Rapport hijackthis
Fermé
dliardet
-
30 août 2008 à 01:45
Lyonnais92 Messages postés 25159 Date d'inscription vendredi 23 juin 2006 Statut Contributeur sécurité Dernière intervention 16 septembre 2016 - 30 août 2008 à 14:41
Lyonnais92 Messages postés 25159 Date d'inscription vendredi 23 juin 2006 Statut Contributeur sécurité Dernière intervention 16 septembre 2016 - 30 août 2008 à 14:41
A voir également:
- Rapport hijackthis
- Hijackthis windows 10 - Télécharger - Antivirus & Antimalwares
- Plan rapport de stage - Guide
- Impossible d'afficher le rapport de tableau croisé dynamique sur un rapport existant ✓ - Forum Excel
- Problém affichage du tableau croisé dynamique - Forum Excel
- Rapport erreur windows - Guide
2 réponses
Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
-Attention Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. risque de figer l'ordi
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
!\ Ne touche à rien tant que le scan n'est pas terminé. /!\ : risque de figer l'ordi (plantage complet)
::Si combofix demande a faire mise a jour tu refuse
::Si combofix detecte quelque chose et de demande a redemarer tu accepte
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
-Attention Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. risque de figer l'ordi
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
!\ Ne touche à rien tant que le scan n'est pas terminé. /!\ : risque de figer l'ordi (plantage complet)
::Si combofix demande a faire mise a jour tu refuse
::Si combofix detecte quelque chose et de demande a redemarer tu accepte
ComboFix 08-08-29.02 - David Liardet 2008-08-30 2:28:56.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1537 [GMT 2:00]
Endroit: C:\Documents and Settings\David Liardet\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\David Liardet\Application Data\rhctm7j0en2p
C:\Documents and Settings\Lili Dos Santos\Cookies\lili_dos_santos@ehg-swisscom.hitbox[2].txt
C:\Program Files\GamesBar\oberontb.dll
C:\WINDOWS\system32\blphcpm7j0en2p.scr
C:\WINDOWS\system32\phcpm7j0en2p.bmp
C:\WINDOWS\SYSTEM32\VEdLTvut.ini
C:\WINDOWS\SYSTEM32\VEdLTvut.ini2
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-28 to 2008-08-30 ))))))))))))))))))))))))))))))))))))
.
2008-08-28 15:27 . 2008-08-28 15:39 96,976 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\klin.dat
2008-08-28 15:27 . 2008-08-28 15:39 87,855 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\klick.dat
2008-08-28 15:26 . 2008-08-28 15:26 <REP> d-------- C:\Program Files\Kaspersky Lab
2008-08-28 15:26 . 2008-08-30 13:13 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-28 15:26 . 2008-08-30 06:59 3,368,992 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2008-08-28 15:26 . 2008-08-30 06:59 507,936 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.dat
2008-08-28 15:26 . 2008-08-30 06:59 27,400 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx
2008-08-28 15:26 . 2008-08-30 06:59 2,816 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.idx
2008-08-26 15:22 . 2008-08-26 15:22 <REP> d-------- C:\Program Files\Fichiers communs\PCSuite
2008-08-26 15:22 . 2008-08-26 15:22 <REP> d-------- C:\Documents and Settings\David Liardet\Application Data\Malwarebytes
2008-08-26 15:12 . 2008-08-26 15:22 <REP> d-------- C:\WINDOWS\LastGood(2)
2008-08-23 15:24 . 2008-08-30 13:15 <REP> d-------- C:\Documents and Settings\David Liardet\Application Data\OpenOffice.org2
2008-08-23 15:18 . 2008-08-23 15:18 <REP> d-------- C:\Program Files\OpenOffice.org 2.4
2008-08-23 12:49 . 2008-08-26 15:22 <REP> d-------- C:\Program Files\PC Connectivity Solution
2008-08-23 12:49 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\pccsmcfd.sys
2008-08-23 12:49 . 2008-08-23 12:49 0 --a------ C:\WINDOWS\nsreg.dat
2008-08-22 23:23 . 2008-08-26 15:22 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-22 23:23 . 2008-08-22 23:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-22 23:23 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-08-22 23:23 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-08-22 23:08 . 2008-08-22 23:08 <REP> d-------- C:\Program Files\Trend Micro
2008-08-21 20:22 . 2008-08-28 12:46 <REP> d-------- C:\Program Files\a-squared Free
2008-08-17 19:00 . 2008-08-28 12:08 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-17 19:00 . 2008-08-28 15:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-17 18:21 . 2008-08-17 18:21 32 --a-s---- C:\WINDOWS\SYSTEM32\3897972993.dat
2008-08-17 18:17 . 2008-08-23 12:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-17 18:17 . 2008-08-17 18:17 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-16 11:04 . 2008-08-28 13:10 <REP> d-------- C:\Program Files\Yahoo!
