Svchost infecte par un trojan
Elanakin
-
Lyonnais92 Messages postés 25708 Statut Contributeur sécurité -
Lyonnais92 Messages postés 25708 Statut Contributeur sécurité -
Bonjour, j'ai un assez gros problèmes à priori mon fichier svchost.exe est infecter par un trojan l'alerte Avast se déclenche assez souvent et à priori il est in-supprimable in-quarantainable :p et in-modifiable !
Je ne sais vraiment pas quoi faire :p
Merci d'avance pour votre aides !
Je ne sais vraiment pas quoi faire :p
Merci d'avance pour votre aides !
A voir également:
- Svchost infecte par un trojan
- Svchost - Guide
- Trojan remover - Télécharger - Antivirus & Antimalwares
- Trojan sms-par google - Accueil - Messagerie instantanée
- Anti trojan - Télécharger - Antivirus & Antimalwares
- Ce malware Android se fait passer pour Chrome pour voler vos données personnelles en toute discrétion - Accueil - Virus
57 réponses
[url=https://www.hiboox.fr/][img]http://images0.hiboox.com/images/4108/084268be81aae90da25ec3b7b353c5fc.bmp[/img][/url]
https://www.hiboox.fr/
https://www.hiboox.fr/
Re,
tu as le CD de Windows ? avec le SP2 ? et la clé de 25 caractères ?
On va envisager de réparer Windows.
tu as le CD de Windows ? avec le SP2 ? et la clé de 25 caractères ?
On va envisager de réparer Windows.
Re,
on va commencer par la console de récupération.
Ouvre ce lien :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
tu as des procédures pour installer la console de récupération.
Choisis celle qui correspond à ton cas et installe la.
Ensuite, exécute Combofix comme indiqué.
on va commencer par la console de récupération.
Ouvre ce lien :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
tu as des procédures pour installer la console de récupération.
Choisis celle qui correspond à ton cas et installe la.
Ensuite, exécute Combofix comme indiqué.
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Je change le svchost depuis la console de réparation ?
voici le rapport de combofix :
ComboFix 08-10-08.05 - Elanakin 2008-10-09 22:23:11.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.627 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Elanakin\Bureau\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\EhRrutwa.ini
C:\WINDOWS\system32\EhRrutwa.ini2
C:\WINDOWS\system32\eqdfikqn.ini
C:\WINDOWS\system32\vvutnnyv.ini
C:\WINDOWS\system32\wfdiorgs.ini
C:\WINDOWS\system32\xswxurcw.ini
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-09 au 2008-10-09 ))))))))))))))))))))))))))))))))))))
.
2008-10-09 21:55 . 2008-10-09 21:55 362 --a------ C:\WINDOWS\Raccourci vers WINDOWS.lnk
2008-10-08 22:29 . 2008-10-08 22:29 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-10-07 09:36 . 2008-10-07 09:40 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\GrabIt
2008-10-07 08:56 . 2008-10-07 08:57 <REP> d-------- C:\Program Files\trend micro
2008-10-06 18:01 . 2008-10-06 18:49 <REP> d-------- C:\Program Files\SoundBase
2008-10-06 07:08 . 2008-10-06 18:31 <REP> d-------- C:\Program Files\AIMP2
2008-10-05 22:17 . 2008-10-05 22:18 <REP> d-------- C:\Program Files\Winamp
2008-10-05 22:17 . 2008-10-05 22:31 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Winamp
2008-10-03 17:35 . 2008-10-03 17:35 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LameFE
2008-10-03 07:19 . 2008-10-06 23:17 <REP> d-------- C:\Program Files\LameFE
2008-10-03 07:19 . 2008-10-03 07:23 <REP> d-------- C:\Documents and Settings\Elanakin\LameFE22
2008-09-28 12:59 . 2008-10-02 17:57 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LimeWire
2008-09-28 12:55 . 2008-09-28 12:56 <REP> d-------- C:\Program Files\LimeWire
2008-09-24 14:48 . 2008-09-27 08:55 <REP> d-------- C:\Program Files\Trojan Remover
2008-09-23 12:12 . 2008-09-23 12:12 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Search
2008-09-23 11:54 . 2008-09-23 11:54 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Desktop Search
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\WINDOWS\system32\GroupPolicy
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\Program Files\Windows Desktop Search
2008-09-23 11:43 . 2008-09-23 11:43 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-23 09:55 . 2008-09-23 09:57 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-23 09:55 . 2008-09-23 09:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\PassMark
2008-09-23 09:42 . 2008-09-23 10:34 6,203,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-23 09:42 . 2008-09-23 10:34 74,816 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-22 19:14 . 2008-09-22 19:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-09-16 13:17 . 2008-09-16 13:17 <REP> d-------- C:\WINDOWS\Sun
2008-09-16 11:06 . 2008-09-16 11:06 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Malwarebytes
2008-09-09 08:01 . 2008-10-09 19:02 <REP> d-------- C:\Warhammer Online - Age of Reckoning
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-09 16:39 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\uTorrent
2008-10-07 15:56 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-16 08:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-15 19:10 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\dvdcss
2008-09-13 11:02 --------- d-----w C:\Program Files\LucasArts
2008-09-09 22:04 38,528 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 22:03 17,200 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-08 01:01 --------- d-----w C:\Program Files\Windows Live
2008-09-07 18:04 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TuneUp Software
2008-09-07 18:03 --------- d-----w C:\Program Files\ESET
2008-09-07 13:22 2,322,176 ----a-w C:\WINDOWS\system32\TUKernel.exe
2008-09-07 13:08 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-09-07 13:04 355,584 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe
2008-09-07 13:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-07 13:02 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-07 13:02 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-09-07 12:58 --------- d-----w C:\Program Files\OO Software
2008-09-07 09:29 --------- d-----w C:\Program Files\uTorrent
2008-09-07 09:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-07 09:10 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-09-06 16:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-05 15:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-05 06:56 --------- d-----w C:\Program Files\Fichiers communs\BitDefender
2008-09-04 19:32 --------- d-----w C:\Program Files\BitDefender
2008-09-04 19:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 14:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom
2008-09-01 14:12 --------- d-----w C:\Program Files\TomTom HOME
2008-09-01 10:49 --------- d-----w C:\Program Files\Lavasoft
2008-09-01 10:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-31 12:03 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Nero
2008-08-31 11:52 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-08-31 11:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-08-31 11:47 --------- d-----w C:\Program Files\Nero
2008-08-31 10:06 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TomTom
2008-08-31 09:23 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\InstallShield
2008-08-31 09:21 --------- d-----w C:\Program Files\TomTom DesktopSuite
2008-08-31 08:30 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Ahead
2008-08-31 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-08-31 08:00 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Canneverbe_Limited
2008-08-31 07:38 --------- d-----w C:\Program Files\StarWarsGalaxies
2008-08-31 06:56 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-30 07:21 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Petroglyph
2008-08-28 07:30 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-08-27 08:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-25 20:31 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-08-25 20:30 --------- d-----w C:\Program Files\Fichiers communs\Logishrd
2008-08-19 12:15 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-19 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-08-19 07:43 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Logitech
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-08-19 07:39 --------- d-----w C:\Program Files\Logitech
2008-08-17 13:22 53,480 ----a-w C:\Documents and Settings\Elanakin\Application Data\GDIPFONTCACHEV1.DAT
2008-08-17 13:21 --------- d-----w C:\Program Files\MSECache
2008-08-14 18:12 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-16 23:02 634,880 ------w C:\WINDOWS\system32\gpprefcl.dll
2008-07-11 15:29 94,208 ----a-w C:\WINDOWS\ScUnin.exe
.
