Virus photos msn
njackass57
Messages postés
42
Statut
Membre
-
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,j'ai un virus qui envoie des messages tout seule avec mon pseudo . photos.zip un truc comme ça et malgre que jai deja fait un post c n'a rien supprimé alors que j'ai fait tout ce qu'on m'a dit , est ce que quelqu'un aurait le temps de m'aider svp merci j'ai vu que ça a marché pour plusieurs personnes
A voir également:
- Virus photos msn
- Partager des photos - Guide
- Toutes mes photos - Guide
- Google photos - Télécharger - Albums photo
- Virus mcafee - Accueil - Piratage
- Doublons photos - Guide
15 réponses
voici le hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:18:16, on 21/08/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\mobsync.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\conime.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.13\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:18:16, on 21/08/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\mobsync.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\conime.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.13\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
slt
reste ici et fais msn fix aprs avoir désactivé le compte utilisateur comme indiqué en 22
http://www.commentcamarche.net/forum/affich 7904511 message bizarre sur msn virus
reste ici et fais msn fix aprs avoir désactivé le compte utilisateur comme indiqué en 22
http://www.commentcamarche.net/forum/affich 7904511 message bizarre sur msn virus
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.
télécharge combofix (par sUBs) ici :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
Tu as un tutoriel complet ici :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
_________________________________
colle le rapport d'un scan en ligne
avec un des suivants:
bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html
Panda en ligne :
http://pandasoftware.fr
kaspersky:
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.
télécharge combofix (par sUBs) ici :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
Tu as un tutoriel complet ici :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
_________________________________
colle le rapport d'un scan en ligne
avec un des suivants:
bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html
Panda en ligne :
http://pandasoftware.fr
kaspersky:
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
ComboFix 08-08-24.03 - Nicoli 2008-08-25 22:39:25.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1998 [GMT 2:00]
Endroit: C:\Users\Nicoli\Desktop\ComboFix.exe
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\KBL.LOG
.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-25 to 2008-08-25 ))))))))))))))))))))))))))))))))))))
.
2008-08-25 22:00 . 2008-08-25 22:00 <REP> d-------- C:\Program Files\Real
2008-08-25 22:00 . 2008-08-25 22:04 <REP> d-------- C:\Program Files\Common Files\Real
2008-08-25 21:54 . 2008-08-25 21:56 <REP> d-------- C:\Program Files\WMVTOAVI
2008-08-25 21:50 . 2008-08-25 21:56 <REP> d-------- C:\Program Files\VideoLAN
2008-08-24 18:00 . 2008-08-24 18:00 <REP> d-------- C:\Users\All Users\PlayFirst
2008-08-24 18:00 . 2008-08-24 18:00 <REP> d-------- C:\ProgramData\PlayFirst
2008-08-22 12:28 . 2008-08-22 12:28 <REP> d-------- C:\Program Files\EMME
2008-08-21 10:17 . 2008-08-21 10:17 <REP> d-------- C:\Program Files\Trend Micro
2008-08-17 14:55 . 2008-08-17 14:55 <REP> d-------- C:\Program Files\MP3 Player Utilities 4.13
2008-08-16 23:35 . 2008-08-16 23:35 <REP> d-------- C:\Windows\System32\QuickTime
2008-08-16 23:35 . 2008-08-16 23:35 <REP> d-------- C:\Program Files\QuickTime
2008-08-16 23:35 . 1999-11-10 11:05 86,016 --a------ C:\Windows\unvise32qt.exe
2008-08-16 23:35 . 2008-08-16 23:35 54,812 --a------ C:\Windows\System32\QuickTime.qtp
2008-08-16 23:34 . 2008-08-16 23:34 <REP> d-------- C:\Program Files\Motus
2008-08-16 20:29 . 2008-08-16 20:29 <REP> d-------- C:\Program Files\TVAnts
2008-08-16 20:01 . 2008-08-16 20:01 <REP> d-------- C:\Users\All Users\TVU Networks
2008-08-16 20:01 . 2008-08-16 20:01 <REP> d-------- C:\ProgramData\TVU Networks
2008-08-16 20:00 . 2008-08-16 20:00 <REP> d-------- C:\Program Files\TVUPlayer
2008-08-15 18:59 . 2008-08-15 18:59 <REP> d-------- C:\Program Files\AxBx
2008-08-15 12:19 . 2008-08-15 12:19 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-08-15 12:19 . 2008-08-15 12:19 <REP> d-------- C:\ProgramData\Malwarebytes
2008-08-15 12:19 . 2008-08-15 12:19 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-15 12:19 . 2008-07-30 20:07 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-08-15 12:19 . 2008-07-30 20:07 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-08-15 00:08 . 2008-08-15 00:08 <REP> d-------- C:\Program Files\CCleaner
2008-08-15 00:00 . 2008-08-25 17:17 <REP> d-------- C:\Users\All Users\Google Updater
2008-08-15 00:00 . 2008-08-25 17:17 <REP> d-------- C:\ProgramData\Google Updater