2008-07-16 11:04 . 2008-07-16 11:04 <REP> d-------- C:\Program Files\CCleaner
2008-07-16 10:50 . 2005-05-23 13:00 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-07-16 10:50 . 2005-05-23 13:00 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-07-16 10:50 . 2005-05-23 13:00 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-07-16 10:50 . 2005-05-23 13:00 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-07-16 10:50 . 2005-05-23 13:00 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-07-16 10:50 . 2005-05-23 13:00 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-07-16 10:50 . 2005-05-23 13:00 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-07-16 10:50 . 2007-08-16 18:21 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Teleca
2008-07-16 10:50 . 2007-08-16 18:21 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sony Ericsson
2008-07-16 10:50 . 2005-05-23 13:29 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sonic
2008-07-16 10:50 . 2007-07-08 14:28 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Desperate Housewives
2008-07-16 10:50 . 2008-08-26 15:25 <REP> d-------- C:\Documents and Settings\Administrateur
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-30 00:29 --------- d-----w C:\Program Files\GamesBar
2008-08-28 18:13 --------- d-----w C:\Documents and Settings\Lili Dos Santos\Application Data\Skype
2008-08-28 13:39 58,368 ----a-w C:\WINDOWS\SYSTEM32\spoolsv.exe
2008-08-28 13:39 509,952 ----a-w C:\WINDOWS\SYSTEM32\winlogon.exe
2008-08-28 13:39 16,896 ----a-w C:\WINDOWS\SYSTEM32\svchost.exe
2008-08-28 13:39 14,336 ----a-w C:\WINDOWS\SYSTEM32\lsass.exe
2008-08-28 13:39 110,080 ----a-w C:\WINDOWS\SYSTEM32\services.exe
2008-08-28 13:39 1,039,360 ----a-w C:\WINDOWS\explorer.exe
2008-08-28 11:06 --------- d-----w C:\Program Files\Gamenext
2008-08-26 13:24 --------- d-----w C:\Program Files\World of Warcraft (privé)
2008-08-25 13:18 --------- d-----w C:\Program Files\World of Warcraft
2008-08-23 13:17 --------- d-----w C:\Program Files\Java
2008-08-23 10:51 --------- d-----w C:\Program Files\Nokia
2008-08-23 10:51 --------- d-----w C:\Program Files\Fichiers communs\Nokia
2008-08-23 10:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-08-18 14:58 --------- d-----w C:\Documents and Settings\Lili Dos Santos\Application Data\scrfunkamok
2008-08-18 14:52 --------- d-----w C:\Documents and Settings\David Liardet\Application Data\scrfunkamok
2008-08-18 14:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\INTERNET SPAM SUPPORT AUDIO
2008-08-17 17:44 --------- d-----w C:\Program Files\BearShare
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\wuauclt.exe
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\SYSTEM32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\wups.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\wuapi.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\wucltui.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\wuweb.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\wuaueng.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\SYSTEM32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\SYSTEM32\muweb.dll
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\SYSTEM32\es.dll
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\SYSTEM32\mscms.dll
2008-06-24 16:23 74,240 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mscms.dll
2008-06-24 08:28 3,592,192 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2008-06-23 09:21 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2008-06-23 09:21 625,664 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2008-06-23 09:20 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2008-06-21 05:23 161,792 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\SYSTEM32\mswsock.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
2008-06-20 10:44 138,368 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip6.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\bthport.sys
2008-05-08 12:28 202,752 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\rmcast.sys
2008-05-07 05:38 90,624 ----a-w C:\WINDOWS\SYSTEM32\nmwcdcls.dll
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2008-05-07 05:15 1,293,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2008-05-01 14:31 331,776 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msadce.dll
.
