Ordinateur infecté par un virus Fermé

Question

Bonjour,

J'ai été infecté par un virus. Malheureusement, je ne connais pas son nom. Voici ce qui se passe depuis que l'ordinateur est infecté.

Sur une session "Administrateur" :

1. Tous les "droits" d'un administrateur (créer un nouveau compte, accéder au gestionnaire des tâches etc...) ont disparu.

2. Je ne peux plus accéder au gestionnaire des tâches, comptes d'utilisateurs, base de registres, etc...

3. Mon disque dur de 160Go était séparé en 2 Disques de 80Go chacun (C:/ et F:/). Le disque dur C:/ a disparu. Pourtant, avec Knoppix, il apparait.

4. Des publicités intempestives apparaissent tout le temps sur l'ordinateur (exemple : You are infected by a virus, download XxX or whatever...)

5. L'ordinateur est horriblement lent (le CPU est totalement bouffé).

6. Les connexions réseau ont disparu.

7. Certains de mes logiciels ont disparu.

8. Tous les éléments du bureau ont disparu.

9. Le menu démarrer est altéré : il manque l'onglet "Tous les programmes", et les autres dossiers du genre, Panneau de Configuration, Mes documents etc...

10. Il manque également le bouton "Fermer la session", ce qui fait que je dois redémarrer l'ordinateur à chaque fois.

11. A côté de l'horloge dans la barre des tâches, il y a écrit : "Virus Alert!". Je suis sûr et certain qu'il ne s'agit pas d'une alerte windows.

12. Une fois de plus, TOUS les droits d'administrateur ont disparu (base de registre, comptes d'utilisateur etc...)

13. 3 logiciels ont été installés contre mon gré. Il s'agit de logiciels "anti-spywares", mais qui sont probablement des virus. J'ai déjà tenté de les désinstaller, mais à chaque fois, ils se réinstallent.

Au moment où j'ai été infecté (cad quand le PC commencait à déconner), mon premier reflèxe était de couper la connexion internet. Malheureusement, c'était trop tard.

Etrangement, sur l'unique session "Invité", rien n'a été altéré. Les 2 disques durs apparaissent bel et bien en tant que C:/ et F:/, le menu démarrer est complet, le panneau de configuration est toujours là, mais le seul problème, c'est que sur cette session, je ne dispose point des droits d'administrateur. Ce qui fait que je ne peux pas accéder au dossiers des autres sessions, je ne peux pas créer de nouvelles sessions etc...

Effectivement, les connexions réseau ont disparu, mais j'ai lancé l'assistant de connexion, et internet marche maintenant. J'ai essayé d'ouvrir Mozilla Firefox, mais il ne s'est jamais ouvert. J'ai ouvert Internet Explorer, mais à la moindre recherche, j'étais redirigé vers un autre lien qui ne concernait meme pas la recherche effectuée.

Pour pouvoir poster ici, j'ai dû créer mon propre navigateur web.

Si quelqu'un pouvait me dire le nom du virus et comment l'éradiquer, ca serait sympa.

Merci d'avance, c'est très urgent.

Utilisateur anonyme · Answer

Salut

tres infecté donc ....

Télécharge HijackThis ici : 

->  http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe 


Tutoriel d´instalation : (Merci a Balltrap34 pour cette réalisation) 

-> http://pageperso.aol.fr/balltrap34/Hijenr.gif 

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation) 

-> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm 

Post le rapport généré ici stp...

Fyerrblad · Answer

:/ Apparement, Windows à bloqué Notepad "pour ma sécurité". Et vu que je suis sur une session "Invité", je ne sais pas comment faire... ce qui fait que je ne peux pas poster le rapport.

Utilisateur anonyme · Answer

met toi sur ta session administrateur 


ensuite on va commencer le nettoyage 

# Télécharge ceci: (merci a S!RI pour ce petit programme). 

http://siri.urz.free.fr/Fix/SmitfraudFix.zip 

Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, 
voila a quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php 
il va générer un rapport : copie/colle le sur le poste stp.

Fyerrblad · Answer

Désolé pour le petit retard.

Rapport de Hijackthis : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:41: VIRUS ALERT!, on 13/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
F:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
F:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
F:\PROGRA~1\Grisoft\AVG7\avgemc.exe
F:\WINDOWS\system32\cisvc.exe
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
F:\WINDOWS\Explorer.EXE
C:\PROGRA~1\softwin\BITDEF~2\bdmcon.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe
C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe
F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE
F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe
F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
F:\PROGRA~1\Grisoft\AVG7\avgcc.exe
F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
F:\Program Files\Logitech\QuickCam\Quickcam.exe
F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
F:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Messenger\Msmsgs.exe
F:\Program Files\DNA\btdna.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
F:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
F:\WINDOWS\system32\rundll32.exe
F:\Documents and Settings\Invité\Bureau\Opération A\HijackThis.exe
F:\Documents and Settings\Ibixis Studios™\Bureau\Programmation Ibixis New Technologies™\Int Internet\Int Internet\obj\Release\Int Internet.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07C7156E-D651-4ACC-9AD3-498C916E9651} - (no file)
O2 - BHO: (no name) - {1B44E59C-165C-4EE2-B3CD-4DFD348BE123} - F:\WINDOWS\system32\xxyyxYQk.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - F:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {42146562-47E8-433B-8A28-67860F7A9CD1} - F:\WINDOWS\system32\geBqRkij.dll
O2 - BHO: (no name) - {51E27C23-FF84-4787-8F44-D267FD921CFC} - (no file)
O2 - BHO: QXK Olive - {5A671C3E-B5EA-4512-A6AC-2CA1D623AFDB} - F:\WINDOWS\wbxdpgfefml.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CDLPObj Object - {BE2ED590-CA49-46B5-8CCE-244FB2E0D1AA} - F:\WINDOWS\DLP.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: {1a42ec07-0c04-fd98-4574-0aa3d2525ade} - {eda5252d-3aa0-4754-89df-40c070ce24a1} - F:\WINDOWS\system32\exezou.dll
O3 - Toolbar: Protection Bar - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Crack  Find Search - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} - F:\WINDOWS\SrchPlug.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [PHIME2002ASync] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [BDMCon] c:\PROGRA~1\softwin\BITDEF~2\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LWBMOUSE] F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe
O4 - HKLM\..\Run: [OFFICEKB] F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe
O4 - HKLM\..\Run: [Motive SmartBridge] F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [AVG7_CC] F:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "F:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [StartCCC] "F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [58e64c4e] rundll32.exe "F:\WINDOWS\system32\wfqhokhi.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [VoipBuster] "F:\Program Files\VoipBuster\VoipBuster\VoipBuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "F:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] F:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Download with &DAP - F:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - F:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - F:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - F:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - F:\Documents and Settings\Knightmare\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O21 - SSODL: fsrpknov - {2F0276BC-170A-44C1-BFE7-9695243D69D3} - F:\WINDOWS\fsrpknov.dll
O21 - SSODL: fdxbameg - {6A330420-1B41-4C0A-8A52-C2F34EA2565C} - F:\WINDOWS\fdxbameg.dll
O22 - SharedTaskScheduler: crowsteps - {e1d3b05d-4dd9-468d-982e-c342f05436e5} - (no file)
O23 - Service: Apple Mobile Device - Apple, Inc. - F:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: LVCOMSer - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - F:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - F:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Fyerrblad · Answer

Désolé pour le retard.

Rapport Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:41: VIRUS ALERT!, on 13/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
F:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
F:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
F:\PROGRA~1\Grisoft\AVG7\avgemc.exe
F:\WINDOWS\system32\cisvc.exe
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
F:\WINDOWS\Explorer.EXE
C:\PROGRA~1\softwin\BITDEF~2\bdmcon.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe
C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe
F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE
F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe
F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
F:\PROGRA~1\Grisoft\AVG7\avgcc.exe
F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
F:\Program Files\Logitech\QuickCam\Quickcam.exe
F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
F:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Messenger\Msmsgs.exe
F:\Program Files\DNA\btdna.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
F:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
F:\WINDOWS\system32\rundll32.exe
F:\Documents and Settings\Invité\Bureau\Opération A\HijackThis.exe
F:\Documents and Settings\Ibixis Studios™\Bureau\Programmation Ibixis New Technologies™\Int Internet\Int Internet\obj\Release\Int Internet.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07C7156E-D651-4ACC-9AD3-498C916E9651} - (no file)
O2 - BHO: (no name) - {1B44E59C-165C-4EE2-B3CD-4DFD348BE123} - F:\WINDOWS\system32\xxyyxYQk.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - F:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {42146562-47E8-433B-8A28-67860F7A9CD1} - F:\WINDOWS\system32\geBqRkij.dll
O2 - BHO: (no name) - {51E27C23-FF84-4787-8F44-D267FD921CFC} - (no file)
O2 - BHO: QXK Olive - {5A671C3E-B5EA-4512-A6AC-2CA1D623AFDB} - F:\WINDOWS\wbxdpgfefml.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CDLPObj Object - {BE2ED590-CA49-46B5-8CCE-244FB2E0D1AA} - F:\WINDOWS\DLP.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: {1a42ec07-0c04-fd98-4574-0aa3d2525ade} - {eda5252d-3aa0-4754-89df-40c070ce24a1} - F:\WINDOWS\system32\exezou.dll
O3 - Toolbar: Protection Bar - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Crack  Find Search - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} - F:\WINDOWS\SrchPlug.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [PHIME2002ASync] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [BDMCon] c:\PROGRA~1\softwin\BITDEF~2\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LWBMOUSE] F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe
O4 - HKLM\..\Run: [OFFICEKB] F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe
O4 - HKLM\..\Run: [Motive SmartBridge] F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [AVG7_CC] F:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "F:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [StartCCC] "F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [58e64c4e] rundll32.exe "F:\WINDOWS\system32\wfqhokhi.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [VoipBuster] "F:\Program Files\VoipBuster\VoipBuster\VoipBuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "F:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] F:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Download with &DAP - F:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - F:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - F:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - F:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - F:\Documents and Settings\Knightmare\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O21 - SSODL: fsrpknov - {2F0276BC-170A-44C1-BFE7-9695243D69D3} - F:\WINDOWS\fsrpknov.dll
O21 - SSODL: fdxbameg - {6A330420-1B41-4C0A-8A52-C2F34EA2565C} - F:\WINDOWS\fdxbameg.dll
O22 - SharedTaskScheduler: crowsteps - {e1d3b05d-4dd9-468d-982e-c342f05436e5} - (no file)
O23 - Service: Apple Mobile Device - Apple, Inc. - F:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: LVCOMSer - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - F:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - F:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Utilisateur anonyme · Answer

t as pass smithfraud sur la session administrateur ??

t as le rapport ??

le session invité est elle saine ??

Fyerrblad · Answer

Désolé pour le double post (accident). Je n'ai pas pu télécharger smithfraud encore : le PC rame vraiment, mais je suis en train de le télécharger maintenant. Je poste une fois que j'ai fait le rapport, ok ?

Apparement oui, la session "invité" est saine.

Utilisateur anonyme · Answer

ok et ok pour la session invité

Fyerrblad · Answer

Re désolé pour le double post, mais je crois bien que le smithfraud ne s'éxécute pas. Pour info, je suis encore sur la session "Invité" parce que la session "Admin" ne s'ouvre même plus...

Utilisateur anonyme · Answer

ok

sur ta session invité 


Telecharge malwarebytes 

-> http://www.malwarebytes.org/mbam/program/mbam-setup.exe 

Tu l´instale; le programme va se mettre automatiquement a jour. 

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression". 

Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet". 

Puis click sur "rechercher". 

Laisse le scanner le pc... 

Si des elements on ete trouvés > click sur supprimer la selection. 

si il t´es demandé de redemarrer > click sur "yes". 

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum. 

Copie et colle le rapport stp.

ps : les rapport sont aussi rangé dans l onglet rapport/log


ensuite regarde si tu peux aller sur l asession admin et passer smithfraud

Fyerrblad · Answer

J'ai cliqué sur ton lien, mais je suis toujours redirigé vers une autre page, ce qui fait que je ne peux pas procéder au téléchargement. J'ai essayé de mettre directement le lien dans la barre d'adresse, mais la page est introuvable...

