolé de repondre que m'intenant hier soir j'ai pas pu me conecté et aujourd'hui cours
voila le rapport de combofix:
ComboFix 08-06-07.3 - toto 2008-06-09 17:03:37.2 - NTFSx86
Endroit: C:\Documents and Settings\toto\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\toto\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
FILE ::
C:\Program Files\Winsos\WINSOS.exe
C:\Program Files\Zango\bin\10.3.37.0\Weather.exe
C:\Program Files\Zango\bin\10.3.37.0\ZangoSA.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\$AVG8.VAULT$
C:\$AVG8.VAULT$\V_00000001.fil
C:\$AVG8.VAULT$\V_00000002.fil
C:\$AVG8.VAULT$\V_00000003.fil
C:\$AVG8.VAULT$\V_00000004.fil
C:\$AVG8.VAULT$\V_00000005.fil
C:\$AVG8.VAULT$\V_00000006.fil
C:\$AVG8.VAULT$\V_00000007.fil
C:\$AVG8.VAULT$\V_00000008.fil
C:\$AVG8.VAULT$\V_00000009.fil
C:\$AVG8.VAULT$\V_00000010.fil
C:\$AVG8.VAULT$\V_00000011.fil
C:\$AVG8.VAULT$\V_00000012.fil
C:\$AVG8.VAULT$\V_00000013.fil
C:\$AVG8.VAULT$\V_00000014.fil
C:\$AVG8.VAULT$\V_00000015.fil
C:\$AVG8.VAULT$\V_00000016.fil
C:\$AVG8.VAULT$\V_00000017.fil
C:\$AVG8.VAULT$\V_00000018.fil
C:\$AVG8.VAULT$\V_00000019.fil
C:\$AVG8.VAULT$\V_00000020.fil
C:\$AVG8.VAULT$\V_00000021.fil
C:\$AVG8.VAULT$\V_00000022.fil
C:\$AVG8.VAULT$\V_00000023.fil
C:\$AVG8.VAULT$\V_00000024.fil
C:\$AVG8.VAULT$\V_00000025.fil
C:\$AVG8.VAULT$\V_00000026.fil
C:\$AVG8.VAULT$\V_00000027.fil
C:\$AVG8.VAULT$\V_00000028.fil
C:\$AVG8.VAULT$\V_00000029.fil
C:\$AVG8.VAULT$\V_00000030.fil
C:\$AVG8.VAULT$\V_00000031.fil
C:\$AVG8.VAULT$\V_00000032.fil
C:\$AVG8.VAULT$\V_00000033.fil
C:\$AVG8.VAULT$\V_00000034.fil
C:\$AVG8.VAULT$\V_00000035.fil
C:\$AVG8.VAULT$\V_00000036.fil
C:\$AVG8.VAULT$\V_00000037.fil
C:\$AVG8.VAULT$\V_00000038.fil
C:\$AVG8.VAULT$\V_00000039.fil
C:\$AVG8.VAULT$\V_00000040.fil
C:\$AVG8.VAULT$\V_00000041.fil
C:\$AVG8.VAULT$\V_00000042.fil
C:\$AVG8.VAULT$\V_00000043.fil
C:\$AVG8.VAULT$\V_00000044.fil
C:\$AVG8.VAULT$\V_00000045.fil
C:\$AVG8.VAULT$\V_00000046.fil
C:\$AVG8.VAULT$\V_00000047.fil
C:\$AVG8.VAULT$\V_00000048.fil
C:\$AVG8.VAULT$\V_00000049.fil
C:\$AVG8.VAULT$\V_00000050.fil
C:\$AVG8.VAULT$\V_00000051.fil
C:\$AVG8.VAULT$\V_00000052.fil
C:\$AVG8.VAULT$\V_00000053.fil
C:\$AVG8.VAULT$\V_00000054.fil
C:\$AVG8.VAULT$\V_00000055.fil
C:\$AVG8.VAULT$\V_00000056.fil
C:\$AVG8.VAULT$\V_00000057.fil
C:\$AVG8.VAULT$\V_00000058.fil
C:\$AVG8.VAULT$\V_00000059.fil
C:\$AVG8.VAULT$\V_00000060.fil
C:\$AVG8.VAULT$\V_00000061.fil
C:\$AVG8.VAULT$\V_00000062.fil
C:\$AVG8.VAULT$\V_00000063.fil
C:\$AVG8.VAULT$\V_00000064.fil
C:\$AVG8.VAULT$\V_00000065.fil
C:\$AVG8.VAULT$\V_00000066.fil
C:\$AVG8.VAULT$\V_00000067.fil
C:\$AVG8.VAULT$\V_00000068.fil
C:\$AVG8.VAULT$\V_00000069.fil
C:\$AVG8.VAULT$\V_00000070.fil
C:\$AVG8.VAULT$\V_00000071.fil
C:\$AVG8.VAULT$\vvfolder.idx
C:\BackUpMSNCleaner
C:\Documents and Settings\All Users\Application Data\avg8
C:\Documents and Settings\All Users\Application Data\avg8\Cfg\krnl.cfg
C:\Documents and Settings\All Users\Application Data\avg8\Cfg\mail.cfg
C:\Documents and Settings\All Users\Application Data\avg8\Cfg\scan.cfg
C:\Documents and Settings\All Users\Application Data\avg8\Cfg\sched.cfg
C:\Documents and Settings\All Users\Application Data\avg8\Cfg\update.cfg
C:\Documents and Settings\All Users\Application Data\avg8\Cfg\user.cfg
C:\Documents and Settings\All Users\Application Data\avg8\dumps\avgupd.exe_128570903443658700.dmp
C:\Documents and Settings\All Users\Application Data\avg8\emc\Log\emc.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcfg.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcore.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcore.log.1
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcore.log.2
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcore.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgfrw.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgfrw.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log.1
C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log.2
C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log.3
C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log.4
C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgrs.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgrs.log.1
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgrs.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgscan.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgscan.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgsched.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgsrm.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgsrm.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgui.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgui.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgupd.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgupd.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgwd.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgwdsvc.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgwdsvc.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\commonpriv.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\commonpriv.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\history.xml
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000001.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000005.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000006.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000007.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000008.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000009.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000010.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000011.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\srm.idx
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\avi7.avg
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\incavi.avm
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\microavi.avg
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\miniavi.avg
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\sb.dat
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\sb2.dat
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\sc.dat
C:\Documents and Settings\All Users\Application Data\avg8\update\prepare\sb.dat.prepare
C:\Documents and Settings\All Users\Application Data\avg8\update\prepare\sc.dat.prepare
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\avglinks.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\avglogo.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\avgstatus.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\avgstatus_error.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\avgtoolbartb0502.cfg
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\brandlogo.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\COMBOSEARCH.acs
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\ErrorLog.txt
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\p_yahoo.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\safesearch.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\safesearch_off.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\safesearch_on.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\safesurf.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\safesurf_off.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\safesurf_on.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\slider.bmp
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-09 to 2008-06-09 ))))))))))))))))))))))))))))))))))))
.