------- Sigcheck -------
2008-08-28 15:39 16896 a8fb150e88a67da58410b7e28ad52e8c C:\WINDOWS\SYSTEM32\svchost.exe
2005-05-25 21:07 359936 63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-01-13 19:07 360448 5562cc0a47b2aef06d3417b733f3c195 C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 18:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 12:44 360960 744e57c99232201ae98c49168b918f48 C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 13:51 361600 9aefa14bd6b182d61e3119fa5f436d3d C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 13:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2004-08-05 13:00 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2005-05-25 21:04 359808 88763a98a4c26c409741b4aa162720c9 C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys
2006-01-13 04:28 359808 583e063fdc888ca30d05c2724b0d7ef4 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
2007-10-30 19:20 360064 90caff4b094573449a0872a0f919b178 C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
2008-06-20 12:45 360320 1cc09561e21a48a7f649a40f18235860 C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
2008-06-20 12:45 360320 1cc09561e21a48a7f649a40f18235860 C:\WINDOWS\SYSTEM32\DRIVERS\tcpip.sys
2008-08-28 15:39 509952 68f89dcb80b45660aee06bf1fe353b49 C:\WINDOWS\SYSTEM32\winlogon.exe
md5deep: C:\WINDOWS\explorer.exe: error at offset 0: Permission denied
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-05 13:00 1036288 4c33e5b9a6197b6ed215f6cfba0a2daa C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2008-08-28 15:39 110080 e063b61a9466b0cf8a3a68316bd85877 C:\WINDOWS\SYSTEM32\services.exe
2008-08-28 15:39 14336 0c4a26a14d5812484d8a3c834bbd47ab C:\WINDOWS\SYSTEM32\lsass.exe
2005-06-11 02:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2004-08-05 13:00 57856 b4ef928e4fad79364a80acba6d999934 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
2008-08-28 15:39 58368 3513a57ec257df60f641d20031acb383 C:\WINDOWS\SYSTEM32\spoolsv.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-26 23:29 36864]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-01 17:41 68856]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41 1832272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 15:42 1404928]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 13:52 339968]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 21:12 221184]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 17:54 57344]
"UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01 110592]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 02:02 86016]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 04:19 69632]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"D-Link AirPlus XtremeG"="C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe" [2005-03-28 15:25 1011712]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-12-16 18:49 49152]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe" [2006-06-26 10:46 497200]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2006-06-26 11:34 614960]
"LVCOMSX"="C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe" [2006-06-26 11:33 243248]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-05-26 12:45 257088]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-13 21:53 1838592]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-04-25 18:21 201992]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispScrSavPage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"jGnnL"= {701B4D5E-DAB1-E7F4-5014-331C81A3A981} - C:\WINDOWS\system32\vqa.dll [2007-04-16 17:53 32768]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winbb65.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winet18.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winff25.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingg00.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winhv06.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winii23.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkd16.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winli76.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wintw03.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winus13.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwj78.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\HD Publishing\\Joint Task Force\\jtf.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.0\\cnc3game.dat"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"C:\\WINDOWS\\SYSTEM32\\DPVSETUP.EXE"=
"C:\\Program Files\\Fichiers communs\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29]
R2 LF30FS;LF30FS;C:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys [2004-11-19 19:07]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07]
S0 Winbb65;Winbb65;C:\WINDOWS\system32\Drivers\Winbb65.sys []