2008-08-14 23:49 . 2008-08-15 19:01 <REP> d-a------ C:\Users\All Users\TEMP
2008-08-14 23:49 . 2008-08-15 19:01 <REP> d-a------ C:\ProgramData\TEMP
2008-08-14 02:23 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-14 02:19 . 2008-06-27 03:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-14 02:19 . 2008-06-27 06:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-14 02:19 . 2008-04-10 07:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-14 02:19 . 2008-06-19 05:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-14 02:19 . 2008-04-18 07:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-10 11:30 . 2008-08-10 11:30 <REP> d-------- C:\Users\All Users\AOL OCP
2008-08-10 11:30 . 2008-08-10 11:30 <REP> d-------- C:\Users\All Users\AOL
2008-08-10 11:30 . 2008-08-10 11:30 <REP> d-------- C:\ProgramData\AOL OCP
2008-08-10 11:30 . 2008-08-10 11:30 <REP> d-------- C:\ProgramData\AOL
2008-08-05 12:42 . 2008-08-05 12:42 <REP> d-------- C:\Users\All Users\Microgaming
2008-08-05 12:42 . 2008-08-05 12:42 <REP> d-------- C:\Users\All Users\MGS
2008-08-05 12:42 . 2008-08-05 12:42 <REP> d-------- C:\ProgramData\Microgaming
2008-08-05 12:42 . 2008-08-05 12:42 <REP> d-------- C:\ProgramData\MGS
2008-08-05 12:41 . 2008-08-05 12:41 <REP> d-------- C:\Windows\System32\FlashAX
2008-08-05 12:41 . 2008-08-05 12:41 <REP> d-------- C:\MicroGaming
2008-08-01 11:37 . 2006-11-28 21:46 28,224 --a------ C:\Windows\System32\drivers\PCAMp50.sys
2008-08-01 11:37 . 2006-11-28 21:46 27,072 --a------ C:\Windows\System32\drivers\PCASp50.sys
2008-08-01 11:31 . 2008-08-01 11:31 <REP> d-------- C:\Program Files\Securitoo
2008-08-01 11:31 . 2008-08-01 11:31 <REP> d-------- C:\Program Files\Inventel
2008-07-31 03:01 . 2008-07-31 03:01 <REP> d-------- C:\Program Files\MSXML 4.0
2008-07-30 16:06 . 2008-07-30 16:06 <REP> d-------- C:\Users\All Users\Messenger Plus!
2008-07-30 16:06 . 2008-07-30 16:06 <REP> d-------- C:\ProgramData\Messenger Plus!
2008-07-30 16:04 . 2008-07-30 16:04 <REP> d-------- C:\Users\All Users\Logitech
2008-07-30 16:04 . 2008-07-31 16:58 <REP> d-------- C:\Users\All Users\Logishrd
2008-07-30 16:04 . 2008-07-30 16:04 <REP> d-------- C:\ProgramData\Logitech
2008-07-30 16:04 . 2008-07-31 16:58 <REP> d-------- C:\ProgramData\Logishrd
2008-07-30 16:00 . 2008-07-31 16:58 <REP> d-------- C:\Program Files\Common Files\logishrd
2008-07-30 15:42 . 2008-07-30 15:42 <REP> d-------- C:\Program Files\Common Files\Adobe
2008-07-30 14:33 . 2008-08-13 16:25 <REP> d-------- C:\Program Files\PKR
2008-07-30 14:21 . 2008-05-23 00:22 3,596,288 --a------ C:\Windows\System32\qt-dx331.dll
2008-07-30 14:21 . 2008-07-04 08:34 860,160 --a------ C:\Windows\System32\lameACM.acm
2008-07-30 14:21 . 2008-01-10 14:15 755,027 --a------ C:\Windows\System32\xvidcore.dll
2008-07-30 14:21 . 2004-01-25 18:18 217,088 --a------ C:\Windows\System32\yv12vfw.dll
2008-07-30 14:21 . 2007-09-04 18:56 164,352 --a------ C:\Windows\System32\unrar.dll
2008-07-30 14:21 . 2008-01-10 14:16 159,839 --a------ C:\Windows\System32\xvidvfw.dll
2008-07-30 14:21 . 2007-09-21 02:52 118,784 --a------ C:\Windows\System32\ac3acm.acm
2008-07-30 14:21 . 2008-05-23 00:19 81,920 --a------ C:\Windows\System32\dpl100.dll
2008-07-30 14:21 . 2007-10-03 17:03 414 --a------ C:\Windows\System32\lame_acm.xml
2008-07-30 14:20 . 2008-07-30 14:21 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2008-07-30 14:20 . 2008-05-31 01:22 683,520 --a------ C:\Windows\System32\divx.dll
2008-07-30 14:20 . 2008-06-12 20:36 7,680 --a------ C:\Windows\System32\ff_vfw.dll
2008-07-30 14:20 . 2007-07-10 18:10 547 --a------ C:\Windows\System32\ff_vfw.dll.manifest
2008-07-30 14:14 . 2008-07-30 14:14 <REP> d-------- C:\Users\All Users\IncrediMail
2008-07-30 14:14 . 2008-07-30 14:15 <REP> d-------- C:\Users\All Users\IM
2008-07-30 14:14 . 2008-07-30 14:14 <REP> d-------- C:\ProgramData\IncrediMail
2008-07-30 14:14 . 2008-07-30 14:15 <REP> d-------- C:\ProgramData\IM
2008-07-30 14:14 . 2008-07-30 14:14 <REP> d-------- C:\Program Files\IncrediMail
2008-07-30 14:02 . 2008-07-30 14:02 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-07-30 13:59 . 2008-07-30 13:59 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-07-30 13:59 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll
2008-07-30 13:51 . 2008-07-30 13:51 <REP> d-------- C:\Users\All Users\eMule
2008-07-30 13:51 . 2008-07-30 13:51 <REP> d-------- C:\ProgramData\eMule
2008-07-30 13:50 . 2008-07-30 13:50 <REP> d-------- C:\Program Files\eMule
2008-07-30 13:41 . 2007-11-27 22:45 91,200 --a------ C:\Windows\System32\drivers\msfwdrv.sys
2008-07-30 13:41 . 2007-11-27 22:44 37,440 --a------ C:\Windows\System32\drivers\msfwhlpr.sys
2008-07-30 13:40 . 2008-07-30 13:41 <REP> d----c--- C:\Windows\System32\DRVSTORE
2008-07-30 13:40 . 2008-07-30 13:40 <REP> d-------- C:\Program Files\Common Files\PX Storage Engine
2008-07-30 13:40 . 2008-04-23 06:42 428,544 --a------ C:\Windows\System32\EncDec.dll
