Virus Srosa.Sys Bagle Gen Win 32
Fermé
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
-
18 août 2008 à 10:53
sKe69 - 22 août 2008 à 21:39
sKe69 - 22 août 2008 à 21:39
A voir également:
- Virus Srosa.Sys Bagle Gen Win 32
- 32 bits - Guide
- Poweriso 32 bit - Télécharger - Gravure
- Win setup from usb - Télécharger - Utilitaires
- Telecharger win rar - Télécharger - Compression & Décompression
- Télécharger windows 7 32 bits usb - Télécharger - Systèmes d'exploitation
247 réponses
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
20 août 2008 à 18:50
20 août 2008 à 18:50
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:50, on 2008-08-20
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Safe mode with network support
Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "c:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [V0230Mon.exe] C:\Windows\V0230Mon.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [ReEXEc] C:\Users\Max\Downloads\ELIBAGLA.%D8A%D8IB%D8%D8H.EXE
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: IntelDHSvcConf - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
Scan saved at 18:50, on 2008-08-20
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Safe mode with network support
Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "c:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [V0230Mon.exe] C:\Windows\V0230Mon.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [ReEXEc] C:\Users\Max\Downloads\ELIBAGLA.%D8A%D8IB%D8%D8H.EXE
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: IntelDHSvcConf - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
20 août 2008 à 18:52
20 août 2008 à 18:52
SA MARCHEEEEE =DDD
Grand début.
Merci
Grand début.
Merci
Utilisateur anonyme
20 août 2008 à 18:56
20 août 2008 à 18:56
ok
tu vas pouvoir aller en mode normal
supprime FindB et findyKill
norton logiquement est "n est pas une ... win32 valide si c est le cas désinstal le et réinstal le
pour désinstaller norton telcharge cet outil
http://service1.symantec.com/support/inter/tsgeninfointl.nsf/fr_docid/20050414110429924?OpenDocument&seg=hm&lg=fr&ct=fr
windows defender est HS , si c est le cas fais ceci :
Démarrer >accesoire puis executer > tape : services.msc
- double Clic sur le service cité - windows defender
type de démarrge le mettre en automatique
clic sur appliquer
en haut a gauche clic sur demarrer le service
idem pour parefeu windows
ensuite reviens sur le forum avec un rapport hijackthis effectué en mode normal
tu vas pouvoir aller en mode normal
supprime FindB et findyKill
norton logiquement est "n est pas une ... win32 valide si c est le cas désinstal le et réinstal le
pour désinstaller norton telcharge cet outil
http://service1.symantec.com/support/inter/tsgeninfointl.nsf/fr_docid/20050414110429924?OpenDocument&seg=hm&lg=fr&ct=fr
windows defender est HS , si c est le cas fais ceci :
Démarrer >accesoire puis executer > tape : services.msc
- double Clic sur le service cité - windows defender
type de démarrge le mettre en automatique
clic sur appliquer
en haut a gauche clic sur demarrer le service
idem pour parefeu windows
ensuite reviens sur le forum avec un rapport hijackthis effectué en mode normal
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
20 août 2008 à 19:22
20 août 2008 à 19:22
Super, Win32 non valide.... Mais pas de "select file to crack",
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Utilisateur anonyme
20 août 2008 à 19:25
20 août 2008 à 19:25
OK
telecharge ce fichier :
http://perso.orange.fr/-Gof/DL/VaccinUSB.exe
il faut l executer et cliquer sur fix
post le rapport VaccinUSB.txt dans la prochaine réponse stp
ensuite redémarre et test pour win32 non valide
telecharge ce fichier :
http://perso.orange.fr/-Gof/DL/VaccinUSB.exe
il faut l executer et cliquer sur fix
post le rapport VaccinUSB.txt dans la prochaine réponse stp
ensuite redémarre et test pour win32 non valide
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
20 août 2008 à 19:37
20 août 2008 à 19:37
Sa fait toujours Win 32 non valide, mais il est ou ce rapport ?
Utilisateur anonyme
20 août 2008 à 19:39
20 août 2008 à 19:39
Sa fait toujours Win 32 non valide
laisse le rapport
windows defender ok ?
norton ok ?
parefeu ok ?
fais le point stp
laisse le rapport
windows defender ok ?
norton ok ?
parefeu ok ?
fais le point stp
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
20 août 2008 à 19:43
20 août 2008 à 19:43
Je me suis trompé dans son utilisation, tiens :
-------------------------------------------------------
- Operation: 1 Supprimer fichier
%CURRENT_DIRECTORY%\adober.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 2 Supprimer fichier
%CURRENT_DIRECTORY%\autorun.inf
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 3 Supprimer fichier
%CURRENT_DIRECTORY%\comment.htt
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 4 Supprimer fichier
%CURRENT_DIRECTORY%\copy.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 5 Supprimer fichier
%CURRENT_DIRECTORY%\host.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 6 Supprimer fichier
%CURRENT_DIRECTORY%\msvcr71.dll
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 7 Supprimer fichier
%CURRENT_DIRECTORY%\ravmon.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 8 Supprimer fichier
%CURRENT_DIRECTORY%\ravmon.log
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 9 Supprimer fichier
%CURRENT_DIRECTORY%\temp.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 10 Supprimer fichier
%CURRENT_DIRECTORY%\temp1.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 11 Supprimer fichier
%CURRENT_DIRECTORY%\temp2.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 12 Supprimer fichier
%CURRENT_DIRECTORY%\winfile.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 13 Créer dossier
%CURRENT_DIRECTORY%\adober.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 14 Créer dossier
%CURRENT_DIRECTORY%\comment.htt
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 15 Créer dossier
%CURRENT_DIRECTORY%\copy.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 16 Créer dossier
%CURRENT_DIRECTORY%\host.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 17 Créer dossier
%CURRENT_DIRECTORY%\ravmon.exe
Result: Error! Opération réussie.
-------------------------------------------------------
-------------------------------------------------------
- Operation: 18 Créer dossier
%CURRENT_DIRECTORY%\msvcr71.dll
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 19 Créer dossier
%CURRENT_DIRECTORY%\ravmon.log
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 20 Créer dossier
%CURRENT_DIRECTORY%\temp.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 21 Créer dossier
%CURRENT_DIRECTORY%\temp1.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 22 Créer dossier
%CURRENT_DIRECTORY%\temp2.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 23 Créer dossier
%CURRENT_DIRECTORY%\winfile.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 24 Créer dossier
%CURRENT_DIRECTORY%\autorun.inf
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 25 Executer
C:\Users\Max\AppData\Local\Microsoft\Windows\Temporary Internet Files\Vaccin_USB-Lisez_moi.html
Result: Success
-------------------------------------------------------
Je redémarre.
-------------------------------------------------------
- Operation: 1 Supprimer fichier
%CURRENT_DIRECTORY%\adober.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 2 Supprimer fichier
%CURRENT_DIRECTORY%\autorun.inf
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 3 Supprimer fichier
%CURRENT_DIRECTORY%\comment.htt
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 4 Supprimer fichier
%CURRENT_DIRECTORY%\copy.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 5 Supprimer fichier
%CURRENT_DIRECTORY%\host.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 6 Supprimer fichier
%CURRENT_DIRECTORY%\msvcr71.dll
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 7 Supprimer fichier
%CURRENT_DIRECTORY%\ravmon.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 8 Supprimer fichier
%CURRENT_DIRECTORY%\ravmon.log
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 9 Supprimer fichier
%CURRENT_DIRECTORY%\temp.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 10 Supprimer fichier
%CURRENT_DIRECTORY%\temp1.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 11 Supprimer fichier
%CURRENT_DIRECTORY%\temp2.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 12 Supprimer fichier
%CURRENT_DIRECTORY%\winfile.exe
Result: Error! Fichier introuvable
-------------------------------------------------------
-------------------------------------------------------
- Operation: 13 Créer dossier
%CURRENT_DIRECTORY%\adober.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 14 Créer dossier
%CURRENT_DIRECTORY%\comment.htt
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 15 Créer dossier
%CURRENT_DIRECTORY%\copy.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 16 Créer dossier
%CURRENT_DIRECTORY%\host.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 17 Créer dossier
%CURRENT_DIRECTORY%\ravmon.exe
Result: Error! Opération réussie.