PS : Je viens de me rendre compte que le nom de l'ordinateur à changé

Utilisateur anonyme · Answer

réouvre hijackthis
fais scan only
coche cette ligne :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 


et clic sur fix checked

ensuite :

Télécharge cet outil de SiRi: 

http://siri.urz.free.fr/RHosts.php 

Double cliquer dessus pour l'exécuter 

et cliquer sur " Restore original Hosts " 

ps : c est normal que rien ne se passe 

ensuite redémarre le pc 

puis essais de telecharger malewarebyte et de faire le scan et dis moi si c est ok

Fyerrblad · Answer

Ok, je te tiens au courant ;) Merci, je vais essayer maintenant !

Fyerrblad · Answer

Une fois de plus, désolé pour le double post.

je n'ai pas trouvé  : R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 

mais : R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr

Utilisateur anonyme · Answer

SI T arrive a passer malewarebyte il va faire le plus gros du travail et te supprimer "vrus alerte"

Utilisateur anonyme · Answer

ok passe a restore host

Fyerrblad · Answer

Que veux tu dire par là ?

Utilisateur anonyme · Answer

fais ça :

Télécharge cet outil de SiRi: 

http://siri.urz.free.fr/RHosts.php 

Double cliquer dessus pour l'exécuter 

et cliquer sur " Restore original Hosts " 

ps : c est normal que rien ne se passe 

ensuite redémarre le pc 

puis essais de telecharger malewarebyte et de faire le scan et dis moi si c est ok

Fyerrblad · Answer

Ca me dit : Impossible de créer le fichier F:\WINDOWS\system32\drivers\etc\hosts.

Est-ce que c'est parce que je suis sur une session "Invité" ?

Utilisateur anonyme · Answer

c est possible

et tu n as pas du tout acces a la session admin ??

Fyerrblad · Answer

:/ Je vais réessayer. 2 sec.

Utilisateur anonyme · Answer

ok

Fyerrblad · Answer

J'ai télécharger le logiciel, mais je n'arrive pas à l'exécuter, donc je n'arrive pas à l'installer... (je suis sur la session Administrateur, mais j'ai télécharger RHosts et Malwarebytes sur la session Invité).Que faire ?

Utilisateur anonyme · Answer

ok reste sur la session admin 


Telecharge malwarebytes 

-> http://www.malwarebytes.org/mbam/program/mbam-setup.exe 

Tu l´instale; le programme va se mettre automatiquement a jour. 

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression". 

Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet". 

Puis click sur "rechercher". 

Laisse le scanner le pc... 

Si des elements on ete trouvés > click sur supprimer la selection. 

si il t´es demandé de redemarrer > click sur "yes". 

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum. 

Copie et colle le rapport stp.

ps : les rapport sont aussi rangé dans l onglet rapport/log

Utilisateur anonyme · Answer

t as réussi avec malewarebyte ? sur ta sesion admin ?

Fyerrblad · Answer

2 sec, je vais essayer

Fyerrblad · Answer

Désolé, je ne peux vraiment pas télécharger quoique se soit sur la session Admin... 1. Ca rame vraiment trop (pour ouvrir un fichier, un dossier, ca "freeze" de temps à autre, et 2. Dès que je veux télécharger qqchose, ca le quitte automatiquement, et ca dit "Envoyer le rapport d'erreur blabla...")... Je ne sais vraiment pas que faire, je suis sur la session "Invité".

Utilisateur anonyme · Answer

ok tu as messenger ??

Fyerrblad · Answer

Oui, mais je ne sais pas si je peux l'ouvrir. Tu veux mon adresse ?

Utilisateur anonyme · Answer

regarde deja si tu peux l ouvrir si oui je vais t envoyer un message privé sur le site

Fyerrblad · Answer

Ok.

Utilisateur anonyme · Answer

t as un message privé -;)

Utilisateur anonyme · Answer

pour tenir informé la communauté en plus y a du bagle ......... 


les rapports suivronts

Fyerrblad · Answer

Rapport N°1 :


	  Sun Jul 13 21:34:32 2008
EliBagle v11.60  (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 11 de Julio del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Sun Jul 13 21:34:40 2008
EliBagle v11.60  (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 11 de Julio del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad F:\

Nº Total de Directorios:   241
Nº Total de Ficheros:      3818
Nº de Ficheros Analizados: 71
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0
Exploración Detenida por el Usuario.

	  Sun Jul 13 21:35:10 2008
EliBagle v11.60  (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 11 de Julio del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Sun Jul 13 21:35:13 2008
EliBagle v11.60  (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 11 de Julio del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad F:\
EMACS-22.1-BIN-I386.ZIP -> Bagle
Nº Total de Directorios:   19892
Nº Total de Ficheros:      221175
Nº de Ficheros Analizados: 18882
Nº de Ficheros Infectados: 1
Nº de Ficheros Limpiados:  1

Fyerrblad · Answer

Bon, ca y est, Malwarebytes est lancé depuis +9 heures mais ça n'a pas beaucoup avancé durant ces nombreuses heures. Effectivement, je n'en suis qu'à a peu près 120000 fichiers analysés là maintenant, avec toujours 57 fichiers infectés. Durant mon sommeil (les 9 heures), 40 publicités intempestives (un peu plus même) ont fait leur apparition ce qui fait qu'il y a eu beaucoup de moments de lenteur, et même de bugs avec Malwarebytes. Je ne peux ouvrir aucun process pour le moment, et je suis un peu déboussolé car en 9H, seuls 120000 ont été analysés...

Tout ca à cause des publicités intempestivess (enfin, je crois). Au fait, je ne sais pas pourqoi mais le ram n'est pas utilisé à son potentiel max. pourtant, le CPU est totalement bouffé. Voilà pour les informations.

Fyerrblad · Answer

Nette évolution par rapport à la dernière fois (un grand merci à Chiquitine29 !).

Voici le log de Malwarebytes :

Disque dur F:\

Malwarebytes' Anti-Malware 1.20
Version de la base de données: 947
Windows 5.1.2600 Service Pack 3

16:20:35 14/07/2008
mbam-log-7-14-2008 (16-20-35).txt

Type de recherche: Examen complet (F:\|)
Eléments examinés: 209684
Temps écoulé: 1 hour(s), 1 minute(s), 7 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
F:\Documents and Settings\Invité\Local Settings\Temp\heomxqke.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Disque dur C:\

Malwarebytes' Anti-Malware 1.20
Version de la base de données: 947
Windows 5.1.2600 Service Pack 3

15:16:13 14/07/2008
mbam-log-7-14-2008 (15-16-13).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 153128
Temps écoulé: 32 minute(s), 48 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 17
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 18
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 25

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07561ea1-b647-4746-88df-833673fcc0bf} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07561ea1-b647-4746-88df-833673fcc0bf} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1b44e59c-165c-4ee2-b3cd-4dfd348be123} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1b44e59c-165c-4ee2-b3cd-4dfd348be123} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxyyxyqk (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\webHancer (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6a330420-1b41-4c0a-8a52-c2f34ea2565c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2f0276bc-170a-44c1-bfe7-9695243d69d3} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{23156882-ff98-4d21-980c-e30021c97fed} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5a671c3e-b5ea-4512-a6ac-2ca1d623afdb} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5a671c3e-b5ea-4512-a6ac-2ca1d623afdb} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{1b44e59c-165c-4ee2-b3cd-4dfd348be123} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\fdxbameg (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\fsrpknov (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: f:\windows\system32\gebqrkij -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: f:\windows\system32\gebqrkij  -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 Good: (https://www.google.com/?gws_rd=ssl -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (76412-OEM-0061914-49957) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
F:\WINDOWS\system32\geBqRkij.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\WINDOWS\system32\jikRqBeg.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\WINDOWS\system32\jikRqBeg.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\WINDOWS\system32\clbdll.dll (Trojan.Agent) -> Delete on reboot.
F:\WINDOWS\system32\drivers\clbdriver.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
F:\WINDOWS\DLP.dll (Adware.WebDir) -> Quarantined and deleted successfully.
F:\WINDOWS\system32\xxyyxYQk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\WINDOWS\system32\yayvSmki.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\WINDOWS\fdxbameg.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
F:\WINDOWS\fsrpknov.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
F:\WINDOWS\gpefaowr.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
F:\WINDOWS\sqvgnrpx.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
F:\WINDOWS\wbxdpgfefml.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
F:\Documents and Settings\Mom\Bureau\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
F:\Documents and Settings\Ibixis Studios™\Bureau\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
F:\Documents and Settings\Mom\Bureau\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
F:\Documents and Settings\Ibixis Studios™\Bureau\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
F:\Documents and Settings\Mom\Bureau\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
F:\Documents and Settings\Ibixis Studios™\Bureau\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
F:\Documents and Settings\Mom\Favoris\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
F:\Documents and Settings\Ibixis Studios™\Favoris\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
F:\Documents and Settings\Mom\Favoris\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
F:\Documents and Settings\Ibixis Studios™\Favoris\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
F:\Documents and Settings\Mom\Favoris\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
F:\Documents and Settings\Ibixis Studios™\Favoris\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.

Fyerrblad · Answer

main.txt

Deckard's System Scanner v20071014.68
Run by Ibixis Studios™ on 2008-07-15 17:27:21
Computer is in Safe Mode with Networking.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.


Backed up registry hives.
Performed disk cleanup.

[color=red]System Drive F: has 7.47 GiB (less than 15%) free.[/color]


-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-07-15 17:31:03
Platform: Windows XP Service Pack 3 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16674)
Boot mode: Safe mode with network support

Running processes:
F:\WINDOWS\system32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Windows Live\Messenger\msnmsgr.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Documents and Settings\Ibixis Studios™\Bureau\Operation A\7062\Antibagle-fr.exe
F:\Documents and Settings\Ibixis Studios™\Bureau\Operation A\FxBeagle\FxBeagle.exe
F:\WINDOWS\explorer.exe
F:\Documents and Settings\Invité\Bureau\Opération A\Cadeaux\AdiosB.EXE
F:\Documents and Settings\Ibixis Studios™\Bureau\Operation A\HOP\HOP.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - F:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {51E27C23-FF84-4787-8F44-D267FD921CFC} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Protection Bar - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [PHIME2002ASync] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [BDMCon] c:\PROGRA~1\softwin\BITDEF~2\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LWBMOUSE] F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe
O4 - HKLM\..\Run: [OFFICEKB] F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe
O4 - HKLM\..\Run: [Motive SmartBridge] F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [AVG7_CC] F:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "F:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [StartCCC] "F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [VoipBuster] "F:\Program Files\VoipBuster\VoipBuster\VoipBuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "F:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] F:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] F:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] F:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] F:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Download with &DAP - F:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - F:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - F:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - F:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - F:\Documents and Settings\Knightmare\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS
etwork diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS
etwork diagnostic\xpnetdiag.exe
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\Msmsgs.exe
O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\Msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - F:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - F:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - F:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - F:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - F:\Program Files\Fichiers communs\Microsoft Shared\Web Components\10\OWC10.DLL
O20 - AppInit_DLLs: sockspy.dll
O20 - Winlogon Notify: xxyvtqo - F:\WINDOWS\system32\xxyvtqo.dll (file missing)
O21 - SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - (no file)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - F:\WINDOWS\system32\shell32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - F:\WINDOWS\system32\shell32.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - F:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - F:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - F:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - F:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - F:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - F:\Program Files\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - F:\Program Files\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Boonty Games - BOONTY - F:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: LVCOMSer - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - F:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
O23 - Service: SQL Server (MSSQLSERVER) (MSSQLSERVER) - Unknown owner - F:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
O23 - Service: Pml Driver HPZ12 - HP - F:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - F:\WINDOWS\system32\TuneUpDefragService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - F:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Fyerrblad · Answer