2008-07-30 13:40 . 2008-04-23 06:42 293,376 --a------ C:\Windows\System32\psisdecd.dll
2008-07-30 13:40 . 2008-04-23 06:41 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-07-30 13:40 . 2008-04-23 06:41 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-07-30 13:40 . 2008-05-15 16:15 53,168 --a------ C:\Windows\System32\drivers\MpFilter.sys
2008-07-30 13:38 . 2008-08-25 22:29 <REP> d-------- C:\Program Files\Microsoft Windows OneCare Live
2008-07-30 13:32 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-07-30 13:32 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
2008-07-30 13:32 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
2008-07-30 13:29 . 2008-03-08 04:08 4,240,384 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-07-30 13:29 . 2008-04-26 10:25 3,600,952 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-07-30 13:29 . 2008-04-26 10:25 3,549,240 --a------ C:\Windows\System32\ntoskrnl.exe
2008-07-30 13:29 . 2008-03-08 06:21 1,695,744 --a------ C:\Windows\System32\gameux.dll
2008-07-30 13:29 . 2008-04-26 10:26 891,448 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-07-30 13:29 . 2008-04-12 05:32 784,896 --a------ C:\Windows\System32\rpcrt4.dll
2008-07-30 13:29 . 2008-05-10 05:35 564,736 --a------ C:\Windows\System32\emdmgmt.dll
2008-07-30 13:29 . 2008-04-05 03:21 72,192 --a------ C:\Windows\System32\drivers\pacer.sys
2008-07-30 13:29 . 2008-04-05 05:34 15,360 --a------ C:\Windows\System32\pacerprf.dll
2008-07-30 13:27 . 2008-07-30 13:58 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-30 13:26 . 2008-07-31 17:08 <REP> d-------- C:\Program Files\Windows Live
2008-07-30 13:25 . 2008-04-26 10:08 1,314,816 --a------ C:\Windows\System32\quartz.dll
2008-07-30 13:19 . 2008-07-30 13:19 <REP> d-------- C:\Users\All Users\Google
2008-07-30 13:19 . 2008-08-15 00:11 <REP> d-------- C:\Program Files\Google
2008-07-30 13:17 . 2008-07-30 13:57 <REP> d-------- C:\Users\All Users\WLInstaller
2008-07-30 13:17 . 2008-07-30 13:57 <REP> d-------- C:\ProgramData\WLInstaller
2008-07-30 12:20 . 2008-07-30 12:20 <REP> dr------- C:\Users\Nicoli\Searches
2008-07-30 12:20 . 2008-08-23 23:34 <REP> dr------- C:\Users\Nicoli\Contacts
2008-07-30 12:20 . 2008-07-30 12:20 81 --a------ C:\Windows\System32\LOG
2008-07-30 12:20 . 2008-07-30 12:20 44 --a------ C:\Windows\system\hpsysdrv.dat
2008-07-30 12:16 . 2008-07-30 12:16 <REP> d-------- C:\Users\All Users\Electronic Arts
2008-07-30 12:16 . 2008-07-30 12:16 <REP> d-------- C:\ProgramData\Electronic Arts
2008-07-30 12:12 . 2008-07-30 12:16 <REP> d-------- C:\Program Files\Electronic Arts
2008-07-30 12:11 . 2008-07-30 12:11 <REP> d-------- C:\Program Files\HPQ
2008-07-30 12:11 . 2008-07-30 12:11 <REP> d-------- C:\Program Files\Common Files\LightScribe
2008-07-30 12:10 . 2008-07-30 12:10 0 -rahs---- C:\Windows\System32\drivers\103C_HP_cNB_Presario A900 Notebook PC_Y5335KV_0U_QCND8253W3R_E482590-051_4A_I30ED_SHP_V83.21_F.33_T080429_WV3-1_L40C_M3062_J160_7Intel_86FD_92.00_#080730_N10EC8139;168C001C_(FM211EA#ABF)_XMOBILE_CN10_Z_2F.33.MRK
2008-07-30 12:09 . 2008-07-30 16:05 <REP> dr------- C:\Users\Nicoli\Videos
2008-07-30 12:09 . 2008-08-07 20:48 <REP> dr------- C:\Users\Nicoli\Saved Games
2008-07-30 12:09 . 2008-08-24 13:33 <REP> dr------- C:\Users\Nicoli\Pictures
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-22 10:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-14 09:32 --------- d-----w C:\Program Files\Windows Mail
2008-08-14 00:23 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-07 18:48 --------- d-----w C:\ProgramData\WildTangent
2008-07-30 12:35 --------- d-----w C:\ProgramData\CyberLink
2008-07-30 11:20 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-07-30 11:18 --------- d-----w C:\Program Files\Java
2008-07-30 11:16 --------- d-----w C:\ProgramData\Symantec
2008-07-30 10:21 --------- d-----w C:\ProgramData\Hewlett-Packard
2008-07-30 10:04 --------- d-sh--w C:\ProgramData\Modèles
2008-07-30 10:04 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-07-30 10:04 --------- d-sh--w C:\ProgramData\Favoris
2008-07-30 10:04 --------- d-sh--w C:\ProgramData\Bureau
2008-07-30 10:04 --------- d-sh--w C:\Program Files\Fichiers communs
2008-07-18 18:39 587,264 ----a-w C:\Windows\WLXPGSS.SCR
2008-06-12 05:28 541,696 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll
2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 34,816 ----a-w C:\Windows\System32\msscb.dll
2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 11,776 ----a-w C:\Windows\System32\msshooks.dll
2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
2008-05-27 04:59 18,904 ----a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin
2008-05-27 04:59 106,605 ----a-w C:\Windows\System32\StructuredQuerySchema.bin
2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-21 04:23 1233920]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 17:36 455968]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2008-07-24 14:22 243072]
"ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2008-07-29 15:41 1213680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-08-28 14:43 141848]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-08-28 14:43 154136]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-08-28 14:43 137752]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-06-30 12:14 159744]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 15:44 178712]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-12-19 19:27 468264]
"UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 16:32 222504]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 17:24 54840]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 16:15 480560]
"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [2008-06-25 06:48 67112]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DC9FE3DB-6BE8-4D95-9D7E-4F9EAEE750D9}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{06A686F4-75BC-4259-B286-C0B71492019B}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{F4B32B59-D931-4ABB-8151-C138A7853338}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AEB37F41-6F5A-4BF1-8FA6-DA77D37284A0}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{80323D2D-86FD-4A68-B2E5-6A5ED3F36C3C}"= C:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{1C33E29A-A77C-4144-8B9A-52A9291B05CA}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{A403E1BB-06A3-47C4-AA57-4E7B7851CE7E}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{012C7CFC-796B-4A35-A615-99403638B346}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{3762E29A-9AAD-404A-BAB4-6E5DDB0EAAFE}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{3D4DFC70-BD7B-4E0C-958F-43DECB4B0A1A}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{404C0952-84D5-4ACD-AC54-162E32AD67E1}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{3A42597B-1B66-4971-8C48-2806326CA286}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{1C14C589-2C86-4E6F-8A1F-DB5D44FAC216}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{F73FA812-B398-4D9A-AC0B-2A7A28AC8399}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{772A99AF-8026-4CE2-9A71-FA2FCD3E249E}"= UDP:4662:emuletcp
"{DA0B3783-38BD-4BE0-9E27-76FF7E95471A}"= TCP:4672:emuleudp
"{0E2CA898-B17F-4585-B627-D8A198EEBA0E}"= UDP:63331:Windows Live OneCare
"{0C87BD26-48EF-4B48-98CF-01DF082E9D59}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{4AF1F07D-DAD5-438C-8313-09F1184E108B}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{F287762B-4A2E-4260-BA3C-D35B7A79A791}"= UDP:63331:Windows Live OneCare
"{A95B1987-7B2F-4186-9C14-E54A92045C0D}"= UDP:63331:Windows Live OneCare
"{F2878983-B0F5-4C7E-AAD7-CB135AD220EB}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{B0459D65-477D-4520-AAF5-6E30D90781FC}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R2 OcHealthMon;Windows Live OneCare Health Monitor;C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe [2008-06-25 06:47]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service;C:\Windows\system32\drivers\CHDRT32.sys [2008-02-27 06:26]
R3 RTSTOR;USB Mass Storage Device;C:\Windows\system32\drivers\RTSTOR.SYS [2007-09-27 17:33]
S3 GameConsoleService;GameConsoleService;C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe [2008-05-06 00:25]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 21:46]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 21:46]
S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 04:23]
S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 04:23]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ff2fcef-5e1e-11dd-925c-806e6f6e6963}]
\shell\AutoRun\command - E:\Reg\setup.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.orange.fr/
R0 -: HKLM-Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=81&bd=Presario&pf=laptop
O8 -: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 -: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 -: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.13\MediaManager\grab.html
O17 -: HKLM\CCS\Interface\{EDCA6CA3-CE2A-4A4F-B8C4-F0A81E88F06F}: NameServer = 192.168.1.1
O16 -: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game13.zylom.com/activex/zylomgamesplayer.cab
C:\Windows\Downloaded Program Files\ZylomGamesPlayer.inf
C:\Windows\Downloaded Program Files\zylomgamesplayer.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-25 22:42:43
Windows 6.0.6001 Service Pack 1 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-08-25 22:43:58
ComboFix-quarantined-files.txt 2008-08-25 20:43:56
Pre-Run: 98,175,164,416 octets libres
Post-Run: 98,159,611,904 octets libres
284 --- E O F --- 2008-08-14 00:24:10
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1998 [GMT 2:00]
Endroit: C:\Users\Nicoli\Desktop\ComboFix.exe
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\KBL.LOG
.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-25 to 2008-08-25 ))))))))))))))))))))))))))))))))))))
.
