Infecter par lssas.exe

valou -  
 E..T -
Bonjour,
jai lssas.exe dans mon cpu je croi bein que ses un virus que fair!
Configuration: Windows XP
Firefox 3.0.1

27 réponses

  • 1
  • 2
Résumé de la discussion

Un utilisateur soupçonne que lsass.exe est un virus sur Windows XP et demande des conseils pratiques pour vérifier et nettoyer l’ordinateur, après avoir constaté des ralentissements et l’apparition d’un rapport. Plusieurs réponses suggèrent d’utiliser HijackThis pour générer un log et d’examiner les entrées de démarrage et les barres d’outil, afin d’identifier des composants potentiellement indésirables. En parallèle, des conseils préconisent des scans complémentaires comme rav.exe et la vérification des services actifs, car les éléments détectés dans le log proviennent parfois de pilotes légitimes ou de programmes fiables. Des échanges évoquent aussi le risque de ralentissement et de conflits logiciels, sans aboutir à une conclusion unique, et soulignent l’importance de sauvegarder les données et de privilégier des analyses approfondies.

Bobot (l'IA à votre service)
  2. valou
     
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:23:45, on 15/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
    C:\Program Files\Comodo\Firewall\CPF.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\souris.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\TmUnitedForever\TmForever.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: TBSB02408 - {21998A86-8246-4F14-ADAF-0E490696FE59} - C:\Documents and Settings\user\Application Data\Toolbars\Amazon Toolbar\amazon.dll
    O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Amazon Toolbar - {DABEFD00-2B5E-4DB8-88EB-B1F7500E97A8} - C:\Documents and Settings\user\Application Data\Toolbars\Amazon Toolbar\amazon.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SourisLancement] c:\souris.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{66A1966F-489A-4085-A451-C1B3C3A1D0DD}: NameServer = 208.67.222.222,208.67.220.220
    O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - Unknown owner - C:\WINDOWS\System32\TuneUpDefragService.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing)
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  7. valou
     
    dacoord je fait tous sa et je dit quand même que mon ordi mes 10minute a salumer!!!
    (il a3go de ram)
    0
  8. valou
     
    ComboFix 08-09-15.02 - user 2008-09-16 17:39:18.1 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.2556 [GMT 2:00]
    Lancé depuis: C:\Documents and Settings\user\Bureau\ComboFix.exe
    * Un nouveau point de restauration a été créé

    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\deceaff0_z.dll

    .
    ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-16 au 2008-09-16 ))))))))))))))))))))))))))))))))))))
    .