2008-06-08 17:32 . 2007-09-02 20:37 4,096 --a------ C:\WINDOWS\system32\drivers\KProcCheck.sys
2008-06-08 15:45 . 2008-06-08 16:40 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-06-07 19:51 . 2008-06-07 20:07 <REP> d-------- C:\Backups
2008-06-07 19:50 . 2008-06-08 19:11 <REP> d-------- C:\WINDOWS\ERUNT
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Documents and Settings\toto\Application Data\Malwarebytes
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-06 19:31 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-06 19:31 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-06 13:00 . 2008-06-08 19:11 <REP> d-------- C:\Program Files\Trend Micro
2008-06-04 16:17 . 2008-06-04 16:17 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-06-03 19:24 . 2008-06-03 19:41 417,792 --a------ C:\WINDOWS\39382.got
2008-06-03 18:01 . 2008-06-03 20:49 61,444 --a------ C:\WINDOWS\scvhost.MSNFix
2008-06-02 21:12 . 2008-06-04 13:34 61,566 --a------ C:\WINDOWS\images.MSNFix
2008-05-31 14:42 . 2008-05-31 14:42 <REP> d-------- C:\Documents and Settings\toto\Application Data\AVS4YOU
2008-05-31 14:42 . 2008-05-31 14:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-05-31 14:40 . 2008-05-31 14:41 <REP> d-------- C:\Program Files\Fichiers communs\AVSMedia
2008-05-31 14:40 . 2003-05-22 00:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2008-05-31 14:40 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-05-31 14:39 . 2008-06-01 13:39 <REP> d-------- C:\Program Files\AVS4YOU
2008-05-27 20:23 . 2008-06-03 00:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-27 20:20 . 2008-05-27 20:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-05-27 19:15 . 2008-05-27 19:15 <REP> d-------- C:\Program Files\Yahoo!
2008-05-27 19:14 . 2008-05-27 19:15 <REP> d-------- C:\Program Files\CCleaner
2008-05-26 19:56 . 2008-05-26 19:56 268 --ah----- C:\sqmdata15.sqm
2008-05-26 19:56 . 2008-05-26 19:56 244 --ah----- C:\sqmnoopt14.sqm
2008-05-26 14:41 . 2008-05-26 14:41 244 --ah----- C:\sqmnoopt12.sqm
2008-05-26 14:41 . 2008-05-26 14:41 232 --ah----- C:\sqmdata12.sqm
2008-05-26 14:41 . 2008-05-26 14:41 208 --ah----- C:\sqmdata14.sqm
2008-05-26 14:41 . 2008-05-26 14:41 172 --ah----- C:\sqmnoopt13.sqm
2008-05-26 14:41 . 2008-05-26 14:41 136 --ah----- C:\sqmdata13.sqm
2008-05-19 15:12 . 2008-05-19 15:12 354,560 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-19 15:12 . 2008-04-04 14:51 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-11 12:28 . 2008-05-11 12:28 268 --ah----- C:\sqmdata09.sqm
2008-05-11 12:28 . 2008-05-11 12:28 244 --ah----- C:\sqmnoopt09.sqm
2008-05-11 12:28 . 2008-05-11 12:28 160 --ah----- C:\sqmnoopt11.sqm
2008-05-11 12:28 . 2008-05-11 12:28 160 --ah----- C:\sqmdata10.sqm
2008-05-11 12:28 . 2008-05-11 12:28 148 --ah----- C:\sqmnoopt10.sqm
2008-05-11 12:28 . 2008-05-11 12:28 148 --ah----- C:\sqmdata11.sqm
2008-05-10 21:35 . 2008-05-10 21:35 268 --ah----- C:\sqmdata07.sqm
2008-05-10 21:35 . 2008-05-10 21:35 244 --ah----- C:\sqmnoopt08.sqm
2008-05-10 21:35 . 2008-05-10 21:35 244 --ah----- C:\sqmnoopt07.sqm
2008-05-10 21:35 . 2008-05-10 21:35 232 --ah----- C:\sqmdata08.sqm
2008-05-10 21:24 . 2008-05-10 21:24 244 --ah----- C:\sqmnoopt06.sqm
2008-05-10 21:24 . 2008-05-10 21:24 232 --ah----- C:\sqmdata06.sqm
2008-05-10 20:48 . 2008-05-10 20:48 244 --ah----- C:\sqmnoopt05.sqm
2008-05-10 20:48 . 2008-05-10 20:48 232 --ah----- C:\sqmdata05.sqm
2008-05-10 05:38 . 2008-05-10 05:38 <REP> d-------- C:\report
2008-05-10 05:38 . 2008-05-10 05:38 <REP> d-------- C:\cs
2008-05-09 03:38 . 2008-05-09 03:38 59 --a------ C:\WINDOWS\yesmessenger.ini
2008-05-09 03:36 . 2008-05-09 03:52 <REP> d-------- C:\Program Files\YesMessenger
2008-05-09 03:14 . 2008-05-09 03:14 <REP> d-------- C:\Documents and Settings\toto\Documents and Settings
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-02 22:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-27 17:55 --------- d-----w C:\Documents and Settings\toto\Application Data\uTorrent
2008-05-19 13:14 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-05-15 16:22 --------- d-----w C:\Program Files\uTorrent
2008-05-07 21:04 --------- d-----w C:\Program Files\Free Easy Burner
2008-05-06 22:59 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-06 22:56 --------- d-----w C:\Documents and Settings\toto\Application Data\DNA
2008-05-06 22:45 --------- d-----w C:\Program Files\Lphant
2008-05-06 11:43 --------- d-----w C:\Program Files\Windows Live
2008-05-05 18:58 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-05-05 18:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-05 15:34 --------- d-----w C:\Program Files\mp3DirectCut
2008-05-05 10:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-03 21:36 164 ----a-w C:\install.dat
2008-05-02 21:33 --------- d-----w C:\Documents and Settings\toto\Application Data\PC Tools
2008-05-02 19:41 --------- d-----w C:\Documents and Settings\toto\Application Data\BitTorrent
2008-05-02 05:23 --------- d-----w C:\Program Files\DNA
2008-04-30 01:36 --------- d-----w C:\Program Files\Mp3 My Mp3 2.0
2008-04-23 23:25 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-23 23:04 --------- d-----w C:\Program Files\Alwil Software
2008-04-23 14:08 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-04-23 13:25 --------- d-----w C:\Documents and Settings\toto\Application Data\MSNInstaller
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 10:26 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-08_20.29.51.64 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-08 18:23:53 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-09 15:08:21 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-09 15:08:35 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_50c.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-03-20 12:26 20480]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 12:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 18:47 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 18:37 217088]
"AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57 81408]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
C:\Program Files\Spyware Doctor\pctsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\PROGRA~1\WINDOW~4\MESSEN~1\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Lphant\\eLePhantClient.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\toto\\Mes documents\\VirtualDJ\\virtualdj.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"DEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ӟ"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:55]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-19 15:12]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-06-09 15:09:07 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 17:10:46
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-09 17:16:25 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-09 15:16:11
ComboFix2.txt 2008-06-08 18:30:39
Pre-Run: 9,341,898,752 octets libres
Post-Run: 9,615,392,768 octets libres
330 --- E O F --- 2008-05-29 00:47:17
voila le rapport de combofix:
ComboFix 08-06-07.3 - toto 2008-06-09 17:03:37.2 - NTFSx86
Endroit: C:\Documents and Settings\toto\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\toto\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