-------------------------------------------------------
-------------------------------------------------------
- Operation: 18 Créer dossier
%CURRENT_DIRECTORY%\msvcr71.dll
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 19 Créer dossier
%CURRENT_DIRECTORY%\ravmon.log
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 20 Créer dossier
%CURRENT_DIRECTORY%\temp.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 21 Créer dossier
%CURRENT_DIRECTORY%\temp1.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 22 Créer dossier
%CURRENT_DIRECTORY%\temp2.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 23 Créer dossier
%CURRENT_DIRECTORY%\winfile.exe
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 24 Créer dossier
%CURRENT_DIRECTORY%\autorun.inf
Result: Success
-------------------------------------------------------
-------------------------------------------------------
- Operation: 25 Executer
C:\Users\Max\AppData\Local\Microsoft\Windows\Temporary Internet Files\Vaccin_USB-Lisez_moi.html
Result: Success
-------------------------------------------------------
Je redémarre.
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
20 août 2008 à 20:21
20 août 2008 à 20:21
Norton: ciao ^^
Pare feu : OK https://www.casimages.com/i/080820082716109440.jpg.html
Windows Defender: "windows defender est désactivé" https://www.casimages.com/i/080820082917476135.jpg.html
https://www.casimages.com/i/080820082553232498.jpg.html
J'ai alors installé Avast "Application win32 non valide"
Hijackthis : "Application win32 non valide"
Pare feu : OK https://www.casimages.com/i/080820082716109440.jpg.html
Windows Defender: "windows defender est désactivé" https://www.casimages.com/i/080820082917476135.jpg.html
https://www.casimages.com/i/080820082553232498.jpg.html
J'ai alors installé Avast "Application win32 non valide"
Hijackthis : "Application win32 non valide"
Utilisateur anonyme
20 août 2008 à 20:28
20 août 2008 à 20:28
si tu fais cette manip :
windows defender est HS , si c est le cas fais ceci :
Démarrer >accesoire puis executer > tape : services.msc
- double Clic sur le service cité - windows defender
type de démarrge le mettre en automatique
clic sur appliquer
en haut a gauche clic sur demarrer le service
il t es impossible de demarrer le services ?
télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
Assure toi que la case Unregister Dll's and Ocx's soit bien cochée
copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
C:\Users\Max\AppData\Roaming\PnkBstrK.sys
C:\Users\Max\Oblivion.exe
C:\Users\Max\Oblivion_All_Languages_NoDVD.exe
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
windows defender est HS , si c est le cas fais ceci :
Démarrer >accesoire puis executer > tape : services.msc
- double Clic sur le service cité - windows defender
type de démarrge le mettre en automatique
clic sur appliquer
en haut a gauche clic sur demarrer le service
il t es impossible de demarrer le services ?
télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
Assure toi que la case Unregister Dll's and Ocx's soit bien cochée
copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
C:\Users\Max\AppData\Roaming\PnkBstrK.sys
C:\Users\Max\Oblivion.exe
C:\Users\Max\Oblivion_All_Languages_NoDVD.exe
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
20 août 2008 à 20:34
20 août 2008 à 20:34
C:\Users\Max\AppData\Roaming\PnkBstrK.sys moved successfully.
C:\Users\Max\Oblivion.exe moved successfully.
C:\Users\Max\Oblivion_All_Languages_NoDVD.exe moved successfully.
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08202008_203257
Non, on peut pas redémmarer le service, punaise , en plus j'ai le CD de oblivion, jespere que c'est pas sa =S
https://www.casimages.com/i/080820083825504904.jpg.html Pour t'éclairer
C:\Users\Max\Oblivion.exe moved successfully.
C:\Users\Max\Oblivion_All_Languages_NoDVD.exe moved successfully.
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08202008_203257
Non, on peut pas redémmarer le service, punaise , en plus j'ai le CD de oblivion, jespere que c'est pas sa =S
https://www.casimages.com/i/080820083825504904.jpg.html Pour t'éclairer
Utilisateur anonyme
20 août 2008 à 20:37
20 août 2008 à 20:37
on va repasser combofix
supprime tralala.exe et le dossier combofix dans programmes
repasse combofix sans le renomer
Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir avant de lancer ce FIX
-> Double clique sur combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
supprime tralala.exe et le dossier combofix dans programmes
repasse combofix sans le renomer
Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir avant de lancer ce FIX
-> Double clique sur combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
20 août 2008 à 20:42
20 août 2008 à 20:42
"lancer ce FIX " quel fix ? et pourquoi mettre une clé usb ?
Utilisateur anonyme
20 août 2008 à 20:43
20 août 2008 à 20:43
FIX = combofix les clé usb branches les ainsi je verrai si elles sont infectées ou pas sur le rapport
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
20 août 2008 à 20:58
20 août 2008 à 20:58
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
20 août 2008 à 21:09
20 août 2008 à 21:09
Log Combo fix :
ComboFix 08-08-19.03 - Max 2008-08-20 21:01:05.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1137 [GMT 2:00]
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\InfoSat.txt
C:\Users\Max\AppData\Local\Microsoft\Windows\Temporary Internet Files\Vaccin_USB-Lisez_moi.html
C:\Users\Max\AppData\Roaming\m
C:\Users\Max\AppData\Roaming\m\data.oct
C:\Users\Max\AppData\Roaming\m\flec006.exe
C:\Users\Max\AppData\Roaming\m\list.oct
C:\Users\Max\AppData\Roaming\m\shared
C:\Users\Max\AppData\Roaming\m\shared\LOWA Typing Warmups 1.2.zip
C:\Users\Max\AppData\Roaming\m\shared\Lowcarb 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\lowdisk32 1.0.0.12.zip
C:\Users\Max\AppData\Roaming\m\shared\LOWER 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lower Blood Pressure 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lower Case Switcher 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lower Cholesterol 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lowney Math Flash 2.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lowry Park Zoo Screensaver 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LowToSleep 1.6.zip
C:\Users\Max\AppData\Roaming\m\shared\Loyalty Tracking System 1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lozdodge 1.09.zip
C:\Users\Max\AppData\Roaming\m\shared\LP-Calc 1.01.zip
C:\Users\Max\AppData\Roaming\m\shared\LP-Text 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LP Recorder 8.8.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LP Ripper 9.0.2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LPDForm 1.31B.zip
C:\Users\Max\AppData\Roaming\m\shared\lphant 3.50.zip
C:\Users\Max\AppData\Roaming\m\shared\LPI 117-102 Practice Test Exam Questions.zip
C:\Users\Max\AppData\Roaming\m\shared\LPS - Live Playlist Signature (Winamp Plugin) 0.11.zip
C:\Users\Max\AppData\Roaming\m\shared\LQ RichTextBox 1.8.0.7.zip
C:\Users\Max\AppData\Roaming\m\shared\LS-CRM 1.53.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Addressbook 1.0.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Archiver 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Cleanup 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Countdown Timer 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Image Converter 2.67.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Jukebox.zip
