Infecter par lssas.exe

valou -  
Bonjour,
jai lssas.exe dans mon cpu je croi bein que ses un virus que fair!
Configuration: Windows XP
Firefox 3.0.1

27 réponses

Résumé de la discussion

Un utilisateur soupçonne que lsass.exe est un virus sur Windows XP et demande des conseils pratiques pour vérifier et nettoyer l’ordinateur, après avoir constaté des ralentissements et l’apparition d’un rapport. Plusieurs réponses suggèrent d’utiliser HijackThis pour générer un log et d’examiner les entrées de démarrage et les barres d’outil, afin d’identifier des composants potentiellement indésirables. En parallèle, des conseils préconisent des scans complémentaires comme rav.exe et la vérification des services actifs, car les éléments détectés dans le log proviennent parfois de pilotes légitimes ou de programmes fiables. Des échanges évoquent aussi le risque de ralentissement et de conflits logiciels, sans aboutir à une conclusion unique, et soulignent l’importance de sauvegarder les données et de privilégier des analyses approfondies.

Bobot (l’IA à votre service)
  2. valou
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:23:45, on 15/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
    C:\Program Files\Comodo\Firewall\CPF.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\souris.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\TmUnitedForever\TmForever.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: TBSB02408 - {21998A86-8246-4F14-ADAF-0E490696FE59} - C:\Documents and Settings\user\Application Data\Toolbars\Amazon Toolbar\amazon.dll
    O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Amazon Toolbar - {DABEFD00-2B5E-4DB8-88EB-B1F7500E97A8} - C:\Documents and Settings\user\Application Data\Toolbars\Amazon Toolbar\amazon.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SourisLancement] c:\souris.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{66A1966F-489A-4085-A451-C1B3C3A1D0DD}: NameServer = 208.67.222.222,208.67.220.220
    O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - Unknown owner - C:\WINDOWS\System32\TuneUpDefragService.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing)
    5. valou
      dacoord je fait tous sa et je dit quand même que mon ordi mes 10minute a salumer!!!
      (il a3go de ram)
      1. valou
        ComboFix 08-09-15.02 - user 2008-09-16 17:39:18.1 - NTFSx86
        Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.2556 [GMT 2:00]
        Lancé depuis: C:\Documents and Settings\user\Bureau\ComboFix.exe
        * Un nouveau point de restauration a été créé

        [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
        .

        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\WINDOWS\system32\deceaff0_z.dll

        .
        ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-16 au 2008-09-16 ))))))))))))))))))))))))))))))))))))
        .