FILE ::
C:\Program Files\Winsos\WINSOS.exe
C:\Program Files\Zango\bin\10.3.37.0\Weather.exe
C:\Program Files\Zango\bin\10.3.37.0\ZangoSA.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\$AVG8.VAULT$
C:\$AVG8.VAULT$\V_00000001.fil
C:\$AVG8.VAULT$\V_00000002.fil
C:\$AVG8.VAULT$\V_00000003.fil
C:\$AVG8.VAULT$\V_00000004.fil
C:\$AVG8.VAULT$\V_00000005.fil
C:\$AVG8.VAULT$\V_00000006.fil
C:\$AVG8.VAULT$\V_00000007.fil
C:\$AVG8.VAULT$\V_00000008.fil
C:\$AVG8.VAULT$\V_00000009.fil
C:\$AVG8.VAULT$\V_00000010.fil
C:\$AVG8.VAULT$\V_00000011.fil
C:\$AVG8.VAULT$\V_00000012.fil
C:\$AVG8.VAULT$\V_00000013.fil
C:\$AVG8.VAULT$\V_00000014.fil
C:\$AVG8.VAULT$\V_00000015.fil
C:\$AVG8.VAULT$\V_00000016.fil
C:\$AVG8.VAULT$\V_00000017.fil
C:\$AVG8.VAULT$\V_00000018.fil
C:\$AVG8.VAULT$\V_00000019.fil
C:\$AVG8.VAULT$\V_00000020.fil
C:\$AVG8.VAULT$\V_00000021.fil
C:\$AVG8.VAULT$\V_00000022.fil
C:\$AVG8.VAULT$\V_00000023.fil
C:\$AVG8.VAULT$\V_00000024.fil
C:\$AVG8.VAULT$\V_00000025.fil
C:\$AVG8.VAULT$\V_00000026.fil
C:\$AVG8.VAULT$\V_00000027.fil
C:\$AVG8.VAULT$\V_00000028.fil
C:\$AVG8.VAULT$\V_00000029.fil
C:\$AVG8.VAULT$\V_00000030.fil
C:\$AVG8.VAULT$\V_00000031.fil
C:\$AVG8.VAULT$\V_00000032.fil
C:\$AVG8.VAULT$\V_00000033.fil
C:\$AVG8.VAULT$\V_00000034.fil
C:\$AVG8.VAULT$\V_00000035.fil
C:\$AVG8.VAULT$\V_00000036.fil
C:\$AVG8.VAULT$\V_00000037.fil
C:\$AVG8.VAULT$\V_00000038.fil
C:\$AVG8.VAULT$\V_00000039.fil
C:\$AVG8.VAULT$\V_00000040.fil
C:\$AVG8.VAULT$\V_00000041.fil
C:\$AVG8.VAULT$\V_00000042.fil
C:\$AVG8.VAULT$\V_00000043.fil
C:\$AVG8.VAULT$\V_00000044.fil
C:\$AVG8.VAULT$\V_00000045.fil
C:\$AVG8.VAULT$\V_00000046.fil
C:\$AVG8.VAULT$\V_00000047.fil
C:\$AVG8.VAULT$\V_00000048.fil
C:\$AVG8.VAULT$\V_00000049.fil
C:\$AVG8.VAULT$\V_00000050.fil
C:\$AVG8.VAULT$\V_00000051.fil
C:\$AVG8.VAULT$\V_00000052.fil
C:\$AVG8.VAULT$\V_00000053.fil
C:\$AVG8.VAULT$\V_00000054.fil
C:\$AVG8.VAULT$\V_00000055.fil
C:\$AVG8.VAULT$\V_00000056.fil
C:\$AVG8.VAULT$\V_00000057.fil
C:\$AVG8.VAULT$\V_00000058.fil
C:\$AVG8.VAULT$\V_00000059.fil
C:\$AVG8.VAULT$\V_00000060.fil
C:\$AVG8.VAULT$\V_00000061.fil
C:\$AVG8.VAULT$\V_00000062.fil
C:\$AVG8.VAULT$\V_00000063.fil
C:\$AVG8.VAULT$\V_00000064.fil
C:\$AVG8.VAULT$\V_00000065.fil
C:\$AVG8.VAULT$\V_00000066.fil
C:\$AVG8.VAULT$\V_00000067.fil
C:\$AVG8.VAULT$\V_00000068.fil
C:\$AVG8.VAULT$\V_00000069.fil
C:\$AVG8.VAULT$\V_00000070.fil
C:\$AVG8.VAULT$\V_00000071.fil
C:\$AVG8.VAULT$\vvfolder.idx
C:\BackUpMSNCleaner
C:\Documents and Settings\All Users\Application Data\avg8
C:\Documents and Settings\All Users\Application Data\avg8\Cfg\krnl.cfg
C:\Documents and Settings\All Users\Application Data\avg8\Cfg\mail.cfg
C:\Documents and Settings\All Users\Application Data\avg8\Cfg\scan.cfg
C:\Documents and Settings\All Users\Application Data\avg8\Cfg\sched.cfg
C:\Documents and Settings\All Users\Application Data\avg8\Cfg\update.cfg
C:\Documents and Settings\All Users\Application Data\avg8\Cfg\user.cfg
C:\Documents and Settings\All Users\Application Data\avg8\dumps\avgupd.exe_128570903443658700.dmp
C:\Documents and Settings\All Users\Application Data\avg8\emc\Log\emc.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcfg.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcore.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcore.log.1
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcore.log.2
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcore.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgfrw.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgfrw.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log.1
C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log.2
C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log.3
C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log.4
C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgrs.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgrs.log.1
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgrs.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgscan.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgscan.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgsched.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgsrm.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgsrm.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgui.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgui.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgupd.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgupd.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgwd.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgwdsvc.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\avgwdsvc.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\commonpriv.log
C:\Documents and Settings\All Users\Application Data\avg8\Log\commonpriv.log.lock
C:\Documents and Settings\All Users\Application Data\avg8\Log\history.xml
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000001.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000005.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000006.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000007.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000008.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000009.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000010.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\I_00000011.log
C:\Documents and Settings\All Users\Application Data\avg8\scanlogs\srm.idx
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\avi7.avg
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\incavi.avm
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\microavi.avg
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\miniavi.avg
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\sb.dat
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\sb2.dat
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\sc.dat
C:\Documents and Settings\All Users\Application Data\avg8\update\prepare\sb.dat.prepare
C:\Documents and Settings\All Users\Application Data\avg8\update\prepare\sc.dat.prepare
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\avglinks.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\avglogo.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\avgstatus.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\avgstatus_error.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\avgtoolbartb0502.cfg
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\brandlogo.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\COMBOSEARCH.acs
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\ErrorLog.txt
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\p_yahoo.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\safesearch.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\safesearch_off.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\safesearch_on.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\safesurf.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\safesurf_off.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\safesurf_on.bmp
C:\Documents and Settings\toto\Application Data\AVGTOOLBAR\slider.bmp
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-09 to 2008-06-09 ))))))))))))))))))))))))))))))))))))
.
