Internet restreint, lent et avec des pubs
Bonjour, mon internet est vraiment lent, j'ai dû mal a accéder à certains sites, genre yahoo ou même des forums, j'ai des pubs qui s'ouvrent pour scanner mon ordinateur et autres saloperies
j'ai lancé plusieurs anti-virus, spywares et autres malvares, voici le log de hijack this après tout ce rafus fait sur mon ordinateur.
Je dois certainement m'être chopé quelque chose, merci de votre aide.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:33:22, on 19/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
F:\anti-virus\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINDOWS\system32\StacSV.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\DellTPad\Apoint.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
C:\Program Files\Wave Systems Corp\SecureUpgrade.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
F:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ECCenter.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
F:\Mozilla Firefox\firefox.exe
C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.dell.com/fr-ch?c=ch&l=fr&s=gen&redirect=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-ch?c=ch&l=fr&s=gen&redirect=1
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.dell.com/fr-ch?c=ch&l=fr&s=gen&redirect=1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.heig-vd.ch/heig-vd.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
O4 - HKLM\..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exe
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Fichiers communs\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKLM\..\Run: [5c7cffb6] rundll32.exe "C:\WINDOWS\system32\mdqqjtmy.dll",b
O4 - HKLM\..\Run: [BM5f4fcc2a] Rundll32.exe "C:\WINDOWS\system32\rhxrnplo.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O20 - AppInit_DLLs: ltabta.dll zwynms.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - F:\anti-virus\aawservice.exe
O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe
O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: NTRU TSS v1.2.1.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
O23 - Service: WaveEnrollmentService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 10089 bytes
j'ai lancé plusieurs anti-virus, spywares et autres malvares, voici le log de hijack this après tout ce rafus fait sur mon ordinateur.
Je dois certainement m'être chopé quelque chose, merci de votre aide.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:33:22, on 19/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
F:\anti-virus\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINDOWS\system32\StacSV.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\DellTPad\Apoint.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
C:\Program Files\Wave Systems Corp\SecureUpgrade.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
F:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ECCenter.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
F:\Mozilla Firefox\firefox.exe
C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.dell.com/fr-ch?c=ch&l=fr&s=gen&redirect=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-ch?c=ch&l=fr&s=gen&redirect=1
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.dell.com/fr-ch?c=ch&l=fr&s=gen&redirect=1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.heig-vd.ch/heig-vd.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
O4 - HKLM\..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exe
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Fichiers communs\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKLM\..\Run: [5c7cffb6] rundll32.exe "C:\WINDOWS\system32\mdqqjtmy.dll",b
O4 - HKLM\..\Run: [BM5f4fcc2a] Rundll32.exe "C:\WINDOWS\system32\rhxrnplo.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O20 - AppInit_DLLs: ltabta.dll zwynms.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - F:\anti-virus\aawservice.exe
O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe
O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: NTRU TSS v1.2.1.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
O23 - Service: WaveEnrollmentService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 10089 bytes
Configuration: Windows XP Firefox 3.0.1
7 réponses
-
ModérateurSalut,
Important : Désactive TeaTimer, le résident de Spybot, il va gêner la désinfection en empêchant la modification des BHO.
---> Démarre Spybot, clique sur Mode, coche Mode avancé
---> A gauche, clique sur Outils, puis sur Résident
---> Décoche la case devant Résident "TeaTimer" :
http://apu.mabul.org/up/5/apu-5-gpdx9e06cwz2dypom2q7n6nc.jpg
---> Quitte Spybot
Note : Je te conseille de ne pas le réactiver, il a été incapable d'empêcher l'infection de ton PC.