2008-08-25 22:00 . 2008-08-25 22:00 <REP> d-------- C:\Program Files\Real
2008-08-25 22:00 . 2008-08-25 22:04 <REP> d-------- C:\Program Files\Common Files\Real
2008-08-25 21:54 . 2008-08-25 21:56 <REP> d-------- C:\Program Files\WMVTOAVI
2008-08-25 21:50 . 2008-08-25 21:56 <REP> d-------- C:\Program Files\VideoLAN
2008-08-24 18:00 . 2008-08-24 18:00 <REP> d-------- C:\Users\All Users\PlayFirst
2008-08-24 18:00 . 2008-08-24 18:00 <REP> d-------- C:\ProgramData\PlayFirst
2008-08-22 12:28 . 2008-08-22 12:28 <REP> d-------- C:\Program Files\EMME
2008-08-21 10:17 . 2008-08-21 10:17 <REP> d-------- C:\Program Files\Trend Micro
2008-08-17 14:55 . 2008-08-17 14:55 <REP> d-------- C:\Program Files\MP3 Player Utilities 4.13
2008-08-16 23:35 . 2008-08-16 23:35 <REP> d-------- C:\Windows\System32\QuickTime
2008-08-16 23:35 . 2008-08-16 23:35 <REP> d-------- C:\Program Files\QuickTime
2008-08-16 23:35 . 1999-11-10 11:05 86,016 --a------ C:\Windows\unvise32qt.exe
2008-08-16 23:35 . 2008-08-16 23:35 54,812 --a------ C:\Windows\System32\QuickTime.qtp
2008-08-16 23:34 . 2008-08-16 23:34 <REP> d-------- C:\Program Files\Motus
2008-08-16 20:29 . 2008-08-16 20:29 <REP> d-------- C:\Program Files\TVAnts
2008-08-16 20:01 . 2008-08-16 20:01 <REP> d-------- C:\Users\All Users\TVU Networks
2008-08-16 20:01 . 2008-08-16 20:01 <REP> d-------- C:\ProgramData\TVU Networks
2008-08-16 20:00 . 2008-08-16 20:00 <REP> d-------- C:\Program Files\TVUPlayer
2008-08-15 18:59 . 2008-08-15 18:59 <REP> d-------- C:\Program Files\AxBx
2008-08-15 12:19 . 2008-08-15 12:19 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-08-15 12:19 . 2008-08-15 12:19 <REP> d-------- C:\ProgramData\Malwarebytes
2008-08-15 12:19 . 2008-08-15 12:19 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-15 12:19 . 2008-07-30 20:07 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-08-15 12:19 . 2008-07-30 20:07 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-08-15 00:08 . 2008-08-15 00:08 <REP> d-------- C:\Program Files\CCleaner
2008-08-15 00:00 . 2008-08-25 17:17 <REP> d-------- C:\Users\All Users\Google Updater
2008-08-15 00:00 . 2008-08-25 17:17 <REP> d-------- C:\ProgramData\Google Updater
2008-08-14 23:49 . 2008-08-15 19:01 <REP> d-a------ C:\Users\All Users\TEMP
2008-08-14 23:49 . 2008-08-15 19:01 <REP> d-a------ C:\ProgramData\TEMP
2008-08-14 02:23 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-14 02:19 . 2008-06-27 03:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-14 02:19 . 2008-06-27 06:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-14 02:19 . 2008-04-10 07:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-14 02:19 . 2008-06-19 05:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-14 02:19 . 2008-04-18 07:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-10 11:30 . 2008-08-10 11:30 <REP> d-------- C:\Users\All Users\AOL OCP
2008-08-10 11:30 . 2008-08-10 11:30 <REP> d-------- C:\Users\All Users\AOL
2008-08-10 11:30 . 2008-08-10 11:30 <REP> d-------- C:\ProgramData\AOL OCP
2008-08-10 11:30 . 2008-08-10 11:30 <REP> d-------- C:\ProgramData\AOL
2008-08-05 12:42 . 2008-08-05 12:42 <REP> d-------- C:\Users\All Users\Microgaming
2008-08-05 12:42 . 2008-08-05 12:42 <REP> d-------- C:\Users\All Users\MGS
2008-08-05 12:42 . 2008-08-05 12:42 <REP> d-------- C:\ProgramData\Microgaming
2008-08-05 12:42 . 2008-08-05 12:42 <REP> d-------- C:\ProgramData\MGS
2008-08-05 12:41 . 2008-08-05 12:41 <REP> d-------- C:\Windows\System32\FlashAX
2008-08-05 12:41 . 2008-08-05 12:41 <REP> d-------- C:\MicroGaming
2008-08-01 11:37 . 2006-11-28 21:46 28,224 --a------ C:\Windows\System32\drivers\PCAMp50.sys
2008-08-01 11:37 . 2006-11-28 21:46 27,072 --a------ C:\Windows\System32\drivers\PCASp50.sys
2008-08-01 11:31 . 2008-08-01 11:31 <REP> d-------- C:\Program Files\Securitoo
2008-08-01 11:31 . 2008-08-01 11:31 <REP> d-------- C:\Program Files\Inventel
2008-07-31 03:01 . 2008-07-31 03:01 <REP> d-------- C:\Program Files\MSXML 4.0
2008-07-30 16:06 . 2008-07-30 16:06 <REP> d-------- C:\Users\All Users\Messenger Plus!
