Probleme fermeture de programmes//PC infecté?
lostboy
-
lostboy -
lostboy -
Bonjour,
Il y a quelques semaines de cela j'ai été infecté par des téléchargeurs de trojan, entres autres, dans mon fichier "comrepl.exe".
Je pensais les avoir correctement supprimé, mais apparemment ce n'est pas le cas depuis quelques jours mes programmes se ferment tout seuls, et windows me signale très souvent que tel ou tel processus a été arrêté.
Mon antivirus (Avira Antivir Personal) ne détecte rien, et mon ordinateur continue a délirer.
J'ai fait un rapport HijackThis que je poste ci-dessous, si quelqu'un pouvait m'aider je lui en serait extrêmement reconnaissant.
Merci d'avance.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:17:10, on 29/08/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Users\JRMY~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAP\DAP.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wermgr.exe
C:\Users\Jérémy\Desktop\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = file://C:\PROGRA~1\SPEEDB~1\vaproxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PLFSetL] C:\Windows\PLFSetL.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ComRepl] C:\Users\Jérémy\AppData\Roaming\comrepl.exe /com /w
O4 - HKCU\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
Il y a quelques semaines de cela j'ai été infecté par des téléchargeurs de trojan, entres autres, dans mon fichier "comrepl.exe".
Je pensais les avoir correctement supprimé, mais apparemment ce n'est pas le cas depuis quelques jours mes programmes se ferment tout seuls, et windows me signale très souvent que tel ou tel processus a été arrêté.
Mon antivirus (Avira Antivir Personal) ne détecte rien, et mon ordinateur continue a délirer.
J'ai fait un rapport HijackThis que je poste ci-dessous, si quelqu'un pouvait m'aider je lui en serait extrêmement reconnaissant.
Merci d'avance.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:17:10, on 29/08/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Users\JRMY~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAP\DAP.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wermgr.exe
C:\Users\Jérémy\Desktop\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = file://C:\PROGRA~1\SPEEDB~1\vaproxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PLFSetL] C:\Windows\PLFSetL.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ComRepl] C:\Users\Jérémy\AppData\Roaming\comrepl.exe /com /w
O4 - HKCU\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
A voir également:
- Probleme fermeture de programmes//PC infecté?
- Reinitialiser pc - Guide
- Pc lent - Guide
- Downloader for pc - Télécharger - Téléchargement & Transfert
- Forcer demarrage pc - Guide
- Double ecran pc - Guide
17 réponses
analyse ce fichier sur virus total et colles le rapport: https://www.virustotal.com/gui/
C:\Users\Jérémy\AppData\Roaming\comrepl.exe
__________________
colle un rapport avec malwarebyte antimalware après suppression de ce qui a été trouvé:
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
C:\Users\Jérémy\AppData\Roaming\comrepl.exe
__________________
colle un rapport avec malwarebyte antimalware après suppression de ce qui a été trouvé:
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Voila le rapport:
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.8.29.0 2008.08.29 Win-Trojan/Downloader.53248.DG
AntiVir 7.8.1.23 2008.08.29 TR/Agent.YQW.19
Authentium 5.1.0.4 2008.08.29 -
Avast 4.8.1195.0 2008.08.28 Win32:Trojan-gen {Other}
AVG 8.0.0.161 2008.08.29 Small.AKZ
BitDefender 7.2 2008.08.29 Trojan.Packed.20344
CAT-QuickHeal 9.50 2008.08.26 Trojan.Agent.yqw
ClamAV 0.93.1 2008.08.29 Trojan.Agent-42543
DrWeb 4.44.0.09170 2008.08.29 Trojan.DownLoad.3206
eSafe 7.0.17.0 2008.08.28 Win32.Agent.yqw
eTrust-Vet 31.6.6055 2008.08.29 -
Ewido 4.0 2008.08.28 -
F-Prot 4.4.4.56 2008.08.29 -
F-Secure 7.60.13501.0 2008.08.29 Trojan.Win32.Agent.yqw
Fortinet 3.14.0.0 2008.08.29 W32/Agent.YQW!tr
GData 19 2008.08.29 Trojan.Win32.Agent.yqw
Ikarus T3.1.1.34.0 2008.08.29 Virus.Trojan.Win32.Agent.yqw
K7AntiVirus 7.10.431 2008.08.29 Trojan.Win32.Agent.yqw
Kaspersky 7.0.0.125 2008.08.29 Trojan.Win32.Agent.yqw
McAfee 5372 2008.08.28 -
Microsoft 1.3807 2008.08.25 -
NOD32v2 3397 2008.08.28 -
Norman 5.80.02 2008.08.28 W32/Agent.GWRG
Panda 9.0.0.4 2008.08.29 Trj/Agent.JRE
PCTools 4.4.2.0 2008.08.28 -
Prevx1 V2 2008.08.29 Malicious Software
Rising 20.59.41.00 2008.08.29 -
Sophos 4.33.0 2008.08.29 -
Sunbelt 3.1.1592.1 2008.08.29 Trojan.Win32.Agent.yqw
Symantec 10 2008.08.29 -
TheHacker 6.3.0.6.064 2008.08.27 -
TrendMicro 8.700.0.1004 2008.08.29 -
VBA32 3.12.8.4 2008.08.29 Trojan.DownLoad.3206
ViRobot 2008.8.29.1355 2008.08.29 Trojan.Win32.Agent.53248.S
VirusBuster 4.5.11.0 2008.08.28 -
Webwasher-Gateway 6.6.2 2008.08.29 Trojan.Agent.YQW.19
Information additionnelle
File size: 53248 bytes
MD5...: ff99cc4a4acf076566461006949f4731
SHA1..: 5d55cea6b9476719a77ea039b1a8722c81d38c21
SHA256: 4ca56c529fba67cbc61299b0989e039efb200d6901d5b41d8a40f05b9b506417
SHA512: d9e16b6cdcf3f5bbe1a4298b11172e88c2bae5ec4f992ab2d86a9fedc2293000
60bf23533e4a9fc2b61aaeef339036930754b2ee82dc8e71807398d705f7a80c
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x4039ae
timedatestamp.....: 0x488d1e8d (Mon Jul 28 01:19:09 2008)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x81cf 0x9000 6.21 6d796a0ace6afe058af6f8066a578fe2
.rdata 0xa000 0x1a30 0x2000 4.56 982e5476d689c5ece91e467d7758eb3a
.data 0xc000 0x49d8 0x1000 1.48 65b9da513847e1016cfc46fabed8d84e
( 4 imports )
> ADVAPI32.dll: RegSetValueExA, RegCloseKey, RegOpenKeyExA, RegQueryValueExA, RegCreateKeyExA
> WS2_32.dll: -
> WININET.dll: InternetCloseHandle, InternetReadFile, HttpQueryInfoA, InternetOpenA, InternetOpenUrlA
> KERNEL32.dll: GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, MultiByteToWideChar, OpenMutexA, CreateMutexA, CloseHandle, GetVolumeInformationA, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLocalTime, LoadLibraryA, GetModuleFileNameA, SetEnvironmentVariableA, GetEnvironmentVariableA, ReadFile, CreateFileA, WriteFile, CreateProcessA, GlobalFree, CopyFileA, CreateThread, GlobalAlloc, GetCurrentProcess, GetProcAddress, ExitProcess, RtlUnwind, GetModuleHandleA, TerminateProcess, GetStartupInfoA, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetLastError, GetEnvironmentStringsW, SetHandleCount, GetFileType, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, HeapAlloc, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, HeapReAlloc, HeapSize, GetACP, GetOEMCP, GetCPInfo, VirtualAlloc, SetStdHandle, LCMapStringA
( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=B35B86F000D12F8AD0A700C4DD81C300A5EBF614
Mais je ne sais pas comment supprimer ce qui a été trouvé... :s
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.8.29.0 2008.08.29 Win-Trojan/Downloader.53248.DG
AntiVir 7.8.1.23 2008.08.29 TR/Agent.YQW.19
Authentium 5.1.0.4 2008.08.29 -