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt -
J'ai fait tout ce que tu as dit. Voilà le rapport
ComboFix 08-08-18.05 - HeSébastien 2008-08-19 21:50:07.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.2962 [GMT 2:00]
Endroit: G:\Téléchargement\ComboFix.exe
* Création d'un nouveau point de restauration
* Resident AV is active
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\HeSébastien.22SEBHEIGVD\UserData
C:\Documents and Settings\HeSébastien.22SEBHEIGVD\UserData\[u]0[/u]LY74HER\sn[1].xml
C:\Documents and Settings\HeSébastien.22SEBHEIGVD\UserData\GDYV8X2Z\oWindowsUpdate[1].xml
C:\Documents and Settings\HeSébastien.22SEBHEIGVD\UserData\index.dat
C:\WINDOWS\BM5f4fcc2a.txt
C:\WINDOWS\BM5f4fcc2a.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\abmlafav.ini
C:\WINDOWS\system32\akaujz.dll
C:\WINDOWS\system32\fdinbuqv.dll
C:\WINDOWS\system32\geBSkKdC.dll
C:\WINDOWS\system32\geBtRlkL.dll
C:\WINDOWS\system32\lSuuxyay.ini
C:\WINDOWS\system32\lSuuxyay.ini2
C:\WINDOWS\system32\ltabta.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mdqqjtmy.dll
C:\WINDOWS\system32\npqvjfpw.ini
C:\WINDOWS\system32\owqxeenc.dll
C:\WINDOWS\system32\rhxrnplo.dll
C:\WINDOWS\system32\roauklhb.dll
C:\WINDOWS\system32\vxawmotl.dll
C:\WINDOWS\system32\yayxuuSl.dll
C:\WINDOWS\system32\ymtjqqdm.ini
C:\WINDOWS\system32\zwynms.dll
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-19 to 2008-08-19 ))))))))))))))))))))))))))))))))))))
.
2008-08-19 21:11 . 2008-08-19 21:11 4,476 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-19 21:04 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-08-19 21:04 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-08-19 21:04 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-08-19 21:04 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-08-19 21:04 . 2008-08-14 21:52 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-08-19 21:04 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-08-19 21:04 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-08-19 21:04 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-08-19 21:04 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-08-19 20:48 . 2008-08-19 21:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-19 20:47 . 2008-08-19 20:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-19 20:46 . 2008-08-19 20:46 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-08-19 20:28 . 2008-08-19 20:43 <REP> d-------- C:\Program Files\Navilog1
2008-08-19 20:07 . 2008-08-19 20:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-19 20:07 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-19 20:07 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-19 19:14 . 2004-08-04 00:54 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-08-19 19:14 . 2004-08-04 00:54 21,504 --a------ C:\WINDOWS\system32\dllcache\hidserv.dll
2008-08-18 15:02 . 2007-04-09 14:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll
2008-08-18 15:02 . 2008-08-18 15:02 385 --a------ C:\WINDOWS\ODBC.INI
2008-08-18 14:39 . 2008-08-18 14:42 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-08-18 14:38 . 2008-08-18 14:38 <REP> d-------- C:\Program Files\Microsoft.NET
2008-08-18 14:31 . 2008-08-19 22:01 1,871 --a------ C:\WINDOWS\system32\Config.MPF
2008-08-18 14:30 . 2008-08-19 19:14 <REP> d-------- C:\Program Files\SiteAdvisor
2008-08-18 14:30 . 2008-08-18 14:30 <REP> d-------- C:\Documents and Settings\LocalService\Bureau