2008-07-30 16:06 . 2008-07-30 16:06 <REP> d-------- C:\ProgramData\Messenger Plus!
2008-07-30 16:04 . 2008-07-30 16:04 <REP> d-------- C:\Users\All Users\Logitech
2008-07-30 16:04 . 2008-07-31 16:58 <REP> d-------- C:\Users\All Users\Logishrd
2008-07-30 16:04 . 2008-07-30 16:04 <REP> d-------- C:\ProgramData\Logitech
2008-07-30 16:04 . 2008-07-31 16:58 <REP> d-------- C:\ProgramData\Logishrd
2008-07-30 16:00 . 2008-07-31 16:58 <REP> d-------- C:\Program Files\Common Files\logishrd
2008-07-30 15:42 . 2008-07-30 15:42 <REP> d-------- C:\Program Files\Common Files\Adobe
2008-07-30 14:33 . 2008-08-13 16:25 <REP> d-------- C:\Program Files\PKR
2008-07-30 14:21 . 2008-05-23 00:22 3,596,288 --a------ C:\Windows\System32\qt-dx331.dll
2008-07-30 14:21 . 2008-07-04 08:34 860,160 --a------ C:\Windows\System32\lameACM.acm
2008-07-30 14:21 . 2008-01-10 14:15 755,027 --a------ C:\Windows\System32\xvidcore.dll
2008-07-30 14:21 . 2004-01-25 18:18 217,088 --a------ C:\Windows\System32\yv12vfw.dll
2008-07-30 14:21 . 2007-09-04 18:56 164,352 --a------ C:\Windows\System32\unrar.dll
2008-07-30 14:21 . 2008-01-10 14:16 159,839 --a------ C:\Windows\System32\xvidvfw.dll
2008-07-30 14:21 . 2007-09-21 02:52 118,784 --a------ C:\Windows\System32\ac3acm.acm
2008-07-30 14:21 . 2008-05-23 00:19 81,920 --a------ C:\Windows\System32\dpl100.dll
2008-07-30 14:21 . 2007-10-03 17:03 414 --a------ C:\Windows\System32\lame_acm.xml
2008-07-30 14:20 . 2008-07-30 14:21 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2008-07-30 14:20 . 2008-05-31 01:22 683,520 --a------ C:\Windows\System32\divx.dll
2008-07-30 14:20 . 2008-06-12 20:36 7,680 --a------ C:\Windows\System32\ff_vfw.dll
2008-07-30 14:20 . 2007-07-10 18:10 547 --a------ C:\Windows\System32\ff_vfw.dll.manifest
2008-07-30 14:14 . 2008-07-30 14:14 <REP> d-------- C:\Users\All Users\IncrediMail
2008-07-30 14:14 . 2008-07-30 14:15 <REP> d-------- C:\Users\All Users\IM
2008-07-30 14:14 . 2008-07-30 14:14 <REP> d-------- C:\ProgramData\IncrediMail
2008-07-30 14:14 . 2008-07-30 14:15 <REP> d-------- C:\ProgramData\IM
2008-07-30 14:14 . 2008-07-30 14:14 <REP> d-------- C:\Program Files\IncrediMail
2008-07-30 14:02 . 2008-07-30 14:02 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-07-30 13:59 . 2008-07-30 13:59 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-07-30 13:59 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll
2008-07-30 13:51 . 2008-07-30 13:51 <REP> d-------- C:\Users\All Users\eMule
2008-07-30 13:51 . 2008-07-30 13:51 <REP> d-------- C:\ProgramData\eMule
2008-07-30 13:50 . 2008-07-30 13:50 <REP> d-------- C:\Program Files\eMule
2008-07-30 13:41 . 2007-11-27 22:45 91,200 --a------ C:\Windows\System32\drivers\msfwdrv.sys
2008-07-30 13:41 . 2007-11-27 22:44 37,440 --a------ C:\Windows\System32\drivers\msfwhlpr.sys
2008-07-30 13:40 . 2008-07-30 13:41 <REP> d----c--- C:\Windows\System32\DRVSTORE
2008-07-30 13:40 . 2008-07-30 13:40 <REP> d-------- C:\Program Files\Common Files\PX Storage Engine
2008-07-30 13:40 . 2008-04-23 06:42 428,544 --a------ C:\Windows\System32\EncDec.dll
2008-07-30 13:40 . 2008-04-23 06:42 293,376 --a------ C:\Windows\System32\psisdecd.dll
2008-07-30 13:40 . 2008-04-23 06:41 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-07-30 13:40 . 2008-04-23 06:41 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-07-30 13:40 . 2008-05-15 16:15 53,168 --a------ C:\Windows\System32\drivers\MpFilter.sys
2008-07-30 13:38 . 2008-08-25 22:29 <REP> d-------- C:\Program Files\Microsoft Windows OneCare Live
2008-07-30 13:32 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-07-30 13:32 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
2008-07-30 13:32 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
2008-07-30 13:29 . 2008-03-08 04:08 4,240,384 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-07-30 13:29 . 2008-04-26 10:25 3,600,952 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-07-30 13:29 . 2008-04-26 10:25 3,549,240 --a------ C:\Windows\System32\ntoskrnl.exe
2008-07-30 13:29 . 2008-03-08 06:21 1,695,744 --a------ C:\Windows\System32\gameux.dll
2008-07-30 13:29 . 2008-04-26 10:26 891,448 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-07-30 13:29 . 2008-04-12 05:32 784,896 --a------ C:\Windows\System32\rpcrt4.dll