------- Sigcheck -------
md5deep: C:\WINDOWS\system32\svchost.exe: Permission denied
2008-06-21 16:53 506368 8d52aedd07247b743a4d9bd372f69109 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.EXE" [2003-04-14 1498032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 154368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 86016]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-28 2512128]
"nwiz"="nwiz.exe" [2008-05-03 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15360]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 237568]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=pgufxu.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Elanakin^Menu Démarrer^Programmes^Démarrage^hamachi.lnk]
path=C:\Documents and Settings\Elanakin\Menu Démarrer\Programmes\Démarrage\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Steam\\steamapps\\tom182_2\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Steam\\steamapps\\tom182_2\\day of defeat source\\hl2.exe"=
"D:\\Jeux\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
"D:\\Jeux\\Dofus\\Dofus.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"44979:TCP"= 44979:TCP:utorrent
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-19 14336]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-06-25 43520]
S3 musbehco;musbehco;C:\DOCUME~1\Elanakin\LOCALS~1\Temp\musbehco.sys [ ]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-09-07 355584]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-10-09 C:\WINDOWS\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:23]
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Elanakin\Application Data\Mozilla\Firefox\Profiles\f26i7xlz.default\
FF -: plugin - C:\Documents and Settings\Elanakin\Application Data\Mozilla\Firefox\Profiles\f26i7xlz.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-09 22:24:47
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-10-09 22:27:26
ComboFix-quarantined-files.txt 2008-10-09 20:27:17
Avant-CF: 16,171,958,272 octets libres
Après-CF: 16,174,522,368 octets libres
209 --- E O F --- 2008-09-23 09:45:38
voici le rapport de combofix :
ComboFix 08-10-08.05 - Elanakin 2008-10-09 22:23:11.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.627 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Elanakin\Bureau\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\EhRrutwa.ini
C:\WINDOWS\system32\EhRrutwa.ini2
C:\WINDOWS\system32\eqdfikqn.ini
C:\WINDOWS\system32\vvutnnyv.ini
C:\WINDOWS\system32\wfdiorgs.ini
C:\WINDOWS\system32\xswxurcw.ini
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-09 au 2008-10-09 ))))))))))))))))))))))))))))))))))))
.
2008-10-09 21:55 . 2008-10-09 21:55 362 --a------ C:\WINDOWS\Raccourci vers WINDOWS.lnk
2008-10-08 22:29 . 2008-10-08 22:29 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-10-07 09:36 . 2008-10-07 09:40 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\GrabIt
2008-10-07 08:56 . 2008-10-07 08:57 <REP> d-------- C:\Program Files\trend micro
2008-10-06 18:01 . 2008-10-06 18:49 <REP> d-------- C:\Program Files\SoundBase
2008-10-06 07:08 . 2008-10-06 18:31 <REP> d-------- C:\Program Files\AIMP2
2008-10-05 22:17 . 2008-10-05 22:18 <REP> d-------- C:\Program Files\Winamp
2008-10-05 22:17 . 2008-10-05 22:31 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Winamp
2008-10-03 17:35 . 2008-10-03 17:35 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LameFE
2008-10-03 07:19 . 2008-10-06 23:17 <REP> d-------- C:\Program Files\LameFE
2008-10-03 07:19 . 2008-10-03 07:23 <REP> d-------- C:\Documents and Settings\Elanakin\LameFE22
2008-09-28 12:59 . 2008-10-02 17:57 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LimeWire
2008-09-28 12:55 . 2008-09-28 12:56 <REP> d-------- C:\Program Files\LimeWire
2008-09-24 14:48 . 2008-09-27 08:55 <REP> d-------- C:\Program Files\Trojan Remover
2008-09-23 12:12 . 2008-09-23 12:12 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Search
2008-09-23 11:54 . 2008-09-23 11:54 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Desktop Search
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\WINDOWS\system32\GroupPolicy
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\Program Files\Windows Desktop Search
2008-09-23 11:43 . 2008-09-23 11:43 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-23 09:55 . 2008-09-23 09:57 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-23 09:55 . 2008-09-23 09:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\PassMark
2008-09-23 09:42 . 2008-09-23 10:34 6,203,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-23 09:42 . 2008-09-23 10:34 74,816 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-22 19:14 . 2008-09-22 19:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-09-16 13:17 . 2008-09-16 13:17 <REP> d-------- C:\WINDOWS\Sun
2008-09-16 11:06 . 2008-09-16 11:06 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Malwarebytes
2008-09-09 08:01 . 2008-10-09 19:02 <REP> d-------- C:\Warhammer Online - Age of Reckoning
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-09 16:39 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\uTorrent
2008-10-07 15:56 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-16 08:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-15 19:10 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\dvdcss
2008-09-13 11:02 --------- d-----w C:\Program Files\LucasArts
2008-09-09 22:04 38,528 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 22:03 17,200 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-08 01:01 --------- d-----w C:\Program Files\Windows Live
2008-09-07 18:04 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TuneUp Software
2008-09-07 18:03 --------- d-----w C:\Program Files\ESET
2008-09-07 13:22 2,322,176 ----a-w C:\WINDOWS\system32\TUKernel.exe
2008-09-07 13:08 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-09-07 13:04 355,584 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe
2008-09-07 13:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-07 13:02 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-07 13:02 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-09-07 12:58 --------- d-----w C:\Program Files\OO Software
2008-09-07 09:29 --------- d-----w C:\Program Files\uTorrent