Avast 4.8.1195.0 2008.08.28 Win32:Trojan-gen {Other}
AVG 8.0.0.161 2008.08.29 Small.AKZ
BitDefender 7.2 2008.08.29 Trojan.Packed.20344
CAT-QuickHeal 9.50 2008.08.26 Trojan.Agent.yqw
ClamAV 0.93.1 2008.08.29 Trojan.Agent-42543
DrWeb 4.44.0.09170 2008.08.29 Trojan.DownLoad.3206
eSafe 7.0.17.0 2008.08.28 Win32.Agent.yqw
eTrust-Vet 31.6.6055 2008.08.29 -
Ewido 4.0 2008.08.28 -
F-Prot 4.4.4.56 2008.08.29 -
F-Secure 7.60.13501.0 2008.08.29 Trojan.Win32.Agent.yqw
Fortinet 3.14.0.0 2008.08.29 W32/Agent.YQW!tr
GData 19 2008.08.29 Trojan.Win32.Agent.yqw
Ikarus T3.1.1.34.0 2008.08.29 Virus.Trojan.Win32.Agent.yqw
K7AntiVirus 7.10.431 2008.08.29 Trojan.Win32.Agent.yqw
Kaspersky 7.0.0.125 2008.08.29 Trojan.Win32.Agent.yqw
McAfee 5372 2008.08.28 -
Microsoft 1.3807 2008.08.25 -
NOD32v2 3397 2008.08.28 -
Norman 5.80.02 2008.08.28 W32/Agent.GWRG
Panda 9.0.0.4 2008.08.29 Trj/Agent.JRE
PCTools 4.4.2.0 2008.08.28 -
Prevx1 V2 2008.08.29 Malicious Software
Rising 20.59.41.00 2008.08.29 -
Sophos 4.33.0 2008.08.29 -
Sunbelt 3.1.1592.1 2008.08.29 Trojan.Win32.Agent.yqw
Symantec 10 2008.08.29 -
TheHacker 6.3.0.6.064 2008.08.27 -
TrendMicro 8.700.0.1004 2008.08.29 -
VBA32 3.12.8.4 2008.08.29 Trojan.DownLoad.3206
ViRobot 2008.8.29.1355 2008.08.29 Trojan.Win32.Agent.53248.S
VirusBuster 4.5.11.0 2008.08.28 -
Webwasher-Gateway 6.6.2 2008.08.29 Trojan.Agent.YQW.19
Information additionnelle
File size: 53248 bytes
MD5...: ff99cc4a4acf076566461006949f4731
SHA1..: 5d55cea6b9476719a77ea039b1a8722c81d38c21
SHA256: 4ca56c529fba67cbc61299b0989e039efb200d6901d5b41d8a40f05b9b506417
SHA512: d9e16b6cdcf3f5bbe1a4298b11172e88c2bae5ec4f992ab2d86a9fedc2293000
60bf23533e4a9fc2b61aaeef339036930754b2ee82dc8e71807398d705f7a80c
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x4039ae
timedatestamp.....: 0x488d1e8d (Mon Jul 28 01:19:09 2008)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x81cf 0x9000 6.21 6d796a0ace6afe058af6f8066a578fe2
.rdata 0xa000 0x1a30 0x2000 4.56 982e5476d689c5ece91e467d7758eb3a
.data 0xc000 0x49d8 0x1000 1.48 65b9da513847e1016cfc46fabed8d84e
( 4 imports )
> ADVAPI32.dll: RegSetValueExA, RegCloseKey, RegOpenKeyExA, RegQueryValueExA, RegCreateKeyExA
> WS2_32.dll: -
> WININET.dll: InternetCloseHandle, InternetReadFile, HttpQueryInfoA, InternetOpenA, InternetOpenUrlA
> KERNEL32.dll: GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, MultiByteToWideChar, OpenMutexA, CreateMutexA, CloseHandle, GetVolumeInformationA, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLocalTime, LoadLibraryA, GetModuleFileNameA, SetEnvironmentVariableA, GetEnvironmentVariableA, ReadFile, CreateFileA, WriteFile, CreateProcessA, GlobalFree, CopyFileA, CreateThread, GlobalAlloc, GetCurrentProcess, GetProcAddress, ExitProcess, RtlUnwind, GetModuleHandleA, TerminateProcess, GetStartupInfoA, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetLastError, GetEnvironmentStringsW, SetHandleCount, GetFileType, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, HeapAlloc, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, HeapReAlloc, HeapSize, GetACP, GetOEMCP, GetCPInfo, VirtualAlloc, SetStdHandle, LCMapStringA
( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=B35B86F000D12F8AD0A700C4DD81C300A5EBF614
Mais je ne sais pas comment supprimer ce qui a été trouvé... :s
Voila le rapport:
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.8.29.0 2008.08.29 Win-Trojan/Downloader.53248.DG
AntiVir 7.8.1.23 2008.08.29 TR/Agent.YQW.19
Authentium 5.1.0.4 2008.08.29 -
Avast 4.8.1195.0 2008.08.28 Win32:Trojan-gen {Other}
AVG 8.0.0.161 2008.08.29 Small.AKZ
BitDefender 7.2 2008.08.29 Trojan.Packed.20344
CAT-QuickHeal 9.50 2008.08.26 Trojan.Agent.yqw
ClamAV 0.93.1 2008.08.29 Trojan.Agent-42543
DrWeb 4.44.0.09170 2008.08.29 Trojan.DownLoad.3206
eSafe 7.0.17.0 2008.08.28 Win32.Agent.yqw
eTrust-Vet 31.6.6055 2008.08.29 -
Ewido 4.0 2008.08.28 -
F-Prot 4.4.4.56 2008.08.29 -
F-Secure 7.60.13501.0 2008.08.29 Trojan.Win32.Agent.yqw
Fortinet 3.14.0.0 2008.08.29 W32/Agent.YQW!tr
GData 19 2008.08.29 Trojan.Win32.Agent.yqw
Ikarus T3.1.1.34.0 2008.08.29 Virus.Trojan.Win32.Agent.yqw
K7AntiVirus 7.10.431 2008.08.29 Trojan.Win32.Agent.yqw
Kaspersky 7.0.0.125 2008.08.29 Trojan.Win32.Agent.yqw
McAfee 5372 2008.08.28 -
Microsoft 1.3807 2008.08.25 -
NOD32v2 3397 2008.08.28 -
Norman 5.80.02 2008.08.28 W32/Agent.GWRG
Panda 9.0.0.4 2008.08.29 Trj/Agent.JRE
PCTools 4.4.2.0 2008.08.28 -
Prevx1 V2 2008.08.29 Malicious Software
Rising 20.59.41.00 2008.08.29 -
Sophos 4.33.0 2008.08.29 -
Sunbelt 3.1.1592.1 2008.08.29 Trojan.Win32.Agent.yqw
Symantec 10 2008.08.29 -
TheHacker 6.3.0.6.064 2008.08.27 -
TrendMicro 8.700.0.1004 2008.08.29 -
VBA32 3.12.8.4 2008.08.29 Trojan.DownLoad.3206
ViRobot 2008.8.29.1355 2008.08.29 Trojan.Win32.Agent.53248.S
VirusBuster 4.5.11.0 2008.08.28 -
Webwasher-Gateway 6.6.2 2008.08.29 Trojan.Agent.YQW.19
Information additionnelle
File size: 53248 bytes
MD5...: ff99cc4a4acf076566461006949f4731
SHA1..: 5d55cea6b9476719a77ea039b1a8722c81d38c21
SHA256: 4ca56c529fba67cbc61299b0989e039efb200d6901d5b41d8a40f05b9b506417
SHA512: d9e16b6cdcf3f5bbe1a4298b11172e88c2bae5ec4f992ab2d86a9fedc2293000
60bf23533e4a9fc2b61aaeef339036930754b2ee82dc8e71807398d705f7a80c
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x4039ae
timedatestamp.....: 0x488d1e8d (Mon Jul 28 01:19:09 2008)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x81cf 0x9000 6.21 6d796a0ace6afe058af6f8066a578fe2
.rdata 0xa000 0x1a30 0x2000 4.56 982e5476d689c5ece91e467d7758eb3a
.data 0xc000 0x49d8 0x1000 1.48 65b9da513847e1016cfc46fabed8d84e
( 4 imports )
> ADVAPI32.dll: RegSetValueExA, RegCloseKey, RegOpenKeyExA, RegQueryValueExA, RegCreateKeyExA
> WS2_32.dll: -
> WININET.dll: InternetCloseHandle, InternetReadFile, HttpQueryInfoA, InternetOpenA, InternetOpenUrlA
> KERNEL32.dll: GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, MultiByteToWideChar, OpenMutexA, CreateMutexA, CloseHandle, GetVolumeInformationA, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLocalTime, LoadLibraryA, GetModuleFileNameA, SetEnvironmentVariableA, GetEnvironmentVariableA, ReadFile, CreateFileA, WriteFile, CreateProcessA, GlobalFree, CopyFileA, CreateThread, GlobalAlloc, GetCurrentProcess, GetProcAddress, ExitProcess, RtlUnwind, GetModuleHandleA, TerminateProcess, GetStartupInfoA, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetLastError, GetEnvironmentStringsW, SetHandleCount, GetFileType, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, HeapAlloc, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, HeapReAlloc, HeapSize, GetACP, GetOEMCP, GetCPInfo, VirtualAlloc, SetStdHandle, LCMapStringA
( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=B35B86F000D12F8AD0A700C4DD81C300A5EBF614
Mais je ne sais pas comment supprimer ce qui a été trouvé... :s
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.8.29.0 2008.08.29 Win-Trojan/Downloader.53248.DG
AntiVir 7.8.1.23 2008.08.29 TR/Agent.YQW.19