Rapport DiagHelp : DiagHelp version v1.4 - http://www.malekal.com excute le 16/07/2008 à 17:20:10,06 Liste des derniers fichies modifies/crees dans windir\system32 et prefetch F:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->16/07/2008 17:19:52 F:\WINDOWS\prefetch\NOTEPAD.EXE-336351A9.pf -->16/07/2008 17:19:30 F:\WINDOWS\prefetch\WINRAR.EXE-39C6DAD9.pf -->16/07/2008 17:19:00 F:\WINDOWS\prefetch\MSVS.EXE-129B5DE4.pf -->16/07/2008 17:15:09 F:\WINDOWS\prefetch\REALPLAY.EXE-1BF219BD.pf -->16/07/2008 17:09:18 F:\WINDOWS\prefetch\JQSNOTIFY.EXE-24AE4A36.pf -->16/07/2008 17:09:18 F:\WINDOWS\prefetch\FIREFOX.EXE-17EE503B.pf -->16/07/2008 17:09:17 F:\WINDOWS\prefetch\BDNEWS.EXE-00D692C7.pf -->16/07/2008 17:09:00 F:\WINDOWS\prefetch\ONECLICKSTARTER.EXE-1492110E.pf -->16/07/2008 17:00:00 F:\WINDOWS\prefetch\WMIPRVSE.EXE-28F301A9.pf -->16/07/2008 16:41:53 F:\WINDOWS\System32\drivers\fidbox.dat -->16/07/2008 17:19:40 F:\WINDOWS\System32\drivers\fidbox.idx -->16/07/2008 16:06:45 F:\WINDOWS\System32\drivers\mbamcatchme.sys -->07/07/2008 17:35:36 F:\WINDOWS\System32\drivers\mbam.sys -->07/07/2008 17:35:30 F:\WINDOWS\System32\drivers cpip.sys -->20/06/2008 13:51:12 F:\WINDOWS\System32\drivers\afd.sys -->20/06/2008 13:40:08 F:\WINDOWS\System32\drivers cpip6.sys -->20/06/2008 13:08:27 F:\WINDOWS\System32\getfile.dat -->16/07/2008 17:20:09 F:\WINDOWS\System32\bdod.bin -->16/07/2008 17:18:03 F:\WINDOWS\System32\CONFIG.NT -->16/07/2008 16:12:55 F:\WINDOWS\System32\zllictbl.dat -->16/07/2008 16:07:48 F:\WINDOWS\System32\vsconfig.xml -->16/07/2008 16:07:44 F:\WINDOWS\System32\wpa.dbl -->16/07/2008 16:07:40 F:\WINDOWS\System32\d3d9caps.dat -->16/07/2008 08:06:59 F:\WINDOWS\System32\d3d8caps.dat -->15/07/2008 18:14:50 F:\WINDOWS\System32\TuneUpDefragService.exe -->15/07/2008 13:12:21 F:\WINDOWS\System32\wfqhokhi.dll -->14/07/2008 13:58:40 F:\WINDOWS\System32\exezou.dll -->14/07/2008 13:58:40 F:\WINDOWS\System32\53c58830-.txt -->13/07/2008 17:22:25 F:\WINDOWS\System32\perfh00C.dat -->10/07/2008 14:00:16 F:\WINDOWS\System32\perfh009.dat -->10/07/2008 14:00:16 F:\WINDOWS\System32\perfc00C.dat -->10/07/2008 14:00:16 F:\WINDOWS\System32\perfc009.dat -->10/07/2008 14:00:16 F:\WINDOWS\System32\PerfStringBackup.INI -->10/07/2008 14:00:15 F:\WINDOWS\System32\vsutil_loc040c.dll -->09/07/2008 09:05:44 F:\WINDOWS\System32\imslsp_install_loc040c.dll -->09/07/2008 09:05:42 F:\WINDOWS\System32\imsinstall_loc040c.dll -->09/07/2008 09:05:42 F:\WINDOWS\System32\vsdatant.sys -->09/07/2008 09:05:22 F:\WINDOWS\System32\zpeng24.dll -->09/07/2008 09:05:16 F:\WINDOWS\System32\zlcommdb.dll -->09/07/2008 09:05:12 F:\WINDOWS\System32\zlcomm.dll -->09/07/2008 09:05:12 F:\WINDOWS\System32\vsxml.dll -->09/07/2008 09:05:12 F:\WINDOWS\win.ini -->16/07/2008 17:20:09 F:\WINDOWS\setupapi.log -->16/07/2008 17:15:26 F:\WINDOWS\WindowsUpdate.log -->16/07/2008 16:31:59 F:\WINDOWS\QTFont.qfn -->16/07/2008 16:08:30 F:\WINDOWS\wiadebug.log -->16/07/2008 16:07:32 F:\WINDOWS\wiaservc.log -->16/07/2008 16:07:30 F:\WINDOWS\0.log -->16/07/2008 16:06:49 F:\WINDOWS\bootstat.dat -->16/07/2008 16:06:46 F:\WINDOWS\SchedLgU.Txt -->16/07/2008 16:05:58 F:\WINDOWS\QTFont.for -->16/07/2008 11:12:18 F:\WINDOWS\Thumbs.db -->13/07/2008 23:00:44 F:\WINDOWS\zllsputility_loc040c.dll -->09/07/2008 09:05:44 F:\WINDOWS\zllsputility.exe -->09/07/2008 09:05:20 F:\WINDOWS\csmash.ini -->08/07/2008 23:01:54 F:\WINDOWS\PControl.ini -->06/07/2008 22:16:03 winlogon.exe Verified: Signed svchost.exe Verified: Signed ws2_32.dll Verified: Signed user32.dll Verified: Unsigned tcpip.sys Verified: Signed ndis.sys Verified: Signed null.sys Verified: Signed ListDLLs v2.25 - DLL lister for Win9x/NT Copyright (C) 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ explorer.exe pid: 1976 Command line: F:\WINDOWS\Explorer.EXE Base Size Version Path 0x77be0000 0x58000 7.00.2600.5512 F:\WINDOWS\system32\msvcrt.dll 0x779e0000 0x97000 5.131.2600.5512 F:\WINDOWS\system32\CRYPT32.dll 0x76610000 0x84000 5.131.2600.5512 F:\WINDOWS\system32\CRYPTUI.dll 0x44080000 0xd0000 7.00.6000.16674 F:\WINDOWS\system32\WININET.dll 0x00400000 0x9000 6.00.5441.0000 F:\WINDOWS\system32\Normaliz.dll 0x43e00000 0x45000 7.00.6000.16674 F:\WINDOWS\system32\iertutil.dll 0x76be0000 0x2e000 5.131.2600.5512 F:\WINDOWS\system32\WINTRUST.dll 0x753c0000 0x6b000 1.420.2600.5512 F:\WINDOWS\system32\USP10.dll 0x76f80000 0x7f000 2001.12.4414.0700 F:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0258 F:\WINDOWS\system32\COMRes.dll 0x76ac0000 0x11000 3.05.2284.0001 F:\WINDOWS\system32\ATL.DLL 0x7d200000 0x2bc000 3.01.4001.5512 F:\WINDOWS\system32\msi.dll 0x44360000 0x5cd000 7.00.6000.16674 F:\WINDOWS\system32\ieframe.dll 0x44160000 0x127000 7.00.6000.16674 F:\WINDOWS\system32\urlmon.dll 0x442b0000 0x3c000 7.00.6000.16674 F:\WINDOWS\system32\webcheck.dll 0x164a0000 0x23000 5.02.5721.5145 F:\WINDOWS\system32\WPDShServiceObj.dll 0x109c0000 0x2c000 5.02.5721.5145 F:\WINDOWS\system32\PortableDeviceTypes.dll 0x10930000 0x49000 5.02.5721.5145 F:\WINDOWS\system32\PortableDeviceApi.dll 0x10000000 0x20000 9.00.0000.0000 C:\Program Files\Softwin\BitDefender9\bdoe.dll 0x01770000 0x15000 1.08.0011.0000 F:\WINDOWS\system32\XCOMM.dll 0x7c340000 0x56000 7.10.3052.0004 F:\WINDOWS\system32\MSVCR71.dll 0x01af0000 0xf000 3.00.0002.0000 F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\MOUDL32A.DLL 0x01dd0000 0x13000 9.00.0007.0000 F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\MOUSEDLL.DLL 0x014e0000 0x20000 5.08.0022.6405 F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\SBHook.dll 0x24000000 0x7000 5.00.0006.8903 F:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mlfhook.dll 0x74730000 0x3d000 3.525.1132.0000 F:\WINDOWS\system32\ODBC32.dll 0x01200000 0x18000 3.525.1117.0000 F:\WINDOWS\system32\odbcint.dll 0x02730000 0x8e000 6.84.0083.0007 F:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll 0x027c0000 0xa5000 6.84.0100.0004 F:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll 0x7c3a0000 0x7b000 7.10.3077.0000 F:\WINDOWS\system32\MSVCP71.dll 0x00980000 0xb000 6.84.0051.0000 F:\Program Files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_fre.nlr 0x02aa0000 0x87000 6.84.0015.0001 F:\Program Files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr 0x02870000 0x2c000 F:\Program Files\WinRAR arext.dll 0x02910000 0x1d000 7.05.0000.0464 F:\WINDOWS\system32\avgfwafu.dll 0x01e10000 0x12000 1.00.0000.0003 C:\Program Files\Softwin\BitDefender9\bdshelxt.dll 0x01e30000 0xb000 7.00.0483.0000 F:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll 0x01e40000 0x4000 5.03.0017.0000 F:\Program Files\Zone Labs\ZoneAlarm\zlavscan_Loc040c.dll 0x03890000 0x76000 1.00.0008.0046 F:\PROGRA~1\TROJAN~1\Trshlex.dll 0x01e70000 0x8000 1.00.0000.0000 F:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll 0x03510000 0x9000 2.00.0000.0004 F:\Program Files\TuneUp Utilities 2008\SDShelEx-win32.dll 0x03530000 0xf000 1.00.0000.0001 F:\Program Files\SafeSoft\Chaos Shredder sc.dll 0x1c000000 0x6000 1.02.0001.0000 F:\Program Files\Notepad++ ppcm.dll 0x03b30000 0x1a000 1.01.0221.0000 F:\WINDOWS\system32\CmdLineExt.dll 0x01d60000 0xd000 7.00.0009.0050 F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll 0x6da50000 0x12000 6.00.0050.0005 F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 0x32520000 0x12000 10.00.2609.0000 F:\Program Files\Microsoft Office\Office10\msohev.dll 0x01ea0000 0x1c000 7.00.0000.0000 F:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll ListDLLs v2.25 - DLL lister for Win9x/NT Copyright (C) 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ winlogon.exe pid: 804 Command line: winlogon.exe Base Size Version Path 0x01000000 0x82000 \??\F:\WINDOWS\system32\winlogon.exe 0x77be0000 0x58000 7.00.2600.5512 F:\WINDOWS\system32\msvcrt.dll 0x779e0000 0x97000 5.131.2600.5512 F:\WINDOWS\system32\CRYPT32.dll 0x76be0000 0x2e000 5.131.2600.5512 F:\WINDOWS\system32\WINTRUST.dll 0x753c0000 0x6b000 1.420.2600.5512 F:\WINDOWS\system32\USP10.dll 0x74730000 0x3d000 3.525.1132.0000 F:\WINDOWS\system32\ODBC32.dll 0x20000000 0x18000 3.525.1117.0000 F:\WINDOWS\system32\odbcint.dll 0x10000000 0x24000 6.14.0010.4177 F:\WINDOWS\system32\Ati2evxx.dll 0x014d0000 0xae000 1.05.0540.0000 F:\WINDOWS\system32\WgaLogon.dll 0x76f80000 0x7f000 2001.12.4414.0700 F:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0258 F:\WINDOWS\system32\COMRes.dll 0x76ac0000 0x11000 3.05.2284.0001 F:\WINDOWS\system32\ATL.DLL Le volume dans le lecteur F s'appelle Hard Drive 2 Le num‚ro de s‚rie du volume est 703C-6602 R‚pertoire de F:\WINDOWS\system32 13/04/2008 19:34 6ÿ144 csrss.exe 1 fichier(s) 6ÿ144 octets 0 R‚p(s) 5ÿ754ÿ855ÿ424 octets libres Contenu de Downloaded Program Files Le volume dans le lecteur F s'appelle Hard Drive 2 Le num‚ro de s‚rie du volume est 703C-6602 R‚pertoire de F:\WINDOWS\Downloaded Program Files 15/07/2008 19:07 . 15/07/2008 19:07 .. 25/06/2006 12:10 65 desktop.ini 19/03/2002 12:25 24ÿ576 dwusplay.dll 19/03/2002 12:25 192ÿ512 dwusplay.exe 19/03/2002 12:28 143ÿ360 isusweb.dll 08/08/2006 11:45 576 kavwebscan.inf 20/01/2000 16:25 1ÿ162 Microsoft XML Parser for Java.osd 09/11/2006 15:36 5ÿ019 swflash.inf 30/06/2003 23:41 1ÿ689 WMV9VCM.inf 8 fichier(s) 368ÿ959 octets Total des fichiers list‚sÿ: 8 fichier(s) 368ÿ959 octets 2 R‚p(s) 5ÿ754ÿ855ÿ424 octets libres Recherche de rootkit! (Merci S!Ri) Recherche d'infections connues Export des clefs sensibles..