2008-09-07 09:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-07 09:10 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-09-06 16:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-05 15:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-05 06:56 --------- d-----w C:\Program Files\Fichiers communs\BitDefender
2008-09-04 19:32 --------- d-----w C:\Program Files\BitDefender
2008-09-04 19:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 14:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom
2008-09-01 14:12 --------- d-----w C:\Program Files\TomTom HOME
2008-09-01 10:49 --------- d-----w C:\Program Files\Lavasoft
2008-09-01 10:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-31 12:03 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Nero
2008-08-31 11:52 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-08-31 11:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-08-31 11:47 --------- d-----w C:\Program Files\Nero
2008-08-31 10:06 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TomTom
2008-08-31 09:23 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\InstallShield
2008-08-31 09:21 --------- d-----w C:\Program Files\TomTom DesktopSuite
2008-08-31 08:30 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Ahead
2008-08-31 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-08-31 08:00 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Canneverbe_Limited
2008-08-31 07:38 --------- d-----w C:\Program Files\StarWarsGalaxies
2008-08-31 06:56 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-30 07:21 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Petroglyph
2008-08-28 07:30 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-08-27 08:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-25 20:31 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-08-25 20:30 --------- d-----w C:\Program Files\Fichiers communs\Logishrd
2008-08-19 12:15 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-19 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-08-19 07:43 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Logitech
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-08-19 07:39 --------- d-----w C:\Program Files\Logitech
2008-08-17 13:22 53,480 ----a-w C:\Documents and Settings\Elanakin\Application Data\GDIPFONTCACHEV1.DAT
2008-08-17 13:21 --------- d-----w C:\Program Files\MSECache
2008-08-14 18:12 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-16 23:02 634,880 ------w C:\WINDOWS\system32\gpprefcl.dll
2008-07-11 15:29 94,208 ----a-w C:\WINDOWS\ScUnin.exe
.
------- Sigcheck -------
md5deep: C:\WINDOWS\system32\svchost.exe: Permission denied
2008-06-21 16:53 506368 8d52aedd07247b743a4d9bd372f69109 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.EXE" [2003-04-14 1498032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 154368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 86016]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-28 2512128]
"nwiz"="nwiz.exe" [2008-05-03 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15360]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 237568]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=pgufxu.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Elanakin^Menu Démarrer^Programmes^Démarrage^hamachi.lnk]
path=C:\Documents and Settings\Elanakin\Menu Démarrer\Programmes\Démarrage\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Steam\\steamapps\\tom182_2\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Steam\\steamapps\\tom182_2\\day of defeat source\\hl2.exe"=
"D:\\Jeux\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
"D:\\Jeux\\Dofus\\Dofus.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"44979:TCP"= 44979:TCP:utorrent
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-19 14336]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-06-25 43520]
S3 musbehco;musbehco;C:\DOCUME~1\Elanakin\LOCALS~1\Temp\musbehco.sys [ ]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-09-07 355584]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-10-09 C:\WINDOWS\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:23]
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Elanakin\Application Data\Mozilla\Firefox\Profiles\f26i7xlz.default\
FF -: plugin - C:\Documents and Settings\Elanakin\Application Data\Mozilla\Firefox\Profiles\f26i7xlz.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-09 22:24:47
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-10-09 22:27:26
ComboFix-quarantined-files.txt 2008-10-09 20:27:17
Avant-CF: 16,171,958,272 octets libres
Après-CF: 16,174,522,368 octets libres
209 --- E O F --- 2008-09-23 09:45:38
Re,
oui, l'idée c'est bien de remplacer le fichier par celui du CD d'origine avec la console de récupération.
un peu de nettoyage avant :
Copie ou imprime les instructions avant
Déconnecte toi d'internet et ferme toutes tes applications.
Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
Driver::
musbehco
Rootkit::
C:\DOCUME~1\Elanakin\LOCALS~1\Temp\musbehco.sys
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe
Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Réactive ton parefeu, ton antivirus, la garde de ton antispyware
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Remets aussi un rapport Hijackthis
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.
oui, l'idée c'est bien de remplacer le fichier par celui du CD d'origine avec la console de récupération.
un peu de nettoyage avant :
Copie ou imprime les instructions avant
Déconnecte toi d'internet et ferme toutes tes applications.
Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
Driver::
musbehco
Rootkit::
C:\DOCUME~1\Elanakin\LOCALS~1\Temp\musbehco.sys
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe
Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Réactive ton parefeu, ton antivirus, la garde de ton antispyware
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Remets aussi un rapport Hijackthis
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.
ComboFix 08-10-08.05 - Elanakin 2008-10-10 17:12:08.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.651 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Elanakin\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\Elanakin\Bureau\CFscript.txt
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MUSBEHCO
-------\Service_musbehco
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-10 au 2008-10-10 ))))))))))))))))))))))))))))))))))))
.