S0 Winet18;Winet18;C:\WINDOWS\system32\Drivers\Winet18.sys []
S0 Winff25;Winff25;C:\WINDOWS\system32\Drivers\Winff25.sys []
S0 Wingg00;Wingg00;C:\WINDOWS\system32\Drivers\Wingg00.sys []
S0 Winhv06;Winhv06;C:\WINDOWS\system32\Drivers\Winhv06.sys []
S0 Winii23;Winii23;C:\WINDOWS\system32\Drivers\Winii23.sys []
S0 Winkd16;Winkd16;C:\WINDOWS\system32\Drivers\Winkd16.sys []
S0 Winli76;Winli76;C:\WINDOWS\system32\Drivers\Winli76.sys []
S0 Wintw03;Wintw03;C:\WINDOWS\system32\Drivers\Wintw03.sys []
S0 Winus13;Winus13;C:\WINDOWS\system32\Drivers\Winus13.sys []
S0 Winwj78;Winwj78;C:\WINDOWS\system32\Drivers\Winwj78.sys []
S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys [2005-03-22 04:17]
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 19:08]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 19:11]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 19:11]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 19:13]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 19:15]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 15:17]
S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 15:17]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f0220ff4-4ef4-11db-a566-00123f30285f}]
\Shell\AutoRun\command - F:\setupSNK.exe
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
2008-07-26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 18:13]
2005-06-29 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1117227390.job
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2002-06-27 01:46]
2008-08-29 C:\WINDOWS\Tasks\User_Feed_Synchronization-{BBAB188B-CE11-4665-A1AD-6E8635453E7F}.job
- C:\WINDOWS\system32\msfeedssync.exe [2006-10-17 12:58]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Nokia.PCSync - C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
HKLM-Run-LFAgent - (no file)
Notify-WinCtrl32 - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\David Liardet\Application Data\Mozilla\Firefox\Profiles\ha6mbk7c.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.ch/
FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-30 13:11:50
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\a2freeRasAutogusvc]
"ImagePath"="ð%€|\18Ï\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FontCache3.0.0.0DcomLaunch]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FontCache3.0.0.0ose]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gusvcDcomLaunch]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iPodNtLmSsp]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MessengerNlaAppMgmt]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NlaAppMgmt]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Nlaidsvc]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Nlaidsvcupnphost]
"ImagePath"="ð%€|ÀÍ\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasAutogusvc]
"ImagePath"="ð%€|¨Í\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasAutoPolicyAgent]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgrAlerter]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgrAlerterRasMan]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgrdmserver]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsCryptSvc]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RSVPGoogleDesktopManager]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TapiSrvMSDTC]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usnjsvcclr_optimization_v2.0.50727_32]
"ImagePath"="ð%€|XÍ\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfSvcNla]
"ImagePath"="ð%€|¨Í\[u]0[/u]9 srv"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\SYSTEM32\ati2evxx.exe
C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\QuickCam10\COCIManager.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.bin
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\SYSTEM32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
C:\WINDOWS\SYSTEM32\IMAPI.EXE
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-30 13:19:54 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-30 11:19:41
Pre-Run: 86,592,061,440 octets libres
Post-Run: 87,004,753,920 octets libres
344 --- E O F --- 2008-08-29 23:04:06
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1537 [GMT 2:00]
Endroit: C:\Documents and Settings\David Liardet\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\David Liardet\Application Data\rhctm7j0en2p
C:\Documents and Settings\Lili Dos Santos\Cookies\lili_dos_santos@ehg-swisscom.hitbox[2].txt
C:\Program Files\GamesBar\oberontb.dll
C:\WINDOWS\system32\blphcpm7j0en2p.scr
C:\WINDOWS\system32\phcpm7j0en2p.bmp
C:\WINDOWS\SYSTEM32\VEdLTvut.ini
C:\WINDOWS\SYSTEM32\VEdLTvut.ini2
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-28 to 2008-08-30 ))))))))))))))))))))))))))))))))))))
.
