Problème d'affichage liés à un virus

nad -  
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,
j'ai réçement eu un virus sur mon ordi et depuis j'ai des bandes colorés,comme des codes barres rouges sur l'écran ,j'ai tenter une restauration system mais impossible ...que faire !? je suis débutante en informatique
Configuration: Windows XP
Firefox 2.0.0.17

11 réponses

  1.
    jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    slt

    scan avec malwarebyte et colle le rapport:
    https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

    __________________

    colle un rapport hijackthis

    http://www.trendsecure.com/portal/en-US/tools/security_tools­/hijackthis/download

    manuel :

    http://leblogdeclaude.blogspot.com/2006/10/informatique-sect­ion-hijackthis.html

    Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

    ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

    Ensuite avec Explorer créer un dossier c:\hijackthis
    Décompresser Hijackthis dans ce dossier.
    C'est important pour les sauvegardes."
    1
  2. nad
     
    par contre j'ai foiré pour la sauvegarde car le lien que j'ai trouver pour hijackthis mener directement à l'instalation j'ai renomer l'exe mais ...
    1
  3. nad
     
    merci pour ta réponse,voici le rapport de malwarebyts

    Malwarebytes' Anti-Malware 1.28
    Version de la base de données: 1262
    Windows 5.1.2600 Service Pack 2

    13/10/2008 23:45:59
    mbam-log-2008-10-13 (23-45-59).txt

    Type de recherche: Examen complet (C:\|D:\|)
    Eléments examinés: 111978
    Temps écoulé: 1 hour(s), 18 minute(s), 17 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 0
    Valeur(s) du Registre infectée(s): 0
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 0

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Valeur(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    (Aucun élément nuisible détecté)
    0
  4. nad
     
    je viens d'essayer de telecharger hijackthis mais le lien ne me conduit pas vers son lien de telechargement mais sur celui de house call ,et le lien vers le blog est mort ...
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. nad
     
    bon j'ai trouver un autre lien avec l'install
    voilà le rapport

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 00:07:22, on 14/10/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
    C:\Program Files\Toshiba\Tvs\TvsTray.exe
    C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\WINDOWS\system32\TPSBattM.exe
    C:\Program Files\ltmoh\Ltmoh.exe
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\atwtusb.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O5 "LPT1:" /M "Stylus Photo RX420"
    O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P41 "EPSON Stylus Photo RX420 Series (Copie 1)" /O6 "USB001" /M "Stylus Photo RX420"
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
    O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
    O4 - HKLM\..\Run: [SystemDoctor 2006 Free] C:\Program Files\SystemDoctor 2006 Free\sd2006.exe -scan
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
    O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
    O4 - Global Startup: CD du logiciel supplémentaire.lnk = ?
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    0
  7. nad
     
    bon bé si quelqun à une idée ,car je suis bien embêter :(
    0
  8. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    télécharge combofix (par sUBs) ici :

    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    et enregistre le sur le bureau.

    déconnecte toi d'internet et ferme toutes tes applications.

    désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

    double-clique sur combofix.exe et suis les instructions

    à la fin, il va produire un rapport C:\ComboFix.txt

    réactive ton parefeu, ton antivirus, la garde de ton antispyware

    copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

    Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

    Tu as un tutoriel complet ici :

    https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
    0
  9. nad
     
    voici le rapport

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]
    "DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

    C:\Documents and Settings\Nadine Kmieczak\Menu D‚marrer\Programmes\D‚marrage\
    Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.l3acm"= l3codecp.acm
    "VIDC.X264"= x264vfw.dll
    "vidc.3IV2"= 3ivxVfWCodec.dll
    "vidc.DIV3"= DivXc32.dll
    "vidc.DIV4"= DivXc32f.dll
    "msacm.divxa32"= DivXa32.acm