2008-10-09 21:55 . 2008-10-09 21:55 362 --a------ C:\WINDOWS\Raccourci vers WINDOWS.lnk
2008-10-08 22:29 . 2008-10-08 22:29 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-10-07 09:36 . 2008-10-07 09:40 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\GrabIt
2008-10-07 08:56 . 2008-10-07 08:57 <REP> d-------- C:\Program Files\trend micro
2008-10-06 18:01 . 2008-10-06 18:49 <REP> d-------- C:\Program Files\SoundBase
2008-10-06 07:08 . 2008-10-06 18:31 <REP> d-------- C:\Program Files\AIMP2
2008-10-05 22:17 . 2008-10-05 22:18 <REP> d-------- C:\Program Files\Winamp
2008-10-05 22:17 . 2008-10-05 22:31 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Winamp
2008-10-03 17:35 . 2008-10-03 17:35 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LameFE
2008-10-03 07:19 . 2008-10-06 23:17 <REP> d-------- C:\Program Files\LameFE
2008-10-03 07:19 . 2008-10-03 07:23 <REP> d-------- C:\Documents and Settings\Elanakin\LameFE22
2008-09-28 12:59 . 2008-10-02 17:57 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LimeWire
2008-09-28 12:55 . 2008-09-28 12:56 <REP> d-------- C:\Program Files\LimeWire
2008-09-24 14:48 . 2008-09-27 08:55 <REP> d-------- C:\Program Files\Trojan Remover
2008-09-23 12:12 . 2008-09-23 12:12 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Search
2008-09-23 11:54 . 2008-09-23 11:54 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Desktop Search
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\WINDOWS\system32\GroupPolicy
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\Program Files\Windows Desktop Search
2008-09-23 11:43 . 2008-09-23 11:43 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-23 09:55 . 2008-09-23 09:57 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-23 09:55 . 2008-09-23 09:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\PassMark
2008-09-23 09:42 . 2008-09-23 10:34 6,203,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-23 09:42 . 2008-09-23 10:34 74,816 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-22 19:14 . 2008-09-22 19:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-09-16 13:17 . 2008-09-16 13:17 <REP> d-------- C:\WINDOWS\Sun
2008-09-16 11:06 . 2008-09-16 11:06 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Malwarebytes
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-10 14:52 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\uTorrent
2008-10-07 15:56 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-16 08:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-15 19:10 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\dvdcss
2008-09-13 11:02 --------- d-----w C:\Program Files\LucasArts
2008-09-09 22:04 38,528 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 22:03 17,200 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-08 01:01 --------- d-----w C:\Program Files\Windows Live
2008-09-07 18:04 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TuneUp Software
2008-09-07 18:03 --------- d-----w C:\Program Files\ESET
2008-09-07 13:08 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-09-07 13:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-07 13:02 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-07 13:02 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-09-07 12:58 --------- d-----w C:\Program Files\OO Software
2008-09-07 09:29 --------- d-----w C:\Program Files\uTorrent
2008-09-07 09:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-07 09:10 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-09-06 16:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-05 15:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-05 06:56 --------- d-----w C:\Program Files\Fichiers communs\BitDefender
2008-09-04 19:32 --------- d-----w C:\Program Files\BitDefender
2008-09-04 19:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 14:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom
2008-09-01 14:12 --------- d-----w C:\Program Files\TomTom HOME
2008-09-01 10:49 --------- d-----w C:\Program Files\Lavasoft
2008-09-01 10:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-31 12:03 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Nero
2008-08-31 11:52 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-08-31 11:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-08-31 11:47 --------- d-----w C:\Program Files\Nero
2008-08-31 10:06 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TomTom
2008-08-31 09:23 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\InstallShield
2008-08-31 09:21 --------- d-----w C:\Program Files\TomTom DesktopSuite
2008-08-31 08:30 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Ahead
2008-08-31 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-08-31 08:00 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Canneverbe_Limited
2008-08-31 07:38 --------- d-----w C:\Program Files\StarWarsGalaxies
2008-08-31 06:56 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-30 07:21 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Petroglyph
2008-08-27 08:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-25 20:31 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-08-25 20:30 --------- d-----w C:\Program Files\Fichiers communs\Logishrd
2008-08-19 12:15 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-19 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-08-19 07:43 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Logitech
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-08-19 07:39 --------- d-----w C:\Program Files\Logitech
2008-08-17 13:22 53,480 ----a-w C:\Documents and Settings\Elanakin\Application Data\GDIPFONTCACHEV1.DAT
2008-08-17 13:21 --------- d-----w C:\Program Files\MSECache
2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-11 15:29 94,208 ----a-w C:\WINDOWS\ScUnin.exe
.
------- Sigcheck -------
md5deep: C:\WINDOWS\system32\svchost.exe: Permission denied
2008-06-21 16:53 506368 8d52aedd07247b743a4d9bd372f69109 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-10-09_22.26.50.78 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2008-10-10 15:15:49 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_514.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.EXE" [2003-04-14 1498032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 154368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 86016]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-28 2512128]
"nwiz"="nwiz.exe" [2008-05-03 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15360]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 237568]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"
[HKLM\~\startupfolder\C:^Documents and Settings^Elanakin^Menu Démarrer^Programmes^Démarrage^hamachi.lnk]
path=C:\Documents and Settings\Elanakin\Menu Démarrer\Programmes\Démarrage\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Steam\\steamapps\\tom182_2\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Steam\\steamapps\\tom182_2\\day of defeat source\\hl2.exe"=
"D:\\Jeux\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
"D:\\Jeux\\Dofus\\Dofus.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"44979:TCP"= 44979:TCP:utorrent
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-19 14336]
R3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-09-07 355584]
S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-06-25 43520]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'
2008-10-10 C:\WINDOWS\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:23]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-10 17:16:44
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\TuneUp Utilities 2008\OneClick.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\searchindexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\TuneUp Utilities 2008\RegistryCleaner.exe
C:\WINDOWS\system32\searchprotocolhost.exe
C:\WINDOWS\system32\searchfilterhost.exe
.
**************************************************************************
.