C:\Users\Max\AppData\Roaming\m\shared\LS MP3 Encoder 0.2.12 beta.zip
C:\Users\Max\AppData\Roaming\m\shared\LS MyLib 0.92 RC.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Photo Album 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Screen Capture 1.0.2193.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Speller 3.0.5.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Stock Ticker 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LS_CDRun 1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\LSASecretsDump 1.00.zip
C:\Users\Max\AppData\Roaming\m\shared\LSASecretsView 1.12.zip
C:\Users\Max\AppData\Roaming\m\shared\LSDTech BP 1.02.zip
C:\Users\Max\AppData\Roaming\m\shared\LSDTech PrivateDisk 1.30.zip
C:\Users\Max\AppData\Roaming\m\shared\LSExecuter 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LSFindReplaceDialogW 1.0.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LSL Plus 0.2.0 Alpha.zip
C:\Users\Max\AppData\Roaming\m\shared\LSMC 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LSP-Fix 1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\LsT 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LSText 0.22.zip
C:\Users\Max\AppData\Roaming\m\shared\LSVG 0.0.1.31.zip
C:\Users\Max\AppData\Roaming\m\shared\LSZip 2.60.zip
C:\Users\Max\AppData\Roaming\m\shared\LT Calendar 1.2.1.zip
C:\Users\Max\AppData\Roaming\m\shared\LT Expander 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LTA Singapore Road Monitoring 2.15.zip
C:\Users\Max\AppData\Roaming\m\shared\LTC Password Generator 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LTC System Monitor 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LTF-Cimulator 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LTFCrypt 1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\LTMonitor 2.2.10.zip
C:\Users\Max\AppData\Roaming\m\shared\LTProf 1.4.8.zip
C:\Users\Max\AppData\Roaming\m\shared\Ltrack 5.9.8.zip
C:\Users\Max\AppData\Roaming\m\shared\Luach 1.1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Luay's Digital Image watermarking 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucane 0.7.5.zip
C:\Users\Max\AppData\Roaming\m\shared\LucasRipper 1.0 Beta 4.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucent Clock Screensaver 2.3.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucid Ocean screensaver 2.03.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucid Spec 1.1.0.23487.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucid v1.2.zip
C:\Users\Max\AppData\Roaming\m\shared\LucidLink Home Office Edition 2.2.zip
C:\Users\Max\AppData\Roaming\m\shared\LucidLink Wireless Client 2.2.zip
C:\Users\Max\AppData\Roaming\m\shared\LucidLink Wireless LAN Security 2.22.zip
C:\Users\Max\AppData\Roaming\m\shared\LucidLog.Net 1.0.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LucidScan ActiveX Component 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucifer Wordlist Filter 0.5.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucille 2.zip
C:\Users\Max\AppData\Roaming\m\shared\Luck and Fortune Smiley Collection 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Luck of the Draw 1.0.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucky Clovers Screensaver.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucky Downloads search 1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucky Google 1.5,1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucky Number 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucky Pattys Day Screensaver 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LUCKYme 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LuckyPhoto 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LuckyView 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LuckyZoom 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucy Liu 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LuggageNet 2.18.zip
C:\Users\Max\AppData\Roaming\m\shared\Lullaby Drop-In Administrator 1.10.zip
C:\Users\Max\AppData\Roaming\m\shared\Lullaby Management 6.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lulu 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lum 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Luma Clock Screensaver 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LumiCode Home Edition 2.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lumina 3D 0.3.4.zip
C:\Users\Max\AppData\Roaming\m\shared\LuminaXYs 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Luminescent Clock ScreenSaver 2.3.zip
C:\Users\Max\AppData\Roaming\m\shared\Luminous Cross 1.03.zip
C:\Users\Max\AppData\Roaming\m\shared\Lumisoft UI Controls 1.1.1384.0b.zip
C:\Users\Max\AppData\Roaming\m\shared\Lump Tool 1.0.7.zip
C:\Users\Max\AppData\Roaming\m\shared\LUNA Free 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Luna Royale 3.2.zip
C:\Users\Max\AppData\Roaming\m\shared\Luna Screensaver 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunabase 0.92 beta 4.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunar Calculator 2.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunar Calendar 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunar Calendars and Eclipse Finder 8.01.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunar Colongitude 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunar Date 1.4.3.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunar Picture of the Day 2.63.zip
C:\Users\Max\AppData\Roaming\m\shared\LunarCal 6.24.zip
C:\Users\Max\AppData\Roaming\m\shared\LunarCell 1.7.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LunarEclipse 1.2.7.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunarmark 0.6.0 Beta.zip
C:\Users\Max\AppData\Roaming\m\shared\LunarPhase 2.70.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunascape 4.1.3.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunch Picker 3.0.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lundlay Property Browser 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lung Mass Evaluation 1.zip
C:\Users\Max\AppData\Roaming\m\shared\luntbuild 1.1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lupa 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lupas Rename 5.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lupo PenSuite 6.53.zip
C:\Users\Max\AppData\Roaming\m\shared\LuraDocument Capture 5.1.07.23.zip
C:\Users\Max\AppData\Roaming\m\shared\LuraDocument PDF Compressor 4.2.02.15.zip
C:\Users\Max\AppData\Roaming\m\shared\LuraWave Smart Compress 2.1.05.03.zip
C:\Users\Max\AppData\Roaming\m\shared\Luscious Landscapes Screensaver 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lush.zip
C:\Users\Max\AppData\Roaming\m\shared\lust screensaver 01.zip
C:\Users\Max\AppData\Roaming\m\shared\Lutow 3.1.8.45.zip
C:\Users\Max\AppData\Roaming\m\shared\Lutz Roeder's .NET Reflector 5.0.25.0.zip
C:\Users\Max\AppData\Roaming\m\srvlist.oct
C:\Windows\system32\drivers\downld
C:\Windows\system32\drivers\downld\695951.exe
C:\Windows\system32\drivers\downld\719585.exe
C:\Windows\system32\drivers\downld\733189.exe
C:\Windows\system32\drivers\downld\739850.exe
C:\Windows\system32\drivers\downld\861281.exe
C:\Windows\system32\drivers\hldrrr.exe
C:\Windows\system32\drivers\mdelk.exe
C:\Windows\system32\drivers\srosa.sys
G:\AUTORUN.INF
L:\autorun.inf
.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-20 to 2008-08-20 ))))))))))))))))))))))))))))))))))))
.