2008-06-08 17:32 . 2007-09-02 20:37 4,096 --a------ C:\WINDOWS\system32\drivers\KProcCheck.sys
2008-06-08 15:45 . 2008-06-08 16:40 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-06-07 19:51 . 2008-06-07 20:07 <REP> d-------- C:\Backups
2008-06-07 19:50 . 2008-06-08 19:11 <REP> d-------- C:\WINDOWS\ERUNT
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Documents and Settings\toto\Application Data\Malwarebytes
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-06 19:31 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-06 19:31 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-06 13:00 . 2008-06-08 19:11 <REP> d-------- C:\Program Files\Trend Micro
2008-06-04 16:17 . 2008-06-04 16:17 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-06-03 19:24 . 2008-06-03 19:41 417,792 --a------ C:\WINDOWS\39382.got
2008-06-03 18:01 . 2008-06-03 20:49 61,444 --a------ C:\WINDOWS\scvhost.MSNFix
2008-06-02 21:12 . 2008-06-04 13:34 61,566 --a------ C:\WINDOWS\images.MSNFix
2008-05-31 14:42 . 2008-05-31 14:42 <REP> d-------- C:\Documents and Settings\toto\Application Data\AVS4YOU
2008-05-31 14:42 . 2008-05-31 14:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-05-31 14:40 . 2008-05-31 14:41 <REP> d-------- C:\Program Files\Fichiers communs\AVSMedia
2008-05-31 14:40 . 2003-05-22 00:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2008-05-31 14:40 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-05-31 14:39 . 2008-06-01 13:39 <REP> d-------- C:\Program Files\AVS4YOU
2008-05-27 20:23 . 2008-06-03 00:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-27 20:20 . 2008-05-27 20:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-05-27 19:15 . 2008-05-27 19:15 <REP> d-------- C:\Program Files\Yahoo!
2008-05-27 19:14 . 2008-05-27 19:15 <REP> d-------- C:\Program Files\CCleaner
2008-05-26 19:56 . 2008-05-26 19:56 268 --ah----- C:\sqmdata15.sqm
2008-05-26 19:56 . 2008-05-26 19:56 244 --ah----- C:\sqmnoopt14.sqm
2008-05-26 14:41 . 2008-05-26 14:41 244 --ah----- C:\sqmnoopt12.sqm
2008-05-26 14:41 . 2008-05-26 14:41 232 --ah----- C:\sqmdata12.sqm
2008-05-26 14:41 . 2008-05-26 14:41 208 --ah----- C:\sqmdata14.sqm
2008-05-26 14:41 . 2008-05-26 14:41 172 --ah----- C:\sqmnoopt13.sqm
2008-05-26 14:41 . 2008-05-26 14:41 136 --ah----- C:\sqmdata13.sqm
2008-05-19 15:12 . 2008-05-19 15:12 354,560 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-19 15:12 . 2008-04-04 14:51 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-11 12:28 . 2008-05-11 12:28 268 --ah----- C:\sqmdata09.sqm
2008-05-11 12:28 . 2008-05-11 12:28 244 --ah----- C:\sqmnoopt09.sqm
2008-05-11 12:28 . 2008-05-11 12:28 160 --ah----- C:\sqmnoopt11.sqm
2008-05-11 12:28 . 2008-05-11 12:28 160 --ah----- C:\sqmdata10.sqm
2008-05-11 12:28 . 2008-05-11 12:28 148 --ah----- C:\sqmnoopt10.sqm
2008-05-11 12:28 . 2008-05-11 12:28 148 --ah----- C:\sqmdata11.sqm
2008-05-10 21:35 . 2008-05-10 21:35 268 --ah----- C:\sqmdata07.sqm
2008-05-10 21:35 . 2008-05-10 21:35 244 --ah----- C:\sqmnoopt08.sqm
2008-05-10 21:35 . 2008-05-10 21:35 244 --ah----- C:\sqmnoopt07.sqm
2008-05-10 21:35 . 2008-05-10 21:35 232 --ah----- C:\sqmdata08.sqm
2008-05-10 21:24 . 2008-05-10 21:24 244 --ah----- C:\sqmnoopt06.sqm
2008-05-10 21:24 . 2008-05-10 21:24 232 --ah----- C:\sqmdata06.sqm
2008-05-10 20:48 . 2008-05-10 20:48 244 --ah----- C:\sqmnoopt05.sqm
2008-05-10 20:48 . 2008-05-10 20:48 232 --ah----- C:\sqmdata05.sqm
2008-05-10 05:38 . 2008-05-10 05:38 <REP> d-------- C:\report
2008-05-10 05:38 . 2008-05-10 05:38 <REP> d-------- C:\cs
2008-05-09 03:38 . 2008-05-09 03:38 59 --a------ C:\WINDOWS\yesmessenger.ini
2008-05-09 03:36 . 2008-05-09 03:52 <REP> d-------- C:\Program Files\YesMessenger
2008-05-09 03:14 . 2008-05-09 03:14 <REP> d-------- C:\Documents and Settings\toto\Documents and Settings
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-02 22:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-27 17:55 --------- d-----w C:\Documents and Settings\toto\Application Data\uTorrent
2008-05-19 13:14 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-05-15 16:22 --------- d-----w C:\Program Files\uTorrent
2008-05-07 21:04 --------- d-----w C:\Program Files\Free Easy Burner
2008-05-06 22:59 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-06 22:56 --------- d-----w C:\Documents and Settings\toto\Application Data\DNA
2008-05-06 22:45 --------- d-----w C:\Program Files\Lphant
2008-05-06 11:43 --------- d-----w C:\Program Files\Windows Live
2008-05-05 18:58 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-05-05 18:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-05 15:34 --------- d-----w C:\Program Files\mp3DirectCut
2008-05-05 10:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-03 21:36 164 ----a-w C:\install.dat
2008-05-02 21:33 --------- d-----w C:\Documents and Settings\toto\Application Data\PC Tools
2008-05-02 19:41 --------- d-----w C:\Documents and Settings\toto\Application Data\BitTorrent
2008-05-02 05:23 --------- d-----w C:\Program Files\DNA
2008-04-30 01:36 --------- d-----w C:\Program Files\Mp3 My Mp3 2.0
2008-04-23 23:25 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-23 23:04 --------- d-----w C:\Program Files\Alwil Software
2008-04-23 14:08 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-04-23 13:25 --------- d-----w C:\Documents and Settings\toto\Application Data\MSNInstaller
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 10:26 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-08_20.29.51.64 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-08 18:23:53 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-09 15:08:21 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-09 15:08:35 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_50c.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-03-20 12:26 20480]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 12:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 18:47 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 18:37 217088]
"AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57 81408]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