        2008-09-14 11:34 . 1998-09-24 13:03 171,967 --a------ C:\WINDOWS\system32\Odbcjet.hlp
        2008-09-14 11:34 . 1998-06-18 00:00 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL
        2008-09-14 11:34 . 1998-09-24 13:03 7,348 --a------ C:\WINDOWS\system32\Odbcjet.cnt
        2008-09-14 11:33 . 2008-09-14 11:33 40 --a------ C:\WINDOWS\NAVIGMA.INI
        2008-09-13 11:27 . 2008-09-13 11:33 <REP> d-------- C:\Program Files\TmUnitedForever
        2008-09-12 23:17 . 2008-09-12 23:17 23 --a------ C:\WINDOWS\system32\ffeba2_z.ocx
        2008-09-12 19:42 . 2008-09-15 17:39 <REP> d-------- C:\Program Files\Mozilla Thunderbird
        2008-09-12 18:04 . 2008-09-12 18:04 <REP> d-------- C:\Program Files\Windows Live Safety Center
        2008-09-10 13:56 . 2008-09-12 19:40 <REP> d-------- C:\Program Files\Cheat Engine
        2008-09-10 13:56 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
        2008-09-10 13:56 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
        2008-09-06 15:20 . 2008-09-06 15:20 <REP> d-------- C:\Documents and Settings\user\Application Data\Toolbars
        2008-09-06 15:19 . 2008-09-06 17:17 <REP> d-------- C:\Program Files\Thoosje Vista Sidebar
        2008-09-05 18:31 . 2008-09-05 18:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
        2008-09-04 17:30 . 2005-05-10 18:54 258,352 --a------ C:\WINDOWS\system32\unicows.dll
        2008-09-03 14:53 . 2008-09-03 19:00 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
        2008-09-03 14:53 . 2008-09-03 19:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SpeedBit
        2008-09-03 14:53 . 2008-09-03 14:53 479,298 --a------ C:\WINDOWS\system32\wbocx.ocx
        2008-09-03 14:53 . 2008-09-03 14:53 172,032 --a------ C:\WINDOWS\system32\AniGIF.ocx
        2008-09-03 14:53 . 2008-09-03 14:53 50,688 --a------ C:\WINDOWS\system32\wbhelp2.dll
        2008-08-31 12:36 . 2008-08-31 13:13 974 --a------ C:\Documents and Settings\Orph.egd
        2008-08-31 12:30 . 2008-08-31 12:30 <REP> d-------- C:\Program Files\Trend Micro
        2008-08-30 20:31 . 2008-09-15 19:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TrackMania
        2008-08-30 20:28 . 2008-09-06 14:04 <REP> d-------- C:\Program Files\TmNationsForever
        2008-08-30 12:13 . 2008-08-30 12:13 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
        2008-08-30 12:13 . 2008-08-30 12:13 <REP> d-------- C:\Documents and Settings\user\Application Data\Malwarebytes
        2008-08-30 12:13 . 2008-08-30 12:13 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-08-30 12:13 . 2008-08-17 15:05 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
        2008-08-30 12:13 . 2008-08-17 15:05 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
        2008-08-28 13:14 . 2008-08-28 13:14 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Comodo
        2008-08-28 13:12 . 2008-08-27 14:05 216 --a------ C:\boot.ini.comodofirewall
        2008-08-28 13:11 . 2008-08-28 13:11 <REP> d-------- C:\Program Files\Comodo
        2008-08-27 17:56 . 2008-09-05 18:23 <REP> d-------- C:\Program Files\Messenger Plus! Live
        2008-08-27 11:28 . 2008-08-27 11:28 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
        2008-08-27 11:12 . 2008-08-28 13:14 <REP> d-------- C:\Documents and Settings\user\Application Data\Comodo
        2008-08-27 11:12 . 2008-08-27 11:12 249,592 --a------ C:\WINDOWS\system32\cssdll32.dll
        2008-08-27 10:39 . 2008-09-15 20:23 <REP> d-------- C:\WINDOWS\Internet Logs
        2008-08-27 10:32 . 2008-08-27 10:32 <REP> d-------- C:\Documents and Settings\user\Application Data\Thunderbird
        2008-08-27 10:31 . 2008-08-27 10:31 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
        2008-08-27 10:28 . 2008-08-27 10:28 <REP> d-------- C:\Program Files\Lavasoft
        2008-08-26 19:21 . 2008-08-26 19:34 96,976 --a------ C:\WINDOWS\system32\drivers\klin.dat
        2008-08-26 19:21 . 2008-08-26 19:21 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat
        2008-08-26 19:20 . 2008-08-26 19:20 <REP> d-------- C:\Program Files\Kaspersky Lab
        2008-08-26 19:20 . 2008-09-16 17:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
        2008-08-26 19:20 . 2008-09-16 17:42 1,458,720 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
        2008-08-26 19:20 . 2008-09-16 17:42 360,480 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
        2008-08-26 19:20 . 2008-09-16 17:42 12,476 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
        2008-08-26 19:20 . 2008-09-16 17:42 2,312 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
        2008-08-26 19:09 . 2008-08-26 19:16 <REP> d-------- C:\Documents and Settings\user\Application Data\Uniblue
        2008-08-26 19:09 . 2008-08-26 19:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
        2008-08-26 15:00 . 2008-08-26 15:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\pixelStorm
        2008-08-26 14:03 . 2008-08-26 19:05 <REP> d-------- C:\Program Files\PC Camera
        2008-08-26 14:03 . 2004-08-19 16:10 91,648 --a------ C:\WINDOWS\system32\kswdmcap.ax
        2008-08-25 12:40 . 2008-08-25 12:41 <REP> d-------- C:\Program Files\Windows Live
        2008-08-24 20:11 . 2008-09-16 17:44 122 --a------ C:\Souris.ijh
        2008-08-24 20:09 . 2008-03-17 22:39 1,839,621 --------- C:\WINDOWS\souris.CAB