Pas de nouveau fichier créé dans cet espace de temps
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-20 17:31 167,936 ----a-w C:\VaccinUSB.exe
2008-08-20 17:03 --------- d-----w C:\Program Files\Alwil Software
2008-08-20 16:50 --------- d-----w C:\Program Files\Trend Micro
2008-08-20 15:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-18 11:32 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-18 07:34 --------- d-----w C:\Program Files\Sophos
2008-08-18 01:08 --------- d-----w C:\Program Files\Windows Mail
2008-08-17 23:18 --------- d-----w C:\Program Files\Norton Internet Security
2008-08-17 23:18 --------- d-----w C:\Program Files\Microsoft Works
2008-08-17 23:18 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-17 13:02 --------- d-----w C:\Program Files\EsetOnlineScanner
2008-08-17 13:01 38,472 ----a-w C:\Windows\system32\drivers\mbamswissarmy.sys
2008-08-17 13:01 17,144 ----a-w C:\Windows\system32\drivers\mbam.sys
2008-08-16 23:58 --------- d-----w C:\Users\Sam\AppData\Roaming\Malwarebytes
2008-08-16 19:51 --------- d-----w C:\Users\Max\AppData\Roaming\Malwarebytes
2008-08-16 19:51 --------- d-----w C:\ProgramData\Malwarebytes
2008-08-16 19:36 --------- d-----w C:\Program Files\Panda Security
2008-08-16 17:11 --------- d-----w C:\ProgramData\Symantec
2008-08-16 16:45 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-06 11:27 --------- d-----w C:\Program Files\Common Files\Steam
2008-08-06 08:54 --------- d-----w C:\Program Files\Microsoft Money 2005
2008-08-04 16:22 --------- d-----w C:\Users\Max\AppData\Roaming\Real Desktop
2008-07-22 09:51 --------- d-----w C:\Users\Max\AppData\Roaming\GetRightToGo
2008-07-22 09:07 --------- d-----w C:\Users\Max\AppData\Roaming\Apple Computer
2008-07-22 09:06 --------- d-----w C:\ProgramData\Apple Computer
2008-07-22 09:06 --------- d-----w C:\Program Files\iTunes
2008-07-22 09:06 --------- d-----w C:\Program Files\iPod
2008-07-21 19:27 --------- d-----w C:\Program Files\QuickTime
2008-07-21 19:25 --------- d-----w C:\Program Files\Apple Software Update
2008-07-21 19:24 --------- d-----w C:\ProgramData\Apple
2008-07-21 19:24 --------- d-----w C:\Program Files\Common Files\Apple
2008-07-19 14:36 51,280 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-07-10 15:05 174 --sha-w C:\Program Files\desktop.ini
2008-07-03 11:33 413,696 ----a-w C:\Windows\System32\wrap_oal.dll
2008-07-03 11:33 110,592 ----a-w C:\Windows\System32\OpenAL32.dll
2008-07-03 11:33 --------- d-----w C:\Program Files\Trials 2 Second Edition
2008-07-03 11:33 --------- d-----w C:\Program Files\OpenAL
2008-06-28 17:28 --------- d-----w C:\Program Files\Picasa2
2008-06-28 17:28 --------- d-----w C:\Program Files\Google
2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-19 03:25 61,440 ----a-w C:\Windows\System32\winipsec.dll
2008-06-19 03:25 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
2008-06-19 03:25 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll
2008-06-19 03:25 272,896 ----a-w C:\Windows\System32\polstore.dll
2008-06-12 06:54 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-06-12 06:54 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-12 01:21 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 04:00 1232896]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-12-02 17:42 3739672]
"Steam"="c:\program files\valve\steam\steam.exe" [2008-04-01 17:17 1271032]
"Speech Recognition"="C:\Windows\Speech\Common\sapisvr.exe" [2006-11-02 11:45 49664]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCUTRAYICON"="FactoryMode" [X]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-08-20 19:43 107112]
"osCheck"="c:\Program Files\Norton Internet Security\osCheck.exe" [2008-08-20 19:43 22696]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 12:39 151552]
"Acer Empowering Technology Monitor"="C:\Acer\Empowering Technology\SysMonitor.exe" [2006-08-08 10:06 708616]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-08-08 10:06 708616]
"NMSSupport"="C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [2006-09-26 11:56 423424]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 22:48 57344]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]
"V0230Mon.exe"="C:\Windows\V0230Mon.exe" [2006-09-07 02:01 32768]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 11:22 517768]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 14:35 176128]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-08-20 19:03 78008]
"RtHDVCpl"="RtHDVCpl.exe" [2006-08-08 10:06 708616 C:\Windows\System32\RtHDVCpl.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-04-03 19:07:23 528384]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3006126301-1578542936-2715256611-1003]
"EnableNotificationsRef"=dword:00000004
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{722D1D9F-5885-4D78-9DA5-2079562B23C7}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{BE342372-9CEB-4827-80F2-75D04B42BCD6}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{E6316576-679F-4665-9D38-E34D3DFC70A6}"= C:\Program Files\Acer Zone\Acer Zone Main Page\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{34B087DC-CD9D-44C6-B626-3F79DC528461}"= C:\Program Files\Acer Zone\Acer Picture Slide DVD\Component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess
"{AE078BE2-6F15-4D46-9C88-57063ADCD039}"= C:\Program Files\Acer Zone\Acer Plug and Record\Component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess
"{A0645421-8520-4699-BD1C-254AAC4ACF0C}"= C:\Program Files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess
"{A267EABF-3BE8-45D5-97BE-20BDC6E94454}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{B65BD99F-0C27-4848-9D05-2EF76839A98F}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{63ED5734-C34C-4108-B30E-7A68A4E37CF7}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{5C9100D0-6E96-4D13-A069-91D6253E974F}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{1FEA4046-16A6-4104-BBA3-4A52AC6058CA}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{F21B0008-368B-464F-B72B-32C2ED450D31}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{72E5566D-93F1-447B-B55F-36D91E7CE801}"= TCP:Profile=Private|Profile=Public|9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{CBB98356-FEB1-4F1D-AD20-328376C01391}"= TCP:Profile=Private|Profile=Public|1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"{4EA560A4-A1AD-490E-B7DC-8A5CA26B32F3}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{13FCDB65-9605-496A-9376-EE958E7CE785}"= Disabled:UDP:C:\Users\Sophie\Desktop\incredimail_install.exe:IncrediMail Installer
"{06B24F33-CCFA-4591-8C2A-43D8780ED991}"= Disabled:TCP:C:\Users\Sophie\Desktop\incredimail_install.exe:IncrediMail Installer
"{3EAFD950-B855-4343-B5E6-D4EE1C5CFE80}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{0DAD94A7-6615-4A29-8E0E-5C5B489A60F8}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{0BA2B1EF-2E95-4136-9A26-66CCE3C4F8DD}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{9BD7D90E-C2C5-48D6-A0A6-B1D24AC6D299}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{C976A610-71D2-4138-9C3D-3D13A03BDDC8}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{ED7352BB-FCAF-42B9-A79B-37BBEF79A40C}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{23972178-9F29-4C36-9836-81AB27CB1B4A}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{69F65F90-AE40-409B-84D8-E82490A5C3CF}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{4B2B9988-801D-46A7-B7F7-2B5B772D2D33}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{9BC49054-781C-4BCD-B99E-2F39D931C498}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{C25FCB01-05AD-4438-8D7D-33F9F851B9E2}"= UDP:C:\Users\Max\AppData\Roaming\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{1BE80DFF-11FE-4C2A-BD20-317488140744}"= TCP:C:\Users\Max\AppData\Roaming\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{045C99CF-81E6-4F27-8D3E-2CE8A4C1FD42}"= UDP:C:\Program Files\eMule\emule.exe:eMule
"{70D07A8C-0B5D-49B9-9307-4A3B7AC694D9}"= TCP:C:\Program Files\eMule\emule.exe:eMule
"TCP Query User{C3305525-5063-4753-9991-26A4E629A15F}C:\\program files\\valve\\steam\\steamapps\\cococerise\\counter-strike source\\hl2.exe"= UDP:C:\program files\valve\steam\steamapps\cococerise\counter-strike source\hl2.exe:hl2
"UDP Query User{7120ECFE-090D-4255-8008-E2A3FD5EDEA8}C:\\program files\\valve\\steam\\steamapps\\cococerise\\counter-strike source\\hl2.exe"= TCP:C:\program files\valve\steam\steamapps\cococerise\counter-strike source\hl2.exe:hl2