Heure de fin: 2008-10-10 17:22:49 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-10-10 15:22:43
ComboFix2.txt 2008-10-09 20:27:27
Avant-CF: 16 170 676 224 octets libres
Après-CF: 16,072,957,952 octets libres
208 --- E O F --- 2008-09-23 09:45:38
Rapport hijackthis
ComboFix 08-10-08.05 - Elanakin 2008-10-10 17:12:08.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.651 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Elanakin\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\Elanakin\Bureau\CFscript.txt
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MUSBEHCO
-------\Service_musbehco
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-10 au 2008-10-10 ))))))))))))))))))))))))))))))))))))
.
2008-10-09 21:55 . 2008-10-09 21:55 362 --a------ C:\WINDOWS\Raccourci vers WINDOWS.lnk
2008-10-08 22:29 . 2008-10-08 22:29 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-10-07 09:36 . 2008-10-07 09:40 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\GrabIt
2008-10-07 08:56 . 2008-10-07 08:57 <REP> d-------- C:\Program Files\trend micro
2008-10-06 18:01 . 2008-10-06 18:49 <REP> d-------- C:\Program Files\SoundBase
2008-10-06 07:08 . 2008-10-06 18:31 <REP> d-------- C:\Program Files\AIMP2
2008-10-05 22:17 . 2008-10-05 22:18 <REP> d-------- C:\Program Files\Winamp
2008-10-05 22:17 . 2008-10-05 22:31 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Winamp
2008-10-03 17:35 . 2008-10-03 17:35 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LameFE
2008-10-03 07:19 . 2008-10-06 23:17 <REP> d-------- C:\Program Files\LameFE
2008-10-03 07:19 . 2008-10-03 07:23 <REP> d-------- C:\Documents and Settings\Elanakin\LameFE22
2008-09-28 12:59 . 2008-10-02 17:57 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LimeWire
2008-09-28 12:55 . 2008-09-28 12:56 <REP> d-------- C:\Program Files\LimeWire
2008-09-24 14:48 . 2008-09-27 08:55 <REP> d-------- C:\Program Files\Trojan Remover
2008-09-23 12:12 . 2008-09-23 12:12 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Search
2008-09-23 11:54 . 2008-09-23 11:54 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Desktop Search
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\WINDOWS\system32\GroupPolicy
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\Program Files\Windows Desktop Search
2008-09-23 11:43 . 2008-09-23 11:43 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-23 09:55 . 2008-09-23 09:57 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-23 09:55 . 2008-09-23 09:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\PassMark
2008-09-23 09:42 . 2008-09-23 10:34 6,203,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-23 09:42 . 2008-09-23 10:34 74,816 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-22 19:14 . 2008-09-22 19:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-09-16 13:17 . 2008-09-16 13:17 <REP> d-------- C:\WINDOWS\Sun
2008-09-16 11:06 . 2008-09-16 11:06 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Malwarebytes
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-10 14:52 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\uTorrent
2008-10-07 15:56 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-16 08:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-15 19:10 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\dvdcss
2008-09-13 11:02 --------- d-----w C:\Program Files\LucasArts
2008-09-09 22:04 38,528 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 22:03 17,200 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-08 01:01 --------- d-----w C:\Program Files\Windows Live
2008-09-07 18:04 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TuneUp Software
2008-09-07 18:03 --------- d-----w C:\Program Files\ESET
2008-09-07 13:08 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-09-07 13:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-07 13:02 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-07 13:02 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-09-07 12:58 --------- d-----w C:\Program Files\OO Software
2008-09-07 09:29 --------- d-----w C:\Program Files\uTorrent
2008-09-07 09:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-07 09:10 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-09-06 16:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-05 15:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-05 06:56 --------- d-----w C:\Program Files\Fichiers communs\BitDefender
2008-09-04 19:32 --------- d-----w C:\Program Files\BitDefender
2008-09-04 19:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 14:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom
2008-09-01 14:12 --------- d-----w C:\Program Files\TomTom HOME
2008-09-01 10:49 --------- d-----w C:\Program Files\Lavasoft
2008-09-01 10:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-31 12:03 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Nero
2008-08-31 11:52 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-08-31 11:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-08-31 11:47 --------- d-----w C:\Program Files\Nero
2008-08-31 10:06 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TomTom
2008-08-31 09:23 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\InstallShield
2008-08-31 09:21 --------- d-----w C:\Program Files\TomTom DesktopSuite
2008-08-31 08:30 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Ahead
2008-08-31 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-08-31 08:00 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Canneverbe_Limited
2008-08-31 07:38 --------- d-----w C:\Program Files\StarWarsGalaxies
2008-08-31 06:56 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-30 07:21 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Petroglyph
2008-08-27 08:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-25 20:31 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-08-25 20:30 --------- d-----w C:\Program Files\Fichiers communs\Logishrd
2008-08-19 12:15 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-19 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-08-19 07:43 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Logitech
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-08-19 07:39 --------- d-----w C:\Program Files\Logitech
2008-08-17 13:22 53,480 ----a-w C:\Documents and Settings\Elanakin\Application Data\GDIPFONTCACHEV1.DAT
2008-08-17 13:21 --------- d-----w C:\Program Files\MSECache
2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-11 15:29 94,208 ----a-w C:\WINDOWS\ScUnin.exe
.
------- Sigcheck -------
md5deep: C:\WINDOWS\system32\svchost.exe: Permission denied
2008-06-21 16:53 506368 8d52aedd07247b743a4d9bd372f69109 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-10-09_22.26.50.78 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2008-10-10 15:15:49 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_514.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.EXE" [2003-04-14 1498032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 154368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 86016]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-28 2512128]
"nwiz"="nwiz.exe" [2008-05-03 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15360]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 237568]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"
[HKLM\~\startupfolder\C:^Documents and Settings^Elanakin^Menu Démarrer^Programmes^Démarrage^hamachi.lnk]
path=C:\Documents and Settings\Elanakin\Menu Démarrer\Programmes\Démarrage\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Steam\\steamapps\\tom182_2\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Steam\\steamapps\\tom182_2\\day of defeat source\\hl2.exe"=
"D:\\Jeux\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
"D:\\Jeux\\Dofus\\Dofus.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"44979:TCP"= 44979:TCP:utorrent
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-19 14336]
R3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-09-07 355584]
S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-06-25 43520]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'
2008-10-10 C:\WINDOWS\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:23]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-10 17:16:44
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\TuneUp Utilities 2008\OneClick.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\searchindexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\TuneUp Utilities 2008\RegistryCleaner.exe
C:\WINDOWS\system32\searchprotocolhost.exe
C:\WINDOWS\system32\searchfilterhost.exe
.