C:\Program Files\Spyware Doctor\pctsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\PROGRA~1\WINDOW~4\MESSEN~1\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Lphant\\eLePhantClient.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\toto\\Mes documents\\VirtualDJ\\virtualdj.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"DEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ӟ"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:55]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-19 15:12]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-06-09 15:09:07 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 17:10:46
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-09 17:16:25 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-09 15:16:11
ComboFix2.txt 2008-06-08 18:30:39
Pre-Run: 9,341,898,752 octets libres
Post-Run: 9,615,392,768 octets libres
330 --- E O F --- 2008-05-29 00:47:17
et celui de hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:25:16, on 09/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [AliceSAV] "C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:25:16, on 09/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [AliceSAV] "C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Ok mais j'avais oublier une clé .... Supprimes le doc CFScript que tu as ...
A)Crées un point de restauration de ton PC :
Aller dans le Menu Démarrer puis dans Programmes,
- Ensuite dans Accessoires et enfin dans Outils système,
- Choisir "Restauration du système",
- Sélectionner "Créer un point de restauration",
- Cliquer sur "Suivant",
- Entrer un nom pour le point de restauration : ce nom doit être assez évocateur,
- Cliquer sur "Créer" et le point de restauration se créé automatiquement.
B)On reprend avec ce nouveau script :
1-Crée un doc texte sur ton bureau :
pointes ta souris sur ton bureau , click droit : vas dans "nouveau" et choisis "document texte" .
Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de crée :
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"DEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ӟ"=-
Puis vas dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi :
CFScript puis valides ...
2-Nettoyage :
!!Déconnectes toi,fermes toute tes application et désactive ton antivirus le temps de la manipe ( tu le réactiveras après ) !!
--->Sur ton bureau, fais un glisser avec ta souris le fichier CFScript sur l'icone de ComboFix.exe .
(Regarde ici : http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif )
Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tape 1 puis valide.
Puis patientes le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!)
!!Ne touche à rien tant que le scan n'est pas terminé !!
Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisses-le faire.
Une fois le scan achevé, un rapport va s'afficher : Postes le accompagné d' un nouveau rapport HijackThis pour analyse ...
( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )
A)Crées un point de restauration de ton PC :
Aller dans le Menu Démarrer puis dans Programmes,
- Ensuite dans Accessoires et enfin dans Outils système,
- Choisir "Restauration du système",
- Sélectionner "Créer un point de restauration",
- Cliquer sur "Suivant",
- Entrer un nom pour le point de restauration : ce nom doit être assez évocateur,
- Cliquer sur "Créer" et le point de restauration se créé automatiquement.
B)On reprend avec ce nouveau script :
1-Crée un doc texte sur ton bureau :
pointes ta souris sur ton bureau , click droit : vas dans "nouveau" et choisis "document texte" .
Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de crée :
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"DEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ӟ"=-
Puis vas dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi :
CFScript puis valides ...
2-Nettoyage :
!!Déconnectes toi,fermes toute tes application et désactive ton antivirus le temps de la manipe ( tu le réactiveras après ) !!
--->Sur ton bureau, fais un glisser avec ta souris le fichier CFScript sur l'icone de ComboFix.exe .
(Regarde ici : http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif )
Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tape 1 puis valide.
Puis patientes le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!)
!!Ne touche à rien tant que le scan n'est pas terminé !!
Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisses-le faire.
Une fois le scan achevé, un rapport va s'afficher : Postes le accompagné d' un nouveau rapport HijackThis pour analyse ...
( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )
nouveau rapport combofix:
ComboFix 08-06-07.3 - toto 2008-06-09 17:56:16.3 - NTFSx86
Endroit: C:\Documents and Settings\toto\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\toto\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
((((((((((((((((((((((((((((( Fichiers créés 2008-05-09 to 2008-06-09 ))))))))))))))))))))))))))))))))))))
.
2008-06-08 17:32 . 2007-09-02 20:37 4,096 --a------ C:\WINDOWS\system32\drivers\KProcCheck.sys
2008-06-08 15:45 . 2008-06-08 16:40 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-06-07 19:51 . 2008-06-07 20:07 <REP> d-------- C:\Backups
2008-06-07 19:50 . 2008-06-08 19:11 <REP> d-------- C:\WINDOWS\ERUNT
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Documents and Settings\toto\Application Data\Malwarebytes
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-06 19:31 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-06 19:31 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-06 13:00 . 2008-06-09 17:24 <REP> d-------- C:\Program Files\Trend Micro
2008-06-04 16:17 . 2008-06-04 16:17 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-06-03 19:24 . 2008-06-03 19:41 417,792 --a------ C:\WINDOWS\39382.got
2008-06-03 18:01 . 2008-06-03 20:49 61,444 --a------ C:\WINDOWS\scvhost.MSNFix
2008-06-02 21:12 . 2008-06-04 13:34 61,566 --a------ C:\WINDOWS\images.MSNFix
2008-05-31 14:42 . 2008-05-31 14:42 <REP> d-------- C:\Documents and Settings\toto\Application Data\AVS4YOU
2008-05-31 14:42 . 2008-05-31 14:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-05-31 14:40 . 2008-05-31 14:41 <REP> d-------- C:\Program Files\Fichiers communs\AVSMedia
2008-05-31 14:40 . 2003-05-22 00:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2008-05-31 14:40 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-05-31 14:39 . 2008-06-01 13:39 <REP> d-------- C:\Program Files\AVS4YOU
2008-05-27 20:23 . 2008-06-03 00:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-27 20:20 . 2008-05-27 20:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-05-27 19:15 . 2008-05-27 19:15 <REP> d-------- C:\Program Files\Yahoo!