"{834019A6-1007-4639-AD21-2C2390734716}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{7C515A61-FD49-401B-836A-0ED2C3D00E27}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"TCP Query User{3E5FF350-6E17-49BB-9CBD-ACF024C7B720}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{7E4081CB-839A-450E-8507-B20123812CF9}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{4D7503EF-EA76-48EF-8853-F9972D9EDF5C}"= C:\Program Files\Windows Live\Messenger\wlcsdk.exe:Windows Live Messenger (Phone)
"{4CD403E8-C83E-41B8-A895-FCEE1A4D6CCB}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{8151E3B8-D46D-4564-BEA6-6557386D5320}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{B0406940-8CA9-4E6F-9CF3-E4C13EC133EC}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{E14E56EE-22BE-48C4-8FE1-DD4F0B378052}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R0 pavboot;pavboot;C:\Windows\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 16:35]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080122.002\IDSvix86.sys [2007-11-06 18:07]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 16:36]
R2 DQLWinService;DQLWinService;C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [2006-10-29 10:03]
R2 nmsgopro;GoProto Protocol Driver for NMS;C:\Windows\system32\DRIVERS\nmsgopro.sys [2006-09-27 17:37]
R2 nmsunidr;UniDriver for NMS;C:\Windows\system32\DRIVERS\nmsunidr.sys [2006-10-19 16:49]
R3 IntelDH;IntelDH Driver;C:\Windows\system32\Drivers\IntelDH.sys [2007-11-04 03:24]
R3 V0230Vfx;V0230Vfx;C:\Windows\system32\DRIVERS\V0230Vfx.sys [2006-03-24 02:00]
R3 V0230VID;Live! Cam Video IM Pro;C:\Windows\system32\DRIVERS\V0230VID.sys [2007-08-07 02:03]
S3 IntelDHSvcConf;IntelDHSvcConf;C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [2006-11-18 07:59]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-08-04 18:28]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0547faaa-8ad8-11dc-8a8c-806e6f6e6963}]
\shell\AutoRun\command - L:\nideiect.com
\shell\explore\Command - L:\nideiect.com
\shell\open\Command - L:\nideiect.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ff02a1-63aa-11dd-b405-001c25271e2f}]
\shell\AutoRun\command - G:\nideiect.com
\shell\explore\Command - G:\nideiect.com
\shell\open\Command - G:\nideiect.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0f45cd0-8b77-11dc-aaad-001c25271e2f}]
\shell\AutoRun\command - L:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede7cdf6-8a73-11dc-b37c-806e6f6e6963}]
\shell\AutoRun\command - F:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede7cfb8-8a73-11dc-b37c-001c25271e2f}]
\shell\AutoRun\command - G:\SETUP.EXE
\shell\configure\command - G:\SETUP.EXE
\shell\install\command - G:\SETUP.EXE
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
2008-07-25 C:\Windows\Tasks\Norton Internet Security - Analyse système complète - Max.job
- c:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe [2008-08-20 19:26]
2008-08-20 C:\Windows\Tasks\User_Feed_Synchronization-{08F52541-BB99-43D5-B22D-6E24A2A342B5}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 11:45]
2008-08-20 C:\Windows\Tasks\User_Feed_Synchronization-{399B12F5-B8AF-4FB0-AE82-B196D11AB044}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 11:45]
2008-08-20 C:\Windows\Tasks\User_Feed_Synchronization-{7069164B-34C3-444F-A488-9B5EFDB50680}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 11:45]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Real Desktop - C:\Program Files\Real Desktop\Real Desktop.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\1iof34ro.default\
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.
.
------- File Associations (Beta) -------
.
VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
vbefile\shell\open\command="%SystemRoot%\System32\WScript.exe" "%1" %*
vbsfile\shell\open\command="%SystemRoot%\System32\WScript.exe" "%1" %*
jsefile\shell\open\command=%SystemRoot%\System32\WScript.exe "%1" %*
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-20 21:04:41
Windows 6.0.6000 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Windows\System32\runonce.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\PnkBstrA.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\System32\conime.exe
C:\Windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-20 21:06:23 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-20 19:06:00
ComboFix2.txt 2008-08-18 10:43:19
Pre-Run: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Post-Run: 43,677,483,008 octets libres
408 --- E O F --- 2008-08-18 01:02:51
ComboFix 08-08-19.03 - Max 2008-08-20 21:01:05.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1137 [GMT 2:00]
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\InfoSat.txt
C:\Users\Max\AppData\Local\Microsoft\Windows\Temporary Internet Files\Vaccin_USB-Lisez_moi.html
C:\Users\Max\AppData\Roaming\m
C:\Users\Max\AppData\Roaming\m\data.oct
C:\Users\Max\AppData\Roaming\m\flec006.exe
C:\Users\Max\AppData\Roaming\m\list.oct
C:\Users\Max\AppData\Roaming\m\shared
C:\Users\Max\AppData\Roaming\m\shared\LOWA Typing Warmups 1.2.zip
C:\Users\Max\AppData\Roaming\m\shared\Lowcarb 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\lowdisk32 1.0.0.12.zip
C:\Users\Max\AppData\Roaming\m\shared\LOWER 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lower Blood Pressure 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lower Case Switcher 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lower Cholesterol 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lowney Math Flash 2.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lowry Park Zoo Screensaver 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LowToSleep 1.6.zip
C:\Users\Max\AppData\Roaming\m\shared\Loyalty Tracking System 1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lozdodge 1.09.zip
C:\Users\Max\AppData\Roaming\m\shared\LP-Calc 1.01.zip
C:\Users\Max\AppData\Roaming\m\shared\LP-Text 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LP Recorder 8.8.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LP Ripper 9.0.2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LPDForm 1.31B.zip
C:\Users\Max\AppData\Roaming\m\shared\lphant 3.50.zip
C:\Users\Max\AppData\Roaming\m\shared\LPI 117-102 Practice Test Exam Questions.zip
C:\Users\Max\AppData\Roaming\m\shared\LPS - Live Playlist Signature (Winamp Plugin) 0.11.zip
C:\Users\Max\AppData\Roaming\m\shared\LQ RichTextBox 1.8.0.7.zip
C:\Users\Max\AppData\Roaming\m\shared\LS-CRM 1.53.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Addressbook 1.0.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Archiver 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Cleanup 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Countdown Timer 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Image Converter 2.67.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Jukebox.zip
C:\Users\Max\AppData\Roaming\m\shared\LS MP3 Encoder 0.2.12 beta.zip
C:\Users\Max\AppData\Roaming\m\shared\LS MyLib 0.92 RC.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Photo Album 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Screen Capture 1.0.2193.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Speller 3.0.5.zip
C:\Users\Max\AppData\Roaming\m\shared\LS Stock Ticker 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LS_CDRun 1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\LSASecretsDump 1.00.zip
C:\Users\Max\AppData\Roaming\m\shared\LSASecretsView 1.12.zip
C:\Users\Max\AppData\Roaming\m\shared\LSDTech BP 1.02.zip
C:\Users\Max\AppData\Roaming\m\shared\LSDTech PrivateDisk 1.30.zip
C:\Users\Max\AppData\Roaming\m\shared\LSExecuter 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LSFindReplaceDialogW 1.0.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LSL Plus 0.2.0 Alpha.zip
C:\Users\Max\AppData\Roaming\m\shared\LSMC 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LSP-Fix 1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\LsT 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LSText 0.22.zip
C:\Users\Max\AppData\Roaming\m\shared\LSVG 0.0.1.31.zip
C:\Users\Max\AppData\Roaming\m\shared\LSZip 2.60.zip
C:\Users\Max\AppData\Roaming\m\shared\LT Calendar 1.2.1.zip
C:\Users\Max\AppData\Roaming\m\shared\LT Expander 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LTA Singapore Road Monitoring 2.15.zip
C:\Users\Max\AppData\Roaming\m\shared\LTC Password Generator 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LTC System Monitor 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LTF-Cimulator 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LTFCrypt 1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\LTMonitor 2.2.10.zip
C:\Users\Max\AppData\Roaming\m\shared\LTProf 1.4.8.zip
C:\Users\Max\AppData\Roaming\m\shared\Ltrack 5.9.8.zip
C:\Users\Max\AppData\Roaming\m\shared\Luach 1.1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Luay's Digital Image watermarking 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucane 0.7.5.zip