Fyerrblad · Answer

Rapport Combofix ComboFix 08-07-15.4 - Ibixis Studios™ 2008-07-16 17:54:30.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1000 [GMT 2:00] Endroit: F:\Documents and Settings\Ibixis Studios™\Bureau\Opération A\Cogno\Cogno.exe * Resident AV is active [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . F:\WINDOWS\system32\exezou.dll F:\WINDOWS\system32\lmllm.ini F:\WINDOWS\system32\lmllm.ini2 F:\WINDOWS\system32\MSINET.oca F:\WINDOWS\system32\wfqhokhi.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_CLBDRIVER -------\Service_clbdriver -------\Service_poof ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-16 to 2008-07-16 )))))))))))))))))))))))))))))))))))) . 2008-07-16 17:08 . 2008-07-16 17:08 d-------- F:\_OTMoveIt 2008-07-16 16:29 . 2008-07-16 18:02 0 --a------ F:\WINDOWS\system32\[u]0[/u]0979DC0_kds.xml 2008-07-16 16:29 . 2008-07-16 16:29 0 --a------ F:\rollback.ini 2008-07-16 16:06 . 2008-07-16 18:06 786,720 --ahs---- F:\WINDOWS\system32\drivers\fidbox.dat 2008-07-16 16:06 . 2008-07-16 18:03 12,512 --ahs---- F:\WINDOWS\system32\drivers\fidbox.idx 2008-07-16 16:04 . 2008-07-16 16:04 d-------- F:\Program Files\Alwil Software 2008-07-16 16:02 . 2008-07-16 18:07 d-------- F:\Documents and Settings\All Users\Application Data\MailFrontier 2008-07-16 16:02 . 2008-07-09 09:05 75,248 --a------ F:\WINDOWS\zllsputility.exe 2008-07-16 16:02 . 2008-07-09 09:05 54,672 --a------ F:\WINDOWS\system32\vsutil_loc040c.dll 2008-07-16 16:02 . 2008-07-09 09:05 42,384 --a------ F:\WINDOWS\zllsputility_loc040c.dll 2008-07-16 16:02 . 2008-07-09 09:05 21,904 --a------ F:\WINDOWS\system32\imsinstall_loc040c.dll 2008-07-16 16:02 . 2008-07-09 09:05 17,808 --a------ F:\WINDOWS\system32\imslsp_install_loc040c.dll 2008-07-16 16:02 . 2004-04-27 04:40 11,264 --a------ F:\WINDOWS\system32\SpOrder.dll 2008-07-16 16:02 . 2008-07-16 18:04 4,212 ---h----- F:\WINDOWS\system32\zllictbl.dat 2008-07-16 16:01 . 2008-07-16 16:01 d-------- F:\Program Files\Zone Labs 2008-07-16 15:58 . 2008-07-16 18:04 d-------- F:\WINDOWS\Internet Logs 2008-07-16 15:51 . 2008-07-16 15:51 d-------- F:\Documents and Settings\Mom\Application Data\TuneUp Software 2008-07-16 15:35 . 2008-07-16 17:53 14 --a------ F:\WINDOWS\system32\getfile.dat 2008-07-16 11:12 . 2008-07-16 18:05 54,156 --ah----- F:\WINDOWS\QTFont.qfn 2008-07-16 11:12 . 2008-07-16 11:12 1,409 --a------ F:\WINDOWS\QTFont.for 2008-07-16 10:55 . 2008-07-16 10:55 d-------- F:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-07-15 21:55 . 2008-07-15 22:23 d-------- F:\Program Files\Exterminate It! 2008-07-15 19:07 . 2008-07-15 19:07 d-------- F:\WINDOWS\system32\Kaspersky Lab 2008-07-15 18:55 . 2008-07-15 18:55 d-------- F:\Documents and Settings\Mom\Application Data\Simply Super Software 2008-07-15 18:54 . 2008-07-15 18:54 d-------- F:\Documents and Settings\Knightmare\Application Data\Simply Super Software 2008-07-15 18:20 . 2008-07-15 18:22 d-------- F:\Program Files\Trojan Remover 2008-07-15 18:20 . 2008-07-15 18:20 d-------- F:\Documents and Settings\All Users\Application Data\Simply Super Software 2008-07-15 18:20 . 2006-05-25 15:52 162,304 --a------ F:\WINDOWS\system32\ztvunrar36.dll 2008-07-15 18:20 . 2003-02-02 20:06 153,088 --a------ F:\WINDOWS\system32\UNRAR3.dll 2008-07-15 18:20 . 2005-08-26 01:50 77,312 --a------ F:\WINDOWS\system32\ztvunace26.dll 2008-07-15 18:20 . 2002-03-06 01:00 75,264 --a------ F:\WINDOWS\system32\unacev2.dll 2008-07-15 18:20 . 2006-06-19 13:01 69,632 --a------ F:\WINDOWS\system32\ztvcabinet.dll 2008-07-15 17:26 . 2008-07-15 17:26 d-------- F:\Deckard 2008-07-15 13:12 . 2008-07-15 13:12 d-------- F:\Documents and Settings\All Users\Application Data\TuneUp Software 2008-07-15 13:12 . 2008-07-15 13:12 355,584 --a------ F:\WINDOWS\system32\TuneUpDefragService.exe 2008-07-15 13:12 . 2008-05-29 09:28 28,416 --a------ F:\WINDOWS\system32\uxtuneup.dll 2008-07-15 13:11 . 2008-07-15 13:12 d-------- F:\Program Files\TuneUp Utilities 2008 2008-07-14 17:43 . 2008-07-14 17:43 d-------- F:\Program Files\SafeSoft 2008-07-14 17:29 . 2008-07-14 17:29 d-------- F:\Documents and Settings\Knightmare\Application Data\Notepad++ 2008-07-14 17:01 . 2008-07-14 17:01 d-------- F:\Documents and Settings\Mom\Application Data\Malwarebytes 2008-07-14 16:48 . 2008-07-14 16:48 d-------- F:\Documents and Settings\Knightmare\Application Data\Malwarebytes 2008-07-13 23:55 . 2008-07-13 23:55 d-------- F:\Program Files\Malwarebytes' Anti-Malware 2008-07-13 23:55 . 2008-07-13 23:55 d-------- F:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-07-13 23:55 . 2008-07-07 17:35 34,296 --a------ F:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-07-13 23:55 . 2008-07-07 17:35 17,144 --a------ F:\WINDOWS\system32\drivers\mbam.sys 2008-07-13 13:17 . 2008-07-13 13:17 d-------- F:\Documents and Settings\Mom\Application Data\TmpRecentIcons 2008-07-13 13:12 . 2004-08-05 14:00 4,224 --a------ F:\WINDOWS\system32\beep.sys 2008-07-10 14:00 . 2002-12-17 16:23 33,340 --------- F:\WINDOWS\system32\dbmsqlgc.dll 2008-07-10 14:00 . 2002-10-20 14:05 24,576 --------- F:\WINDOWS\system32\dbmsgnet.dll 2008-07-10 13:57 . 2008-07-10 13:57 d-------- F:\Program Files\Sony Setup 2008-07-10 13:57 . 2008-07-11 19:06 d-------- F:\Program Files\Sony 2008-07-10 13:57 . 2008-07-11 19:06 d-------- F:\Documents and Settings\All Users\Application Data\Sony 2008-07-09 22:13 . 2008-07-16 17:15 d-------- F:\Program Files\Windows Live Safety Center 2008-07-09 11:23 . 2008-07-09 11:23 d-------- F:\Documents and Settings\All Users\Application Data\ATI 2008-07-08 23:06 . 2008-07-08 23:06 d-------- F:\ATI 2008-07-08 22:57 . 2008-07-08 23:01 120 --a------ F:\WINDOWS\csmash.ini 2008-07-08 21:56 . 2008-07-08 21:56 d-------- F:\Program Files\Atari 2008-07-06 22:16 . 2008-07-06 22:16 d-------- F:\WINDOWS\458200709BE54785B770A50F5240250B.TMP 2008-07-05 22:44 . 2008-07-05 22:44 d-------- F:\Program Files\Windows Journal Viewer 2008-07-03 21:26 . 2008-07-06 22:16 29 --a------ F:\WINDOWS\PControl.ini 2008-07-03 21:25 . 2008-07-06 22:16 d-------- F:\Program Files\Active Worlds 2008-07-03 17:56 . 2008-07-05 23:01 d-------- F:\Documents and Settings\All Users\Application Data\Messenger Plus! 2008-07-03 17:54 . 2008-07-03 17:54 d-------- F:\Program Files\Messenger Plus! Live 2008-06-30 13:56 . 2008-06-30 13:56 d-------- F:\Program Files\e frontier 2008-06-25 11:58 . 2008-06-25 11:58 d-------- F:\Program Files\Fichiers communs\DirectX 2008-06-25 11:58 . 2008-06-25 11:58 36,734 --a------ F:\WINDOWS\system32\OggDSuninst.exe 2008-06-24 23:58 . 2008-06-24 23:58 d-------- F:\Program Files\Trymedia 2008-06-24 23:21 . 2008-06-24 23:21 4,096 --a------ F:\WINDOWS\d3dx.dat 2008-06-24 22:38 . 2008-06-24 22:38 d-------- F:\Program Files\ReflexiveArcade 2008-06-20 19:47 . 2008-06-20 19:47 247,808 -----c--- F:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 19:47 . 2008-06-20 19:47 147,968 -----c--- F:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 13:51 . 2008-06-20 13:51 361,600 -----c--- F:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 13:40 . 2008-06-20 13:40 138,496 -----c--- F:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 13:08 . 2008-06-20 13:08 225,856 -----c--- F:\WINDOWS\system32\dllcache\tcpip6.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-16 16:03 81,984 ----a-w F:\WINDOWS\system32\bdod.bin 2008-07-16 16:03 119,808 ----a-w F:\WINDOWS\Internet Logs\xDB1.tmp 2008-07-16 13:50 --------- d-----w F:\Documents and Settings\Mom\Application Data\Skype 2008-07-16 10:09 --------- d---a-w F:\Documents and Settings\All Users\Application Data\TEMP 2008-07-16 09:16 --------- d-----w F:\Documents and Settings\All Users\Application Data\Grisoft 2008-07-15 14:21 --------- d-----w F:\Documents and Settings\Mom\Application Data\AVG7 2008-07-14 15:56 --------- d-----w F:\Program Files\Fichiers communs\Wise Installation Wizard 2008-07-11 17:06 --------- d-----w F:\Program Files\VstPlugins 2008-07-11 13:27 --------- d-----w F:\Program Files\Cheat Engine 2008-07-09 09:20 --------- d-----w F:\Program Files\ATI Technologies 2008-07-09 07:05 1,086,952 ----a-w F:\WINDOWS\system32\zpeng24.dll 2008-07-08 19:57 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-06-30 15:59 --------- d-----w F:\Program Files\Java 2008-06-22 19:58 --------- d-----w F:\Program Files\Auto-école 3D 2008-06-20 17:47 247,808 ----a-w F:\WINDOWS\system32\mswsock.dll 2008-06-20 11:51 361,600 ----a-w F:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 11:40 138,496 ----a-w F:\WINDOWS\system32\drivers\afd.sys 2008-06-20 11:08 225,856 ----a-w F:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-15 15:43 --------- d-----w F:\Program Files\Cinema Business 2008-06-15 15:26 --------- d-----w F:\Program Files\BoontyGames 2008-06-15 15:26 --------- d-----w F:\Program Files\Boonty 2008-06-15 15:14 --------- d-----w F:\Program Files\CCleaner 2008-06-14 17:33 272,768 ------w F:\WINDOWS\system32\drivers\bthport.sys 2008-06-14 13:34 --------- d-----w F:\Program Files\Elektrogames 2008-06-14 12:39 --------- d-----w F:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-06-14 06:46 --------- d-----w F:\Program Files\Ray Adams 2008-06-13 18:45 --------- d-----w F:\Program Files\Fichiers communs\Symantec Shared 2008-06-13 17:02 --------- d-----w F:\Program Files\BitTorrent 2008-06-13 16:58 --------- d-----w F:\Program Files\DNA 2008-06-11 08:58 --------- d-----w F:\Documents and Settings\Knightmare\Application Data\AVG7 2008-06-03 06:20 3,100,160 ----a-w F:\WINDOWS\system32\drivers\ati2mtag.sys 2008-06-03 03:46 10,276,864 ----a-w F:\WINDOWS\system32\atioglx2.dll 2008-06-03 03:22 413,696 ----a-w F:\WINDOWS\system32\ATIDEMGX.dll 2008-06-03 03:21 306,688 ----a-w F:\WINDOWS\system32\ati2dvag.dll 2008-06-03 03:11 43,520 ----a-w F:\WINDOWS\system32\ati2edxx.dll 2008-06-03 03:11 26,112 ----a-w F:\WINDOWS\system32\Ati2mdxx.exe 2008-06-03 03:11 180,224 ----a-w F:\WINDOWS\system32\atipdlxx.dll 2008-06-03 03:11 139,264 ----a-w F:\WINDOWS\system32\Oemdspif.dll 2008-06-03 03:11 139,264 ----a-w F:\WINDOWS\system32\ati2evxx.dll 2008-06-03 03:09 552,960 ----a-w F:\WINDOWS\system32\ati2evxx.exe 2008-06-03 03:08 53,248 ----a-w F:\WINDOWS\system32\ATIDDC.DLL 2008-06-03 03:04 245,760 ----a-w F:\WINDOWS\system32\atiok3x2.dll 2008-06-03 03:02 307,200 ----a-w F:\WINDOWS\system32\atiiiexx.dll 2008-06-03 02:59 3,500,352 ----a-w F:\WINDOWS\system32\ati3duag.dll 2008-06-03 02:48 2,120,832 ----a-w F:\WINDOWS\system32\ativvaxx.dll 2008-06-03 02:33 48,128 ----a-w F:\WINDOWS\system32\amdpcom32.dll 2008-06-03 02:29 348,160 ----a-w F:\WINDOWS\system32\atikvmag.dll 2008-06-03 02:28 23,040 ----a-w F:\WINDOWS\system32\atiadlxx.dll 2008-06-03 02:28 17,408 ----a-w F:\WINDOWS\system32\atitvo32.dll 2008-06-03 02:27 49,152 ----a-w F:\WINDOWS\system32\drivers\ati2erec.dll 2008-06-03 02:22 5,439,488 ----a-w F:\WINDOWS\system32\atioglxx.dll 2008-06-03 02:21 557,056 ----a-w F:\WINDOWS\system32\ati2cqag.dll 2008-06-02 19:05 593,920 ------w F:\WINDOWS\system32\ati2sgag.exe 2008-06-01 10:10 --------- d-----w F:\Program Files\Monte Cristo 2008-05-26 14:14 --------- d-----w F:\Documents and Settings\Mom\Application Data\AdobeUM 2008-05-25 11:40 --------- d-----w F:\Program Files\AGEIA Technologies 2008-05-25 11:29 --------- d-----w F:\Program Files\Cube 2008-05-23 20:55 --------- d-----w F:\Documents and Settings\All Users\Application Data\Skyline 2008-05-23 06:49 --------- d-----w F:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic 2008-05-22 18:46 --------- d-----w F:\Program Files\Notepad++ 2008-05-22 16:54 --------- d-----w F:\Program Files\Eurobarre 2008-05-22 16:54 --------- d-----w F:\Program Files\BMW M3 Challenge 2008-05-19 11:06 --------- d-----w F:\Documents and Settings\Mom\Application Data\LimeWire 2008-05-15 09:30 208,896 ----a-w F:\WINDOWS\system32\TubeFinder.exe 2008-05-11 15:25 121,272 ----a-w F:\Documents and Settings\Mom\Application Data\GDIPFONTCACHEV1.DAT 2008-05-09 22:09 2,560 ----a-w F:\WINDOWS\_MSRSTRT.EXE 2008-05-09 10:55 90,112 ----a-w F:\WINDOWS\system32\wshext.dll 2008-05-09 10:55 430,080 ----a-w F:\WINDOWS\system32\vbscript.dll 2008-05-09 10:55 180,224 ----a-w F:\WINDOWS\system32\scrobj.dll 2008-05-09 10:55 172,032 ----a-w F:\WINDOWS\system32\scrrun.dll 2008-05-08 11:24 155,648 ----a-w F:\WINDOWS\system32\wscript.exe 2008-05-07 09:07 135,168 ----a-w F:\WINDOWS\system32\cscript.exe 2008-05-07 05:11 1,294,336 ----a-w F:\WINDOWS\system32\quartz.dll 2008-04-23 04:16 826,368 ----a-w F:\WINDOWS\system32\wininet.dll 2007-11-05 20:40 7,073 ----a-w F:\Program Files\DeIsL1.isu 2007-11-05 20:40 147 ----a-w F:\Program Files\_DEISREG.ISR 2006-08-03 13:34 323 ----a-w F:\Program Files\INSTALL.LOG 2004-12-01 16:34 716 ---ha-w F:\Documents and Settings\All Users\Application Data\pb7msys.dat 1997-04-23 01:16 40,960 ----a-w F:\Program Files\_ISREG32.DLL . ------- Sigcheck ------- 2005-03-02 20:20 578048 c34920eb988ce98910bd6b0417f334eb F:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll 2007-03-08 17:50 579072 4d88aaf39adabfe45958ea1384e2c4ff F:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll 2007-03-08 17:37 578560 ce81abaa6581bd3cfe3f85cad3b08a38 F:\WINDOWS\$NtServicePackUninstall$\user32.dll 2005-03-02 20:10 578048 0df75fb73f705b011630159a43d7c354 F:\WINDOWS\ServicePackFiles\i386\user32.dll 2005-03-02 20:10 578048 0df75fb73f705b011630159a43d7c354 F:\WINDOWS\system32\user32.dll . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:34 15360] "MSMSGS"="F:\Program Files\Messenger\Msmsgs.exe" [2007-04-12 01:43 1661304] "BitTorrent DNA"="F:\Program Files\DNA\btdna.exe" [2008-06-13 18:58 289088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PHIME2002ASync"="F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 14:00 455168] "PHIME2002A"="F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 14:00 455168] "BDMCon"="c:\PROGRA~1\softwin\BITDEF~2\bdmcon.exe" [2006-06-25 13:16 372736] "BDOESRV"="C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" [2005-03-11 17:53 90112] "BDNewsAgent"="C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe" [2005-06-09 10:28 9728] "BDSwitchAgent"="C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe" [2005-04-06 13:09 33280] "ATIPTA"="F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-11 22:10 344064] "NeroFilterCheck"="F:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "LWBMOUSE"="F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe" [2001-04-20 13:42 429568] "OFFICEKB"="F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE" [2007-04-13 18:35 396288] "FLMOFFICE4DMOUSE"="F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe" [2007-04-13 18:35 370176] "Motive SmartBridge"="F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe" [2006-04-21 15:41 438359] "SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "QuickTime Task"="F:\Program Files\QuickTime\QTTask.exe" [2008-01-10 16:27 385024] "iTunesHelper"="F:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 04:22 267048] "PCSuiteTrayApplication"="F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360] "LogitechQuickCamRibbon"="F:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 17:37 2178832] "LogitechCommunicationsManager"="F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984] "TkBellExe"="F:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-03-01 20:13 185896] "StartCCC"="F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440] "TrojanScanner"="F:\Program Files\Trojan Remover\Trjscan.exe" [2008-06-03 20:33 878672] "ZoneAlarm Client"="F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05 919016] "SoundMan"="SOUNDMAN.EXE" [2004-07-01 12:23 67584 F:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 19:34 15360] "Nokia.PCSync"="F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"= 1 (0x1) "AllowUnhashedWebView"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMBalloonTip"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=sockspy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.enc"= ITIG726.acm "vidc.mjpg"= pvmjpg30.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-01-15 04:22 267048 F:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-06-18 15:10 271360 F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Boonty Games"=3 (0x3) "Bonjour Service"=2 (0x2) "MSSQLSERVER"=2 (0x2) "MSSQL$SQLEXPRESS"=2 (0x2) "iPod Service"=3 (0x3) "clr_optimization_v2.0.50727_32"=3 (0x3) "aspnet_state"=3 (0x3) "Apple Mobile Device"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "F:\Program Files\DNA\btdna.exe"= "F:\Program Files\Messenger\Msmsgs.exe"= "F:\Program Files\iTunes\iTunes.exe"= "F:\Program Files\Skype\Phone\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6346:TCP"= 6346:TCP:6346 R0 viasraid;viasraid;F:\WINDOWS\system32\drivers\viasraid.sys [2003-10-31 13:22] R2 DbgMsg;Debug Message;F:\WINDOWS\System32\Drivers\DbgMsg.sys [2004-07-21 10:38] R2 JavaQuickStarterService;Java Quick Starter;F:\Program Files\Java\jre6\bin\jqs.exe [2007-10-20 14:48] R2 UxTuneUp;TuneUp Extension de thème;F:\WINDOWS\System32\svchost.exe [2008-04-13 19:34] R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;F:\WINDOWS\system32\DRIVERS\getnd5b.sys [2004-01-29 08:32] S2 FILESpy;FILESpy;C:\Program Files\Softwin\BitDefender9\filespy.sys [] S3 AFW;AFW;F:\DOCUME~1\IBIXIS~3\LOCALS~1\Temp\[u]0[/u]02fbe98.sys [] S3 fbxusb;FreeBox USB Network Adapter;F:\WINDOWS\system32\DRIVERS\fbxusb.sys [2003-12-31 11:35] S3 TuneUp.Defrag;TuneUp Drive Defrag Service;F:\WINDOWS\System32\TuneUpDefragService.exe [2008-07-15 13:12] S3 uir1100a;UIR1100A;F:\WINDOWS\system32\DRIVERS\uir1100a.sys [2004-12-01 09:43] S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;F:\WINDOWS\system32\DRIVERS\usb8023.sys [2008-04-13 11:56] S4 Boonty Games;Boonty Games;F:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2007-06-10 19:43] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2008-07-08 07:43:01 F:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - F:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-03-28 18:32:03 F:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1167159061.job" - F:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe "2008-07-16 16:04:18 F:\WINDOWS\Tasks\Maintenance en 1 clic.job" - F:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe . - - - - ORPHANS REMOVED - - - - HKCU-Run-VoipBuster - F:\Program Files\VoipBuster\VoipBuster\VoipBuster.exe HKLM-Run-StandardInstall - (no file) MSConfigStartUp-HostManager - F:\Program Files\Fichiers communs\AOL\1151516705\ee\AOLSoftware.exe ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-16 18:05:35 Windows 5.1.2600 Service Pack 3 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... ************************************************************************** . ------------------------ Other Running Processes ------------------------ . F:\WINDOWS\system32\ati2evxx.exe F:\WINDOWS\system32\ati2evxx.exe F:\WINDOWS\system32\ZoneLabs\vsmon.exe F:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe F:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe F:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe F:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe F:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe F:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe C:\Program Files\Softwin\BitDefender9\vsserv.exe F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe F:\Program Files\PC Connectivity Solution\ServiceLayer.exe F:\Program Files\iPod\bin\iPodService.exe F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe F:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe F:\Program Files\Fichiers communs\LogiShrd\LQCVFX\COCIManager.exe F:\WINDOWS\system32\verclsid.exe . ************************************************************************** . Temps d'accomplissement: 2008-07-16 18:15:48 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-16 16:14:39 Pre-Run: 5,659,185,152 octets libres Post-Run: 5,703,704,576 octets libres 322 --- E O F --- 2008-07-10 06:23:08