Authentium 5.1.0.4 2008.08.29 -
Avast 4.8.1195.0 2008.08.28 Win32:Trojan-gen {Other}
AVG 8.0.0.161 2008.08.29 Small.AKZ
BitDefender 7.2 2008.08.29 Trojan.Packed.20344
CAT-QuickHeal 9.50 2008.08.26 Trojan.Agent.yqw
ClamAV 0.93.1 2008.08.29 Trojan.Agent-42543
DrWeb 4.44.0.09170 2008.08.29 Trojan.DownLoad.3206
eSafe 7.0.17.0 2008.08.28 Win32.Agent.yqw
eTrust-Vet 31.6.6055 2008.08.29 -
Ewido 4.0 2008.08.28 -
F-Prot 4.4.4.56 2008.08.29 -
F-Secure 7.60.13501.0 2008.08.29 Trojan.Win32.Agent.yqw
Fortinet 3.14.0.0 2008.08.29 W32/Agent.YQW!tr
GData 19 2008.08.29 Trojan.Win32.Agent.yqw
Ikarus T3.1.1.34.0 2008.08.29 Virus.Trojan.Win32.Agent.yqw
K7AntiVirus 7.10.431 2008.08.29 Trojan.Win32.Agent.yqw
Kaspersky 7.0.0.125 2008.08.29 Trojan.Win32.Agent.yqw
McAfee 5372 2008.08.28 -
Microsoft 1.3807 2008.08.25 -
NOD32v2 3397 2008.08.28 -
Norman 5.80.02 2008.08.28 W32/Agent.GWRG
Panda 9.0.0.4 2008.08.29 Trj/Agent.JRE
PCTools 4.4.2.0 2008.08.28 -
Prevx1 V2 2008.08.29 Malicious Software
Rising 20.59.41.00 2008.08.29 -
Sophos 4.33.0 2008.08.29 -
Sunbelt 3.1.1592.1 2008.08.29 Trojan.Win32.Agent.yqw
Symantec 10 2008.08.29 -
TheHacker 6.3.0.6.064 2008.08.27 -
TrendMicro 8.700.0.1004 2008.08.29 -
VBA32 3.12.8.4 2008.08.29 Trojan.DownLoad.3206
ViRobot 2008.8.29.1355 2008.08.29 Trojan.Win32.Agent.53248.S
VirusBuster 4.5.11.0 2008.08.28 -
Webwasher-Gateway 6.6.2 2008.08.29 Trojan.Agent.YQW.19
Information additionnelle
File size: 53248 bytes
MD5...: ff99cc4a4acf076566461006949f4731
SHA1..: 5d55cea6b9476719a77ea039b1a8722c81d38c21
SHA256: 4ca56c529fba67cbc61299b0989e039efb200d6901d5b41d8a40f05b9b506417
SHA512: d9e16b6cdcf3f5bbe1a4298b11172e88c2bae5ec4f992ab2d86a9fedc2293000
60bf23533e4a9fc2b61aaeef339036930754b2ee82dc8e71807398d705f7a80c
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x4039ae
timedatestamp.....: 0x488d1e8d (Mon Jul 28 01:19:09 2008)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x81cf 0x9000 6.21 6d796a0ace6afe058af6f8066a578fe2
.rdata 0xa000 0x1a30 0x2000 4.56 982e5476d689c5ece91e467d7758eb3a
.data 0xc000 0x49d8 0x1000 1.48 65b9da513847e1016cfc46fabed8d84e
( 4 imports )
> ADVAPI32.dll: RegSetValueExA, RegCloseKey, RegOpenKeyExA, RegQueryValueExA, RegCreateKeyExA
> WS2_32.dll: -
> WININET.dll: InternetCloseHandle, InternetReadFile, HttpQueryInfoA, InternetOpenA, InternetOpenUrlA
> KERNEL32.dll: GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, MultiByteToWideChar, OpenMutexA, CreateMutexA, CloseHandle, GetVolumeInformationA, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLocalTime, LoadLibraryA, GetModuleFileNameA, SetEnvironmentVariableA, GetEnvironmentVariableA, ReadFile, CreateFileA, WriteFile, CreateProcessA, GlobalFree, CopyFileA, CreateThread, GlobalAlloc, GetCurrentProcess, GetProcAddress, ExitProcess, RtlUnwind, GetModuleHandleA, TerminateProcess, GetStartupInfoA, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetLastError, GetEnvironmentStringsW, SetHandleCount, GetFileType, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, HeapAlloc, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, HeapReAlloc, HeapSize, GetACP, GetOEMCP, GetCPInfo, VirtualAlloc, SetStdHandle, LCMapStringA
( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=B35B86F000D12F8AD0A700C4DD81C300A5EBF614
Mais je ne sais pas comment supprimer ce qui a été trouvé... :s
télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
Citation :
C:\Users\Jérémy\AppData\Roaming\comrepl.exe
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
________________
vire ce qui est dans movedfiles en allant dans POSTE DE TRAVAIL puis C puis OTMOVIT
__________________
colle un rapport avec malwarebyte antimalware après suppression de ce qui a été trouvé:
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
Citation :
C:\Users\Jérémy\AppData\Roaming\comrepl.exe
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
________________
vire ce qui est dans movedfiles en allant dans POSTE DE TRAVAIL puis C puis OTMOVIT
__________________
colle un rapport avec malwarebyte antimalware après suppression de ce qui a été trouvé:
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
VOila le rapport otmoveit,
C:\Users\Jérémy\AppData\Roaming\comrepl.exe moved successfully.
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08292008_120431
J'ai supprimé le contenu du dossier movedfiles, je suis actuellement en train de faire un scan avec malwarebyte antimalware.
C:\Users\Jérémy\AppData\Roaming\comrepl.exe moved successfully.
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08292008_120431
J'ai supprimé le contenu du dossier movedfiles, je suis actuellement en train de faire un scan avec malwarebyte antimalware.
Avant que le scan, ne soit terminé, l'ordinateur a redémarré :s
A peine rallumé il s'est arrêté et a affiché un écran disant qu'un probleme avait été détecté et que windows avait été arrêté afin de prévenir tout dommage...
Que puis-je faire? recommencer un scan? me prendra-t-il aussi longtemps?
A peine rallumé il s'est arrêté et a affiché un écran disant qu'un probleme avait été détecté et que windows avait été arrêté afin de prévenir tout dommage...
Que puis-je faire? recommencer un scan? me prendra-t-il aussi longtemps?
J'ai fait un scan rapide, voici le rapport :
Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1094
Windows 6.0.6001 Service Pack 1
20:27:05 29/08/2008
mbam-log-08-29-2008 (20-27-05).txt
Type de recherche: Examen rapide
Eléments examinés: 40212
Temps écoulé: 2 minute(s), 15 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Il ne détecte rien, cependant, il y a toujours autant de programmes qui plantent... :(
Que faire maintenant?
Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1094
Windows 6.0.6001 Service Pack 1
20:27:05 29/08/2008
mbam-log-08-29-2008 (20-27-05).txt
Type de recherche: Examen rapide
Eléments examinés: 40212
Temps écoulé: 2 minute(s), 15 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Il ne détecte rien, cependant, il y a toujours autant de programmes qui plantent... :(
Que faire maintenant?
télécharge combofix (par sUBs) ici :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
Tu as un tutoriel complet ici :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
Tu as un tutoriel complet ici :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Voila, c'est fait. Et voici le rapport :
ComboFix 08-08-29.01 - Jérémy 2008-08-29 22:07:37.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1898 [GMT 2:00]
Endroit: C:\Users\Jérémy\Desktop\ComboFix.exe
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Users\Jérémy\AppData\Roaming\.#
C:\Windows\system32\AutoRun.inf
C:\Windows\system32\x64
C:\Windows\system32\x64\csnp2uvc.dll
C:\Windows\system32\x64\rsnpvc64.dll
C:\Windows\system32\x64\sncduvc.sys
C:\Windows\system32\x64\snp2uvc.sys
C:\Windows\system32\x64\vsnpvc64.dll
.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-28 to 2008-08-29 ))))))))))))))))))))))))))))))))))))
.