C:\Users\Max\AppData\Roaming\m\shared\LucasRipper 1.0 Beta 4.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucent Clock Screensaver 2.3.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucid Ocean screensaver 2.03.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucid Spec 1.1.0.23487.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucid v1.2.zip
C:\Users\Max\AppData\Roaming\m\shared\LucidLink Home Office Edition 2.2.zip
C:\Users\Max\AppData\Roaming\m\shared\LucidLink Wireless Client 2.2.zip
C:\Users\Max\AppData\Roaming\m\shared\LucidLink Wireless LAN Security 2.22.zip
C:\Users\Max\AppData\Roaming\m\shared\LucidLog.Net 1.0.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LucidScan ActiveX Component 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucifer Wordlist Filter 0.5.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucille 2.zip
C:\Users\Max\AppData\Roaming\m\shared\Luck and Fortune Smiley Collection 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Luck of the Draw 1.0.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucky Clovers Screensaver.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucky Downloads search 1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucky Google 1.5,1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucky Number 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucky Pattys Day Screensaver 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LUCKYme 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LuckyPhoto 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LuckyView 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LuckyZoom 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lucy Liu 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LuggageNet 2.18.zip
C:\Users\Max\AppData\Roaming\m\shared\Lullaby Drop-In Administrator 1.10.zip
C:\Users\Max\AppData\Roaming\m\shared\Lullaby Management 6.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lulu 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lum 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Luma Clock Screensaver 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LumiCode Home Edition 2.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lumina 3D 0.3.4.zip
C:\Users\Max\AppData\Roaming\m\shared\LuminaXYs 2.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Luminescent Clock ScreenSaver 2.3.zip
C:\Users\Max\AppData\Roaming\m\shared\Luminous Cross 1.03.zip
C:\Users\Max\AppData\Roaming\m\shared\Lumisoft UI Controls 1.1.1384.0b.zip
C:\Users\Max\AppData\Roaming\m\shared\Lump Tool 1.0.7.zip
C:\Users\Max\AppData\Roaming\m\shared\LUNA Free 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Luna Royale 3.2.zip
C:\Users\Max\AppData\Roaming\m\shared\Luna Screensaver 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunabase 0.92 beta 4.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunar Calculator 2.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunar Calendar 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunar Calendars and Eclipse Finder 8.01.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunar Colongitude 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunar Date 1.4.3.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunar Picture of the Day 2.63.zip
C:\Users\Max\AppData\Roaming\m\shared\LunarCal 6.24.zip
C:\Users\Max\AppData\Roaming\m\shared\LunarCell 1.7.0.zip
C:\Users\Max\AppData\Roaming\m\shared\LunarEclipse 1.2.7.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunarmark 0.6.0 Beta.zip
C:\Users\Max\AppData\Roaming\m\shared\LunarPhase 2.70.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunascape 4.1.3.zip
C:\Users\Max\AppData\Roaming\m\shared\Lunch Picker 3.0.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lundlay Property Browser 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lung Mass Evaluation 1.zip
C:\Users\Max\AppData\Roaming\m\shared\luntbuild 1.1.1.zip
C:\Users\Max\AppData\Roaming\m\shared\Lupa 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lupas Rename 5.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lupo PenSuite 6.53.zip
C:\Users\Max\AppData\Roaming\m\shared\LuraDocument Capture 5.1.07.23.zip
C:\Users\Max\AppData\Roaming\m\shared\LuraDocument PDF Compressor 4.2.02.15.zip
C:\Users\Max\AppData\Roaming\m\shared\LuraWave Smart Compress 2.1.05.03.zip
C:\Users\Max\AppData\Roaming\m\shared\Luscious Landscapes Screensaver 1.0.zip
C:\Users\Max\AppData\Roaming\m\shared\Lush.zip
C:\Users\Max\AppData\Roaming\m\shared\lust screensaver 01.zip
C:\Users\Max\AppData\Roaming\m\shared\Lutow 3.1.8.45.zip
C:\Users\Max\AppData\Roaming\m\shared\Lutz Roeder's .NET Reflector 5.0.25.0.zip
C:\Users\Max\AppData\Roaming\m\srvlist.oct
C:\Windows\system32\drivers\downld
C:\Windows\system32\drivers\downld\695951.exe
C:\Windows\system32\drivers\downld\719585.exe
C:\Windows\system32\drivers\downld\733189.exe
C:\Windows\system32\drivers\downld\739850.exe
C:\Windows\system32\drivers\downld\861281.exe
C:\Windows\system32\drivers\hldrrr.exe
C:\Windows\system32\drivers\mdelk.exe
C:\Windows\system32\drivers\srosa.sys
G:\AUTORUN.INF
L:\autorun.inf
.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-20 to 2008-08-20 ))))))))))))))))))))))))))))))))))))
.
Pas de nouveau fichier créé dans cet espace de temps
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-20 17:31 167,936 ----a-w C:\VaccinUSB.exe
2008-08-20 17:03 --------- d-----w C:\Program Files\Alwil Software
2008-08-20 16:50 --------- d-----w C:\Program Files\Trend Micro
2008-08-20 15:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-18 11:32 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-18 07:34 --------- d-----w C:\Program Files\Sophos
2008-08-18 01:08 --------- d-----w C:\Program Files\Windows Mail
2008-08-17 23:18 --------- d-----w C:\Program Files\Norton Internet Security
2008-08-17 23:18 --------- d-----w C:\Program Files\Microsoft Works
2008-08-17 23:18 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-17 13:02 --------- d-----w C:\Program Files\EsetOnlineScanner
2008-08-17 13:01 38,472 ----a-w C:\Windows\system32\drivers\mbamswissarmy.sys
2008-08-17 13:01 17,144 ----a-w C:\Windows\system32\drivers\mbam.sys
2008-08-16 23:58 --------- d-----w C:\Users\Sam\AppData\Roaming\Malwarebytes
2008-08-16 19:51 --------- d-----w C:\Users\Max\AppData\Roaming\Malwarebytes
2008-08-16 19:51 --------- d-----w C:\ProgramData\Malwarebytes
2008-08-16 19:36 --------- d-----w C:\Program Files\Panda Security
2008-08-16 17:11 --------- d-----w C:\ProgramData\Symantec
2008-08-16 16:45 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-06 11:27 --------- d-----w C:\Program Files\Common Files\Steam
2008-08-06 08:54 --------- d-----w C:\Program Files\Microsoft Money 2005
2008-08-04 16:22 --------- d-----w C:\Users\Max\AppData\Roaming\Real Desktop
2008-07-22 09:51 --------- d-----w C:\Users\Max\AppData\Roaming\GetRightToGo
2008-07-22 09:07 --------- d-----w C:\Users\Max\AppData\Roaming\Apple Computer
2008-07-22 09:06 --------- d-----w C:\ProgramData\Apple Computer
2008-07-22 09:06 --------- d-----w C:\Program Files\iTunes
2008-07-22 09:06 --------- d-----w C:\Program Files\iPod
2008-07-21 19:27 --------- d-----w C:\Program Files\QuickTime
2008-07-21 19:25 --------- d-----w C:\Program Files\Apple Software Update
2008-07-21 19:24 --------- d-----w C:\ProgramData\Apple
2008-07-21 19:24 --------- d-----w C:\Program Files\Common Files\Apple
2008-07-19 14:36 51,280 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-07-10 15:05 174 --sha-w C:\Program Files\desktop.ini
2008-07-03 11:33 413,696 ----a-w C:\Windows\System32\wrap_oal.dll
2008-07-03 11:33 110,592 ----a-w C:\Windows\System32\OpenAL32.dll
2008-07-03 11:33 --------- d-----w C:\Program Files\Trials 2 Second Edition
2008-07-03 11:33 --------- d-----w C:\Program Files\OpenAL
2008-06-28 17:28 --------- d-----w C:\Program Files\Picasa2
2008-06-28 17:28 --------- d-----w C:\Program Files\Google
2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-19 03:25 61,440 ----a-w C:\Windows\System32\winipsec.dll
2008-06-19 03:25 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
2008-06-19 03:25 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll
2008-06-19 03:25 272,896 ----a-w C:\Windows\System32\polstore.dll
2008-06-12 06:54 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-06-12 06:54 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-12 01:21 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 04:00 1232896]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-12-02 17:42 3739672]
"Steam"="c:\program files\valve\steam\steam.exe" [2008-04-01 17:17 1271032]