Fyerrblad · Answer

Rapport Hijackthis!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:24:49, on 16/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\ZoneLabs\vsmon.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
F:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\PROGRA~1\softwin\BITDEF~2\bdmcon.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe
C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe
F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE
F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe
F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
F:\Program Files\Logitech\QuickCam\Quickcam.exe
F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
F:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Messenger\Msmsgs.exe
F:\Program Files\DNA\btdna.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
F:\WINDOWS\system32\wuauclt.exe
F:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
F:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
F:\WINDOWS\explorer.exe
F:\WINDOWS\system32
otepad.exe
F:\Program Files\Windows Live\Messenger\msnmsgr.exe
F:\Program Files\Windows Live\Messenger\usnsvc.exe
F:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\VBExpress.exe
F:\Documents and Settings\Ibixis Studios™\Bureau\Programmation Ibixis New Technologies™\Fyerrblad's Studios\Players Textures\Players Textures\bin\Debug\Players Textures.vshost.exe
F:\PROGRA~1\Mozilla Firefox\firefox.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - F:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [PHIME2002ASync] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [BDMCon] c:\PROGRA~1\softwin\BITDEF~2\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LWBMOUSE] F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe
O4 - HKLM\..\Run: [OFFICEKB] F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe
O4 - HKLM\..\Run: [Motive SmartBridge] F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "F:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [StartCCC] "F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [TrojanScanner] F:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "F:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] F:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download with &DAP - F:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - F:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - F:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - F:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - F:\Documents and Settings\Knightmare\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - F:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: LVCOMSer - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - F:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - F:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - F:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - F:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Fyerrblad · Answer

Rapport Hijackthis (2):

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:32:24, on 16/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\ZoneLabs\vsmon.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
F:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\Windows Live\Messenger\usnsvc.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\Explorer.EXE
C:\PROGRA~1\softwin\BITDEF~2\bdmcon.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe
C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe
F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE
F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe
F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
F:\Program Files\Logitech\QuickCam\Quickcam.exe
F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
F:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\CursorXP\CursorXP.exe
F:\WINDOWS\system32\wuauclt.exe
F:\Program Files\Skype\Phone\Skype.exe
F:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
F:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
F:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\PROGRA~1\softwin\BITDEF~2\bdnews.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/md5auth.srf?lc=1036
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - F:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [PHIME2002ASync] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [BDMCon] c:\PROGRA~1\softwin\BITDEF~2\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LWBMOUSE] F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe
O4 - HKLM\..\Run: [OFFICEKB] F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe
O4 - HKLM\..\Run: [Motive SmartBridge] F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "F:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [StartCCC] "F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [TrojanScanner] F:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "F:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MessengerPlus3] "c:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Yahoo! Pager] "F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [IncrediMail] F:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Magentic] F:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKCU\..\Run: [CursorXP] c:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [Skype] "F:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "F:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] F:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Clean Traces - F:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - F:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - F:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - F:\Documents and Settings\Knightmare\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - F:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: LVCOMSer - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - F:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - F:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - F:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - F:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Fyerrblad · Answer

Session Admin (3)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:37:55, on 16/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\ZoneLabs\vsmon.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
F:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
F:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\Windows Live\Messenger\usnsvc.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe
C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe
F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE
F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe
F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
F:\Program Files\Logitech\QuickCam\Quickcam.exe
F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\CursorXP\CursorXP.exe
F:\Program Files\Google\Google Talk\googletalk.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
F:\WINDOWS\system32\wuauclt.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
F:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
F:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - F:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [PHIME2002ASync] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [BDMCon] c:\PROGRA~1\softwin\BITDEF~2\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LWBMOUSE] F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe
O4 - HKLM\..\Run: [OFFICEKB] F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe
O4 - HKLM\..\Run: [Motive SmartBridge] F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "F:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [StartCCC] "F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [TrojanScanner] F:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CursorXP] c:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [googletalk] "F:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] F:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] F:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin
pjpi160_06.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin
pjpi160_06.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - F:\Documents and Settings\Knightmare\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - F:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: LVCOMSer - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - F:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - F:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - F:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - F:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - F:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
O24 - Desktop Component 0: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Mog.gif
O24 - Desktop Component 1: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Stiltzkin.gif
O24 - Desktop Component 10: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Marcus.gif
O24 - Desktop Component 11: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Blank.gif
O24 - Desktop Component 12: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Ruby.gif
O24 - Desktop Component 13: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Vivi.gif
O24 - Desktop Component 14: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Eiko.gif
O24 - Desktop Component 15: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Rusty.gif
O24 - Desktop Component 16: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Beatrix.gif
O24 - Desktop Component 17: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Garnet.gif
O24 - Desktop Component 18: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Quina.gif
O24 - Desktop Component 19: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Amarant.gif
O24 - Desktop Component 2: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Baku.gif
O24 - Desktop Component 20: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Kuja.gif
O24 - Desktop Component 21: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Ozma.gif
O24 - Desktop Component 3: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Lani.gif
O24 - Desktop Component 4: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Freya.gif
O24 - Desktop Component 5: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Fratley.gif
O24 - Desktop Component 6: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Pampa.gif
O24 - Desktop Component 7: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Tomberry.gif
O24 - Desktop Component 8: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Cinna.gif
O24 - Desktop Component 9: (no name) - F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Ji-Dan.gif