        2008-08-24 20:09 . 2008-08-24 20:09 249,856 --------- C:\WINDOWS\Setup1.exe
        2008-08-24 20:09 . 2008-08-24 20:09 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
        2008-08-24 20:09 . 2008-08-24 20:09 1,587 --a------ C:\WINDOWS\ST6UNST.000
        2008-08-22 12:45 . 2008-08-22 12:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
        2008-08-22 11:46 . 2008-09-15 18:21 <REP> d-------- C:\Program Files\Executive Software
        2008-08-22 11:32 . 2008-08-22 11:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
        2008-08-22 11:29 . 2008-09-16 17:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
        2008-08-22 11:05 . 2008-08-22 11:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
        2008-08-21 23:22 . 2008-08-21 23:22 0 --a------ C:\WINDOWS\iPlayer.INI
        2008-08-21 20:55 . 2008-08-21 20:55 <REP> d-------- C:\Program Files\Common Files
        2008-08-21 20:55 . 2003-07-20 20:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd
        2008-08-21 20:55 . 2005-01-04 11:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
        2008-08-21 20:48 . 2008-08-21 20:48 <REP> d-------- C:\Documents and Settings\user\Application Data\TuneUp Software
        2008-08-21 20:47 . 2008-09-14 20:01 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
        2008-08-21 17:37 . 2008-08-21 17:47 <REP> d-------- C:\WINDOWS\system32\Adobe
        2008-08-21 13:35 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
        2008-08-21 13:35 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
        2008-08-21 13:35 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
        2008-08-21 13:09 . 2008-08-21 13:09 3,932,214 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
        2008-08-21 13:09 . 2008-08-21 13:09 64,111 --a------ C:\WINDOWS\BricoPackUninst.cmd
        2008-08-21 13:06 . 2008-08-21 13:06 <REP> d-------- C:\WINDOWS\BricoPacks
        2008-08-21 13:06 . 2008-08-21 13:09 6,112 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
        2008-08-21 12:57 . 2008-09-16 17:32 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
        2008-08-21 11:20 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
        2008-08-21 11:20 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
        2008-08-21 11:20 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
        2008-08-21 11:20 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
        2008-08-21 11:20 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
        2008-08-21 11:20 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
        2008-08-21 11:20 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
        2008-08-21 11:20 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
        2008-08-21 11:20 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
        2008-08-21 10:58 . 2008-09-15 18:24 <REP> d-------- C:\Documents and Settings\user\Contacts
        2008-08-20 20:37 . 2008-08-21 10:57 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
        2008-08-20 20:37 . 2008-08-25 12:40 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
        2008-08-20 19:53 . 2008-08-20 19:53 <REP> d-------- C:\Program Files\Windows Media Connect 2
        2008-08-20 19:52 . 2008-08-21 10:25 <REP> d-------- C:\WINDOWS\system32\LogFiles
        2008-08-20 19:52 . 2008-08-20 19:52 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
        2008-08-20 19:46 . 2008-08-20 19:46 <REP> d-------- C:\Program Files\CCleaner
        2008-08-20 19:25 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
        2008-08-20 19:25 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
        2008-08-20 19:24 . 2008-04-11 20:51 683,520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
        2008-08-20 19:24 . 2008-05-01 16:31 331,776 --a--c--- C:\WINDOWS\system32\dllcache\msadce.dll
        2008-08-20 19:24 . 2008-05-08 14:28 202,752 --a--c--- C:\WINDOWS\system32\dllcache\rmcast.sys
        2008-08-20 19:12 . 2008-08-22 08:36 <REP> d-------- C:\WINDOWS\system32\fr-fr
        2008-08-20 19:12 . 2008-08-21 10:37 <REP> d-------- C:\WINDOWS\system32\fr
        2008-08-20 19:12 . 2008-08-21 10:37 <REP> d-------- C:\WINDOWS\system32\bits
        2008-08-20 19:12 . 2008-08-21 10:36 <REP> d-------- C:\WINDOWS\l2schemas
        2008-08-20 19:08 . 2006-12-28 12:01 19,569 --a------ C:\WINDOWS\[u]0[/u]02583_.tmp
        2008-08-20 18:24 . 2008-08-20 18:24 <REP> d--hs---- C:\Documents and Settings\user\UserData
        2008-08-20 18:24 . 2008-08-20 18:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
        2008-08-20 18:15 . 2003-03-18 22:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
        2008-08-20 18:15 . 2003-03-18 21:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
        2008-08-20 18:15 . 2003-02-21 05:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
        2008-08-20 18:14 . 2008-08-20 18:14 13,678 --a------ C:\WINDOWS\system32\wpa.bak
        2008-08-20 18:05 . 2008-08-20 18:05 278,528 --a------ C:\Program Files\Fichiers communs\FDEUnInstaller.exe
        2008-08-20 18:05 . 2003-08-04 14:22 94,208 --a------ C:\WINDOWS\system32\W32n50.dll
        2008-08-20 18:05 . 2004-08-23 14:50 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
        2008-08-20 18:05 . 2003-08-04 14:22 16,128 --------- C:\WINDOWS\system32\PCANDIS5.SYS
        2008-08-17 12:55 . 2008-09-06 17:09 <REP> d-------- C:\Program Files\Yahoo!