"Speech Recognition"="C:\Windows\Speech\Common\sapisvr.exe" [2006-11-02 11:45 49664]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCUTRAYICON"="FactoryMode" [X]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-08-20 19:43 107112]
"osCheck"="c:\Program Files\Norton Internet Security\osCheck.exe" [2008-08-20 19:43 22696]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 12:39 151552]
"Acer Empowering Technology Monitor"="C:\Acer\Empowering Technology\SysMonitor.exe" [2006-08-08 10:06 708616]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-08-08 10:06 708616]
"NMSSupport"="C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [2006-09-26 11:56 423424]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 22:48 57344]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]
"V0230Mon.exe"="C:\Windows\V0230Mon.exe" [2006-09-07 02:01 32768]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 11:22 517768]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 14:35 176128]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-08-20 19:03 78008]
"RtHDVCpl"="RtHDVCpl.exe" [2006-08-08 10:06 708616 C:\Windows\System32\RtHDVCpl.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-04-03 19:07:23 528384]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3006126301-1578542936-2715256611-1003]
"EnableNotificationsRef"=dword:00000004
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{722D1D9F-5885-4D78-9DA5-2079562B23C7}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{BE342372-9CEB-4827-80F2-75D04B42BCD6}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{E6316576-679F-4665-9D38-E34D3DFC70A6}"= C:\Program Files\Acer Zone\Acer Zone Main Page\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{34B087DC-CD9D-44C6-B626-3F79DC528461}"= C:\Program Files\Acer Zone\Acer Picture Slide DVD\Component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess
"{AE078BE2-6F15-4D46-9C88-57063ADCD039}"= C:\Program Files\Acer Zone\Acer Plug and Record\Component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess
"{A0645421-8520-4699-BD1C-254AAC4ACF0C}"= C:\Program Files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess
"{A267EABF-3BE8-45D5-97BE-20BDC6E94454}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{B65BD99F-0C27-4848-9D05-2EF76839A98F}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{63ED5734-C34C-4108-B30E-7A68A4E37CF7}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{5C9100D0-6E96-4D13-A069-91D6253E974F}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{1FEA4046-16A6-4104-BBA3-4A52AC6058CA}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{F21B0008-368B-464F-B72B-32C2ED450D31}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{72E5566D-93F1-447B-B55F-36D91E7CE801}"= TCP:Profile=Private|Profile=Public|9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{CBB98356-FEB1-4F1D-AD20-328376C01391}"= TCP:Profile=Private|Profile=Public|1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"{4EA560A4-A1AD-490E-B7DC-8A5CA26B32F3}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{13FCDB65-9605-496A-9376-EE958E7CE785}"= Disabled:UDP:C:\Users\Sophie\Desktop\incredimail_install.exe:IncrediMail Installer
"{06B24F33-CCFA-4591-8C2A-43D8780ED991}"= Disabled:TCP:C:\Users\Sophie\Desktop\incredimail_install.exe:IncrediMail Installer
"{3EAFD950-B855-4343-B5E6-D4EE1C5CFE80}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{0DAD94A7-6615-4A29-8E0E-5C5B489A60F8}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{0BA2B1EF-2E95-4136-9A26-66CCE3C4F8DD}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{9BD7D90E-C2C5-48D6-A0A6-B1D24AC6D299}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{C976A610-71D2-4138-9C3D-3D13A03BDDC8}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{ED7352BB-FCAF-42B9-A79B-37BBEF79A40C}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{23972178-9F29-4C36-9836-81AB27CB1B4A}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{69F65F90-AE40-409B-84D8-E82490A5C3CF}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{4B2B9988-801D-46A7-B7F7-2B5B772D2D33}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{9BC49054-781C-4BCD-B99E-2F39D931C498}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{C25FCB01-05AD-4438-8D7D-33F9F851B9E2}"= UDP:C:\Users\Max\AppData\Roaming\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{1BE80DFF-11FE-4C2A-BD20-317488140744}"= TCP:C:\Users\Max\AppData\Roaming\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{045C99CF-81E6-4F27-8D3E-2CE8A4C1FD42}"= UDP:C:\Program Files\eMule\emule.exe:eMule
"{70D07A8C-0B5D-49B9-9307-4A3B7AC694D9}"= TCP:C:\Program Files\eMule\emule.exe:eMule
"TCP Query User{C3305525-5063-4753-9991-26A4E629A15F}C:\\program files\\valve\\steam\\steamapps\\cococerise\\counter-strike source\\hl2.exe"= UDP:C:\program files\valve\steam\steamapps\cococerise\counter-strike source\hl2.exe:hl2
"UDP Query User{7120ECFE-090D-4255-8008-E2A3FD5EDEA8}C:\\program files\\valve\\steam\\steamapps\\cococerise\\counter-strike source\\hl2.exe"= TCP:C:\program files\valve\steam\steamapps\cococerise\counter-strike source\hl2.exe:hl2
"{834019A6-1007-4639-AD21-2C2390734716}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{7C515A61-FD49-401B-836A-0ED2C3D00E27}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"TCP Query User{3E5FF350-6E17-49BB-9CBD-ACF024C7B720}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{7E4081CB-839A-450E-8507-B20123812CF9}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{4D7503EF-EA76-48EF-8853-F9972D9EDF5C}"= C:\Program Files\Windows Live\Messenger\wlcsdk.exe:Windows Live Messenger (Phone)
"{4CD403E8-C83E-41B8-A895-FCEE1A4D6CCB}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{8151E3B8-D46D-4564-BEA6-6557386D5320}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{B0406940-8CA9-4E6F-9CF3-E4C13EC133EC}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{E14E56EE-22BE-48C4-8FE1-DD4F0B378052}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R0 pavboot;pavboot;C:\Windows\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 16:35]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080122.002\IDSvix86.sys [2007-11-06 18:07]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 16:36]
R2 DQLWinService;DQLWinService;C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [2006-10-29 10:03]
R2 nmsgopro;GoProto Protocol Driver for NMS;C:\Windows\system32\DRIVERS\nmsgopro.sys [2006-09-27 17:37]
R2 nmsunidr;UniDriver for NMS;C:\Windows\system32\DRIVERS\nmsunidr.sys [2006-10-19 16:49]
R3 IntelDH;IntelDH Driver;C:\Windows\system32\Drivers\IntelDH.sys [2007-11-04 03:24]
R3 V0230Vfx;V0230Vfx;C:\Windows\system32\DRIVERS\V0230Vfx.sys [2006-03-24 02:00]
R3 V0230VID;Live! Cam Video IM Pro;C:\Windows\system32\DRIVERS\V0230VID.sys [2007-08-07 02:03]
S3 IntelDHSvcConf;IntelDHSvcConf;C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [2006-11-18 07:59]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-08-04 18:28]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0547faaa-8ad8-11dc-8a8c-806e6f6e6963}]
\shell\AutoRun\command - L:\nideiect.com
\shell\explore\Command - L:\nideiect.com
\shell\open\Command - L:\nideiect.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ff02a1-63aa-11dd-b405-001c25271e2f}]
\shell\AutoRun\command - G:\nideiect.com
\shell\explore\Command - G:\nideiect.com
\shell\open\Command - G:\nideiect.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0f45cd0-8b77-11dc-aaad-001c25271e2f}]
\shell\AutoRun\command - L:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede7cdf6-8a73-11dc-b37c-806e6f6e6963}]
\shell\AutoRun\command - F:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede7cfb8-8a73-11dc-b37c-001c25271e2f}]
\shell\AutoRun\command - G:\SETUP.EXE
\shell\configure\command - G:\SETUP.EXE
\shell\install\command - G:\SETUP.EXE
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
2008-07-25 C:\Windows\Tasks\Norton Internet Security - Analyse système complète - Max.job
- c:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe [2008-08-20 19:26]
2008-08-20 C:\Windows\Tasks\User_Feed_Synchronization-{08F52541-BB99-43D5-B22D-6E24A2A342B5}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 11:45]
2008-08-20 C:\Windows\Tasks\User_Feed_Synchronization-{399B12F5-B8AF-4FB0-AE82-B196D11AB044}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 11:45]
2008-08-20 C:\Windows\Tasks\User_Feed_Synchronization-{7069164B-34C3-444F-A488-9B5EFDB50680}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 11:45]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Real Desktop - C:\Program Files\Real Desktop\Real Desktop.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\1iof34ro.default\
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.