    2008-09-14 11:34 . 1998-09-24 13:03 171,967 --a------ C:\WINDOWS\system32\Odbcjet.hlp
    2008-09-14 11:34 . 1998-06-18 00:00 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL
    2008-09-14 11:34 . 1998-09-24 13:03 7,348 --a------ C:\WINDOWS\system32\Odbcjet.cnt
    2008-09-14 11:33 . 2008-09-14 11:33 40 --a------ C:\WINDOWS\NAVIGMA.INI
    2008-09-13 11:27 . 2008-09-13 11:33 <REP> d-------- C:\Program Files\TmUnitedForever
    2008-09-12 23:17 . 2008-09-12 23:17 23 --a------ C:\WINDOWS\system32\ffeba2_z.ocx
    2008-09-12 19:42 . 2008-09-15 17:39 <REP> d-------- C:\Program Files\Mozilla Thunderbird
    2008-09-12 18:04 . 2008-09-12 18:04 <REP> d-------- C:\Program Files\Windows Live Safety Center
    2008-09-10 13:56 . 2008-09-12 19:40 <REP> d-------- C:\Program Files\Cheat Engine
    2008-09-10 13:56 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
    2008-09-10 13:56 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
    2008-09-06 15:20 . 2008-09-06 15:20 <REP> d-------- C:\Documents and Settings\user\Application Data\Toolbars
    2008-09-06 15:19 . 2008-09-06 17:17 <REP> d-------- C:\Program Files\Thoosje Vista Sidebar
    2008-09-05 18:31 . 2008-09-05 18:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
    2008-09-04 17:30 . 2005-05-10 18:54 258,352 --a------ C:\WINDOWS\system32\unicows.dll
    2008-09-03 14:53 . 2008-09-03 19:00 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-09-03 14:53 . 2008-09-03 19:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SpeedBit
    2008-09-03 14:53 . 2008-09-03 14:53 479,298 --a------ C:\WINDOWS\system32\wbocx.ocx
    2008-09-03 14:53 . 2008-09-03 14:53 172,032 --a------ C:\WINDOWS\system32\AniGIF.ocx
    2008-09-03 14:53 . 2008-09-03 14:53 50,688 --a------ C:\WINDOWS\system32\wbhelp2.dll
    2008-08-31 12:36 . 2008-08-31 13:13 974 --a------ C:\Documents and Settings\Orph.egd
    2008-08-31 12:30 . 2008-08-31 12:30 <REP> d-------- C:\Program Files\Trend Micro
    2008-08-30 20:31 . 2008-09-15 19:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TrackMania
    2008-08-30 20:28 . 2008-09-06 14:04 <REP> d-------- C:\Program Files\TmNationsForever
    2008-08-30 12:13 . 2008-08-30 12:13 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-30 12:13 . 2008-08-30 12:13 <REP> d-------- C:\Documents and Settings\user\Application Data\Malwarebytes
    2008-08-30 12:13 . 2008-08-30 12:13 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-30 12:13 . 2008-08-17 15:05 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-08-30 12:13 . 2008-08-17 15:05 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-08-28 13:14 . 2008-08-28 13:14 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Comodo
    2008-08-28 13:12 . 2008-08-27 14:05 216 --a------ C:\boot.ini.comodofirewall
    2008-08-28 13:11 . 2008-08-28 13:11 <REP> d-------- C:\Program Files\Comodo
    2008-08-27 17:56 . 2008-09-05 18:23 <REP> d-------- C:\Program Files\Messenger Plus! Live
    2008-08-27 11:28 . 2008-08-27 11:28 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
    2008-08-27 11:12 . 2008-08-28 13:14 <REP> d-------- C:\Documents and Settings\user\Application Data\Comodo
    2008-08-27 11:12 . 2008-08-27 11:12 249,592 --a------ C:\WINDOWS\system32\cssdll32.dll
    2008-08-27 10:39 . 2008-09-15 20:23 <REP> d-------- C:\WINDOWS\Internet Logs
    2008-08-27 10:32 . 2008-08-27 10:32 <REP> d-------- C:\Documents and Settings\user\Application Data\Thunderbird
    2008-08-27 10:31 . 2008-08-27 10:31 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-08-27 10:28 . 2008-08-27 10:28 <REP> d-------- C:\Program Files\Lavasoft
    2008-08-26 19:21 . 2008-08-26 19:34 96,976 --a------ C:\WINDOWS\system32\drivers\klin.dat
    2008-08-26 19:21 . 2008-08-26 19:21 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat
    2008-08-26 19:20 . 2008-08-26 19:20 <REP> d-------- C:\Program Files\Kaspersky Lab
    2008-08-26 19:20 . 2008-09-16 17:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-08-26 19:20 . 2008-09-16 17:42 1,458,720 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-08-26 19:20 . 2008-09-16 17:42 360,480 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
    2008-08-26 19:20 . 2008-09-16 17:42 12,476 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
    2008-08-26 19:20 . 2008-09-16 17:42 2,312 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
    2008-08-26 19:09 . 2008-08-26 19:16 <REP> d-------- C:\Documents and Settings\user\Application Data\Uniblue
    2008-08-26 19:09 . 2008-08-26 19:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
    2008-08-26 15:00 . 2008-08-26 15:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\pixelStorm
    2008-08-26 14:03 . 2008-08-26 19:05 <REP> d-------- C:\Program Files\PC Camera
    2008-08-26 14:03 . 2004-08-19 16:10 91,648 --a------ C:\WINDOWS\system32\kswdmcap.ax
    2008-08-25 12:40 . 2008-08-25 12:41 <REP> d-------- C:\Program Files\Windows Live
    2008-08-24 20:11 . 2008-09-16 17:44 122 --a------ C:\Souris.ijh
    2008-08-24 20:09 . 2008-03-17 22:39 1,839,621 --------- C:\WINDOWS\souris.CAB