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-09-16 15:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
        2008-08-22 10:41 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
        2008-08-21 11:09 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
        2008-08-15 17:44 --------- d-----w C:\Documents and Settings\user\Application Data\vlc
        2008-08-14 18:32 --------- d-----w C:\Program Files\VideoLAN
        2008-08-14 18:22 16,376 ----a-w C:\WINDOWS\gdrv.sys
        2008-08-14 18:22 --------- d-----w C:\Program Files\Realtek
        2008-08-14 18:22 --------- d-----w C:\Documents and Settings\user\Application Data\InstallShield
        2008-08-14 18:20 315,392 ----a-w C:\WINDOWS\HideWin.exe
        2008-08-14 18:08 --------- d-----w C:\Program Files\microsoft frontpage
        2008-08-14 18:06 --------- d-----w C:\Program Files\Services en ligne
        2008-07-29 18:21 218,376 ----a-w C:\WINDOWS\system32\klogon.dll
        2008-07-29 18:20 24,774 ----a-w C:\WINDOWS\system32\drivers\klopp.dat
        2008-07-21 16:34 121,872 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
        2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
        2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
        2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
        2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
        2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
        2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
        2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
        2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
        2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
        2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
        2008-06-24 16:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
        2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
        2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
        .

        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
        REGEDIT4

        [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{21998A86-8246-4F14-ADAF-0E490696FE59}]
        2008-04-14 17:31 2433024 --a------ C:\Documents and Settings\user\Application Data\Toolbars\Amazon Toolbar\amazon.dll

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
        "{DABEFD00-2B5E-4DB8-88EB-B1F7500E97A8}"= "C:\Documents and Settings\user\Application Data\Toolbars\Amazon Toolbar\amazon.dll" [2008-04-14 2433024]

        [HKEY_CLASSES_ROOT\clsid\{dabefd00-2b5e-4db8-88eb-b1f7500e97a8}]
        [HKEY_CLASSES_ROOT\TBSB02408.TBSB02408.3]
        [HKEY_CLASSES_ROOT\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}]
        [HKEY_CLASSES_ROOT\TBSB02408.TBSB02408]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
        "{DABEFD00-2B5E-4DB8-88EB-B1F7500E97A8}"= "C:\Documents and Settings\user\Application Data\Toolbars\Amazon Toolbar\amazon.dll" [2008-04-14 2433024]

        [HKEY_CLASSES_ROOT\clsid\{dabefd00-2b5e-4db8-88eb-b1f7500e97a8}]
        [HKEY_CLASSES_ROOT\TBSB02408.TBSB02408.3]
        [HKEY_CLASSES_ROOT\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}]
        [HKEY_CLASSES_ROOT\TBSB02408.TBSB02408]