.
------- File Associations (Beta) -------
.
VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
vbefile\shell\open\command="%SystemRoot%\System32\WScript.exe" "%1" %*
vbsfile\shell\open\command="%SystemRoot%\System32\WScript.exe" "%1" %*
jsefile\shell\open\command=%SystemRoot%\System32\WScript.exe "%1" %*
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-20 21:04:41
Windows 6.0.6000 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Windows\System32\runonce.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\PnkBstrA.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\System32\conime.exe
C:\Windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-20 21:06:23 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-20 19:06:00
ComboFix2.txt 2008-08-18 10:43:19
Pre-Run: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Post-Run: 43,677,483,008 octets libres
408 --- E O F --- 2008-08-18 01:02:51
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
20 août 2008 à 21:24
20 août 2008 à 21:24
Okay, j'attends avec impatience, merci , et merci encore.
Utilisateur anonyme
20 août 2008 à 21:30
20 août 2008 à 21:30
Copie le texte ci-dessous :
File::
C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080122.002\IDSvix86.sys
L:\nideiect.com
G:\nideiect.com
L:\LaunchU3.exe -a
L:\LaunchU3.exe
F:\autorun.exe
G:\SETUP.EXE
Folder::
C:\PROGRA~2\Symantec
C:\Program Files\Panda Security
C:\ProgramData\Symantec
C:\Program Files\Common Files\Symantec Shared
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCUTRAYICON"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec PIF AlertEng"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0547faaa-8ad8-11dc-8a8c-806e6f6e6963}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ff02a1-63aa-11dd-b405-001c25271e2f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0f45cd0-8b77-11dc-aaad-001c25271e2f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede7cdf6-8a73-11dc-b37c-806e6f6e6963}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede7cfb8-8a73-11dc-b37c-001c25271e2f}]
Driver::
pavboot
IDSvix86
DirLook::
C:\Users\Max\AppData\Roaming\Real Desktop
C:\Users\Max\AppData\Roaming\GetRightToGo
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt
S'il n'y a pas de rédémarrage, poste quand même le rapport.
File::
C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080122.002\IDSvix86.sys
L:\nideiect.com
G:\nideiect.com
L:\LaunchU3.exe -a
L:\LaunchU3.exe
F:\autorun.exe
G:\SETUP.EXE
Folder::
C:\PROGRA~2\Symantec
C:\Program Files\Panda Security
C:\ProgramData\Symantec
C:\Program Files\Common Files\Symantec Shared
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCUTRAYICON"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec PIF AlertEng"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0547faaa-8ad8-11dc-8a8c-806e6f6e6963}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ff02a1-63aa-11dd-b405-001c25271e2f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0f45cd0-8b77-11dc-aaad-001c25271e2f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede7cdf6-8a73-11dc-b37c-806e6f6e6963}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede7cfb8-8a73-11dc-b37c-001c25271e2f}]
Driver::
pavboot
IDSvix86
DirLook::
C:\Users\Max\AppData\Roaming\Real Desktop
C:\Users\Max\AppData\Roaming\GetRightToGo
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt
S'il n'y a pas de rédémarrage, poste quand même le rapport.
maxouxd
Messages postés
122
Date d'inscription
lundi 18 août 2008
Statut
Membre
Dernière intervention
22 août 2008
20 août 2008 à 21:51
20 août 2008 à 21:51
Après redémarrage, pendant l'édition du rapport : select a file to crack (dans system32) + Bsod
Mais j'ai trouvé sa :
File::
C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080122.002\IDSvix86.sys
L:\nideiect.com
G:\nideiect.com
L:\LaunchU3.exe -a
L:\LaunchU3.exe
F:\autorun.exe
G:\SETUP.EXE
Folder::
C:\PROGRA~2\Symantec
C:\Program Files\Panda Security
C:\ProgramData\Symantec
C:\Program Files\Common Files\Symantec Shared
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCUTRAYICON"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec PIF AlertEng"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0547faaa-8ad8-11dc-8a8c-806e6f6e6963}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ff02a1-63aa-11dd-b405-001c25271e2f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0f45cd0-8b77-11dc-aaad-001c25271e2f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede7cdf6-8a73-11dc-b37c-806e6f6e6963}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede7cfb8-8a73-11dc-b37c-001c25271e2f}]
Driver::
pavboot
IDSvix86
DirLook::
C:\Users\Max\AppData\Roaming\Real Desktop
C:\Users\Max\AppData\Roaming\GetRightToGo
Mais j'ai trouvé sa :
File::
C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080122.002\IDSvix86.sys
L:\nideiect.com
G:\nideiect.com
L:\LaunchU3.exe -a
L:\LaunchU3.exe
F:\autorun.exe
G:\SETUP.EXE
Folder::
C:\PROGRA~2\Symantec
C:\Program Files\Panda Security
C:\ProgramData\Symantec
C:\Program Files\Common Files\Symantec Shared
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCUTRAYICON"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec PIF AlertEng"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0547faaa-8ad8-11dc-8a8c-806e6f6e6963}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ff02a1-63aa-11dd-b405-001c25271e2f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0f45cd0-8b77-11dc-aaad-001c25271e2f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede7cdf6-8a73-11dc-b37c-806e6f6e6963}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede7cfb8-8a73-11dc-b37c-001c25271e2f}]
Driver::
pavboot
IDSvix86
DirLook::
C:\Users\Max\AppData\Roaming\Real Desktop
C:\Users\Max\AppData\Roaming\GetRightToGo