2008-08-29 21:59 . 2008-08-29 21:59 <REP> d--hs---- C:\found.003
2008-08-29 13:57 . 2008-06-19 17:24 28,544 --a------ C:\Windows\System32\drivers\pavboot.sys
2008-08-29 13:55 . 2008-08-29 13:55 <REP> d-------- C:\Program Files\Panda Security
2008-08-29 13:51 . 2008-08-29 14:07 <REP> d-------- C:\Users\Jérémy\.housecall6.6
2008-08-29 13:51 . 2008-08-29 14:07 <REP> d-------- C:\Users\Jérémy\.housecall6.6
2008-08-29 13:48 . 2008-08-29 13:49 <REP> d-------- C:\Program Files\Java
2008-08-29 13:45 . 2008-08-29 13:45 <REP> d-------- C:\Program Files\Common Files\Java
2008-08-29 13:18 . 2008-08-29 13:18 <REP> d--hs---- C:\found.002
2008-08-29 12:11 . 2008-08-29 12:11 <REP> d-------- C:\Users\Jérémy\AppData\Roaming\Malwarebytes
2008-08-29 12:10 . 2008-08-29 12:10 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-08-29 12:10 . 2008-08-29 12:10 <REP> d-------- C:\ProgramData\Malwarebytes
2008-08-29 12:10 . 2008-08-17 15:01 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-08-29 12:10 . 2008-08-17 15:01 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-08-29 12:04 . 2008-08-29 12:04 <REP> d-------- C:\_OTMoveIt
2008-08-29 11:08 . 2008-08-29 11:08 <REP> d-------- C:\Windows\BDOSCAN8
2008-08-27 15:10 . 2008-08-27 15:10 <REP> d--hs---- C:\found.001
2008-08-26 17:31 . 2008-08-26 17:32 <REP> d-------- C:\Program Files\FinePixViewer
2008-08-25 13:50 . 2008-08-25 13:50 <REP> d--hs---- C:\found.000
2008-08-22 22:13 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll
2008-08-22 22:13 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll
2008-08-22 22:13 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll
2008-08-22 22:13 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll
2008-08-22 22:13 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll
2008-08-22 22:13 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe
2008-08-22 22:13 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll
2008-08-22 22:13 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll
2008-08-22 22:13 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-08-20 14:41 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-20 09:28 . 2008-08-20 09:28 <REP> d-------- C:\Users\All Users\Avira
2008-08-20 09:28 . 2008-08-20 09:28 <REP> d-------- C:\ProgramData\Avira
2008-08-20 09:28 . 2008-08-20 09:28 <REP> d-------- C:\Program Files\Avira
2008-08-20 04:15 . 2008-06-27 03:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-20 04:15 . 2008-06-27 06:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-20 04:15 . 2008-06-19 05:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-20 04:15 . 2008-04-18 07:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-20 04:14 . 2008-04-10 07:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-15 18:56 . 2008-08-15 18:56 <REP> d-------- C:\Users\All Users\Xerox
2008-08-15 18:56 . 2008-08-15 18:56 <REP> d-------- C:\ProgramData\Xerox
2008-08-13 19:21 . 2008-08-13 19:21 <REP> d-------- C:\Program Files\Apple Software Update(1)
2008-08-13 19:20 . 2008-08-13 19:20 <REP> d-------- C:\Program Files\iTunes(103)
2008-08-13 19:20 . 2008-08-13 19:20 <REP> d-------- C:\Program Files\iPod(102)
2008-08-11 17:55 . 2008-08-11 17:55 <REP> d-------- C:\Program Files\DivX
2008-08-05 14:42 . 2008-08-05 14:42 <REP> d-------- C:\Users\All Users\WindowsSearch
2008-08-05 14:42 . 2008-08-05 14:42 <REP> d-------- C:\ProgramData\WindowsSearch
2008-07-30 20:51 . 2008-07-30 20:51 <REP> d-------- C:\Program Files\Sunbelt Software
2008-07-30 20:51 . 2008-06-21 04:54 65,576 --a------ C:\Windows\System32\drivers\SbFwIm.sys
2008-07-30 03:23 . 2008-07-30 03:25 <REP> d--h----- C:\Windows\msdownld.tmp
2008-07-30 03:23 . 2008-07-30 03:23 <REP> d--h-c--- C:\Users\All Users\{ECF27DA6-61FA-4DDA-870F-1766B3B8A74E}
2008-07-30 03:23 . 2008-07-30 03:23 <REP> d--h-c--- C:\ProgramData\{ECF27DA6-61FA-4DDA-870F-1766B3B8A74E}
2008-07-30 03:23 . 2008-07-30 03:23 <REP> d-------- C:\Program Files\ffdshow
2008-07-30 03:23 . 2007-04-24 16:30 60,273 --a------ C:\Windows\System32\pthreadGC2.dll
2008-07-30 03:23 . 2008-03-04 12:33 7,680 --a------ C:\Windows\System32\ff_vfw.dll
2008-07-30 03:23 . 2007-07-10 17:10 547 --a------ C:\Windows\System32\ff_vfw.dll.manifest
2008-07-30 03:17 . 2008-07-30 03:17 <REP> d-------- C:\Program Files\Utherverse Digital Inc
2008-07-29 14:40 . 2008-08-29 22:03 <REP> d-a------ C:\Users\All Users\TEMP
2008-07-29 14:40 . 2008-08-29 22:03 <REP> d-a------ C:\ProgramData\TEMP
2008-07-29 14:40 . 2008-08-29 22:04 <REP> d-------- C:\Program Files\SpeedBit Video Accelerator
2008-07-29 14:40 . 2008-07-29 14:43 <REP> d-------- C:\Program Files\DAP
2008-07-29 14:40 . 2008-07-29 14:40 479,298 --a------ C:\Windows\System32\wbocx.ocx
2008-07-29 14:40 . 2008-07-29 14:40 172,032 --a------ C:\Windows\System32\AniGIF.ocx
2008-07-29 14:40 . 2008-07-29 14:40 50,688 --a------ C:\Windows\System32\wbhelp2.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 20:14 2,621,440 --sha-w C:\Users\Jérémy\ntuser.dat
2008-08-29 20:14 2,621,440 --sha-w C:\Users\Jérémy\ntuser.dat
2008-08-29 10:11 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Malwarebytes
2008-08-28 16:30 27,934 ----a-w C:\Users\Jérémy\AppData\Roaming\nvModes.dat
2008-08-26 15:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-26 15:32 --------- d-----w C:\Users\Jérémy\AppData\Roaming\FUJIFILM
2008-08-25 01:28 --------- d-----w C:\Users\Jérémy\AppData\Roaming\gtk-2.0
2008-08-22 15:07 --------- d-----w C:\Program Files\Windows Mail
2008-08-20 12:42 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-20 12:05 --------- d-----w C:\ProgramData\HP Product Assistant
2008-08-20 12:05 --------- d-----w C:\Program Files\eMule
2008-08-20 12:05 --------- d-----w C:\Program Files\Apple Software Update
2008-08-20 08:12 --------- d-----w C:\Program Files\iTunes
2008-08-20 08:12 --------- d-----w C:\Program Files\iPod
2008-08-20 07:35 --------- d-----w C:\Program Files\Microsoft Games
2008-08-15 16:58 --------- d-s---w C:\Users\Jérémy\AppData\Roaming\Microsoft
2008-08-13 17:20 --------- d-----w C:\ProgramData\Apple Computer
2008-07-31 15:44 --------- d-----w C:\Program Files\Common Files\Steam
2008-07-30 18:35 --------- d-----w C:\ProgramData\McAfee
2008-07-30 18:28 --------- d-----w C:\ProgramData\SiteAdvisor
2008-07-28 17:23 --------- d-----w C:\Users\Jérémy\AppData\Roaming\CyberLink
2008-07-28 16:49 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Microsoft Games
2008-07-28 16:23 --------- d-----w C:\Program Files\Common Files\Microsoft Games
2008-07-27 22:11 --------- d-----w C:\Program Files\ATI Technologies
2008-07-27 16:55 --------- d-----w C:\Program Files\ATI
2008-07-25 20:16 --------- d-----w C:\Users\Jérémy\AppData\Roaming\HP
2008-07-25 20:05 --------- d-----w C:\ProgramData\WEBREG
2008-07-25 20:05 --------- d-----w C:\ProgramData\HP
2008-07-25 19:57 --------- d-----w C:\ProgramData\Hewlett-Packard
2008-07-25 19:49 --------- d-----w C:\Users\Jérémy\AppData\Roaming\HPAppData
2008-07-25 19:49 --------- d-----w C:\ProgramData\HPSSUPPLY
2008-07-25 19:49 --------- d-----w C:\Program Files\HP
2008-07-25 19:47 --------- d-----w C:\Program Files\Common Files\HP
2008-07-25 19:46 --------- d-----w C:\Program Files\Hewlett-Packard
2008-07-25 19:46 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2008-07-25 15:59 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-07-22 13:24 --------- d-----w C:\Program Files\Audacity
2008-07-22 11:05 --------- d-----w C:\Program Files\PhotoFiltre
2008-07-22 01:19 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Apple Computer
2008-07-17 23:21 --------- d-----w C:\ProgramData\FLEXnet
2008-07-17 22:22 --------- d-----w C:\Program Files\GIMP-2.0
2008-07-17 22:16 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-17 22:16 --------- d-----w C:\ProgramData\WLInstaller
2008-07-17 22:16 --------- d-----w C:\Program Files\Windows Live
2008-07-17 21:05 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Adobe
2008-07-16 08:34 --------- d-----w C:\Program Files\Safari
2008-07-06 20:23 --------- d-----w C:\ProgramData\Messenger Plus!
2008-07-06 20:22 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-06-30 16:45 --------- d-----w C:\Users\Jérémy\AppData\Roaming\WinRAR
2008-06-30 15:19 --------- d-----w C:\ProgramData\eMule
2008-06-30 14:35 --------- d-----w C:\ProgramData\ALM
2008-06-30 14:35 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-30 14:28 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-06-30 14:18 --------- d-----w C:\Program Files\Adobe Illustrator CS3 Crack
2008-06-30 13:51 --------- d-----w C:\Program Files\Valve
2008-06-29 12:08 --------- d-----w C:\Program Files\Dofus
2008-06-29 10:55 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2008-06-29 10:47 --------- d-----w C:\Program Files\QuickTime
2008-06-29 10:47 --------- d-----w C:\Program Files\Bonjour
2008-06-29 10:45 --------- d-----w C:\ProgramData\Apple
2008-06-29 10:45 --------- d-----w C:\Program Files\Common Files\Apple
2008-06-29 10:10 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Yahoo!