Fyerrblad · Answer

Rapport Combofix : ComboFix 08-07-15.4 - Knightmare 2008-07-16 18:52:31.2 - NTFSx86 NETWORK Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1650 [GMT 2:00] Endroit: F:\Dossier central de partage de fichiers\Cogno.exe [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . ((((((((((((((((((((((((((((( Fichiers créés 2008-06-16 to 2008-07-16 )))))))))))))))))))))))))))))))))))) . 2008-07-16 18:40 . 2008-07-16 18:40 d-------- F:\Documents and Settings\Invité\Application Data\MailFrontier 2008-07-16 18:35 . 2008-07-16 18:35 d-------- F:\Documents and Settings\Knightmare\Application Data\MailFrontier 2008-07-16 18:32 . 2008-07-16 18:32 d-------- F:\Documents and Settings\Mom\Application Data\MailFrontier 2008-07-16 18:24 . 2008-07-16 18:24 d-------- F:\Program Files\Trend Micro 2008-07-16 18:15 . 2008-07-16 18:15 d-------- F:\Documents and Settings\InvitÚ 2008-07-16 18:15 . 2008-07-16 18:15 d-------- F:\Documents and Settings\Ibixis StudiosÖ 2008-07-16 17:08 . 2008-07-16 17:08 d-------- F:\_OTMoveIt 2008-07-16 16:29 . 2008-07-16 18:02 0 --a------ F:\WINDOWS\system32\[u]0[/u]0979DC0_kds.xml 2008-07-16 16:29 . 2008-07-16 16:29 0 --a------ F:\rollback.ini 2008-07-16 16:06 . 2008-07-16 18:46 967,712 --ahs---- F:\WINDOWS\system32\drivers\fidbox.dat 2008-07-16 16:06 . 2008-07-16 18:03 12,512 --ahs---- F:\WINDOWS\system32\drivers\fidbox.idx 2008-07-16 16:04 . 2008-07-16 16:04 d-------- F:\Program Files\Alwil Software 2008-07-16 16:02 . 2008-07-16 18:07 d-------- F:\Documents and Settings\All Users\Application Data\MailFrontier 2008-07-16 16:02 . 2008-07-09 09:05 75,248 --a------ F:\WINDOWS\zllsputility.exe 2008-07-16 16:02 . 2008-07-09 09:05 54,672 --a------ F:\WINDOWS\system32\vsutil_loc040c.dll 2008-07-16 16:02 . 2008-07-09 09:05 42,384 --a------ F:\WINDOWS\zllsputility_loc040c.dll 2008-07-16 16:02 . 2008-07-09 09:05 21,904 --a------ F:\WINDOWS\system32\imsinstall_loc040c.dll 2008-07-16 16:02 . 2008-07-09 09:05 17,808 --a------ F:\WINDOWS\system32\imslsp_install_loc040c.dll 2008-07-16 16:02 . 2004-04-27 04:40 11,264 --a------ F:\WINDOWS\system32\SpOrder.dll 2008-07-16 16:02 . 2008-07-16 18:04 4,212 ---h----- F:\WINDOWS\system32\zllictbl.dat 2008-07-16 16:01 . 2008-07-16 16:01 d-------- F:\Program Files\Zone Labs 2008-07-16 15:58 . 2008-07-16 18:50 d-------- F:\WINDOWS\Internet Logs 2008-07-16 15:51 . 2008-07-16 15:51 d-------- F:\Documents and Settings\Mom\Application Data\TuneUp Software 2008-07-16 15:35 . 2008-07-16 18:47 14 --a------ F:\WINDOWS\system32\getfile.dat 2008-07-16 11:12 . 2008-07-16 18:43 54,156 --ah----- F:\WINDOWS\QTFont.qfn 2008-07-16 11:12 . 2008-07-16 11:12 1,409 --a------ F:\WINDOWS\QTFont.for 2008-07-16 10:55 . 2008-07-16 10:55 d-------- F:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-07-15 21:55 . 2008-07-15 22:23 d-------- F:\Program Files\Exterminate It! 2008-07-15 19:07 . 2008-07-15 19:07 d-------- F:\WINDOWS\system32\Kaspersky Lab 2008-07-15 18:55 . 2008-07-15 18:55 d-------- F:\Documents and Settings\Mom\Application Data\Simply Super Software 2008-07-15 18:54 . 2008-07-15 18:54 d-------- F:\Documents and Settings\Knightmare\Application Data\Simply Super Software 2008-07-15 18:20 . 2008-07-15 18:22 d-------- F:\Program Files\Trojan Remover 2008-07-15 18:20 . 2008-07-15 18:20 d-------- F:\Documents and Settings\All Users\Application Data\Simply Super Software 2008-07-15 18:20 . 2006-05-25 15:52 162,304 --a------ F:\WINDOWS\system32\ztvunrar36.dll 2008-07-15 18:20 . 2003-02-02 20:06 153,088 --a------ F:\WINDOWS\system32\UNRAR3.dll 2008-07-15 18:20 . 2005-08-26 01:50 77,312 --a------ F:\WINDOWS\system32\ztvunace26.dll 2008-07-15 18:20 . 2002-03-06 01:00 75,264 --a------ F:\WINDOWS\system32\unacev2.dll 2008-07-15 18:20 . 2006-06-19 13:01 69,632 --a------ F:\WINDOWS\system32\ztvcabinet.dll 2008-07-15 17:26 . 2008-07-15 17:26 d-------- F:\Deckard 2008-07-15 13:12 . 2008-07-15 13:12 d-------- F:\Documents and Settings\All Users\Application Data\TuneUp Software 2008-07-15 13:12 . 2008-07-15 13:12 355,584 --a------ F:\WINDOWS\system32\TuneUpDefragService.exe 2008-07-15 13:12 . 2008-05-29 09:28 28,416 --a------ F:\WINDOWS\system32\uxtuneup.dll 2008-07-15 13:11 . 2008-07-15 13:12 d-------- F:\Program Files\TuneUp Utilities 2008 2008-07-14 17:43 . 2008-07-14 17:43 d-------- F:\Program Files\SafeSoft 2008-07-14 17:29 . 2008-07-14 17:29 d-------- F:\Documents and Settings\Knightmare\Application Data\Notepad++ 2008-07-14 17:01 . 2008-07-14 17:01 d-------- F:\Documents and Settings\Mom\Application Data\Malwarebytes 2008-07-14 16:48 . 2008-07-14 16:48 d-------- F:\Documents and Settings\Knightmare\Application Data\Malwarebytes 2008-07-13 23:55 . 2008-07-13 23:55 d-------- F:\Program Files\Malwarebytes' Anti-Malware 2008-07-13 23:55 . 2008-07-13 23:55 d-------- F:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-07-13 23:55 . 2008-07-07 17:35 34,296 --a------ F:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-07-13 23:55 . 2008-07-07 17:35 17,144 --a------ F:\WINDOWS\system32\drivers\mbam.sys 2008-07-13 13:17 . 2008-07-13 13:17 d-------- F:\Documents and Settings\Mom\Application Data\TmpRecentIcons 2008-07-13 13:12 . 2004-08-05 14:00 4,224 --a------ F:\WINDOWS\system32\beep.sys 2008-07-10 14:00 . 2002-12-17 16:23 33,340 --------- F:\WINDOWS\system32\dbmsqlgc.dll 2008-07-10 14:00 . 2002-10-20 14:05 24,576 --------- F:\WINDOWS\system32\dbmsgnet.dll 2008-07-10 13:57 . 2008-07-10 13:57 d-------- F:\Program Files\Sony Setup 2008-07-10 13:57 . 2008-07-11 19:06 d-------- F:\Program Files\Sony 2008-07-10 13:57 . 2008-07-11 19:06 d-------- F:\Documents and Settings\All Users\Application Data\Sony 2008-07-09 22:13 . 2008-07-16 17:15 d-------- F:\Program Files\Windows Live Safety Center 2008-07-09 11:23 . 2008-07-09 11:23 d-------- F:\Documents and Settings\All Users\Application Data\ATI 2008-07-08 23:06 . 2008-07-08 23:06 d-------- F:\ATI 2008-07-08 22:57 . 2008-07-08 23:01 120 --a------ F:\WINDOWS\csmash.ini 2008-07-08 21:56 . 2008-07-08 21:56 d-------- F:\Program Files\Atari 2008-07-06 22:16 . 2008-07-06 22:16 d-------- F:\WINDOWS\458200709BE54785B770A50F5240250B.TMP 2008-07-05 22:44 . 2008-07-05 22:44 d-------- F:\Program Files\Windows Journal Viewer 2008-07-03 21:26 . 2008-07-06 22:16 29 --a------ F:\WINDOWS\PControl.ini 2008-07-03 21:25 . 2008-07-06 22:16 d-------- F:\Program Files\Active Worlds 2008-07-03 17:56 . 2008-07-05 23:01 d-------- F:\Documents and Settings\All Users\Application Data\Messenger Plus! 2008-07-03 17:54 . 2008-07-03 17:54 d-------- F:\Program Files\Messenger Plus! Live 2008-06-30 13:56 . 2008-06-30 13:56 d-------- F:\Program Files\e frontier 2008-06-25 11:58 . 2008-06-25 11:58 d-------- F:\Program Files\Fichiers communs\DirectX 2008-06-25 11:58 . 2008-06-25 11:58 36,734 --a------ F:\WINDOWS\system32\OggDSuninst.exe 2008-06-24 23:58 . 2008-06-24 23:58 d-------- F:\Program Files\Trymedia 2008-06-24 23:21 . 2008-06-24 23:21 4,096 --a------ F:\WINDOWS\d3dx.dat 2008-06-24 22:38 . 2008-06-24 22:38 d-------- F:\Program Files\ReflexiveArcade 2008-06-20 19:47 . 2008-06-20 19:47 247,808 -----c--- F:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 19:47 . 2008-06-20 19:47 147,968 -----c--- F:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 13:51 . 2008-06-20 13:51 361,600 -----c--- F:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 13:40 . 2008-06-20 13:40 138,496 -----c--- F:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 13:08 . 2008-06-20 13:08 225,856 -----c--- F:\WINDOWS\system32\dllcache\tcpip6.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-16 16:47 1,453,056 ----a-w F:\WINDOWS\Internet Logs\xDB2.tmp 2008-07-16 16:44 81,984 ----a-w F:\WINDOWS\system32\bdod.bin 2008-07-16 16:44 --------- d---a-w F:\Documents and Settings\All Users\Application Data\TEMP 2008-07-16 16:33 --------- d-----w F:\Documents and Settings\Mom\Application Data\Skype 2008-07-16 16:03 119,808 ----a-w F:\WINDOWS\Internet Logs\xDB1.tmp 2008-07-16 09:16 --------- d-----w F:\Documents and Settings\All Users\Application Data\Grisoft 2008-07-15 14:21 --------- d-----w F:\Documents and Settings\Mom\Application Data\AVG7 2008-07-14 15:56 --------- d-----w F:\Program Files\Fichiers communs\Wise Installation Wizard 2008-07-13 12:35 --------- d-----w F:\Documents and Settings\Invité\Application Data\AVG7 2008-07-11 17:06 --------- d-----w F:\Program Files\VstPlugins 2008-07-11 13:27 --------- d-----w F:\Program Files\Cheat Engine 2008-07-09 09:20 --------- d-----w F:\Program Files\ATI Technologies 2008-07-09 07:05 1,086,952 ----a-w F:\WINDOWS\system32\zpeng24.dll 2008-07-08 19:57 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-06-30 15:59 --------- d-----w F:\Program Files\Java 2008-06-22 19:58 --------- d-----w F:\Program Files\Auto-école 3D 2008-06-20 17:47 247,808 ----a-w F:\WINDOWS\system32\mswsock.dll 2008-06-20 11:51 361,600 ----a-w F:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 11:40 138,496 ----a-w F:\WINDOWS\system32\drivers\afd.sys 2008-06-20 11:08 225,856 ----a-w F:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-15 15:43 --------- d-----w F:\Program Files\Cinema Business 2008-06-15 15:26 --------- d-----w F:\Program Files\BoontyGames 2008-06-15 15:26 --------- d-----w F:\Program Files\Boonty 2008-06-15 15:14 --------- d-----w F:\Program Files\CCleaner 2008-06-14 17:33 272,768 ------w F:\WINDOWS\system32\drivers\bthport.sys 2008-06-14 13:34 --------- d-----w F:\Program Files\Elektrogames 2008-06-14 12:39 --------- d-----w F:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-06-14 06:46 --------- d-----w F:\Program Files\Ray Adams 2008-06-13 18:45 --------- d-----w F:\Program Files\Fichiers communs\Symantec Shared 2008-06-13 17:02 --------- d-----w F:\Program Files\BitTorrent 2008-06-13 16:58 --------- d-----w F:\Program Files\DNA 2008-06-11 08:58 --------- d-----w F:\Documents and Settings\Knightmare\Application Data\AVG7 2008-06-03 06:20 3,100,160 ----a-w F:\WINDOWS\system32\drivers\ati2mtag.sys 2008-06-03 03:46 10,276,864 ----a-w F:\WINDOWS\system32\atioglx2.dll 2008-06-03 03:22 413,696 ----a-w F:\WINDOWS\system32\ATIDEMGX.dll 2008-06-03 03:21 306,688 ----a-w F:\WINDOWS\system32\ati2dvag.dll 2008-06-03 03:11 43,520 ----a-w F:\WINDOWS\system32\ati2edxx.dll 2008-06-03 03:11 26,112 ----a-w F:\WINDOWS\system32\Ati2mdxx.exe 2008-06-03 03:11 180,224 ----a-w F:\WINDOWS\system32\atipdlxx.dll 2008-06-03 03:11 139,264 ----a-w F:\WINDOWS\system32\Oemdspif.dll 2008-06-03 03:11 139,264 ----a-w F:\WINDOWS\system32\ati2evxx.dll 2008-06-03 03:09 552,960 ----a-w F:\WINDOWS\system32\ati2evxx.exe 2008-06-03 03:08 53,248 ----a-w F:\WINDOWS\system32\ATIDDC.DLL 2008-06-03 03:04 245,760 ----a-w F:\WINDOWS\system32\atiok3x2.dll 2008-06-03 03:02 307,200 ----a-w F:\WINDOWS\system32\atiiiexx.dll 2008-06-03 02:59 3,500,352 ----a-w F:\WINDOWS\system32\ati3duag.dll 2008-06-03 02:48 2,120,832 ----a-w F:\WINDOWS\system32\ativvaxx.dll 2008-06-03 02:33 48,128 ----a-w F:\WINDOWS\system32\amdpcom32.dll 2008-06-03 02:29 348,160 ----a-w F:\WINDOWS\system32\atikvmag.dll 2008-06-03 02:28 23,040 ----a-w F:\WINDOWS\system32\atiadlxx.dll 2008-06-03 02:28 17,408 ----a-w F:\WINDOWS\system32\atitvo32.dll 2008-06-03 02:27 49,152 ----a-w F:\WINDOWS\system32\drivers\ati2erec.dll 2008-06-03 02:22 5,439,488 ----a-w F:\WINDOWS\system32\atioglxx.dll 2008-06-03 02:21 557,056 ----a-w F:\WINDOWS\system32\ati2cqag.dll 2008-06-02 19:05 593,920 ------w F:\WINDOWS\system32\ati2sgag.exe 2008-06-01 10:10 --------- d-----w F:\Program Files\Monte Cristo 2008-05-26 14:14 --------- d-----w F:\Documents and Settings\Mom\Application Data\AdobeUM 2008-05-25 11:40 --------- d-----w F:\Program Files\AGEIA Technologies 2008-05-25 11:29 --------- d-----w F:\Program Files\Cube 2008-05-23 20:55 --------- d-----w F:\Documents and Settings\All Users\Application Data\Skyline 2008-05-23 06:49 --------- d-----w F:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic 2008-05-22 18:46 --------- d-----w F:\Program Files\Notepad++ 2008-05-22 16:54 --------- d-----w F:\Program Files\Eurobarre 2008-05-22 16:54 --------- d-----w F:\Program Files\BMW M3 Challenge 2008-05-19 11:06 --------- d-----w F:\Documents and Settings\Mom\Application Data\LimeWire 2008-05-15 09:30 208,896 ----a-w F:\WINDOWS\system32\TubeFinder.exe 2008-05-11 15:25 121,272 ----a-w F:\Documents and Settings\Mom\Application Data\GDIPFONTCACHEV1.DAT 2008-05-09 22:09 2,560 ----a-w F:\WINDOWS\_MSRSTRT.EXE 2008-05-09 10:55 90,112 ----a-w F:\WINDOWS\system32\wshext.dll 2008-05-09 10:55 430,080 ----a-w F:\WINDOWS\system32\vbscript.dll 2008-05-09 10:55 180,224 ----a-w F:\WINDOWS\system32\scrobj.dll 2008-05-09 10:55 172,032 ----a-w F:\WINDOWS\system32\scrrun.dll 2008-05-08 11:24 155,648 ----a-w F:\WINDOWS\system32\wscript.exe 2008-05-07 09:07 135,168 ----a-w F:\WINDOWS\system32\cscript.exe 2008-05-07 05:11 1,294,336 ----a-w F:\WINDOWS\system32\quartz.dll 2008-04-23 04:16 826,368 ----a-w F:\WINDOWS\system32\wininet.dll 2007-12-25 09:45 1 ----a-w F:\Documents and Settings\Ibixis Studios™\SI.bin 2007-12-25 09:45 1 ----a-w F:\Documents and Settings\Ibixis Studios™\SI.bin 2007-11-05 20:40 7,073 ----a-w F:\Program Files\DeIsL1.isu 2007-11-05 20:40 147 ----a-w F:\Program Files\_DEISREG.ISR 2006-08-03 13:34 323 ----a-w F:\Program Files\INSTALL.LOG 2004-12-01 16:34 716 ---ha-w F:\Documents and Settings\All Users\Application Data\pb7msys.dat 2004-02-26 14:27 73,728 ----a-w F:\Documents and Settings\Ibixis Studios™\SrchPlug.dll 2004-02-26 14:27 73,728 ----a-w F:\Documents and Settings\Ibixis Studios™\SrchPlug.dll 2003-06-05 22:40 24,576 ----a-w F:\Documents and Settings\Ibixis Studios™\SearchPluginInstaller.exe 2003-06-05 22:40 24,576 ----a-w F:\Documents and Settings\Ibixis Studios™\SearchPluginInstaller.exe 1997-04-23 01:16 40,960 ----a-w F:\Program Files\_ISREG32.DLL 1996-07-29 11:11 733,296 ----a-w F:\Documents and Settings\Ibixis Studios™\OPENGL32.DLL 1996-07-29 11:11 733,296 ----a-w F:\Documents and Settings\Ibixis Studios™\OPENGL32.DLL 1996-07-29 11:09 139,712 ----a-w F:\Documents and Settings\Ibixis Studios™\GLU32.DLL 1996-07-29 11:09 139,712 ----a-w F:\Documents and Settings\Ibixis Studios™\GLU32.DLL . ------- Sigcheck ------- 2005-03-02 20:20 578048 c34920eb988ce98910bd6b0417f334eb F:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll 2007-03-08 17:50 579072 4d88aaf39adabfe45958ea1384e2c4ff F:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll 2007-03-08 17:37 578560 ce81abaa6581bd3cfe3f85cad3b08a38 F:\WINDOWS\$NtServicePackUninstall$\user32.dll 2005-03-02 20:10 578048 0df75fb73f705b011630159a43d7c354 F:\WINDOWS\ServicePackFiles\i386\user32.dll 2005-03-02 20:10 578048 0df75fb73f705b011630159a43d7c354 F:\WINDOWS\system32\user32.dll . ((((((((((((((((((((((((((((( snapshot@2008-07-16_18.13.54.75 ))))))))))))))))))))))))))))))))))))))))) . - 2008-07-16 16:05:04 36,068 ----a-w F:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat + 2008-07-16 16:48:56 36,068 ----a-w F:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CursorXP"="c:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 17:34 128000] "googletalk"="F:\Program Files\Google\Google Talk\googletalk.exe" [2007-04-19 07:39 3297280] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:34 15360] "updateMgr"="F:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PHIME2002ASync"="F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 14:00 455168] "PHIME2002A"="F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 14:00 455168] "BDMCon"="c:\PROGRA~1\softwin\BITDEF~2\bdmcon.exe" [2006-06-25 13:16 372736] "BDOESRV"="C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" [2005-03-11 17:53 90112] "BDNewsAgent"="C:\PROGRA~1\softwin\BITDEF~2\bdnagent.exe" [2005-06-09 10:28 9728] "BDSwitchAgent"="C:\PROGRA~1\softwin\BITDEF~2\bdswitch.exe" [2005-04-06 13:09 33280] "ATIPTA"="F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-11 22:10 344064] "NeroFilterCheck"="F:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "LWBMOUSE"="F:\Program Files\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe" [2001-04-20 13:42 429568] "OFFICEKB"="F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Keyboard\kbdap32a.EXE" [2007-04-13 18:35 396288] "FLMOFFICE4DMOUSE"="F:\Program Files\Trust\3011A WIRELESS OPTICAL DESKSET\Mouse\mouse32a.exe" [2007-04-13 18:35 370176] "Motive SmartBridge"="F:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe" [2006-04-21 15:41 438359] "SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "QuickTime Task"="F:\Program Files\QuickTime\QTTask.exe" [2008-01-10 16:27 385024] "iTunesHelper"="F:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 04:22 267048] "PCSuiteTrayApplication"="F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360] "LogitechQuickCamRibbon"="F:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 17:37 2178832] "LogitechCommunicationsManager"="F:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984] "TkBellExe"="F:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-03-01 20:13 185896] "StartCCC"="F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440] "ZoneAlarm Client"="F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05 919016] "SoundMan"="SOUNDMAN.EXE" [2004-07-01 12:23 67584 F:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 19:34 15360] "Nokia.PCSync"="F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088] F:\Documents and Settings\Mom\Menu D‚marrer\Programmes\D‚marrage\ Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2006-05-28 17:31:16 2746104] F:\Documents and Settings\Invit‚\Menu D‚marrer\Programmes\D‚marrage\ Club Internet.lnk - F:\Program Files\Club-Internet\Lanceur\lanceur.exe [2007-01-30 11:06:18 5484544] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"= 1 (0x1) "AllowUnhashedWebView"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\[u]0[/u]] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Mog.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Stiltzkin.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\10] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Marcus.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\11] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Blank.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\12] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Ruby.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\13] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Vivi.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\14] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Eiko.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\15] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Rusty.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\16] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Beatrix.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\17] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Garnet.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\18] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Quina.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\19] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Amarant.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Baku.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\20] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Kuja.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\21] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Ozma.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\3] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Lani.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\4] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Freya.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\5] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Fratley.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\6] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Pampa.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\7] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Tomberry.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\8] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Cinna.gif FriendlyName= [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\9] Source= F:\Documents and Settings\Knightmare\Mes documents\Mes images\Artworks\Gifs\Ji-Dan.gif FriendlyName= [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=sockspy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.enc"= ITIG726.acm "vidc.mjpg"= pvmjpg30.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-01-15 04:22 267048 F:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-06-18 15:10 271360 F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Boonty Games"=3 (0x3) "Bonjour Service"=2 (0x2) "MSSQLSERVER"=2 (0x2) "MSSQL$SQLEXPRESS"=2 (0x2) "iPod Service"=3 (0x3) "clr_optimization_v2.0.50727_32"=3 (0x3) "aspnet_state"=3 (0x3) "Apple Mobile Device"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "F:\Program Files\DNA\btdna.exe"= "F:\Program Files\Messenger\Msmsgs.exe"= "F:\Program Files\iTunes\iTunes.exe"= "F:\Program Files\Skype\Phone\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6346:TCP"= 6346:TCP:6346 R0 viasraid;viasraid;F:\WINDOWS\system32\drivers\viasraid.sys [2003-10-31 13:22] R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;F:\WINDOWS\system32\DRIVERS\getnd5b.sys [2004-01-29 08:32] S2 DbgMsg;Debug Message;F:\WINDOWS\System32\Drivers\DbgMsg.sys [2004-07-21 10:38] S2 FILESpy;FILESpy;C:\Program Files\Softwin\BitDefender9\filespy.sys [] S2 JavaQuickStarterService;Java Quick Starter;F:\Program Files\Java\jre6\bin\jqs.exe [2007-10-20 14:48] S2 UxTuneUp;TuneUp Extension de thème;F:\WINDOWS\System32\svchost.exe [2008-04-13 19:34] S3 AFW;AFW;F:\DOCUME~1\IBIXIS~3\LOCALS~1\Temp\[u]0[/u]02fbe98.sys [] S3 fbxusb;FreeBox USB Network Adapter;F:\WINDOWS\system32\DRIVERS\fbxusb.sys [2003-12-31 11:35] S3 TuneUp.Defrag;TuneUp Drive Defrag Service;F:\WINDOWS\System32\TuneUpDefragService.exe [2008-07-15 13:12] S3 uir1100a;UIR1100A;F:\WINDOWS\system32\DRIVERS\uir1100a.sys [2004-12-01 09:43] S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;F:\WINDOWS\system32\DRIVERS\usb8023.sys [2008-04-13 11:56] S4 Boonty Games;Boonty Games;F:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2007-06-10 19:43] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp *Newly Created Service* - CATCHME *Newly Created Service* - TSP . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-07-08 07:43:01 F:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - F:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-03-28 18:32:03 F:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1167159061.job" - F:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe "2008-07-16 16:42:57 F:\WINDOWS\Tasks\Maintenance en 1 clic.job" - F:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-16 18:56:59 Windows 5.1.2600 Service Pack 3 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . --------------------- DLLs a chargé sous des processus courants --------------------- PROCESS: F:\WINDOWS\system32\winlogon.exe -> F:\WINDOWS\system32\sockspy.dll PROCESS: F:\WINDOWS\system32\lsass.exe -> F:\WINDOWS\system32\sockspy.dll . Temps d'accomplissement: 2008-07-16 18:59:10 ComboFix-quarantined-files.txt 2008-07-16 16:59:02 ComboFix2.txt 2008-07-16 16:15:51 Pre-Run: 7,835,013,120 octets libres Post-Run: 7,814,553,600 octets libres 382 --- E O F --- 2008-07-10 06:23:08