2008-08-18 14:30 . 2008-08-18 14:30 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2008-08-18 14:30 . 2008-08-18 14:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-08-18 14:28 . 2007-11-22 06:44 201,320 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-08-18 14:28 . 2007-07-13 09:20 113,952 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2008-08-18 14:28 . 2007-11-22 06:44 79,304 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-08-18 14:28 . 2007-12-02 12:51 40,488 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-08-18 14:28 . 2007-11-22 06:44 35,240 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-08-18 14:28 . 2007-11-22 06:44 33,832 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2008-08-18 14:27 . 2008-08-18 14:27 <REP> d-------- C:\Program Files\McAfee.com
2008-08-18 14:27 . 2008-08-18 15:32 <REP> d-------- C:\Program Files\McAfee
2008-08-18 14:27 . 2008-08-18 14:28 <REP> d-------- C:\Program Files\Fichiers communs\McAfee
2008-08-18 14:26 . 2008-08-18 14:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-08-18 14:25 . 2008-08-18 14:25 <REP> d-------- C:\WINDOWS\35C03C043F1F42C2A989A757EE691F65.TMP
2008-08-18 12:55 . 2008-08-18 12:55 <REP> d-------- C:\WINDOWS\report
2008-08-18 12:55 . 2008-08-18 12:55 <REP> d-------- C:\WINDOWS\AU_Backup
2008-08-18 12:55 . 2008-08-18 12:55 25,957,649 --a------ C:\WINDOWS\VPTNFILE.483
2008-08-18 12:55 . 2008-08-18 12:55 25,957,649 --a------ C:\WINDOWS\LPT$VPN.483
2008-08-18 12:55 . 2008-08-18 12:55 1,964,523 --a------ C:\WINDOWS\tsc.ptn
2008-08-18 12:55 . 2008-08-18 12:55 1,213,784 --a------ C:\WINDOWS\vsapi32.dll
2008-08-18 12:55 . 2008-08-18 12:55 333,576 --a------ C:\WINDOWS\TSC.exe
2008-08-18 12:55 . 2008-08-18 12:55 91,744 --a------ C:\WINDOWS\BPMNT.dll
2008-08-18 12:55 . 2008-08-18 12:55 71,749 --a------ C:\WINDOWS\hcextoutput.dll
2008-08-18 12:55 . 2008-08-18 12:55 823 --a------ C:\WINDOWS\tsc.ini
2008-08-18 12:54 . 2008-08-18 12:55 <REP> d-------- C:\WINDOWS\AU_Temp
2008-08-18 12:54 . 2008-08-18 12:54 <REP> d-------- C:\WINDOWS\AU_Log
2008-08-18 12:54 . 2008-08-18 12:54 170 --a------ C:\WINDOWS\GetServer.ini
2008-08-18 12:53 . 2008-08-18 12:53 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
2008-08-18 12:53 . 2008-08-18 12:53 286,720 --a------ C:\WINDOWS\PATCH.EXE
2008-08-18 12:53 . 2008-08-18 12:53 69,689 --a------ C:\WINDOWS\UNZIP.DLL
2008-08-18 04:11 . 2008-08-18 04:11 <REP> d--hs---- C:\Boot
2008-08-18 04:11 . 2008-01-21 04:25 333,203 -rahs---- C:\bootmgr
2008-08-18 04:11 . 2008-08-18 04:11 8,192 -ra-s---- C:\BOOTSECT.BAK
2008-08-17 21:30 . 2008-08-17 21:30 <REP> d-------- C:\Intel
2008-08-17 21:26 . 2008-08-17 22:02 <REP> d-------- C:\Program Files\ma-config.com
2008-08-17 21:26 . 2008-08-17 22:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ma-config.com
2008-08-17 21:04 . 2008-08-19 19:14 <REP> d-------- C:\WINDOWS\system32\CatRoot2
2008-08-17 19:31 . 2008-08-17 19:31 0 --a------ C:\WINDOWS\nsreg.dat
2008-08-17 18:26 . 2008-08-17 18:26 <REP> d--hs---- C:\$RECYCLE.BIN
2008-08-17 11:10 . 2008-08-17 11:13 0 --------- C:\WINDOWS\system32\pqtmp.fil
2008-08-17 11:09 . 2008-08-17 11:09 619 --------- C:\WINDOWS\system32\PQ_BATCH.PQB
2008-08-17 11:05 . 2001-08-10 07:00 1,262,956 --------- C:\WINDOWS\system32\XMNT2001.EXE
2008-08-17 11:00 . 2008-08-17 11:00 <REP> d-------- C:\Documents and Settings\HESBAS~1~22S\LOCALS~1
2008-08-17 11:00 . 2008-08-17 11:00 <REP> d-------- C:\Documents and Settings\HESBAS~1~22S
2008-08-16 21:03 . 2008-08-16 21:03 <REP> d-------- C:\Program Files\MSXML 4.0
2008-08-16 19:50 . 2008-08-16 19:50 <REP> d-------- C:\Program Files\Fichiers communs\Acronis
2008-08-16 19:50 . 2008-08-16 19:50 <REP> d-------- C:\Program Files\Acronis
2008-08-16 19:50 . 2008-08-16 19:50 114,048 --------- C:\WINDOWS\system32\drivers\snapman.sys
2008-08-16 16:52 . 2008-08-16 16:52 <REP> d-------- C:\Program Files\SIW