    [HKLM\~\startupfolder\C:^Documents and Settings^Nadine Kmieczak^Menu Démarrer^Programmes^Démarrage^Outil de détection de support de Cyber-shot Viewer.lnk]
    path=C:\Documents and Settings\Nadine Kmieczak\Menu Démarrer\Programmes\Démarrage\Outil de détection de support de Cyber-shot Viewer.lnk
    backup=C:\WINDOWS\pss\Outil de détection de support de Cyber-shot Viewer.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Resolume-2-2\\resolume.exe"=
    "C:\\Program Files\\aestesis\\elektronika live\\elektronika.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=
    "C:\\Program Files\\eMule\\emule.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "18376:TCP"= 18376:TCP:*:Disabled:NortonAV
    "13086:TCP"= 13086:TCP:*:Disabled:NortonAV
    "14270:TCP"= 14270:TCP:*:Disabled:NortonAV
    "16759:TCP"= 16759:TCP:*:Disabled:NortonAV
    "17559:TCP"= 17559:TCP:*:Disabled:NortonAV
    "18067:TCP"= 18067:TCP:*:Disabled:NortonAV
    "13888:TCP"= 13888:TCP:*:Disabled:NortonAV
    "13153:TCP"= 13153:TCP:*:Disabled:NortonAV
    "17959:TCP"= 17959:TCP:*:Disabled:NortonAV
    "17511:TCP"= 17511:TCP:*:Disabled:NortonAV
    "13709:TCP"= 13709:TCP:*:Disabled:NortonAV
    "12279:TCP"= 12279:TCP:*:Disabled:NortonAV
    "18611:TCP"= 18611:TCP:*:Disabled:NortonAV
    "15177:TCP"= 15177:TCP:*:Disabled:NortonAV
    "16112:TCP"= 16112:TCP:*:Disabled:NortonAV
    "17110:TCP"= 17110:TCP:*:Disabled:NortonAV
    "14146:TCP"= 14146:TCP:*:Disabled:NortonAV
    "16718:TCP"= 16718:TCP:*:Disabled:NortonAV
    "17789:TCP"= 17789:TCP:*:Disabled:NortonAV
    "12879:TCP"= 12879:TCP:*:Disabled:NortonAV
    "12966:TCP"= 12966:TCP:*:Disabled:NortonAV
    "13696:TCP"= 13696:TCP:*:Disabled:NortonAV
    "14178:TCP"= 14178:TCP:*:Disabled:NortonAV
    "13285:TCP"= 13285:TCP:*:Disabled:NortonAV
    "18156:TCP"= 18156:TCP:*:Disabled:NortonAV
    "17566:TCP"= 17566:TCP:*:Disabled:NortonAV
    "16727:TCP"= 16727:TCP:*:Disabled:NortonAV
    "16158:TCP"= 16158:TCP:*:Disabled:NortonAV
    "16364:TCP"= 16364:TCP:*:Disabled:NortonAV
    "16675:TCP"= 16675:TCP:*:Disabled:NortonAV
    "18592:TCP"= 18592:TCP:*:Disabled:NortonAV
    "13599:TCP"= 13599:TCP:*:Disabled:NortonAV
    "12143:TCP"= 12143:TCP:*:Disabled:NortonAV
    "17725:TCP"= 17725:TCP:*:Disabled:NortonAV
    "16730:TCP"= 16730:TCP:*:Disabled:NortonAV
    "18049:TCP"= 18049:TCP:*:Disabled:NortonAV
    "18918:TCP"= 18918:TCP:*:Disabled:NortonAV
    "17886:TCP"= 17886:TCP:*:Disabled:NortonAV
    "18825:TCP"= 18825:TCP:*:Disabled:NortonAV
    "16884:TCP"= 16884:TCP:*:Disabled:NortonAV
    "17743:TCP"= 17743:TCP:*:Disabled:NortonAV
    "17711:TCP"= 17711:TCP:*:Disabled:NortonAV
    "14693:TCP"= 14693:TCP:*:Disabled:NortonAV
    "15947:TCP"= 15947:TCP:*:Disabled:NortonAV
    "16557:TCP"= 16557:TCP:*:Disabled:NortonAV