2008-08-28 15:27 . 2008-08-28 15:39 96,976 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\klin.dat
2008-08-28 15:27 . 2008-08-28 15:39 87,855 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\klick.dat
2008-08-28 15:26 . 2008-08-28 15:26 <REP> d-------- C:\Program Files\Kaspersky Lab
2008-08-28 15:26 . 2008-08-30 13:13 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-28 15:26 . 2008-08-30 06:59 3,368,992 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2008-08-28 15:26 . 2008-08-30 06:59 507,936 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.dat
2008-08-28 15:26 . 2008-08-30 06:59 27,400 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx
2008-08-28 15:26 . 2008-08-30 06:59 2,816 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.idx
2008-08-26 15:22 . 2008-08-26 15:22 <REP> d-------- C:\Program Files\Fichiers communs\PCSuite
2008-08-26 15:22 . 2008-08-26 15:22 <REP> d-------- C:\Documents and Settings\David Liardet\Application Data\Malwarebytes
2008-08-26 15:12 . 2008-08-26 15:22 <REP> d-------- C:\WINDOWS\LastGood(2)
2008-08-23 15:24 . 2008-08-30 13:15 <REP> d-------- C:\Documents and Settings\David Liardet\Application Data\OpenOffice.org2
2008-08-23 15:18 . 2008-08-23 15:18 <REP> d-------- C:\Program Files\OpenOffice.org 2.4
2008-08-23 12:49 . 2008-08-26 15:22 <REP> d-------- C:\Program Files\PC Connectivity Solution
2008-08-23 12:49 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\pccsmcfd.sys
2008-08-23 12:49 . 2008-08-23 12:49 0 --a------ C:\WINDOWS\nsreg.dat
2008-08-22 23:23 . 2008-08-26 15:22 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-22 23:23 . 2008-08-22 23:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-22 23:23 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-08-22 23:23 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-08-22 23:08 . 2008-08-22 23:08 <REP> d-------- C:\Program Files\Trend Micro
2008-08-21 20:22 . 2008-08-28 12:46 <REP> d-------- C:\Program Files\a-squared Free
2008-08-17 19:00 . 2008-08-28 12:08 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-17 19:00 . 2008-08-28 15:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-17 18:21 . 2008-08-17 18:21 32 --a-s---- C:\WINDOWS\SYSTEM32\3897972993.dat
2008-08-17 18:17 . 2008-08-23 12:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-17 18:17 . 2008-08-17 18:17 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-16 11:04 . 2008-08-28 13:10 <REP> d-------- C:\Program Files\Yahoo!
2008-07-16 11:04 . 2008-07-16 11:04 <REP> d-------- C:\Program Files\CCleaner
2008-07-16 10:50 . 2005-05-23 13:00 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-07-16 10:50 . 2005-05-23 13:00 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-07-16 10:50 . 2005-05-23 13:00 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-07-16 10:50 . 2005-05-23 13:00 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-07-16 10:50 . 2005-05-23 13:00 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-07-16 10:50 . 2005-05-23 13:00 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-07-16 10:50 . 2005-05-23 13:00 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-07-16 10:50 . 2007-08-16 18:21 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Teleca
2008-07-16 10:50 . 2007-08-16 18:21 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sony Ericsson
2008-07-16 10:50 . 2005-05-23 13:29 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sonic
2008-07-16 10:50 . 2007-07-08 14:28 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Desperate Housewives
2008-07-16 10:50 . 2008-08-26 15:25 <REP> d-------- C:\Documents and Settings\Administrateur
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-30 00:29 --------- d-----w C:\Program Files\GamesBar
2008-08-28 18:13 --------- d-----w C:\Documents and Settings\Lili Dos Santos\Application Data\Skype
2008-08-28 13:39 58,368 ----a-w C:\WINDOWS\SYSTEM32\spoolsv.exe
2008-08-28 13:39 509,952 ----a-w C:\WINDOWS\SYSTEM32\winlogon.exe
2008-08-28 13:39 16,896 ----a-w C:\WINDOWS\SYSTEM32\svchost.exe
2008-08-28 13:39 14,336 ----a-w C:\WINDOWS\SYSTEM32\lsass.exe
2008-08-28 13:39 110,080 ----a-w C:\WINDOWS\SYSTEM32\services.exe
2008-08-28 13:39 1,039,360 ----a-w C:\WINDOWS\explorer.exe
2008-08-28 11:06 --------- d-----w C:\Program Files\Gamenext
2008-08-26 13:24 --------- d-----w C:\Program Files\World of Warcraft (privé)
2008-08-25 13:18 --------- d-----w C:\Program Files\World of Warcraft
2008-08-23 13:17 --------- d-----w C:\Program Files\Java
2008-08-23 10:51 --------- d-----w C:\Program Files\Nokia
2008-08-23 10:51 --------- d-----w C:\Program Files\Fichiers communs\Nokia
2008-08-23 10:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-08-18 14:58 --------- d-----w C:\Documents and Settings\Lili Dos Santos\Application Data\scrfunkamok
2008-08-18 14:52 --------- d-----w C:\Documents and Settings\David Liardet\Application Data\scrfunkamok
2008-08-18 14:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\INTERNET SPAM SUPPORT AUDIO
2008-08-17 17:44 --------- d-----w C:\Program Files\BearShare
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\wuauclt.exe