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15360]
        "SourisLancement"="c:\souris.exe" [2008-03-17 1085440]
        "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2008-09-05 5724184]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-01-03 13508608]
        "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-01-03 86016]
        "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2008-08-28 1115728]
        "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-07-29 206088]
        "RTHDCPL"="RTHDCPL.EXE" [2007-09-19 C:\WINDOWS\RTHDCPL.exe]
        "nwiz"="nwiz.exe" [2008-01-03 C:\WINDOWS\system32\nwiz.exe]

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
        -r------- 2005-05-03 12:43 69632 C:\WINDOWS\Alcmtr.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
        -r------- 2007-08-03 07:22 1826816 C:\WINDOWS\SkyTel.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
        "DisableMonitoring"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

        R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784]
        R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
        S2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2006-03-02 14336]
        S3 CAM1210;SM0121 USB 2.0 Video Camera;C:\WINDOWS\system32\Drivers\cam1210.sys [2006-07-24 89856]
        S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [ ]

        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
        UxTuneUp
        .
        Contenu du dossier 'Tƒches planifi‚es'
        .
        - - - - ORPHELINS SUPPRIMES - - - -

        Notify-dimsntfy - (no file)
        MSConfigStartUp-!AVG Anti-Spyware - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

        .
        ------- Examen suppl‚mentaire -------
        .
        FireFox -: Profile - C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\naxui4x6.default\
        FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll
        FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll
        .

        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-09-16 17:44:51
        Windows 5.1.2600 Service Pack 2 NTFS

        Recherche de processus cach‚s ...

        Recherche d'‚l‚ments en d‚marrage automatique cach‚s ...

        Recherche de fichiers cach‚s ...

        Scan termin‚ avec succŠs
        Fichiers cach‚s: 0

        **************************************************************************
        .
        ------------------------ Autres processus actifs ------------------------
        .
        C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
        C:\Program Files\Comodo\Firewall\cmdagent.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\WINDOWS\system32\wscntfy.exe
        .
        **************************************************************************
        .
        Heure de fin: 2008-09-16 17:47:07 - La machine a red‚marr‚
        ComboFix-quarantined-files.txt 2008-09-16 15:47:02

        Avant-CF: 124,730,028,032 octets libres
        AprŠs-CF: 124,681,744,384 octets libres

        246 --- E O F --- 2008-09-14 18:59:43
        6. valou
          euh je croie avoir trouver une partie de pourquoi je bug jai télécharger un nettoyeur de registre et javai 795erreur :/
          6. valou
            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 21:13:41, on 17/09/2008
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.6000.16705)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\Explorer.EXE
            C:\WINDOWS\RTHDCPL.EXE
            C:\WINDOWS\system32\RUNDLL32.EXE
            C:\Program Files\Comodo\Firewall\CPF.exe
            C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
            C:\Program Files\Comodo\Firewall\cmdagent.exe
            C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
            C:\WINDOWS\system32\nvsvc32.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Documents and Settings\user\Bureau\souris.exe
            C:\Program Files\Mozilla Firefox\firefox.exe
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
            O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
            O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
            O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
            O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
            O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [SourisLancement] c:\souris.exe
            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
            O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
            O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
            O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
            O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
            O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
            O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
            O17 - HKLM\System\CCS\Services\Tcpip\..\{66A1966F-489A-4085-A451-C1B3C3A1D0DD}: NameServer = 208.67.222.222,208.67.220.220
            O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
            O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
            O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
            O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
            O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing)
            O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)
            • 1
            • 2

            Discussions similaires

            Infecte par un virus
            sapard

            3 réponses
            Mon ordinateur a été infecté par un virus ou
            henry4002

            6 réponses
            Infecter par Trojan:Win32/Skeeyah.A!rfn
            yukiwii-

            6 réponses
            Je dois être infecter par un virus ! PUP.Optional.StartPage
            zentone

            15 réponses
            mon pc est infecter voici mon rapport ZHPDIAG
            zenasmus

            9 réponses