2008-06-29 10:10 --------- d-----w C:\ProgramData\Yahoo! Companion
2008-06-29 09:05 --------- d-----w C:\Program Files\Guitar Pro 5
2008-06-29 08:48 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Mozilla
2008-06-28 23:23 127,034 ------r C:\Windows\bwUnin-8.1.1.50-8876480SL.exe
2008-06-28 23:23 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Logitech
2008-06-28 23:23 --------- d-----w C:\Program Files\Logitech
2008-06-28 23:22 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-06-28 23:21 --------- d-----w C:\ProgramData\Logitech
2008-06-28 23:21 --------- d-----w C:\Program Files\Common Files\Logitech
2008-06-28 23:19 --------- d-----w C:\Users\Jérémy\AppData\Roaming\InstallShield
2008-06-28 23:19 --------- d-----w C:\ProgramData\LogiShrd
2008-06-28 22:49 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-06-28 22:24 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Identities
2008-06-28 22:23 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Macromedia
2008-06-28 22:23 --------- d-----w C:\Program Files\Acer
2008-06-28 22:20 --------- d-sh--w C:\ProgramData\Modèles
2008-06-28 22:20 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-06-28 22:20 --------- d-sh--w C:\ProgramData\Favoris
2008-06-28 22:20 --------- d-sh--w C:\ProgramData\Bureau
2008-06-28 22:20 --------- d-sh--w C:\Program Files\Fichiers communs
2008-06-26 03:29 801,280 ----a-w C:\Windows\System32\NaturalLanguage6.dll
2008-06-26 01:45 2,644,480 ----a-w C:\Windows\System32\NlsLexicons0009.dll
2008-06-26 01:45 12,240,896 ----a-w C:\Windows\System32\NlsLexicons0007.dll
2008-06-12 05:28 541,696 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-05-30 12:19 507,400 ----a-w C:\Windows\System32\XAudio2_1.dll
2008-05-30 12:18 238,088 ----a-w C:\Windows\System32\xactengine3_1.dll
2008-05-30 12:17 65,032 ----a-w C:\Windows\System32\XAPOFX1_0.dll
2008-05-30 12:17 25,608 ----a-w C:\Windows\System32\X3DAudio1_4.dll
2008-05-30 12:11 467,984 ----a-w C:\Windows\System32\d3dx10_38.dll
2008-05-30 12:11 3,850,760 ----a-w C:\Windows\System32\D3DX9_38.dll
2008-05-30 12:11 1,491,992 ----a-w C:\Windows\System32\D3DCompiler_38.dll
2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-01-03 03:00 39472 --a------ C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-21 04:23 1233920]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 04:25 202240]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2008-06-30 17:56 5724184]
"Steam"="C:\Program Files\Valve\Steam\Steam.exe" [2008-06-30 16:03 1271032]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-21 04:25 125952]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.EXE" [2008-07-29 14:40 3065344]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-05 15:15 525360]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 05:38 40048]
"PLFSetL"="C:\Windows\PLFSetL.exe" [2007-07-05 12:35 94208]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-11-15 05:03 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-11-15 05:03 8534560]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-11-15 05:03 81920]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-12 16:36 178712]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2008-01-04 12:21 768520]
"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2008-01-22 11:14 200704]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-07-21 12:18 159744]
"WarReg_PopUp"="C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 09:03 303104]
"eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-10-10 06:41 1286144]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"SpeedBitVideoAccelerator"="C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2008-07-29 14:40 2705008]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"RtHDVCpl"="RtHDVCpl.exe" [2007-09-03 12:39 4702208 C:\Windows\RtHDVCpl.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\Windows\KHALMNPR.Exe]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-03-29 13:11:50 719664]
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2008-03-18 13:48:07 535336]
ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2008-08-26 17:31:29 303104]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-06-29 01:23:35 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-06-29 01:21:28 692224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{90EC56AA-2DED-4327-8AD3-87CACB103932}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{B74D633E-F832-4AC1-B1F6-3E776FFA8B8E}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
"{C42F66DF-E2CC-4881-8E30-B350D11E6142}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
"{36ACBBD2-4A0F-465A-A3BF-304891F28119}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe:DV Wizard
"{A1DB3DD2-C6FE-4A7C-88FD-40D6F57A7F8B}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AC05B029-16FD-4A7C-89F1-FBE4AFD79143}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{4BE86343-D9A6-407A-B63F-8B145836F910}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine
"{2BA9820E-FCDD-4A1C-9477-4EBCB3A7FCF9}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:Play Movie
"{A95CEC68-AA77-45C8-9450-1ED6CC377BB6}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe:Play Movie Resident Program
"{3063D681-FB65-4804-8864-99017BBAA6A8}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{41BF8B88-EA4B-4708-B765-B3B074BE6767}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{9D086850-135E-4195-A3AF-DD57557F7C3F}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{4180B039-8A58-4A5D-A8CE-915865D1017C}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{198C0F0E-AA39-4034-BF93-89E2B403E06A}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{DBEE158C-A2D8-4702-87FF-40F5E3A37282}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{B83D3843-4590-4CCB-BA75-9DA018456D4B}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{2B412466-D951-43FF-8106-86D755649AE2}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{35D7FB07-DE13-4B9D-8D13-D6B44AAE772C}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{33719B08-1635-4478-A360-D66B7BAB48C9}"= Disabled:UDP:E:\setup\HPZNUI01.EXE:hpznui01.exe
"{737C57EC-DEB5-43CD-8B5E-6D737C371C3F}"= Disabled:TCP:E:\setup\HPZNUI01.EXE:hpznui01.exe
"{62254B31-0729-431F-90EE-4BB4DD6C98CA}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{4C04EF1F-5100-46ED-A1A1-9E5BFBCB5638}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{75F73590-BCF6-4DCC-8BBA-4E8B6B3B4CF8}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{182B076D-00DF-4A4F-8239-8EF13B91A694}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{22D2FAC3-CF87-479B-9FB6-B2C8C54859A9}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:hpofxm08.exe
"{50FA0341-CAD8-4C35-8FEF-47280881A67A}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:hpofxm08.exe
"{D9139E29-0416-4E68-8A22-FBF8FFA5BB7A}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:hposfx08.exe
"{58A49FEC-A2B1-4BFF-BEA9-53FC7DAF2997}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:hposfx08.exe
"{93BC95CA-530C-4289-B767-246F90A573D6}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{A3BB96DC-3A44-4367-9E64-FB75A856E448}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{9A5C861F-AE7E-40C1-8BB9-CDEEACA9ED35}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:hpqscnvw.exe
"{F260F2F1-0B3B-4C35-A172-A88AD8A8FCF8}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:hpqscnvw.exe
"{7DA1B897-14F1-4E2C-9CE4-AB7233DF9644}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:hpqkygrp.exe
"{FF66ED64-00DF-4535-9D50-B9226C46D2C6}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:hpqkygrp.exe
"{C1901049-C603-4232-B5C0-FB33AC7CD652}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:hpzwiz01.exe
"{42B8B0C8-B004-4730-96F0-E4C20E68E220}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:hpzwiz01.exe
"{06217C21-A50D-495F-8944-B93D10F498A4}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:hpoews01.exe
"{C5E81C26-6408-4B6E-8ABD-DCAAF8B0BB73}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:hpoews01.exe
"{83E9AF6F-DC73-4379-86CD-8B9F52DC6FE3}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:hpqnrs08.exe
"{376913B1-7939-4733-855C-46F56B8AC8EE}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:hpqnrs08.exe
"{416A3BC9-EC99-4302-9F25-09FE6AF9FDAC}"= UDP:C:\Program Files\Microsoft Games\Gears of War\Binaries\WarGame-G4WLive.exe:Gears of War
"{FB2F40F6-AE40-4263-BE35-3DBE8736B92B}"= TCP:C:\Program Files\Microsoft Games\Gears of War\Binaries\WarGame-G4WLive.exe:Gears of War
"{BC32D55F-4915-4AB6-8667-3DFD6B4C58E6}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{14A51F16-83A1-4D89-8283-A0E89328FAFB}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R0 pavboot;pavboot;C:\Windows\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 SbFw;SbFw;C:\Windows\system32\drivers\SbFw.sys [2008-06-21 04:54]
R1 sbhips;Sunbelt HIPS Driver;C:\Windows\system32\drivers\sbhips.sys [2008-06-21 04:54]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\[u]0/u00.fcl [2008-01-04 17:15]
R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [2007-09-19 15:41]
R2 SbPF.Launcher;SbPF.Launcher;C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-07-01 10:51]
R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-07-01 10:51]
R2 VideoAcceleratorService;VideoAcceleratorService;C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe [2008-07-29 14:40]
R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys [2007-03-07 10:26]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;C:\Windows\system32\DRIVERS\sbfwim.sys [2008-06-21 04:54]
R3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-07-31 17:44]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-07-22 09:00]
S3 btwaudio;Périphérique audio Bluetooth;C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 21:46]
S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 08:20]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 08:20]
S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 04:23]
S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 04:23]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPService REG_MULTI_SZ HPSLPSVC
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e984388c-4599-11dd-aab4-dc1473ef60a2}]
\shell\AutoRun\command - G:\LaunchU3.exe -a
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-ComRepl - C:\Users\Jérémy\AppData\Roaming\comrepl.exe
HKLM-Run-ALaunch - C:\Acer\ALaunch\AlaunchClient.exe
HKLM-Run-Acer Tour Reminder - C:\Acer\AcerTour\Reminder.exe
HKLM-Run-eRecoveryService - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\Jérémy\AppData\Roaming\Mozilla\Firefox\Profiles\kqf98195.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr/
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 22:14:02
Windows 6.0.6001 Service Pack 1 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-08-29 22:16:33
ComboFix-quarantined-files.txt 2008-08-29 20:16:24
Pre-Run: 46,073,675,776 octets libres
Post-Run: 46,107,021,312 octets libres
335 --- E O F --- 2008-08-24 00:13:45
ComboFix 08-08-29.01 - Jérémy 2008-08-29 22:07:37.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1898 [GMT 2:00]
Endroit: C:\Users\Jérémy\Desktop\ComboFix.exe
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Users\Jérémy\AppData\Roaming\.#
C:\Windows\system32\AutoRun.inf
C:\Windows\system32\x64
C:\Windows\system32\x64\csnp2uvc.dll
C:\Windows\system32\x64\rsnpvc64.dll
C:\Windows\system32\x64\sncduvc.sys
C:\Windows\system32\x64\snp2uvc.sys
C:\Windows\system32\x64\vsnpvc64.dll
.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-28 to 2008-08-29 ))))))))))))))))))))))))))))))))))))
.