    2008-08-24 20:09 . 2008-08-24 20:09 249,856 --------- C:\WINDOWS\Setup1.exe
    2008-08-24 20:09 . 2008-08-24 20:09 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
    2008-08-24 20:09 . 2008-08-24 20:09 1,587 --a------ C:\WINDOWS\ST6UNST.000
    2008-08-22 12:45 . 2008-08-22 12:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
    2008-08-22 11:46 . 2008-09-15 18:21 <REP> d-------- C:\Program Files\Executive Software
    2008-08-22 11:32 . 2008-08-22 11:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-08-22 11:29 . 2008-09-16 17:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-08-22 11:05 . 2008-08-22 11:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-21 23:22 . 2008-08-21 23:22 0 --a------ C:\WINDOWS\iPlayer.INI
    2008-08-21 20:55 . 2008-08-21 20:55 <REP> d-------- C:\Program Files\Common Files
    2008-08-21 20:55 . 2003-07-20 20:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd
    2008-08-21 20:55 . 2005-01-04 11:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
    2008-08-21 20:48 . 2008-08-21 20:48 <REP> d-------- C:\Documents and Settings\user\Application Data\TuneUp Software
    2008-08-21 20:47 . 2008-09-14 20:01 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
    2008-08-21 17:37 . 2008-08-21 17:47 <REP> d-------- C:\WINDOWS\system32\Adobe
    2008-08-21 13:35 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-08-21 13:35 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
    2008-08-21 13:35 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-08-21 13:09 . 2008-08-21 13:09 3,932,214 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
    2008-08-21 13:09 . 2008-08-21 13:09 64,111 --a------ C:\WINDOWS\BricoPackUninst.cmd
    2008-08-21 13:06 . 2008-08-21 13:06 <REP> d-------- C:\WINDOWS\BricoPacks
    2008-08-21 13:06 . 2008-08-21 13:09 6,112 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
    2008-08-21 12:57 . 2008-09-16 17:32 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
    2008-08-21 11:20 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
    2008-08-21 11:20 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-08-21 11:20 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-08-21 11:20 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-08-21 11:20 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-08-21 11:20 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
    2008-08-21 11:20 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
    2008-08-21 11:20 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-08-21 11:20 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-08-21 10:58 . 2008-09-15 18:24 <REP> d-------- C:\Documents and Settings\user\Contacts
    2008-08-20 20:37 . 2008-08-21 10:57 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
    2008-08-20 20:37 . 2008-08-25 12:40 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-08-20 19:53 . 2008-08-20 19:53 <REP> d-------- C:\Program Files\Windows Media Connect 2
    2008-08-20 19:52 . 2008-08-21 10:25 <REP> d-------- C:\WINDOWS\system32\LogFiles
    2008-08-20 19:52 . 2008-08-20 19:52 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-08-20 19:46 . 2008-08-20 19:46 <REP> d-------- C:\Program Files\CCleaner
    2008-08-20 19:25 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
    2008-08-20 19:25 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
    2008-08-20 19:24 . 2008-04-11 20:51 683,520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2008-08-20 19:24 . 2008-05-01 16:31 331,776 --a--c--- C:\WINDOWS\system32\dllcache\msadce.dll
    2008-08-20 19:24 . 2008-05-08 14:28 202,752 --a--c--- C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-08-20 19:12 . 2008-08-22 08:36 <REP> d-------- C:\WINDOWS\system32\fr-fr
    2008-08-20 19:12 . 2008-08-21 10:37 <REP> d-------- C:\WINDOWS\system32\fr
    2008-08-20 19:12 . 2008-08-21 10:37 <REP> d-------- C:\WINDOWS\system32\bits
    2008-08-20 19:12 . 2008-08-21 10:36 <REP> d-------- C:\WINDOWS\l2schemas
    2008-08-20 19:08 . 2006-12-28 12:01 19,569 --a------ C:\WINDOWS\[u]0[/u]02583_.tmp
    2008-08-20 18:24 . 2008-08-20 18:24 <REP> d--hs---- C:\Documents and Settings\user\UserData
    2008-08-20 18:24 . 2008-08-20 18:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
    2008-08-20 18:15 . 2003-03-18 22:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
    2008-08-20 18:15 . 2003-03-18 21:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
    2008-08-20 18:15 . 2003-02-21 05:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
    2008-08-20 18:14 . 2008-08-20 18:14 13,678 --a------ C:\WINDOWS\system32\wpa.bak
    2008-08-20 18:05 . 2008-08-20 18:05 278,528 --a------ C:\Program Files\Fichiers communs\FDEUnInstaller.exe
    2008-08-20 18:05 . 2003-08-04 14:22 94,208 --a------ C:\WINDOWS\system32\W32n50.dll
    2008-08-20 18:05 . 2004-08-23 14:50 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
    2008-08-20 18:05 . 2003-08-04 14:22 16,128 --------- C:\WINDOWS\system32\PCANDIS5.SYS
    2008-08-17 12:55 . 2008-09-06 17:09 <REP> d-------- C:\Program Files\Yahoo!