2008-08-16 07:24 . 2008-05-01 16:31 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-15 22:16 . 2008-08-15 22:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2008-08-15 20:54 . 2008-08-15 20:54 <REP> d-------- C:\WINDOWS\Windows NT
2008-08-15 20:37 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-08-15 20:37 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-15 20:37 . 2008-06-20 19:41 247,808 --------- C:\WINDOWS\system32\dllcache\mswsock.dll
2008-08-15 20:37 . 2008-06-20 12:44 138,368 --------- C:\WINDOWS\system32\dllcache\afd.sys
2008-08-15 20:37 . 2006-08-16 13:59 100,352 --------- C:\WINDOWS\system32\dllcache\6to4svc.dll
2008-08-15 19:21 . 2008-08-15 19:21 4,128 --------- C:\INFCACHE.1
2008-08-15 19:16 . 2008-08-15 19:24 1,905 --------- C:\WINDOWS\diagwrn.xml
2008-08-15 19:16 . 2008-08-15 19:24 1,905 --------- C:\WINDOWS\diagerr.xml
2008-08-15 18:31 . 2008-08-15 18:31 8,192 --------- C:\WINDOWS\REGLOCS.OLD
2008-08-15 18:26 . 2008-08-19 21:57 <REP> d-------- C:\Documents and Settings\HeS‚bastien.22SEBHEIGVD
2008-08-15 17:56 . 2008-08-17 22:02 <REP> d-------- C:\WINDOWS\system32\NtmsData
2008-08-15 17:49 . 2008-08-12 18:30 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Wave Systems Corp
2008-08-15 17:49 . 2008-08-12 18:18 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\InstallShield
2008-08-15 17:49 . 2008-08-12 18:36 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\CyberLink
2008-08-15 17:49 . 2008-08-15 18:26 <REP> d---s---- C:\Documents and Settings\HeS‚bastien
2008-08-15 17:48 . 2001-08-23 18:04 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-08-15 17:48 . 2001-08-17 23:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-08-12 18:37 . 2008-08-12 18:37 61 --------- C:\WINDOWS\smscfg.ini
2008-08-12 18:37 . 2008-08-12 18:37 0 --------- C:\WINDOWS\tosOBEX.INI
2008-08-12 18:36 . 2008-08-12 18:36 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\CyberLink
2008-08-12 18:34 . 2008-08-12 18:34 <REP> d-------- C:\Program Files\Sonic
2008-08-12 18:34 . 2008-08-12 18:34 <REP> d-------- C:\Program Files\Roxio
2008-08-12 18:34 . 2008-08-12 18:34 <REP> d-------- C:\Program Files\Fichiers communs\SureThing Shared
2008-08-12 18:34 . 2008-08-12 18:34 <REP> d-------- C:\Program Files\CyberLink
2008-08-12 18:34 . 2008-08-12 18:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-08-12 18:33 . 2008-08-17 22:01 <REP> d-------- C:\Program Files\Fichiers communs\Sonic Shared
2008-08-12 18:33 . 2008-08-12 18:33 <REP> d-------- C:\Program Files\Fichiers communs\Roxio Shared
2008-08-12 18:33 . 2008-08-12 18:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Sonic
2008-08-12 18:33 . 2005-11-02 12:24 36,864 --------- C:\WINDOWS\system32\tpmddl.dll
2008-08-12 18:30 . 2008-08-12 18:30 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Wave Systems Corp
2008-08-12 18:30 . 2007-11-08 23:49 1,769,472 --------- C:\WINDOWS\system32\Tsp1.dll
2008-08-12 18:28 . 2008-08-12 18:28 <REP> d-------- C:\WINDOWS\system32\GTwinUSB
2008-08-12 18:28 . 2008-08-12 18:28 <REP> d-------- C:\WINDOWS\system32\GPinPad
2008-08-12 18:28 . 2008-08-12 18:28 <REP> d-------- C:\WINDOWS\system32\GemPCKey
2008-08-12 18:28 . 2008-08-12 18:28 <REP> d-------- C:\WINDOWS\system32\GemPCExp
2008-08-12 18:28 . 2008-08-12 18:28 <REP> d-------- C:\WINDOWS\system32\GemPCCard
2008-08-12 18:28 . 2008-08-12 18:28 <REP> d-------- C:\Program Files\Gemplus
2008-08-12 18:28 . 2008-08-12 18:28 <REP> d-------- C:\Program Files\Fingerprint Sensor
2008-08-12 18:27 . 2007-09-07 10:57 80,368 --------- C:\WINDOWS\system32\pbadrvdll.dll
2008-08-12 18:27 . 2007-09-07 10:57 26,608 --------- C:\WINDOWS\system32\drivers\PBADRV.sys
2008-08-12 18:24 . 2008-08-12 18:24 <REP> d-------- C:\WINDOWS\system32\Test