2008-08-29 21:59 . 2008-08-29 21:59 <REP> d--hs---- C:\found.003
2008-08-29 13:57 . 2008-06-19 17:24 28,544 --a------ C:\Windows\System32\drivers\pavboot.sys
2008-08-29 13:55 . 2008-08-29 13:55 <REP> d-------- C:\Program Files\Panda Security
2008-08-29 13:51 . 2008-08-29 14:07 <REP> d-------- C:\Users\Jérémy\.housecall6.6
2008-08-29 13:51 . 2008-08-29 14:07 <REP> d-------- C:\Users\Jérémy\.housecall6.6
2008-08-29 13:48 . 2008-08-29 13:49 <REP> d-------- C:\Program Files\Java
2008-08-29 13:45 . 2008-08-29 13:45 <REP> d-------- C:\Program Files\Common Files\Java
2008-08-29 13:18 . 2008-08-29 13:18 <REP> d--hs---- C:\found.002
2008-08-29 12:11 . 2008-08-29 12:11 <REP> d-------- C:\Users\Jérémy\AppData\Roaming\Malwarebytes
2008-08-29 12:10 . 2008-08-29 12:10 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-08-29 12:10 . 2008-08-29 12:10 <REP> d-------- C:\ProgramData\Malwarebytes
2008-08-29 12:10 . 2008-08-17 15:01 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-08-29 12:10 . 2008-08-17 15:01 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-08-29 12:04 . 2008-08-29 12:04 <REP> d-------- C:\_OTMoveIt
2008-08-29 11:08 . 2008-08-29 11:08 <REP> d-------- C:\Windows\BDOSCAN8
2008-08-27 15:10 . 2008-08-27 15:10 <REP> d--hs---- C:\found.001
2008-08-26 17:31 . 2008-08-26 17:32 <REP> d-------- C:\Program Files\FinePixViewer
2008-08-25 13:50 . 2008-08-25 13:50 <REP> d--hs---- C:\found.000
2008-08-22 22:13 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll
2008-08-22 22:13 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll
2008-08-22 22:13 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll
2008-08-22 22:13 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll
2008-08-22 22:13 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll
2008-08-22 22:13 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe
2008-08-22 22:13 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll
2008-08-22 22:13 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll
2008-08-22 22:13 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-08-20 14:41 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-20 09:28 . 2008-08-20 09:28 <REP> d-------- C:\Users\All Users\Avira
2008-08-20 09:28 . 2008-08-20 09:28 <REP> d-------- C:\ProgramData\Avira
2008-08-20 09:28 . 2008-08-20 09:28 <REP> d-------- C:\Program Files\Avira
2008-08-20 04:15 . 2008-06-27 03:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-20 04:15 . 2008-06-27 06:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-20 04:15 . 2008-06-19 05:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-20 04:15 . 2008-04-18 07:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-20 04:14 . 2008-04-10 07:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-15 18:56 . 2008-08-15 18:56 <REP> d-------- C:\Users\All Users\Xerox
2008-08-15 18:56 . 2008-08-15 18:56 <REP> d-------- C:\ProgramData\Xerox
2008-08-13 19:21 . 2008-08-13 19:21 <REP> d-------- C:\Program Files\Apple Software Update(1)
2008-08-13 19:20 . 2008-08-13 19:20 <REP> d-------- C:\Program Files\iTunes(103)
2008-08-13 19:20 . 2008-08-13 19:20 <REP> d-------- C:\Program Files\iPod(102)
2008-08-11 17:55 . 2008-08-11 17:55 <REP> d-------- C:\Program Files\DivX
2008-08-05 14:42 . 2008-08-05 14:42 <REP> d-------- C:\Users\All Users\WindowsSearch
2008-08-05 14:42 . 2008-08-05 14:42 <REP> d-------- C:\ProgramData\WindowsSearch
2008-07-30 20:51 . 2008-07-30 20:51 <REP> d-------- C:\Program Files\Sunbelt Software
2008-07-30 20:51 . 2008-06-21 04:54 65,576 --a------ C:\Windows\System32\drivers\SbFwIm.sys
2008-07-30 03:23 . 2008-07-30 03:25 <REP> d--h----- C:\Windows\msdownld.tmp
2008-07-30 03:23 . 2008-07-30 03:23 <REP> d--h-c--- C:\Users\All Users\{ECF27DA6-61FA-4DDA-870F-1766B3B8A74E}
2008-07-30 03:23 . 2008-07-30 03:23 <REP> d--h-c--- C:\ProgramData\{ECF27DA6-61FA-4DDA-870F-1766B3B8A74E}
2008-07-30 03:23 . 2008-07-30 03:23 <REP> d-------- C:\Program Files\ffdshow
2008-07-30 03:23 . 2007-04-24 16:30 60,273 --a------ C:\Windows\System32\pthreadGC2.dll
2008-07-30 03:23 . 2008-03-04 12:33 7,680 --a------ C:\Windows\System32\ff_vfw.dll
2008-07-30 03:23 . 2007-07-10 17:10 547 --a------ C:\Windows\System32\ff_vfw.dll.manifest
2008-07-30 03:17 . 2008-07-30 03:17 <REP> d-------- C:\Program Files\Utherverse Digital Inc
2008-07-29 14:40 . 2008-08-29 22:03 <REP> d-a------ C:\Users\All Users\TEMP
2008-07-29 14:40 . 2008-08-29 22:03 <REP> d-a------ C:\ProgramData\TEMP
2008-07-29 14:40 . 2008-08-29 22:04 <REP> d-------- C:\Program Files\SpeedBit Video Accelerator
2008-07-29 14:40 . 2008-07-29 14:43 <REP> d-------- C:\Program Files\DAP
2008-07-29 14:40 . 2008-07-29 14:40 479,298 --a------ C:\Windows\System32\wbocx.ocx
2008-07-29 14:40 . 2008-07-29 14:40 172,032 --a------ C:\Windows\System32\AniGIF.ocx
2008-07-29 14:40 . 2008-07-29 14:40 50,688 --a------ C:\Windows\System32\wbhelp2.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 20:14 2,621,440 --sha-w C:\Users\Jérémy\ntuser.dat
2008-08-29 20:14 2,621,440 --sha-w C:\Users\Jérémy\ntuser.dat
2008-08-29 10:11 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Malwarebytes
2008-08-28 16:30 27,934 ----a-w C:\Users\Jérémy\AppData\Roaming\nvModes.dat
2008-08-26 15:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-26 15:32 --------- d-----w C:\Users\Jérémy\AppData\Roaming\FUJIFILM
2008-08-25 01:28 --------- d-----w C:\Users\Jérémy\AppData\Roaming\gtk-2.0
2008-08-22 15:07 --------- d-----w C:\Program Files\Windows Mail
2008-08-20 12:42 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-20 12:05 --------- d-----w C:\ProgramData\HP Product Assistant
2008-08-20 12:05 --------- d-----w C:\Program Files\eMule
2008-08-20 12:05 --------- d-----w C:\Program Files\Apple Software Update
2008-08-20 08:12 --------- d-----w C:\Program Files\iTunes
2008-08-20 08:12 --------- d-----w C:\Program Files\iPod
2008-08-20 07:35 --------- d-----w C:\Program Files\Microsoft Games
2008-08-15 16:58 --------- d-s---w C:\Users\Jérémy\AppData\Roaming\Microsoft
2008-08-13 17:20 --------- d-----w C:\ProgramData\Apple Computer
2008-07-31 15:44 --------- d-----w C:\Program Files\Common Files\Steam
2008-07-30 18:35 --------- d-----w C:\ProgramData\McAfee
2008-07-30 18:28 --------- d-----w C:\ProgramData\SiteAdvisor
2008-07-28 17:23 --------- d-----w C:\Users\Jérémy\AppData\Roaming\CyberLink
2008-07-28 16:49 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Microsoft Games
2008-07-28 16:23 --------- d-----w C:\Program Files\Common Files\Microsoft Games
2008-07-27 22:11 --------- d-----w C:\Program Files\ATI Technologies
2008-07-27 16:55 --------- d-----w C:\Program Files\ATI
2008-07-25 20:16 --------- d-----w C:\Users\Jérémy\AppData\Roaming\HP
2008-07-25 20:05 --------- d-----w C:\ProgramData\WEBREG
2008-07-25 20:05 --------- d-----w C:\ProgramData\HP
2008-07-25 19:57 --------- d-----w C:\ProgramData\Hewlett-Packard
2008-07-25 19:49 --------- d-----w C:\Users\Jérémy\AppData\Roaming\HPAppData
2008-07-25 19:49 --------- d-----w C:\ProgramData\HPSSUPPLY
2008-07-25 19:49 --------- d-----w C:\Program Files\HP
2008-07-25 19:47 --------- d-----w C:\Program Files\Common Files\HP
2008-07-25 19:46 --------- d-----w C:\Program Files\Hewlett-Packard
2008-07-25 19:46 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2008-07-25 15:59 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-07-22 13:24 --------- d-----w C:\Program Files\Audacity
2008-07-22 11:05 --------- d-----w C:\Program Files\PhotoFiltre
2008-07-22 01:19 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Apple Computer
2008-07-17 23:21 --------- d-----w C:\ProgramData\FLEXnet
2008-07-17 22:22 --------- d-----w C:\Program Files\GIMP-2.0
2008-07-17 22:16 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-17 22:16 --------- d-----w C:\ProgramData\WLInstaller
2008-07-17 22:16 --------- d-----w C:\Program Files\Windows Live
2008-07-17 21:05 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Adobe
2008-07-16 08:34 --------- d-----w C:\Program Files\Safari
2008-07-06 20:23 --------- d-----w C:\ProgramData\Messenger Plus!