**************************************************************************
.
Heure de fin: 2008-10-10 17:22:49 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-10-10 15:22:43
ComboFix2.txt 2008-10-09 20:27:27
Avant-CF: 16 170 676 224 octets libres
Après-CF: 16,072,957,952 octets libres
208 --- E O F --- 2008-09-23 09:45:38
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.651 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Elanakin\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\Elanakin\Bureau\CFscript.txt
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MUSBEHCO
-------\Service_musbehco
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-10 au 2008-10-10 ))))))))))))))))))))))))))))))))))))
.
2008-10-09 21:55 . 2008-10-09 21:55 362 --a------ C:\WINDOWS\Raccourci vers WINDOWS.lnk
2008-10-08 22:29 . 2008-10-08 22:29 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-10-07 09:36 . 2008-10-07 09:40 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\GrabIt
2008-10-07 08:56 . 2008-10-07 08:57 <REP> d-------- C:\Program Files\trend micro
2008-10-06 18:01 . 2008-10-06 18:49 <REP> d-------- C:\Program Files\SoundBase
2008-10-06 07:08 . 2008-10-06 18:31 <REP> d-------- C:\Program Files\AIMP2
2008-10-05 22:17 . 2008-10-05 22:18 <REP> d-------- C:\Program Files\Winamp
2008-10-05 22:17 . 2008-10-05 22:31 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Winamp
2008-10-03 17:35 . 2008-10-03 17:35 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LameFE
2008-10-03 07:19 . 2008-10-06 23:17 <REP> d-------- C:\Program Files\LameFE
2008-10-03 07:19 . 2008-10-03 07:23 <REP> d-------- C:\Documents and Settings\Elanakin\LameFE22
2008-09-28 12:59 . 2008-10-02 17:57 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LimeWire
2008-09-28 12:55 . 2008-09-28 12:56 <REP> d-------- C:\Program Files\LimeWire
2008-09-24 14:48 . 2008-09-27 08:55 <REP> d-------- C:\Program Files\Trojan Remover
2008-09-23 12:12 . 2008-09-23 12:12 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Search
2008-09-23 11:54 . 2008-09-23 11:54 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Desktop Search
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\WINDOWS\system32\GroupPolicy
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\Program Files\Windows Desktop Search
2008-09-23 11:43 . 2008-09-23 11:43 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-23 09:55 . 2008-09-23 09:57 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-23 09:55 . 2008-09-23 09:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\PassMark
2008-09-23 09:42 . 2008-09-23 10:34 6,203,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-23 09:42 . 2008-09-23 10:34 74,816 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-22 19:14 . 2008-09-22 19:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-09-16 13:17 . 2008-09-16 13:17 <REP> d-------- C:\WINDOWS\Sun
2008-09-16 11:06 . 2008-09-16 11:06 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Malwarebytes
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-10 14:52 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\uTorrent
2008-10-07 15:56 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-16 08:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-15 19:10 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\dvdcss
2008-09-13 11:02 --------- d-----w C:\Program Files\LucasArts
2008-09-09 22:04 38,528 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 22:03 17,200 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-08 01:01 --------- d-----w C:\Program Files\Windows Live
2008-09-07 18:04 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TuneUp Software
2008-09-07 18:03 --------- d-----w C:\Program Files\ESET
2008-09-07 13:08 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-09-07 13:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-07 13:02 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-07 13:02 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-09-07 12:58 --------- d-----w C:\Program Files\OO Software
2008-09-07 09:29 --------- d-----w C:\Program Files\uTorrent
2008-09-07 09:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-07 09:10 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-09-06 16:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-05 15:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-05 06:56 --------- d-----w C:\Program Files\Fichiers communs\BitDefender
2008-09-04 19:32 --------- d-----w C:\Program Files\BitDefender
2008-09-04 19:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 14:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom
2008-09-01 14:12 --------- d-----w C:\Program Files\TomTom HOME
2008-09-01 10:49 --------- d-----w C:\Program Files\Lavasoft
2008-09-01 10:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-31 12:03 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Nero
2008-08-31 11:52 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-08-31 11:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-08-31 11:47 --------- d-----w C:\Program Files\Nero
2008-08-31 10:06 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TomTom
2008-08-31 09:23 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\InstallShield
2008-08-31 09:21 --------- d-----w C:\Program Files\TomTom DesktopSuite
2008-08-31 08:30 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Ahead
2008-08-31 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-08-31 08:00 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Canneverbe_Limited
2008-08-31 07:38 --------- d-----w C:\Program Files\StarWarsGalaxies
2008-08-31 06:56 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-30 07:21 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Petroglyph
2008-08-27 08:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-25 20:31 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-08-25 20:30 --------- d-----w C:\Program Files\Fichiers communs\Logishrd
2008-08-19 12:15 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-19 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-08-19 07:43 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Logitech
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-08-19 07:39 --------- d-----w C:\Program Files\Logitech
2008-08-17 13:22 53,480 ----a-w C:\Documents and Settings\Elanakin\Application Data\GDIPFONTCACHEV1.DAT
2008-08-17 13:21 --------- d-----w C:\Program Files\MSECache
2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-11 15:29 94,208 ----a-w C:\WINDOWS\ScUnin.exe
.