2008-08-12 18:24 . 2008-08-12 18:24 <REP> d-------- C:\WINDOWS\system32\BioAPIFFDB
2008-08-12 18:24 . 2008-08-12 18:31 <REP> d-------- C:\Program Files\Wave Systems Corp
2008-08-12 18:24 . 2008-08-12 18:24 <REP> d-------- C:\Program Files\NTRU Cryptosystems
2008-08-12 18:24 . 2008-08-12 18:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Wave Systems Corp
2008-08-12 18:24 . 2008-08-12 18:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NTRU Cryptosystems
2008-08-12 18:24 . 2006-11-16 17:09 1,258,496 --------- C:\WINDOWS\system\tfmessbsp.dll
2008-08-12 18:24 . 2005-10-25 19:57 143,360 --------- C:\WINDOWS\system32\bioapi_mds300.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-12 15:53 7,236 ------w C:\WINDOWS\system32\drivers\1028_Dell_LAT_D830.mrk
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:31 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-23 15:39 152,064 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2008-06-23 15:39 1,056,768 ------w C:\WINDOWS\system32\dllcache\danim.dll
2008-06-23 15:39 1,024,000 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2008-06-23 09:49 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe
2008-06-20 21:11 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 13:22 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 13:22 225,920 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 ------w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-15 18:35 94,208 ------w C:\WINDOWS\system32\mdmxsdk.dll
2008-06-15 18:35 237,568 ------w C:\WINDOWS\system32\UCI32M29.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
"ISUSPM"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 05:40 218032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\DellTPad\Apoint.exe" [2007-09-24 21:35 159744]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-31 16:50 8429568]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-05-31 16:50 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2008-02-22 13:43 1245184]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-07-25 17:32 823296]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-07-25 17:30 974848]
"WavXMgr"="C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2007-09-10 10:55 92160]
"SecureUpgrade"="C:\Program Files\Wave Systems Corp\SecureUpgrade.exe" [2007-09-14 11:53 218424]
"KADxMain"="C:\WINDOWS\system32\KADxMain.exe" [2006-11-02 15:05 282624]
"PDVDDXSrv"="C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 11:57 128296]
"OSSelectorReinstall"="C:\Program Files\Fichiers communs\Acronis\Acronis Disk Director\oss_reinstall.exe" [2007-07-11 15:52 2233008]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2007-08-24 23:57 36640]
"nwiz"="nwiz.exe" [2007-05-31 16:50 1626112 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2007-05-31 16:50 67584 C:\WINDOWS\system32\nvhotkey.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gemsafe]
2006-11-16 16:20 73728 C:\Program Files\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth C:\WINDOWS\system32\yayxuuSl
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe"=
R0 PBADRV;PBADRV;C:\WINDOWS\system32\DRIVERS\PBADRV.sys [2007-09-07 10:57]
R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2007-07-23 15:49]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe [2006-12-19 15:21]
R2 TdmService;TdmService;C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe [2007-09-07 18:29]
R2 Wave UCSPlus;Wave UCSPlus;C:\WINDOWS\system32\dllhost.exe [2004-08-05 13:00]
R2 WavxDMgr;WavxDMgr;C:\WINDOWS\system32\DRIVERS\WavxDMgr.sys [2007-09-10 10:55]
R3 DXEC01;DXEC01;C:\WINDOWS\system32\drivers\dxec01.sys [2006-11-02 13:32]