2008-07-06 20:22 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-06-30 16:45 --------- d-----w C:\Users\Jérémy\AppData\Roaming\WinRAR
2008-06-30 15:19 --------- d-----w C:\ProgramData\eMule
2008-06-30 14:35 --------- d-----w C:\ProgramData\ALM
2008-06-30 14:35 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-30 14:28 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-06-30 14:18 --------- d-----w C:\Program Files\Adobe Illustrator CS3 Crack
2008-06-30 13:51 --------- d-----w C:\Program Files\Valve
2008-06-29 12:08 --------- d-----w C:\Program Files\Dofus
2008-06-29 10:55 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2008-06-29 10:47 --------- d-----w C:\Program Files\QuickTime
2008-06-29 10:47 --------- d-----w C:\Program Files\Bonjour
2008-06-29 10:45 --------- d-----w C:\ProgramData\Apple
2008-06-29 10:45 --------- d-----w C:\Program Files\Common Files\Apple
2008-06-29 10:10 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Yahoo!
2008-06-29 10:10 --------- d-----w C:\ProgramData\Yahoo! Companion
2008-06-29 09:05 --------- d-----w C:\Program Files\Guitar Pro 5
2008-06-29 08:48 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Mozilla
2008-06-28 23:23 127,034 ------r C:\Windows\bwUnin-8.1.1.50-8876480SL.exe
2008-06-28 23:23 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Logitech
2008-06-28 23:23 --------- d-----w C:\Program Files\Logitech
2008-06-28 23:22 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-06-28 23:21 --------- d-----w C:\ProgramData\Logitech
2008-06-28 23:21 --------- d-----w C:\Program Files\Common Files\Logitech
2008-06-28 23:19 --------- d-----w C:\Users\Jérémy\AppData\Roaming\InstallShield
2008-06-28 23:19 --------- d-----w C:\ProgramData\LogiShrd
2008-06-28 22:49 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-06-28 22:24 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Identities
2008-06-28 22:23 --------- d-----w C:\Users\Jérémy\AppData\Roaming\Macromedia
2008-06-28 22:23 --------- d-----w C:\Program Files\Acer
2008-06-28 22:20 --------- d-sh--w C:\ProgramData\Modèles
2008-06-28 22:20 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-06-28 22:20 --------- d-sh--w C:\ProgramData\Favoris
2008-06-28 22:20 --------- d-sh--w C:\ProgramData\Bureau
2008-06-28 22:20 --------- d-sh--w C:\Program Files\Fichiers communs
2008-06-26 03:29 801,280 ----a-w C:\Windows\System32\NaturalLanguage6.dll
2008-06-26 01:45 2,644,480 ----a-w C:\Windows\System32\NlsLexicons0009.dll
2008-06-26 01:45 12,240,896 ----a-w C:\Windows\System32\NlsLexicons0007.dll
2008-06-12 05:28 541,696 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-05-30 12:19 507,400 ----a-w C:\Windows\System32\XAudio2_1.dll
2008-05-30 12:18 238,088 ----a-w C:\Windows\System32\xactengine3_1.dll
2008-05-30 12:17 65,032 ----a-w C:\Windows\System32\XAPOFX1_0.dll
2008-05-30 12:17 25,608 ----a-w C:\Windows\System32\X3DAudio1_4.dll
2008-05-30 12:11 467,984 ----a-w C:\Windows\System32\d3dx10_38.dll
2008-05-30 12:11 3,850,760 ----a-w C:\Windows\System32\D3DX9_38.dll
2008-05-30 12:11 1,491,992 ----a-w C:\Windows\System32\D3DCompiler_38.dll
2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-01-03 03:00 39472 --a------ C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-21 04:23 1233920]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 04:25 202240]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2008-06-30 17:56 5724184]
"Steam"="C:\Program Files\Valve\Steam\Steam.exe" [2008-06-30 16:03 1271032]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-21 04:25 125952]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.EXE" [2008-07-29 14:40 3065344]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-05 15:15 525360]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 05:38 40048]
"PLFSetL"="C:\Windows\PLFSetL.exe" [2007-07-05 12:35 94208]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-11-15 05:03 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-11-15 05:03 8534560]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-11-15 05:03 81920]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-12 16:36 178712]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2008-01-04 12:21 768520]
"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2008-01-22 11:14 200704]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-07-21 12:18 159744]
"WarReg_PopUp"="C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 09:03 303104]
"eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-10-10 06:41 1286144]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"SpeedBitVideoAccelerator"="C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2008-07-29 14:40 2705008]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"RtHDVCpl"="RtHDVCpl.exe" [2007-09-03 12:39 4702208 C:\Windows\RtHDVCpl.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\Windows\KHALMNPR.Exe]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-03-29 13:11:50 719664]
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2008-03-18 13:48:07 535336]
ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2008-08-26 17:31:29 303104]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-06-29 01:23:35 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-06-29 01:21:28 692224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{90EC56AA-2DED-4327-8AD3-87CACB103932}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{B74D633E-F832-4AC1-B1F6-3E776FFA8B8E}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
"{C42F66DF-E2CC-4881-8E30-B350D11E6142}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
"{36ACBBD2-4A0F-465A-A3BF-304891F28119}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe:DV Wizard
"{A1DB3DD2-C6FE-4A7C-88FD-40D6F57A7F8B}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AC05B029-16FD-4A7C-89F1-FBE4AFD79143}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{4BE86343-D9A6-407A-B63F-8B145836F910}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine
"{2BA9820E-FCDD-4A1C-9477-4EBCB3A7FCF9}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:Play Movie
"{A95CEC68-AA77-45C8-9450-1ED6CC377BB6}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe:Play Movie Resident Program
"{3063D681-FB65-4804-8864-99017BBAA6A8}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{41BF8B88-EA4B-4708-B765-B3B074BE6767}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{9D086850-135E-4195-A3AF-DD57557F7C3F}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{4180B039-8A58-4A5D-A8CE-915865D1017C}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{198C0F0E-AA39-4034-BF93-89E2B403E06A}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{DBEE158C-A2D8-4702-87FF-40F5E3A37282}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{B83D3843-4590-4CCB-BA75-9DA018456D4B}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{2B412466-D951-43FF-8106-86D755649AE2}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{35D7FB07-DE13-4B9D-8D13-D6B44AAE772C}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{33719B08-1635-4478-A360-D66B7BAB48C9}"= Disabled:UDP:E:\setup\HPZNUI01.EXE:hpznui01.exe
"{737C57EC-DEB5-43CD-8B5E-6D737C371C3F}"= Disabled:TCP:E:\setup\HPZNUI01.EXE:hpznui01.exe
"{62254B31-0729-431F-90EE-4BB4DD6C98CA}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{4C04EF1F-5100-46ED-A1A1-9E5BFBCB5638}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{75F73590-BCF6-4DCC-8BBA-4E8B6B3B4CF8}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{182B076D-00DF-4A4F-8239-8EF13B91A694}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{22D2FAC3-CF87-479B-9FB6-B2C8C54859A9}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:hpofxm08.exe
"{50FA0341-CAD8-4C35-8FEF-47280881A67A}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:hpofxm08.exe
"{D9139E29-0416-4E68-8A22-FBF8FFA5BB7A}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:hposfx08.exe
"{58A49FEC-A2B1-4BFF-BEA9-53FC7DAF2997}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:hposfx08.exe
"{93BC95CA-530C-4289-B767-246F90A573D6}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{A3BB96DC-3A44-4367-9E64-FB75A856E448}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{9A5C861F-AE7E-40C1-8BB9-CDEEACA9ED35}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:hpqscnvw.exe
"{F260F2F1-0B3B-4C35-A172-A88AD8A8FCF8}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:hpqscnvw.exe
"{7DA1B897-14F1-4E2C-9CE4-AB7233DF9644}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:hpqkygrp.exe
"{FF66ED64-00DF-4535-9D50-B9226C46D2C6}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:hpqkygrp.exe
"{C1901049-C603-4232-B5C0-FB33AC7CD652}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:hpzwiz01.exe
"{42B8B0C8-B004-4730-96F0-E4C20E68E220}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:hpzwiz01.exe
"{06217C21-A50D-495F-8944-B93D10F498A4}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:hpoews01.exe
"{C5E81C26-6408-4B6E-8ABD-DCAAF8B0BB73}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:hpoews01.exe
"{83E9AF6F-DC73-4379-86CD-8B9F52DC6FE3}"= Disabled:UDP:C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:hpqnrs08.exe
"{376913B1-7939-4733-855C-46F56B8AC8EE}"= Disabled:TCP:C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:hpqnrs08.exe
"{416A3BC9-EC99-4302-9F25-09FE6AF9FDAC}"= UDP:C:\Program Files\Microsoft Games\Gears of War\Binaries\WarGame-G4WLive.exe:Gears of War
"{FB2F40F6-AE40-4263-BE35-3DBE8736B92B}"= TCP:C:\Program Files\Microsoft Games\Gears of War\Binaries\WarGame-G4WLive.exe:Gears of War
"{BC32D55F-4915-4AB6-8667-3DFD6B4C58E6}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{14A51F16-83A1-4D89-8283-A0E89328FAFB}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R0 pavboot;pavboot;C:\Windows\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 SbFw;SbFw;C:\Windows\system32\drivers\SbFw.sys [2008-06-21 04:54]
R1 sbhips;Sunbelt HIPS Driver;C:\Windows\system32\drivers\sbhips.sys [2008-06-21 04:54]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\[u]0/u00.fcl [2008-01-04 17:15]
R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [2007-09-19 15:41]
R2 SbPF.Launcher;SbPF.Launcher;C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-07-01 10:51]
R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-07-01 10:51]
R2 VideoAcceleratorService;VideoAcceleratorService;C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe [2008-07-29 14:40]
R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys [2007-03-07 10:26]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;C:\Windows\system32\DRIVERS\sbfwim.sys [2008-06-21 04:54]
R3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-07-31 17:44]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-07-22 09:00]
S3 btwaudio;Périphérique audio Bluetooth;C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 21:46]
S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 08:20]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 08:20]
S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 04:23]
S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 04:23]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPService REG_MULTI_SZ HPSLPSVC
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e984388c-4599-11dd-aab4-dc1473ef60a2}]
\shell\AutoRun\command - G:\LaunchU3.exe -a
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-ComRepl - C:\Users\Jérémy\AppData\Roaming\comrepl.exe
HKLM-Run-ALaunch - C:\Acer\ALaunch\AlaunchClient.exe
HKLM-Run-Acer Tour Reminder - C:\Acer\AcerTour\Reminder.exe
HKLM-Run-eRecoveryService - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\Jérémy\AppData\Roaming\Mozilla\Firefox\Profiles\kqf98195.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr/
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 22:14:02
Windows 6.0.6001 Service Pack 1 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-08-29 22:16:33
ComboFix-quarantined-files.txt 2008-08-29 20:16:24
Pre-Run: 46,073,675,776 octets libres
Post-Run: 46,107,021,312 octets libres
335 --- E O F --- 2008-08-24 00:13:45
Télécharge sur ton bureau : http://www.malekal.com/download/clean.zip
Tuto
http://mickael.barroux.free.fr/securite/clean.php
Une fois sur le bureau, tu fais un clic droit sur ton fichier clean.zip et dans le menu déroulant, tu clics sur extrait tout ou extraire ici.