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-16 15:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-22 10:41 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
    2008-08-21 11:09 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
    2008-08-15 17:44 --------- d-----w C:\Documents and Settings\user\Application Data\vlc
    2008-08-14 18:32 --------- d-----w C:\Program Files\VideoLAN
    2008-08-14 18:22 16,376 ----a-w C:\WINDOWS\gdrv.sys
    2008-08-14 18:22 --------- d-----w C:\Program Files\Realtek
    2008-08-14 18:22 --------- d-----w C:\Documents and Settings\user\Application Data\InstallShield
    2008-08-14 18:20 315,392 ----a-w C:\WINDOWS\HideWin.exe
    2008-08-14 18:08 --------- d-----w C:\Program Files\microsoft frontpage
    2008-08-14 18:06 --------- d-----w C:\Program Files\Services en ligne
    2008-07-29 18:21 218,376 ----a-w C:\WINDOWS\system32\klogon.dll
    2008-07-29 18:20 24,774 ----a-w C:\WINDOWS\system32\drivers\klopp.dat
    2008-07-21 16:34 121,872 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
    2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
    2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
    2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
    2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
    2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
    2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
    2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-24 16:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
    2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{21998A86-8246-4F14-ADAF-0E490696FE59}]
    2008-04-14 17:31 2433024 --a------ C:\Documents and Settings\user\Application Data\Toolbars\Amazon Toolbar\amazon.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{DABEFD00-2B5E-4DB8-88EB-B1F7500E97A8}"= "C:\Documents and Settings\user\Application Data\Toolbars\Amazon Toolbar\amazon.dll" [2008-04-14 2433024]