R3 WaveFDE;Wave System Power Monitor Device Driver;C:\WINDOWS\system32\DRIVERS\WaveFDE.sys [2007-09-06 10:18]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [2008-08-17 15:01]
S3 SecureStorageService;SecureStorageService;C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe [2007-08-31 18:39]
S3 WaveEnrollmentService;WaveEnrollmentService;C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exe [2007-09-13 15:31]
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
2008-08-18 C:\WINDOWS\Tasks\McDefragTask.job
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
2008-08-18 C:\WINDOWS\Tasks\McQcTask.job
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
2008-08-18 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
2008-08-18 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-5c7cffb6 - C:\WINDOWS\system32\mdqqjtmy.dll
HKLM-Run-BM5f4fcc2a - C:\WINDOWS\system32\rhxrnplo.dll
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\HeSébastien.22SEBHEIGVD\Application Data\Mozilla\Firefox\Profiles\9ez81bde.default\
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-19 22:00:25
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\SiteAdvisor\6261\saHook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
F:\anti-virus\aawservice.exe
C:\WINDOWS\system32\scardsvr.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\hidfind.exe
C:\Program Files\DellTPad\ApntEx.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\PROGRA~1\FICHIE~1\McAfee\MNA\McNASvc.exe
C:\PROGRA~1\FICHIE~1\McAfee\McProxy\McProxy.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\Dell\QuickSet\NicConfigSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINDOWS\system32\stacsv.exe
C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-19 22:02:17 - machine was rebooted [HeS‚bastien]
ComboFix-quarantined-files.txt 2008-08-19 20:02:11
Pre-Run: 3,479,113,728 octets libres
Post-Run: 3,467,546,624 octets libres
318 --- E O F --- 2008-08-16 19:05:04 -
ModérateurFais un scan avec MBAM (MalwareByte's Anti-Malware) et supprime tout ce qu'il trouve.
-
Merci beaucoup, ça fonctionne déjà beaucoup mieux.
J'ai déjà Mbam mais je vais le faire tourner encore une fois.
Sinon mon bahut m'a installé McAfee, et j'ai 1 firewall + les mises à jour activées. Pas de anti-sypware ou autre.
Tu peux me proposer quoi pour plus de sécurité sur internet et en général, comme logiciel gratuit, histoire que j'évite de me rechoper des saletés numériques. -
ModérateurIl faut que tu fasses plus attention à ce que tu fais sur Internet. Aucun logiciel ne peut remplacer cela.
McAfee est bof comme antivirus.
Une fois le scan fini, signale-le moi. -
J'avais déjà fait 1 scan comme dit avant, MBAM n'a rien trouvé, est-ce bon signe mon seigneur ?
-
ModérateurJe vais vérifier un truc :
* Télécharge SDFix (par Andy Manchesta) et sauvegarde-le sur ton bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
* Double-clique sur SDFix.exe et choisis Install pour l'extraire dans son dossier sur le bureau.
* Redémarre le PC en mode sans échec :
https://www.malekal.com/demarrer-windows-mode-sans-echec/
* Choisis ton compte.
Déroule la liste des instructions ci-dessous :
* Ouvre le dossier SDFix qui vient d'être créé sur le bureau et double-clique sur RunThis.bat pour lancer le script.
* Appuie sur Y pour commencer le nettoyage.
* Quand il te le demandera, appuie sur une touche pour redémarrer le PC.
* Ton système sera plus long à redémarrer car l'outil va continuer à s'exécuter et supprimer des fichiers.
* Après le chargement du bureau, l'outil aura terminé et affichera Finished.
* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton bureau.
* Le rapport SDFix s'ouvrira et il sera enregistré dans le dossier SDFix sous le nom Report.txt.
* Enfin, copie/colle le rapport du fichier Report.txt.