------- Sigcheck -------
md5deep: C:\WINDOWS\system32\svchost.exe: Permission denied
2008-06-21 16:53 506368 8d52aedd07247b743a4d9bd372f69109 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-10-09_22.26.50.78 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2008-10-10 15:15:49 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_514.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.EXE" [2003-04-14 1498032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 154368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 86016]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-28 2512128]
"nwiz"="nwiz.exe" [2008-05-03 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15360]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 237568]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"
[HKLM\~\startupfolder\C:^Documents and Settings^Elanakin^Menu Démarrer^Programmes^Démarrage^hamachi.lnk]
path=C:\Documents and Settings\Elanakin\Menu Démarrer\Programmes\Démarrage\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Steam\\steamapps\\tom182_2\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Steam\\steamapps\\tom182_2\\day of defeat source\\hl2.exe"=
"D:\\Jeux\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
"D:\\Jeux\\Dofus\\Dofus.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"44979:TCP"= 44979:TCP:utorrent
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-19 14336]
R3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-09-07 355584]
S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-06-25 43520]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'
2008-10-10 C:\WINDOWS\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:23]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-10 17:16:44
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\TuneUp Utilities 2008\OneClick.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\searchindexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\TuneUp Utilities 2008\RegistryCleaner.exe
C:\WINDOWS\system32\searchprotocolhost.exe
C:\WINDOWS\system32\searchfilterhost.exe
.
**************************************************************************
.
Heure de fin: 2008-10-10 17:22:49 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-10-10 15:22:43
ComboFix2.txt 2008-10-09 20:27:27
Avant-CF: 16 170 676 224 octets libres
Après-CF: 16,072,957,952 octets libres
208 --- E O F --- 2008-09-23 09:45:38
Rapport hijackthis
ComboFix 08-10-08.05 - Elanakin 2008-10-10 17:12:08.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.651 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Elanakin\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\Elanakin\Bureau\CFscript.txt
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MUSBEHCO
-------\Service_musbehco
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-10 au 2008-10-10 ))))))))))))))))))))))))))))))))))))
.
2008-10-09 21:55 . 2008-10-09 21:55 362 --a------ C:\WINDOWS\Raccourci vers WINDOWS.lnk
2008-10-08 22:29 . 2008-10-08 22:29 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-10-07 09:36 . 2008-10-07 09:40 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\GrabIt
2008-10-07 08:56 . 2008-10-07 08:57 <REP> d-------- C:\Program Files\trend micro
2008-10-06 18:01 . 2008-10-06 18:49 <REP> d-------- C:\Program Files\SoundBase
2008-10-06 07:08 . 2008-10-06 18:31 <REP> d-------- C:\Program Files\AIMP2
2008-10-05 22:17 . 2008-10-05 22:18 <REP> d-------- C:\Program Files\Winamp
2008-10-05 22:17 . 2008-10-05 22:31 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Winamp
2008-10-03 17:35 . 2008-10-03 17:35 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LameFE
2008-10-03 07:19 . 2008-10-06 23:17 <REP> d-------- C:\Program Files\LameFE
2008-10-03 07:19 . 2008-10-03 07:23 <REP> d-------- C:\Documents and Settings\Elanakin\LameFE22
2008-09-28 12:59 . 2008-10-02 17:57 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LimeWire
2008-09-28 12:55 . 2008-09-28 12:56 <REP> d-------- C:\Program Files\LimeWire
2008-09-24 14:48 . 2008-09-27 08:55 <REP> d-------- C:\Program Files\Trojan Remover
2008-09-23 12:12 . 2008-09-23 12:12 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Search
2008-09-23 11:54 . 2008-09-23 11:54 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Desktop Search
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\WINDOWS\system32\GroupPolicy
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\Program Files\Windows Desktop Search
2008-09-23 11:43 . 2008-09-23 11:43 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-23 09:55 . 2008-09-23 09:57 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-23 09:55 . 2008-09-23 09:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\PassMark
2008-09-23 09:42 . 2008-09-23 10:34 6,203,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-23 09:42 . 2008-09-23 10:34 74,816 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-22 19:14 . 2008-09-22 19:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-09-16 13:17 . 2008-09-16 13:17 <REP> d-------- C:\WINDOWS\Sun
2008-09-16 11:06 . 2008-09-16 11:06 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Malwarebytes
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-10 14:52 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\uTorrent
2008-10-07 15:56 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-16 08:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-15 19:10 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\dvdcss
2008-09-13 11:02 --------- d-----w C:\Program Files\LucasArts
2008-09-09 22:04 38,528 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 22:03 17,200 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-08 01:01 --------- d-----w C:\Program Files\Windows Live
2008-09-07 18:04 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TuneUp Software
2008-09-07 18:03 --------- d-----w C:\Program Files\ESET
2008-09-07 13:08 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-09-07 13:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-07 13:02 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-07 13:02 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-09-07 12:58 --------- d-----w C:\Program Files\OO Software
2008-09-07 09:29 --------- d-----w C:\Program Files\uTorrent
2008-09-07 09:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-07 09:10 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-09-06 16:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-05 15:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-05 06:56 --------- d-----w C:\Program Files\Fichiers communs\BitDefender
2008-09-04 19:32 --------- d-----w C:\Program Files\BitDefender
2008-09-04 19:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 14:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom
2008-09-01 14:12 --------- d-----w C:\Program Files\TomTom HOME
2008-09-01 10:49 --------- d-----w C:\Program Files\Lavasoft
2008-09-01 10:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-31 12:03 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Nero
2008-08-31 11:52 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-08-31 11:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-08-31 11:47 --------- d-----w C:\Program Files\Nero
2008-08-31 10:06 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TomTom
2008-08-31 09:23 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\InstallShield
2008-08-31 09:21 --------- d-----w C:\Program Files\TomTom DesktopSuite
2008-08-31 08:30 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Ahead
2008-08-31 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-08-31 08:00 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Canneverbe_Limited
2008-08-31 07:38 --------- d-----w C:\Program Files\StarWarsGalaxies
2008-08-31 06:56 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-30 07:21 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Petroglyph
2008-08-27 08:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-25 20:31 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-08-25 20:30 --------- d-----w C:\Program Files\Fichiers communs\Logishrd
2008-08-19 12:15 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-19 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-08-19 07:43 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Logitech
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-08-19 07:39 --------- d-----w C:\Program Files\Logitech
2008-08-17 13:22 53,480 ----a-w C:\Documents and Settings\Elanakin\Application Data\GDIPFONTCACHEV1.DAT
2008-08-17 13:21 --------- d-----w C:\Program Files\MSECache
2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-11 15:29 94,208 ----a-w C:\WINDOWS\ScUnin.exe
.