Cela va créer un dossier clean.
Double-clic sur ce dossier clean, tu y trouveras dedans plusieurs fichiers.
Double-clic sur clean. Cela va ouvrir une fenêtre noire.
Un menu va apparaître, choisis l'option 1 en appuyant sur la touche 1 de ton clavier.
Clean va travailler.
Un rapport Va etre généré, colle le contenu entier ici.
(- Où est le rapport clean ? : « Poste de travail » / double clic sur disque « C / » double-clic sur « rapport_clean.txt » et « copier/coller le contenu » sur le forum. )
Tuto
http://mickael.barroux.free.fr/securite/clean.php
Une fois sur le bureau, tu fais un clic droit sur ton fichier clean.zip et dans le menu déroulant, tu clics sur extrait tout ou extraire ici.
Cela va créer un dossier clean.
Double-clic sur ce dossier clean, tu y trouveras dedans plusieurs fichiers.
Double-clic sur clean. Cela va ouvrir une fenêtre noire.
Un menu va apparaître, choisis l'option 1 en appuyant sur la touche 1 de ton clavier.
Clean va travailler.
Un rapport Va etre généré, colle le contenu entier ici.
(- Où est le rapport clean ? : « Poste de travail » / double clic sur disque « C / » double-clic sur « rapport_clean.txt » et « copier/coller le contenu » sur le forum. )
Voila le rapport clean :
30/08/2008 a 13:53:38,58
*** Recherche C:
*** Recherche C:\Windows\
*** Recherche C:\Windows\system32
C:\Windows\system32\wininit.exe FOUND
C:\Windows\system32\wininit.exe FOUND
*** Recherche C:\Program Files
*** End of the report !
Par contre maintenant je ne peux presque plus démarrer windows normalement, il plante et affiche la fenetre bleue avec le message "PFN LIST CORRUPT".
Je ne sais pas si ça vous est utile de le savoir, mais voila.
30/08/2008 a 13:53:38,58
*** Recherche C:
*** Recherche C:\Windows\
*** Recherche C:\Windows\system32
C:\Windows\system32\wininit.exe FOUND
C:\Windows\system32\wininit.exe FOUND
*** Recherche C:\Program Files
*** End of the report !
Par contre maintenant je ne peux presque plus démarrer windows normalement, il plante et affiche la fenetre bleue avec le message "PFN LIST CORRUPT".
Je ne sais pas si ça vous est utile de le savoir, mais voila.
c'est depuis que tu as fais combofix ce souci?
si oui restaure ton ordi avant l'utilisation de combofix
http://www.infoprat.net/astuces/windows2k_xp/astuces/divers_004.php
puis refais clean et nettoie avec
si oui restaure ton ordi avant l'utilisation de combofix
http://www.infoprat.net/astuces/windows2k_xp/astuces/divers_004.php
puis refais clean et nettoie avec
Script executed in Safe Mode
Rapport clean par Malekal_morte - http://www.malekal.com
Script executed in Safe Mode 30/08/2008 a 14:58:11,37
Microsoft Windows [version 6.0.6001]
*** Suppression C:
*** Suppression C:\Windows\
*** Suppression C:\Windows\system32
tentative de suppression de C:\Windows\system32\wininit.exe
Impossible de supprimer C:\Windows\system32\wininit.exe
tentative de suppression de C:\Windows\system32\wininit.exe
Impossible de supprimer C:\Windows\system32\wininit.exe
*** Suppression C:\Program Files
*** Deletion of the registry keys successful..
*** End of the report !
Cette fois-ci j'ai pu démarrer normalement, sans avoir fait la restauration.
Rapport clean par Malekal_morte - http://www.malekal.com
Script executed in Safe Mode 30/08/2008 a 14:58:11,37
Microsoft Windows [version 6.0.6001]
*** Suppression C:
*** Suppression C:\Windows\
*** Suppression C:\Windows\system32
tentative de suppression de C:\Windows\system32\wininit.exe
Impossible de supprimer C:\Windows\system32\wininit.exe
tentative de suppression de C:\Windows\system32\wininit.exe
Impossible de supprimer C:\Windows\system32\wininit.exe
*** Suppression C:\Program Files
*** Deletion of the registry keys successful..
*** End of the report !
Cette fois-ci j'ai pu démarrer normalement, sans avoir fait la restauration.
colle le rapport d'un scan en ligne
avec un des suivants:
(désactiver avast le temps du scan)
bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html
Panda en ligne :
http://pandasoftware.fr
avec un des suivants:
(désactiver avast le temps du scan)
bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html
Panda en ligne :
http://pandasoftware.fr
Voila le rapport d'un scan en ligne avec panda :
;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-08-30 20:06:03
PROTECTIONS: 1
MALWARE: 21
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Windows Defender 1.1.3807.0 No No
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@doubleclick[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@doubleclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@atdmt[2].txt
00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@tradedoubler[1].txt
00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@tradedoubler[2].txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@247realmedia[1].txt
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@fastclick[2].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@mediaplex[2].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@mediaplex[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@xiti[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@ad.yieldmanager[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@ad.yieldmanager[1].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@apmebf[2].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@apmebf[1].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@serving-sys[2].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@serving-sys[1].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@bs.serving-sys[1].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@bs.serving-sys[2].txt
00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@weborama[2].txt
00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@weborama[1].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@advertising[1].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@advertising[2].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@ads.pointroll[2].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@overture[1].txt
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@bluestreak[1].txt
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@bluestreak[1].txt
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@adultfriendfinder[2].txt
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@go[1].txt
00238695 Application/Pskill.K HackTools No 0 Yes No C:\Users\Jérémy\Desktop\clean.zip[clean/pskill.exe]
00238695 Application/Pskill.K HackTools No 0 Yes No C:\Users\Jérémy\Desktop\clean\pskill.exe
00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@smartadserver[1].txt
00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@smartadserver[1].txt
01185375 Application/Psexec.A HackTools No 0 Yes No C:\upload_moi_PC-de-Jérémy.tar.gz[upload_moi.tar][Windows/PSEXESVC.EXE]
01185375 Application/Psexec.A HackTools No 0 Yes No C:\Windows\PSEXESVC.EXE
;===================================================================================================================================================================================
SUSPECTS
Sent Location ��D
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description ��D
;===================================================================================================================================================================================
;===================================================================================================================================================================================
;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-08-30 20:06:03
PROTECTIONS: 1
MALWARE: 21
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Windows Defender 1.1.3807.0 No No
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@doubleclick[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@doubleclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@atdmt[2].txt
00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@tradedoubler[1].txt
00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@tradedoubler[2].txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@247realmedia[1].txt
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@fastclick[2].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@mediaplex[2].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@mediaplex[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@xiti[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@ad.yieldmanager[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@ad.yieldmanager[1].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@apmebf[2].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@apmebf[1].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@serving-sys[2].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@serving-sys[1].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@bs.serving-sys[1].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@bs.serving-sys[2].txt
00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@weborama[2].txt
00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@weborama[1].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@advertising[1].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@advertising[2].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@ads.pointroll[2].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@overture[1].txt
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@bluestreak[1].txt
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@bluestreak[1].txt
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@adultfriendfinder[2].txt
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@go[1].txt
00238695 Application/Pskill.K HackTools No 0 Yes No C:\Users\Jérémy\Desktop\clean.zip[clean/pskill.exe]
00238695 Application/Pskill.K HackTools No 0 Yes No C:\Users\Jérémy\Desktop\clean\pskill.exe
00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\jérémy@smartadserver[1].txt
00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Users\Jérémy\AppData\Roaming\Microsoft\Windows\Cookies\Low\jérémy@smartadserver[1].txt
01185375 Application/Psexec.A HackTools No 0 Yes No C:\upload_moi_PC-de-Jérémy.tar.gz[upload_moi.tar][Windows/PSEXESVC.EXE]
01185375 Application/Psexec.A HackTools No 0 Yes No C:\Windows\PSEXESVC.EXE
;===================================================================================================================================================================================
SUSPECTS
Sent Location ��D
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description ��D
;===================================================================================================================================================================================
;===================================================================================================================================================================================