2008-05-27 19:14 . 2008-05-27 19:15 <REP> d-------- C:\Program Files\CCleaner
2008-05-26 19:56 . 2008-05-26 19:56 268 --ah----- C:\sqmdata15.sqm
2008-05-26 19:56 . 2008-05-26 19:56 244 --ah----- C:\sqmnoopt14.sqm
2008-05-26 14:41 . 2008-05-26 14:41 244 --ah----- C:\sqmnoopt12.sqm
2008-05-26 14:41 . 2008-05-26 14:41 232 --ah----- C:\sqmdata12.sqm
2008-05-26 14:41 . 2008-05-26 14:41 208 --ah----- C:\sqmdata14.sqm
2008-05-26 14:41 . 2008-05-26 14:41 172 --ah----- C:\sqmnoopt13.sqm
2008-05-26 14:41 . 2008-05-26 14:41 136 --ah----- C:\sqmdata13.sqm
2008-05-19 15:12 . 2008-05-19 15:12 354,560 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-19 15:12 . 2008-04-04 14:51 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-11 12:28 . 2008-05-11 12:28 268 --ah----- C:\sqmdata09.sqm
2008-05-11 12:28 . 2008-05-11 12:28 244 --ah----- C:\sqmnoopt09.sqm
2008-05-11 12:28 . 2008-05-11 12:28 160 --ah----- C:\sqmnoopt11.sqm
2008-05-11 12:28 . 2008-05-11 12:28 160 --ah----- C:\sqmdata10.sqm
2008-05-11 12:28 . 2008-05-11 12:28 148 --ah----- C:\sqmnoopt10.sqm
2008-05-11 12:28 . 2008-05-11 12:28 148 --ah----- C:\sqmdata11.sqm
2008-05-10 21:35 . 2008-05-10 21:35 268 --ah----- C:\sqmdata07.sqm
2008-05-10 21:35 . 2008-05-10 21:35 244 --ah----- C:\sqmnoopt08.sqm
2008-05-10 21:35 . 2008-05-10 21:35 244 --ah----- C:\sqmnoopt07.sqm
2008-05-10 21:35 . 2008-05-10 21:35 232 --ah----- C:\sqmdata08.sqm
2008-05-10 21:24 . 2008-05-10 21:24 244 --ah----- C:\sqmnoopt06.sqm
2008-05-10 21:24 . 2008-05-10 21:24 232 --ah----- C:\sqmdata06.sqm
2008-05-10 20:48 . 2008-05-10 20:48 244 --ah----- C:\sqmnoopt05.sqm
2008-05-10 20:48 . 2008-05-10 20:48 232 --ah----- C:\sqmdata05.sqm
2008-05-10 05:38 . 2008-05-10 05:38 <REP> d-------- C:\report
2008-05-10 05:38 . 2008-05-10 05:38 <REP> d-------- C:\cs
2008-05-09 03:38 . 2008-05-09 03:38 59 --a------ C:\WINDOWS\yesmessenger.ini
2008-05-09 03:36 . 2008-05-09 03:52 <REP> d-------- C:\Program Files\YesMessenger
2008-05-09 03:14 . 2008-05-09 03:14 <REP> d-------- C:\Documents and Settings\toto\Documents and Settings
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-02 22:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-27 17:55 --------- d-----w C:\Documents and Settings\toto\Application Data\uTorrent
2008-05-19 13:14 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-05-15 16:22 --------- d-----w C:\Program Files\uTorrent
2008-05-07 21:04 --------- d-----w C:\Program Files\Free Easy Burner
2008-05-06 22:59 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-06 22:56 --------- d-----w C:\Documents and Settings\toto\Application Data\DNA
2008-05-06 22:45 --------- d-----w C:\Program Files\Lphant
2008-05-06 11:43 --------- d-----w C:\Program Files\Windows Live
2008-05-05 18:58 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-05-05 18:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-05 15:34 --------- d-----w C:\Program Files\mp3DirectCut
2008-05-05 10:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-03 21:36 164 ----a-w C:\install.dat
2008-05-02 21:33 --------- d-----w C:\Documents and Settings\toto\Application Data\PC Tools
2008-05-02 19:41 --------- d-----w C:\Documents and Settings\toto\Application Data\BitTorrent
2008-05-02 05:23 --------- d-----w C:\Program Files\DNA
2008-04-30 01:36 --------- d-----w C:\Program Files\Mp3 My Mp3 2.0
2008-04-23 23:25 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-23 23:04 --------- d-----w C:\Program Files\Alwil Software
2008-04-23 14:08 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-04-23 13:25 --------- d-----w C:\Documents and Settings\toto\Application Data\MSNInstaller
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 10:26 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-08_20.29.51.64 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-08 18:23:53 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-09 15:08:21 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-09 15:08:35 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_50c.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-03-20 12:26 20480]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 12:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 18:47 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 18:37 217088]
"AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57 81408]
C:\Documents and Settings\toto\Menu D‚marrer\Programmes\D‚marrage\
Outil de notification Live Search.lnk - C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe [2008-06-06 11:58:02 152616]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-03-20 12:26:01 450560]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
C:\Program Files\Spyware Doctor\pctsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\PROGRA~1\WINDOW~4\MESSEN~1\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Lphant\\eLePhantClient.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\toto\\Mes documents\\VirtualDJ\\virtualdj.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"DEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ӟ"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:55]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-19 15:12]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-06-09 16:00:05 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 17:58:47
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-06-09 18:01:00
ComboFix-quarantined-files.txt 2008-06-09 16:00:53
ComboFix2.txt 2008-06-09 15:16:26
ComboFix3.txt 2008-06-08 18:30:39
Pre-Run: 9,539,035,136 octets libres
Post-Run: 9,545,265,152 octets libres
166 --- E O F --- 2008-05-29 00:47:17
et le nouveau de hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:09:23, on 09/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [AliceSAV] "C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
ComboFix 08-06-07.3 - toto 2008-06-09 17:56:16.3 - NTFSx86
Endroit: C:\Documents and Settings\toto\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\toto\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
((((((((((((((((((((((((((((( Fichiers créés 2008-05-09 to 2008-06-09 ))))))))))))))))))))))))))))))))))))
.