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\SYSTEM32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\wups.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\wuapi.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\wucltui.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\wuweb.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\wuaueng.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\SYSTEM32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\SYSTEM32\muweb.dll
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\SYSTEM32\es.dll
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\SYSTEM32\mscms.dll
2008-06-24 16:23 74,240 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mscms.dll
2008-06-24 08:28 3,592,192 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2008-06-23 09:21 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2008-06-23 09:21 625,664 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2008-06-23 09:20 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2008-06-21 05:23 161,792 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\SYSTEM32\mswsock.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
2008-06-20 10:44 138,368 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip6.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\bthport.sys
2008-05-08 12:28 202,752 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\rmcast.sys
2008-05-07 05:38 90,624 ----a-w C:\WINDOWS\SYSTEM32\nmwcdcls.dll
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2008-05-07 05:15 1,293,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2008-05-01 14:31 331,776 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msadce.dll
.
------- Sigcheck -------
2008-08-28 15:39 16896 a8fb150e88a67da58410b7e28ad52e8c C:\WINDOWS\SYSTEM32\svchost.exe
2005-05-25 21:07 359936 63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-01-13 19:07 360448 5562cc0a47b2aef06d3417b733f3c195 C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 18:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 12:44 360960 744e57c99232201ae98c49168b918f48 C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 13:51 361600 9aefa14bd6b182d61e3119fa5f436d3d C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 13:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2004-08-05 13:00 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2005-05-25 21:04 359808 88763a98a4c26c409741b4aa162720c9 C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys
2006-01-13 04:28 359808 583e063fdc888ca30d05c2724b0d7ef4 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
2007-10-30 19:20 360064 90caff4b094573449a0872a0f919b178 C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
2008-06-20 12:45 360320 1cc09561e21a48a7f649a40f18235860 C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
2008-06-20 12:45 360320 1cc09561e21a48a7f649a40f18235860 C:\WINDOWS\SYSTEM32\DRIVERS\tcpip.sys
2008-08-28 15:39 509952 68f89dcb80b45660aee06bf1fe353b49 C:\WINDOWS\SYSTEM32\winlogon.exe
md5deep: C:\WINDOWS\explorer.exe: error at offset 0: Permission denied
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-05 13:00 1036288 4c33e5b9a6197b6ed215f6cfba0a2daa C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2008-08-28 15:39 110080 e063b61a9466b0cf8a3a68316bd85877 C:\WINDOWS\SYSTEM32\services.exe
2008-08-28 15:39 14336 0c4a26a14d5812484d8a3c834bbd47ab C:\WINDOWS\SYSTEM32\lsass.exe
2005-06-11 02:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2004-08-05 13:00 57856 b4ef928e4fad79364a80acba6d999934 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
2008-08-28 15:39 58368 3513a57ec257df60f641d20031acb383 C:\WINDOWS\SYSTEM32\spoolsv.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-26 23:29 36864]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-01 17:41 68856]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41 1832272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 15:42 1404928]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 13:52 339968]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 21:12 221184]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 17:54 57344]
"UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01 110592]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 02:02 86016]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 04:19 69632]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"D-Link AirPlus XtremeG"="C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe" [2005-03-28 15:25 1011712]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-12-16 18:49 49152]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe" [2006-06-26 10:46 497200]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2006-06-26 11:34 614960]