2008-07-30 13:29 . 2008-05-10 05:35 564,736 --a------ C:\Windows\System32\emdmgmt.dll
2008-07-30 13:29 . 2008-04-05 03:21 72,192 --a------ C:\Windows\System32\drivers\pacer.sys
2008-07-30 13:29 . 2008-04-05 05:34 15,360 --a------ C:\Windows\System32\pacerprf.dll
2008-07-30 13:27 . 2008-07-30 13:58 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-30 13:26 . 2008-07-31 17:08 <REP> d-------- C:\Program Files\Windows Live
2008-07-30 13:25 . 2008-04-26 10:08 1,314,816 --a------ C:\Windows\System32\quartz.dll
2008-07-30 13:19 . 2008-07-30 13:19 <REP> d-------- C:\Users\All Users\Google
2008-07-30 13:19 . 2008-08-15 00:11 <REP> d-------- C:\Program Files\Google
2008-07-30 13:17 . 2008-07-30 13:57 <REP> d-------- C:\Users\All Users\WLInstaller
2008-07-30 13:17 . 2008-07-30 13:57 <REP> d-------- C:\ProgramData\WLInstaller
2008-07-30 12:20 . 2008-07-30 12:20 <REP> dr------- C:\Users\Nicoli\Searches
2008-07-30 12:20 . 2008-08-23 23:34 <REP> dr------- C:\Users\Nicoli\Contacts
2008-07-30 12:20 . 2008-07-30 12:20 81 --a------ C:\Windows\System32\LOG
2008-07-30 12:20 . 2008-07-30 12:20 44 --a------ C:\Windows\system\hpsysdrv.dat
2008-07-30 12:16 . 2008-07-30 12:16 <REP> d-------- C:\Users\All Users\Electronic Arts
2008-07-30 12:16 . 2008-07-30 12:16 <REP> d-------- C:\ProgramData\Electronic Arts
2008-07-30 12:12 . 2008-07-30 12:16 <REP> d-------- C:\Program Files\Electronic Arts
2008-07-30 12:11 . 2008-07-30 12:11 <REP> d-------- C:\Program Files\HPQ
2008-07-30 12:11 . 2008-07-30 12:11 <REP> d-------- C:\Program Files\Common Files\LightScribe
2008-07-30 12:10 . 2008-07-30 12:10 0 -rahs---- C:\Windows\System32\drivers\103C_HP_cNB_Presario A900 Notebook PC_Y5335KV_0U_QCND8253W3R_E482590-051_4A_I30ED_SHP_V83.21_F.33_T080429_WV3-1_L40C_M3062_J160_7Intel_86FD_92.00_#080730_N10EC8139;168C001C_(FM211EA#ABF)_XMOBILE_CN10_Z_2F.33.MRK
2008-07-30 12:09 . 2008-07-30 16:05 <REP> dr------- C:\Users\Nicoli\Videos
2008-07-30 12:09 . 2008-08-07 20:48 <REP> dr------- C:\Users\Nicoli\Saved Games
2008-07-30 12:09 . 2008-08-24 13:33 <REP> dr------- C:\Users\Nicoli\Pictures
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-22 10:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-14 09:32 --------- d-----w C:\Program Files\Windows Mail
2008-08-14 00:23 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-07 18:48 --------- d-----w C:\ProgramData\WildTangent
2008-07-30 12:35 --------- d-----w C:\ProgramData\CyberLink
2008-07-30 11:20 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-07-30 11:18 --------- d-----w C:\Program Files\Java
2008-07-30 11:16 --------- d-----w C:\ProgramData\Symantec
2008-07-30 10:21 --------- d-----w C:\ProgramData\Hewlett-Packard
2008-07-30 10:04 --------- d-sh--w C:\ProgramData\Modèles
2008-07-30 10:04 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-07-30 10:04 --------- d-sh--w C:\ProgramData\Favoris
2008-07-30 10:04 --------- d-sh--w C:\ProgramData\Bureau
2008-07-30 10:04 --------- d-sh--w C:\Program Files\Fichiers communs
2008-07-18 18:39 587,264 ----a-w C:\Windows\WLXPGSS.SCR
2008-06-12 05:28 541,696 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll
2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 34,816 ----a-w C:\Windows\System32\msscb.dll
2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 11,776 ----a-w C:\Windows\System32\msshooks.dll
2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
2008-05-27 04:59 18,904 ----a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin
2008-05-27 04:59 106,605 ----a-w C:\Windows\System32\StructuredQuerySchema.bin
2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-21 04:23 1233920]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 17:36 455968]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2008-07-24 14:22 243072]
"ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2008-07-29 15:41 1213680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-08-28 14:43 141848]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-08-28 14:43 154136]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-08-28 14:43 137752]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-06-30 12:14 159744]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 15:44 178712]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-12-19 19:27 468264]
"UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 16:32 222504]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 17:24 54840]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 16:15 480560]
"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [2008-06-25 06:48 67112]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DC9FE3DB-6BE8-4D95-9D7E-4F9EAEE750D9}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{06A686F4-75BC-4259-B286-C0B71492019B}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{F4B32B59-D931-4ABB-8151-C138A7853338}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AEB37F41-6F5A-4BF1-8FA6-DA77D37284A0}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{80323D2D-86FD-4A68-B2E5-6A5ED3F36C3C}"= C:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{1C33E29A-A77C-4144-8B9A-52A9291B05CA}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{A403E1BB-06A3-47C4-AA57-4E7B7851CE7E}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{012C7CFC-796B-4A35-A615-99403638B346}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{3762E29A-9AAD-404A-BAB4-6E5DDB0EAAFE}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{3D4DFC70-BD7B-4E0C-958F-43DECB4B0A1A}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{404C0952-84D5-4ACD-AC54-162E32AD67E1}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{3A42597B-1B66-4971-8C48-2806326CA286}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{1C14C589-2C86-4E6F-8A1F-DB5D44FAC216}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{F73FA812-B398-4D9A-AC0B-2A7A28AC8399}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{772A99AF-8026-4CE2-9A71-FA2FCD3E249E}"= UDP:4662:emuletcp
"{DA0B3783-38BD-4BE0-9E27-76FF7E95471A}"= TCP:4672:emuleudp
"{0E2CA898-B17F-4585-B627-D8A198EEBA0E}"= UDP:63331:Windows Live OneCare
"{0C87BD26-48EF-4B48-98CF-01DF082E9D59}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{4AF1F07D-DAD5-438C-8313-09F1184E108B}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{F287762B-4A2E-4260-BA3C-D35B7A79A791}"= UDP:63331:Windows Live OneCare
"{A95B1987-7B2F-4186-9C14-E54A92045C0D}"= UDP:63331:Windows Live OneCare
"{F2878983-B0F5-4C7E-AAD7-CB135AD220EB}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{B0459D65-477D-4520-AAF5-6E30D90781FC}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R2 OcHealthMon;Windows Live OneCare Health Monitor;C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe [2008-06-25 06:47]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service;C:\Windows\system32\drivers\CHDRT32.sys [2008-02-27 06:26]
R3 RTSTOR;USB Mass Storage Device;C:\Windows\system32\drivers\RTSTOR.SYS [2007-09-27 17:33]
S3 GameConsoleService;GameConsoleService;C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe [2008-05-06 00:25]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 21:46]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 21:46]
S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 04:23]
S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 04:23]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ff2fcef-5e1e-11dd-925c-806e6f6e6963}]
\shell\AutoRun\command - E:\Reg\setup.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.orange.fr/
R0 -: HKLM-Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=81&bd=Presario&pf=laptop
O8 -: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 -: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 -: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.13\MediaManager\grab.html
O17 -: HKLM\CCS\Interface\{EDCA6CA3-CE2A-4A4F-B8C4-F0A81E88F06F}: NameServer = 192.168.1.1
O16 -: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game13.zylom.com/activex/zylomgamesplayer.cab
C:\Windows\Downloaded Program Files\ZylomGamesPlayer.inf
C:\Windows\Downloaded Program Files\zylomgamesplayer.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-25 22:42:43
Windows 6.0.6001 Service Pack 1 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-08-25 22:43:58
ComboFix-quarantined-files.txt 2008-08-25 20:43:56
Pre-Run: 98,175,164,416 octets libres
Post-Run: 98,159,611,904 octets libres
284 --- E O F --- 2008-08-14 00:24:10