    [HKEY_CLASSES_ROOT\clsid\{dabefd00-2b5e-4db8-88eb-b1f7500e97a8}]
    [HKEY_CLASSES_ROOT\TBSB02408.TBSB02408.3]
    [HKEY_CLASSES_ROOT\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}]
    [HKEY_CLASSES_ROOT\TBSB02408.TBSB02408]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{DABEFD00-2B5E-4DB8-88EB-B1F7500E97A8}"= "C:\Documents and Settings\user\Application Data\Toolbars\Amazon Toolbar\amazon.dll" [2008-04-14 2433024]

    [HKEY_CLASSES_ROOT\clsid\{dabefd00-2b5e-4db8-88eb-b1f7500e97a8}]
    [HKEY_CLASSES_ROOT\TBSB02408.TBSB02408.3]
    [HKEY_CLASSES_ROOT\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}]
    [HKEY_CLASSES_ROOT\TBSB02408.TBSB02408]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15360]
    "SourisLancement"="c:\souris.exe" [2008-03-17 1085440]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2008-09-05 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-01-03 13508608]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-01-03 86016]
    "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2008-08-28 1115728]
    "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-07-29 206088]
    "RTHDCPL"="RTHDCPL.EXE" [2007-09-19 C:\WINDOWS\RTHDCPL.exe]
    "nwiz"="nwiz.exe" [2008-01-03 C:\WINDOWS\system32\nwiz.exe]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
    -r------- 2005-05-03 12:43 69632 C:\WINDOWS\Alcmtr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
    -r------- 2007-08-03 07:22 1826816 C:\WINDOWS\SkyTel.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784]
    R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
    S2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2006-03-02 14336]
    S3 CAM1210;SM0121 USB 2.0 Video Camera;C:\WINDOWS\system32\Drivers\cam1210.sys [2006-07-24 89856]
    S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [ ]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp
    .
    Contenu du dossier 'Tƒches planifi‚es'
    .
    - - - - ORPHELINS SUPPRIMES - - - -

    Notify-dimsntfy - (no file)
    MSConfigStartUp-!AVG Anti-Spyware - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

    .
    ------- Examen suppl‚mentaire -------
    .
    FireFox -: Profile - C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\naxui4x6.default\
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-16 17:44:51
    Windows 5.1.2600 Service Pack 2 NTFS

    Recherche de processus cach‚s ...

    Recherche d'‚l‚ments en d‚marrage automatique cach‚s ...

    Recherche de fichiers cach‚s ...

    Scan termin‚ avec succŠs
    Fichiers cach‚s: 0

    **************************************************************************
    .
    ------------------------ Autres processus actifs ------------------------
    .
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\wscntfy.exe
    .
    **************************************************************************
    .
    Heure de fin: 2008-09-16 17:47:07 - La machine a red‚marr‚
    ComboFix-quarantined-files.txt 2008-09-16 15:47:02

    Avant-CF: 124,730,028,032 octets libres
    AprŠs-CF: 124,681,744,384 octets libres

    246 --- E O F --- 2008-09-14 18:59:43
    0
  9. stiph_112
     
    essai de scaner ton ordi avec rav.exe
    0
  14. valou
     
    euh je croie avoir trouver une partie de pourquoi je bug jai télécharger un nettoyeur de registre et javai 795erreur :/
    0
  15. valou
     
    mes je RAM toujours mes moins en fessant se nettoyage que faire ?
    0
  18. hooligan63780 Messages postés 835 Date d'inscription   Statut Membre 5
     
    ben la franchement je ne c'est pas quoi te dire
    0
  20. valou
     
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:13:41, on 17/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Comodo\Firewall\CPF.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Documents and Settings\user\Bureau\souris.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
    O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SourisLancement] c:\souris.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{66A1966F-489A-4085-A451-C1B3C3A1D0DD}: NameServer = 208.67.222.222,208.67.220.220
    O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing)
    O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)
    0
  21. hooligan63780 Messages postés 835 Date d'inscription   Statut Membre 5
     
    franchement je pense que ton ordinateur a besion de defragmenter
    0
  • 1
  • 2

Discussions similaires

lssas.exe
Guilamenace -
kama -

2 réponses
Infecte par un virus
sapard -
seb77150 -

3 réponses
Mon ordinateur a été infecté par un virus ou
henry4002 -
jorginho67 -

6 réponses
Infecter par Trojan:Win32/Skeeyah.A!rfn
yukiwii- -
yukiwii- -

6 réponses
Je dois être infecter par un virus ! PUP.Optional.StartPage
zentone -
bazfile -

15 réponses