Utilisateur anonyme · Answer

réouvre hijackthis
fais scan only
coche ces lignes :

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) 

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') 


O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing) 
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe (file missing) 


O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/s­wflash.cab 


tu les coches et tu clic sur fix checked 


ensuite désinstal java car pas a jours et telecharge et instal cette version :

https://www.java.com/fr/download/manual.jsp


ensuite si c est la version gratuite désinstal adobe reader acrobat car pas a jours et telecharge et instal cette version :

https://get2.adobe.com/reader/otherversions/


ensuite tu as Ccleaner donc passe le passe aussi avg 

ensuite 

* pour supprimer les outils/fix utilisés : 

Télécharge ToolsCleaner sur ton bureau. 
--> 
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 


sous une sesion admin va dans panneau de configuration et supprime la session GUEST 

ensuite 


Clic sur "démarrer", cliques droit sur "poste de travail", "propriétés", onglet "restauration du système" 

¤ coche la case "désactiver la Restauration du systéme sur tous les lecteurs", puis clic sur "appliquer" 
¤ décoche la case et clic sur "appliquer" puis "ok". 

Maintenant, que l'ont à effacés les point infectés, nous allons créer un point propre: 

Clic sur "démarrer", "tous les programmes", "accessoires", "outils système", "restauration du système", choisis "créer un point de restauration" nommes le " ccm" par exemple, cliques sur "créer" puis "ok". 
Voilà, maintenant le point de restauration est créé. Si un jour tu décides tu pourras revenir en arrière à la date créée. 


Tuto : http://www.libellules.ch/desactiver_restauration.php

Utilisateur anonyme · Answer

donc avant le post 44 

supprime "retire" 

 télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. 
double-clique sur OTMoveIt.exe pour le lancer. 
Assure toi que la case Unregister Dll's and Ocx's soit bien cochée 
copie la liste qui se trouve en gras ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

F:\Documents and Settings\Ibixis Studios™\Mes documents\Brutus\
F:\Documents and Settings\Ibixis Studios™\Mes documents\Brutus Hacker\
F:\Documents and Settings\Ibixis Studios™\Mes documents\Craagle\
F:\Documents and Settings\Ibixis Studios™\Mes documents\Internet Download Manager\
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\180785.exe 
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\brutus-aet2.zip/
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\brutus.zip 
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\craagle.rar 
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\craagle.zip/
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\craagle.zip
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\Craggle_.rar/
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\EZTMusicManager_WebHancer.exe/data0018/data.rar/
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\limewire_download_booster_free.exe/ 
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\limewire_download_booster_free.exe  
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\mount_and_blade_751.exe/
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\mount_and_blade_751.exe/
F:\Documents and Settings\Ibixis Studios™\Mes documents\Mes téléchargements\Sony_Vegas_7.0b_Build_151.zip/


clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

Fyerrblad · Answer

TCleaner :

-->- Recherche: 

F:\Qoobox: trouvé !
F:\_OtMoveIt: trouvé !
F:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
F:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
F:\Documents and Settings\Ibixis Studios™\Bureau\HijackThis.lnk: trouvé !
F:\Documents and Settings\Ibixis Studios™\Bureau\Opération A\DiagHelp.zip: trouvé !
F:\Documents and Settings\Ibixis Studios™\Bureau\Opération A\HJTInstall.exe: trouvé !
F:\Documents and Settings\Ibixis Studios™\Bureau\Opération A\DiagHelp: trouvé !
F:\Documents and Settings\Ibixis Studios™\Bureau\Opération A\DiagHelp\DiagHelp: trouvé !
F:\Documents and Settings\Invité\Recent\HijackThis.lnk: trouvé !
F:\Documents and Settings\Knightmare\Mes documents\Other\icons\Microsoft Office icon pack\ICO\Clean: trouvé !
F:\Documents and Settings\Knightmare\Mes documents\Other\icons\Microsoft Office icon pack\PNG\Clean: trouvé !
F:\Program Files\Trend Micro\HijackThis: trouvé !
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

---------------------------------
-->- Suppression: 

F:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
F:\Documents and Settings\Ibixis Studios™\Bureau\HijackThis.lnk: supprimé !
F:\Documents and Settings\Ibixis Studios™\Bureau\Opération A\DiagHelp.zip: supprimé !
F:\Documents and Settings\Ibixis Studios™\Bureau\Opération A\HJTInstall.exe: supprimé !
F:\Documents and Settings\Invité\Recent\HijackThis.lnk: supprimé !
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
F:\Qoobox: supprimé !
F:\_OtMoveIt: supprimé !
F:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
F:\Documents and Settings\Ibixis Studios™\Bureau\Opération A\DiagHelp: supprimé !
F:\Documents and Settings\Knightmare\Mes documents\Other\icons\Microsoft Office icon pack\ICO\Clean: supprimé !
F:\Documents and Settings\Knightmare\Mes documents\Other\icons\Microsoft Office icon pack\PNG\Clean: supprimé !
F:\Program Files\Trend Micro\HijackThis: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !
Sauvegarde du registre crée!

Ordinateur infecté par un virus

46 réponses

Discussions similaires