2008-06-08 17:32 . 2007-09-02 20:37 4,096 --a------ C:\WINDOWS\system32\drivers\KProcCheck.sys
2008-06-08 15:45 . 2008-06-08 16:40 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-06-07 19:51 . 2008-06-07 20:07 <REP> d-------- C:\Backups
2008-06-07 19:50 . 2008-06-08 19:11 <REP> d-------- C:\WINDOWS\ERUNT
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Documents and Settings\toto\Application Data\Malwarebytes
2008-06-06 19:31 . 2008-06-06 19:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-06 19:31 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-06 19:31 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-06 13:00 . 2008-06-09 17:24 <REP> d-------- C:\Program Files\Trend Micro
2008-06-04 16:17 . 2008-06-04 16:17 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-06-03 19:24 . 2008-06-03 19:41 417,792 --a------ C:\WINDOWS\39382.got
2008-06-03 18:01 . 2008-06-03 20:49 61,444 --a------ C:\WINDOWS\scvhost.MSNFix
2008-06-02 21:12 . 2008-06-04 13:34 61,566 --a------ C:\WINDOWS\images.MSNFix
2008-05-31 14:42 . 2008-05-31 14:42 <REP> d-------- C:\Documents and Settings\toto\Application Data\AVS4YOU
2008-05-31 14:42 . 2008-05-31 14:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-05-31 14:40 . 2008-05-31 14:41 <REP> d-------- C:\Program Files\Fichiers communs\AVSMedia
2008-05-31 14:40 . 2003-05-22 00:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2008-05-31 14:40 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-05-31 14:39 . 2008-06-01 13:39 <REP> d-------- C:\Program Files\AVS4YOU
2008-05-27 20:23 . 2008-06-03 00:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-27 20:20 . 2008-05-27 20:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-05-27 19:15 . 2008-05-27 19:15 <REP> d-------- C:\Program Files\Yahoo!
2008-05-27 19:14 . 2008-05-27 19:15 <REP> d-------- C:\Program Files\CCleaner
2008-05-26 19:56 . 2008-05-26 19:56 268 --ah----- C:\sqmdata15.sqm
2008-05-26 19:56 . 2008-05-26 19:56 244 --ah----- C:\sqmnoopt14.sqm
2008-05-26 14:41 . 2008-05-26 14:41 244 --ah----- C:\sqmnoopt12.sqm
2008-05-26 14:41 . 2008-05-26 14:41 232 --ah----- C:\sqmdata12.sqm
2008-05-26 14:41 . 2008-05-26 14:41 208 --ah----- C:\sqmdata14.sqm
2008-05-26 14:41 . 2008-05-26 14:41 172 --ah----- C:\sqmnoopt13.sqm
2008-05-26 14:41 . 2008-05-26 14:41 136 --ah----- C:\sqmdata13.sqm
2008-05-19 15:12 . 2008-05-19 15:12 354,560 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-19 15:12 . 2008-04-04 14:51 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-11 12:28 . 2008-05-11 12:28 268 --ah----- C:\sqmdata09.sqm
2008-05-11 12:28 . 2008-05-11 12:28 244 --ah----- C:\sqmnoopt09.sqm
2008-05-11 12:28 . 2008-05-11 12:28 160 --ah----- C:\sqmnoopt11.sqm
2008-05-11 12:28 . 2008-05-11 12:28 160 --ah----- C:\sqmdata10.sqm
2008-05-11 12:28 . 2008-05-11 12:28 148 --ah----- C:\sqmnoopt10.sqm
2008-05-11 12:28 . 2008-05-11 12:28 148 --ah----- C:\sqmdata11.sqm
2008-05-10 21:35 . 2008-05-10 21:35 268 --ah----- C:\sqmdata07.sqm
2008-05-10 21:35 . 2008-05-10 21:35 244 --ah----- C:\sqmnoopt08.sqm
2008-05-10 21:35 . 2008-05-10 21:35 244 --ah----- C:\sqmnoopt07.sqm
2008-05-10 21:35 . 2008-05-10 21:35 232 --ah----- C:\sqmdata08.sqm
2008-05-10 21:24 . 2008-05-10 21:24 244 --ah----- C:\sqmnoopt06.sqm
2008-05-10 21:24 . 2008-05-10 21:24 232 --ah----- C:\sqmdata06.sqm
2008-05-10 20:48 . 2008-05-10 20:48 244 --ah----- C:\sqmnoopt05.sqm
2008-05-10 20:48 . 2008-05-10 20:48 232 --ah----- C:\sqmdata05.sqm
2008-05-10 05:38 . 2008-05-10 05:38 <REP> d-------- C:\report
2008-05-10 05:38 . 2008-05-10 05:38 <REP> d-------- C:\cs
2008-05-09 03:38 . 2008-05-09 03:38 59 --a------ C:\WINDOWS\yesmessenger.ini
2008-05-09 03:36 . 2008-05-09 03:52 <REP> d-------- C:\Program Files\YesMessenger
2008-05-09 03:14 . 2008-05-09 03:14 <REP> d-------- C:\Documents and Settings\toto\Documents and Settings
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-02 22:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-27 17:55 --------- d-----w C:\Documents and Settings\toto\Application Data\uTorrent
2008-05-19 13:14 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-05-15 16:22 --------- d-----w C:\Program Files\uTorrent
2008-05-07 21:04 --------- d-----w C:\Program Files\Free Easy Burner
2008-05-06 22:59 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-06 22:56 --------- d-----w C:\Documents and Settings\toto\Application Data\DNA
2008-05-06 22:45 --------- d-----w C:\Program Files\Lphant
2008-05-06 11:43 --------- d-----w C:\Program Files\Windows Live
2008-05-05 18:58 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-05-05 18:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-05 15:34 --------- d-----w C:\Program Files\mp3DirectCut
2008-05-05 10:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-03 21:36 164 ----a-w C:\install.dat
2008-05-02 21:33 --------- d-----w C:\Documents and Settings\toto\Application Data\PC Tools
2008-05-02 19:41 --------- d-----w C:\Documents and Settings\toto\Application Data\BitTorrent
2008-05-02 05:23 --------- d-----w C:\Program Files\DNA
2008-04-30 01:36 --------- d-----w C:\Program Files\Mp3 My Mp3 2.0
2008-04-23 23:25 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-23 23:04 --------- d-----w C:\Program Files\Alwil Software
2008-04-23 14:08 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-04-23 13:25 --------- d-----w C:\Documents and Settings\toto\Application Data\MSNInstaller
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 10:26 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-08_20.29.51.64 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-08 18:23:53 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-09 15:08:21 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-09 15:08:35 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_50c.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-03-20 12:26 20480]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 12:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 18:47 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 18:37 217088]
"AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57 81408]
C:\Documents and Settings\toto\Menu D‚marrer\Programmes\D‚marrage\
Outil de notification Live Search.lnk - C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe [2008-06-06 11:58:02 152616]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-03-20 12:26:01 450560]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
C:\Program Files\Spyware Doctor\pctsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\PROGRA~1\WINDOW~4\MESSEN~1\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Lphant\\eLePhantClient.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\toto\\Mes documents\\VirtualDJ\\virtualdj.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"DEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ӟ"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:55]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-19 15:12]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-06-09 16:00:05 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 17:58:47
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-06-09 18:01:00
ComboFix-quarantined-files.txt 2008-06-09 16:00:53
ComboFix2.txt 2008-06-09 15:16:26
ComboFix3.txt 2008-06-08 18:30:39
Pre-Run: 9,539,035,136 octets libres
Post-Run: 9,545,265,152 octets libres
166 --- E O F --- 2008-05-29 00:47:17
et le nouveau de hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:09:23, on 09/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [AliceSAV] "C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\toto\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
bien ... le dernier script n'a pas fonctionné ...