------- Sigcheck -------
md5deep: C:\WINDOWS\system32\svchost.exe: Permission denied
2008-06-21 16:53 506368 8d52aedd07247b743a4d9bd372f69109 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-10-09_22.26.50.78 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2008-10-10 15:15:49 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_514.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.EXE" [2003-04-14 1498032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 154368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 86016]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-28 2512128]
"nwiz"="nwiz.exe" [2008-05-03 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15360]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 237568]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"
[HKLM\~\startupfolder\C:^Documents and Settings^Elanakin^Menu Démarrer^Programmes^Démarrage^hamachi.lnk]
path=C:\Documents and Settings\Elanakin\Menu Démarrer\Programmes\Démarrage\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Steam\\steamapps\\tom182_2\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Steam\\steamapps\\tom182_2\\day of defeat source\\hl2.exe"=
"D:\\Jeux\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
"D:\\Jeux\\Dofus\\Dofus.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"44979:TCP"= 44979:TCP:utorrent
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-19 14336]
R3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-09-07 355584]
S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-06-25 43520]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'
2008-10-10 C:\WINDOWS\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:23]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-10 17:16:44
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\TuneUp Utilities 2008\OneClick.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\searchindexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\TuneUp Utilities 2008\RegistryCleaner.exe
C:\WINDOWS\system32\searchprotocolhost.exe
C:\WINDOWS\system32\searchfilterhost.exe
.
**************************************************************************
.
Heure de fin: 2008-10-10 17:22:49 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-10-10 15:22:43
ComboFix2.txt 2008-10-09 20:27:27
Avant-CF: 16 170 676 224 octets libres
Après-CF: 16,072,957,952 octets libres
208 --- E O F --- 2008-09-23 09:45:38
Re,
OK,
j'ai besoin d'infos :
à quelle lettre correspond ton lecteur de CD ?
Sur ton CD Windows, quel chemin faut-il faire pour accéder à svchost.ex_ ?
Pour la 2ème question, insère ton CD windows et cherche svchost dans le CD (D: ou E: ou ...)
OK,
j'ai besoin d'infos :
à quelle lettre correspond ton lecteur de CD ?
Sur ton CD Windows, quel chemin faut-il faire pour accéder à svchost.ex_ ?
Pour la 2ème question, insère ton CD windows et cherche svchost dans le CD (D: ou E: ou ...)
Bonjour,
bon, bin quand faut y aller, faut y aller !
Ouvre ce lien : http://www.zebulon.fr/dossiers/61-2-installation-console-recuperation-disque.html
et parcours le afin de voir ce qu'est la console de récupération.
Quand tu le sentiras, fais redémarrer l'ordi.
Normalement, on te demande de choisir entre un démarrage normal et le démarrage sur la console.
Tu choisis la console.
Si on te demande un mot de passe et que tu n'en as pas mis, tu cliques sur Entrée.
Quand la console est démarrée et que tu as l'invite de commamnde, tu insères le CD de XP.
Puis tu tapes :
Expand F:\i386\SVCHOST.ex_ C:\Windows\System32\SVCHOST.exe
On va te demander confirmation. Tu confirmes.
Tu redémarres en mode normal.
Problème résolu ?
bon, bin quand faut y aller, faut y aller !
Ouvre ce lien : http://www.zebulon.fr/dossiers/61-2-installation-console-recuperation-disque.html
et parcours le afin de voir ce qu'est la console de récupération.
Quand tu le sentiras, fais redémarrer l'ordi.
Normalement, on te demande de choisir entre un démarrage normal et le démarrage sur la console.
Tu choisis la console.
Si on te demande un mot de passe et que tu n'en as pas mis, tu cliques sur Entrée.
Quand la console est démarrée et que tu as l'invite de commamnde, tu insères le CD de XP.
Puis tu tapes :
Expand F:\i386\SVCHOST.ex_ C:\Windows\System32\SVCHOST.exe
On va te demander confirmation. Tu confirmes.
Tu redémarres en mode normal.
Problème résolu ?
Re,
OK,
nettoyage des outils :
Télécharge ToolsCleaner par A.Rothstein & dj QUIOU sur ton Bureau.
http://pc-system.fr/
hxxp://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
hxxp://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe
Clique sur Recherche et laisse le scan se terminer.
Clique, sur Suppression pour finaliser.
Tu peux, si tu le souhaites, te servir des Options facultatives.
Clique sur Quitter, pour que le rapport puisse se créer.
Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).
=========
Les indications du post 50 correspondent bien à ce que tu as du faire ? Tu n'as pas eu de surprise ?
Il y avait exactement ce qu'il fallait pour réussir ?
Tes réponses vont me permettre d'améliorer mon utilisation de cette procédure que je maîtrise encore mal.
Merci.
OK,
nettoyage des outils :
Télécharge ToolsCleaner par A.Rothstein & dj QUIOU sur ton Bureau.
http://pc-system.fr/
hxxp://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
hxxp://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe
Clique sur Recherche et laisse le scan se terminer.
Clique, sur Suppression pour finaliser.
Tu peux, si tu le souhaites, te servir des Options facultatives.
Clique sur Quitter, pour que le rapport puisse se créer.
Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).
=========
Les indications du post 50 correspondent bien à ce que tu as du faire ? Tu n'as pas eu de surprise ?
Il y avait exactement ce qu'il fallait pour réussir ?
Tes réponses vont me permettre d'améliorer mon utilisation de cette procédure que je maîtrise encore mal.
Merci.