"LVCOMSX"="C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe" [2006-06-26 11:33 243248]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-05-26 12:45 257088]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-13 21:53 1838592]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-04-25 18:21 201992]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispScrSavPage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"jGnnL"= {701B4D5E-DAB1-E7F4-5014-331C81A3A981} - C:\WINDOWS\system32\vqa.dll [2007-04-16 17:53 32768]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winbb65.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winet18.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winff25.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingg00.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winhv06.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winii23.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkd16.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winli76.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wintw03.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winus13.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwj78.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\HD Publishing\\Joint Task Force\\jtf.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.0\\cnc3game.dat"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"C:\\WINDOWS\\SYSTEM32\\DPVSETUP.EXE"=
"C:\\Program Files\\Fichiers communs\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29]
R2 LF30FS;LF30FS;C:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys [2004-11-19 19:07]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07]
S0 Winbb65;Winbb65;C:\WINDOWS\system32\Drivers\Winbb65.sys []
S0 Winet18;Winet18;C:\WINDOWS\system32\Drivers\Winet18.sys []
S0 Winff25;Winff25;C:\WINDOWS\system32\Drivers\Winff25.sys []
S0 Wingg00;Wingg00;C:\WINDOWS\system32\Drivers\Wingg00.sys []
S0 Winhv06;Winhv06;C:\WINDOWS\system32\Drivers\Winhv06.sys []
S0 Winii23;Winii23;C:\WINDOWS\system32\Drivers\Winii23.sys []
S0 Winkd16;Winkd16;C:\WINDOWS\system32\Drivers\Winkd16.sys []
S0 Winli76;Winli76;C:\WINDOWS\system32\Drivers\Winli76.sys []
S0 Wintw03;Wintw03;C:\WINDOWS\system32\Drivers\Wintw03.sys []
S0 Winus13;Winus13;C:\WINDOWS\system32\Drivers\Winus13.sys []
S0 Winwj78;Winwj78;C:\WINDOWS\system32\Drivers\Winwj78.sys []
S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys [2005-03-22 04:17]
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 19:08]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 19:11]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 19:11]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 19:13]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 19:15]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 15:17]
S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 15:17]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f0220ff4-4ef4-11db-a566-00123f30285f}]
\Shell\AutoRun\command - F:\setupSNK.exe
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
2008-07-26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 18:13]
2005-06-29 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1117227390.job
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2002-06-27 01:46]
2008-08-29 C:\WINDOWS\Tasks\User_Feed_Synchronization-{BBAB188B-CE11-4665-A1AD-6E8635453E7F}.job
- C:\WINDOWS\system32\msfeedssync.exe [2006-10-17 12:58]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Nokia.PCSync - C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
HKLM-Run-LFAgent - (no file)
Notify-WinCtrl32 - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\David Liardet\Application Data\Mozilla\Firefox\Profiles\ha6mbk7c.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.ch/
FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-30 13:11:50
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\a2freeRasAutogusvc]
"ImagePath"="ð%€|\18Ï\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FontCache3.0.0.0DcomLaunch]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FontCache3.0.0.0ose]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gusvcDcomLaunch]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iPodNtLmSsp]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MessengerNlaAppMgmt]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NlaAppMgmt]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Nlaidsvc]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Nlaidsvcupnphost]
"ImagePath"="ð%€|ÀÍ\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasAutogusvc]
"ImagePath"="ð%€|¨Í\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasAutoPolicyAgent]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgrAlerter]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgrAlerterRasMan]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgrdmserver]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsCryptSvc]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RSVPGoogleDesktopManager]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TapiSrvMSDTC]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usnjsvcclr_optimization_v2.0.50727_32]
"ImagePath"="ð%€|XÍ\[u]0[/u]9 srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfSvcNla]
"ImagePath"="ð%€|¨Í\[u]0[/u]9 srv"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\SYSTEM32\ati2evxx.exe
C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\QuickCam10\COCIManager.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.bin
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\SYSTEM32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
C:\WINDOWS\SYSTEM32\IMAPI.EXE
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-30 13:19:54 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-30 11:19:41
Pre-Run: 86,592,061,440 octets libres
Post-Run: 87,004,753,920 octets libres
344 --- E O F --- 2008-08-29 23:04:06
30 août 2008 à 10:42
30 août 2008 à 14:41
pour suivre aussi.