Télécharge clean.zip :
http://www.malekal.com/download/clean.zip
Décompresses-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.
Ouvres le dossier Clean qui se trouve sur ton bureau.
Double-clic sur clean.cmd.
Une fenêtre noire va apparaître, suis les consignes.
Postes le rapport qui se trouve ici C:\rapport_clean.txt et attends la suite ...
Télécharge clean.zip :
http://www.malekal.com/download/clean.zip
Décompresses-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.
Ouvres le dossier Clean qui se trouve sur ton bureau.
Double-clic sur clean.cmd.
Une fenêtre noire va apparaître, suis les consignes.
Postes le rapport qui se trouve ici C:\rapport_clean.txt et attends la suite ...
slt desolé de revenir que maintenan je n'ai pas été chez moi cette semaine
Lorsque je fait clean.cmd un momen il me demande d'envoyer un fichier(upload_moi...)et m'ouvre une page internet
je doit faire quoi?
Lorsque je fait clean.cmd un momen il me demande d'envoyer un fichier(upload_moi...)et m'ouvre une page internet
je doit faire quoi?
voila le rapport de fin:
13/06/2008 a 15:20:03,34
*** Recherche des fichiers dans C:
*** Recherche des fichiers dans C:\WINDOWS\
*** Recherche des fichiers dans C:\WINDOWS\system32
*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !
13/06/2008 a 15:20:03,34
*** Recherche des fichiers dans C:
*** Recherche des fichiers dans C:\WINDOWS\
*** Recherche des fichiers dans C:\WINDOWS\system32
*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !
Bon ... rien de ce côter là ...
refais un coup de CCleaner et dis moi comment ce comporte le PC ... Encore des soucis ?
refais un coup de CCleaner et dis moi comment ce comporte le PC ... Encore des soucis ?
ben la au niveau de mon pc c'est bon,je n'est plus msn qui coupe est qui envoi envoi des lien,mon pc ne ram plus auttend que avan,plus de fenetre qui se bloque ou programme je diré que sa remarche bien.
Il n'y a plus rien alor?
Il n'y a plus rien alor?
j'avai recu un message d'un ami avec un coeur http://www.youtube.... est en faite c'était un virus et j'envoyer a mon tour les message la a mes contact et msn se deconecté souvent mé depuis que j'ai fait msnfix et msncleaner et malwarebytes je n'ai plus aucun soucis il m'avait trouvé des infection qui on été enlever
Ok ... tout est nickel alors ^^
Fais ce petit chek up pour finir , c'est un peut long mais nécessaire :
1-Restauration système
*Désactives ta restauration :
Cliques droit sur poste de travail/propriétés/Restauration système/coche la case désactiver la restauration, appliquer, OK
--->Redémarres ton PC
*Réactives ta restauration :
Cliques droit sur poste de travail/propriétés/Restauration système/décoche la case désactiver la restauration, appliquer, OK
--->Redémarres ton PC
2-Nettoyage et Défragmentation de tes Disques
*Nettoyage :
Clic droit sur "poste de travail" ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Général"
Cliques sur le bouton "nettoyage de disque", OK
tu le fais pour chacun de tes disques
*Vérifications des erreurs :
Clic droit sur "poste de travail" ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Outil"
"Vérifier maintenant", une boîte s'ouvre, cocher les cases :
-réparer automatiquement les erreurs...
-rechercher et tenter une récupération...
--->Démarrer, ok
Note : s'il te dis de redémarrer ton Pc pour le faire , tu redémarres et tu laisses faire, cela prend un peu de temps c'est normal
tu le fais pour chacun de tes disques
ensuite toujours dans le même onglet tu choisis :
*Défragmentation :
"défragmenter maintenant", OK
une boîte s'ouvre, tu sélectionnes le disque à défragmenter, et tu cliques sur "analyser", puis après l'analyse, "défragmenter" . OK
tu le fais pour chacun de tes disques
Voili,voilou :)
Une fois cela fait , donnes moi des nouvelles de ton PC ...
Fais ce petit chek up pour finir , c'est un peut long mais nécessaire :
1-Restauration système
*Désactives ta restauration :
Cliques droit sur poste de travail/propriétés/Restauration système/coche la case désactiver la restauration, appliquer, OK
--->Redémarres ton PC
*Réactives ta restauration :
Cliques droit sur poste de travail/propriétés/Restauration système/décoche la case désactiver la restauration, appliquer, OK
--->Redémarres ton PC
2-Nettoyage et Défragmentation de tes Disques
*Nettoyage :
Clic droit sur "poste de travail" ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Général"
Cliques sur le bouton "nettoyage de disque", OK
tu le fais pour chacun de tes disques
*Vérifications des erreurs :
Clic droit sur "poste de travail" ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Outil"
"Vérifier maintenant", une boîte s'ouvre, cocher les cases :
-réparer automatiquement les erreurs...
-rechercher et tenter une récupération...
--->Démarrer, ok
Note : s'il te dis de redémarrer ton Pc pour le faire , tu redémarres et tu laisses faire, cela prend un peu de temps c'est normal
tu le fais pour chacun de tes disques
ensuite toujours dans le même onglet tu choisis :
*Défragmentation :
"défragmenter maintenant", OK
une boîte s'ouvre, tu sélectionnes le disque à défragmenter, et tu cliques sur "analyser", puis après l'analyse, "défragmenter" . OK
tu le fais pour chacun de tes disques
Voili,voilou :)
Une fois cela fait , donnes moi des nouvelles de ton PC ...