    "13012:TCP"= 13012:TCP:*:Disabled:NortonAV
    "17079:TCP"= 17079:TCP:*:Disabled:NortonAV
    "15998:TCP"= 15998:TCP:NortonAV
    "12782:TCP"= 12782:TCP:NortonAV
    "13691:TCP"= 13691:TCP:NortonAV
    "17185:TCP"= 17185:TCP:NortonAV
    "18303:TCP"= 18303:TCP:NortonAV
    "13886:TCP"= 13886:TCP:NortonAV
    "18768:TCP"= 18768:TCP:NortonAV
    "13280:TCP"= 13280:TCP:NortonAV
    "13049:TCP"= 13049:TCP:NortonAV
    "13036:TCP"= 13036:TCP:NortonAV
    "16070:TCP"= 16070:TCP:NortonAV
    "15645:TCP"= 15645:TCP:NortonAV
    "13096:TCP"= 13096:TCP:NortonAV
    "15807:TCP"= 15807:TCP:NortonAV
    "18883:TCP"= 18883:TCP:NortonAV
    "18411:TCP"= 18411:TCP:NortonAV
    "18460:TCP"= 18460:TCP:NortonAV
    "15251:TCP"= 15251:TCP:NortonAV
    "17128:TCP"= 17128:TCP:NortonAV
    "17464:TCP"= 17464:TCP:NortonAV
    "13166:TCP"= 13166:TCP:NortonAV
    "17577:TCP"= 17577:TCP:NortonAV
    "17513:TCP"= 17513:TCP:NortonAV
    "14801:TCP"= 14801:TCP:NortonAV
    "13969:TCP"= 13969:TCP:NortonAV
    "14359:TCP"= 14359:TCP:NortonAV
    "15469:TCP"= 15469:TCP:NortonAV
    "13935:TCP"= 13935:TCP:NortonAV
    "12216:TCP"= 12216:TCP:NortonAV
    "12967:TCP"= 12967:TCP:NortonAV
    "12281:TCP"= 12281:TCP:NortonAV
    "13653:TCP"= 13653:TCP:NortonAV
    "15398:TCP"= 15398:TCP:NortonAV
    "15254:TCP"= 15254:TCP:NortonAV
    "18876:TCP"= 18876:TCP:NortonAV
    "16724:TCP"= 16724:TCP:NortonAV
    "15525:TCP"= 15525:TCP:NortonAV
    "16309:TCP"= 16309:TCP:NortonAV
    "13562:TCP"= 13562:TCP:NortonAV
    "14124:TCP"= 14124:TCP:NortonAV
    "15681:TCP"= 15681:TCP:NortonAV
    "17870:TCP"= 17870:TCP:NortonAV
    "18942:TCP"= 18942:TCP:NortonAV
    "14336:TCP"= 14336:TCP:NortonAV
    "17523:TCP"= 17523:TCP:NortonAV
    "17504:TCP"= 17504:TCP:NortonAV
    "18418:TCP"= 18418:TCP:NortonAV
    "16717:TCP"= 16717:TCP:NortonAV
    "15560:TCP"= 15560:TCP:NortonAV
    "14927:TCP"= 14927:TCP:NortonAV
    "16418:TCP"= 16418:TCP:NortonAV
    "17512:TCP"= 17512:TCP:NortonAV
    "16254:TCP"= 16254:TCP:NortonAV
    "14156:TCP"= 14156:TCP:NortonAV
    "17065:TCP"= 17065:TCP:NortonAV
    "18743:TCP"= 18743:TCP:NortonAV
    "17301:TCP"= 17301:TCP:NortonAV

    S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2004-07-07 22272]
    S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [ ]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96cd8170-b4ab-11dc-a976-0012f01a97bf}]
    \Shell\AutoRun\command - 3wcxx91.cmd
    \Shell\explore\Command - 3wcxx91.cmd
    \Shell\open\Command - 3wcxx91.cmd
    .
    Contenu du dossier 'Tâches planifiées'

    2008-10-03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 18:13]
    .
    .
    ------- Examen supplémentaire -------
    .
    FireFox -: Profile - C:\Documents and Settings\Nadine Kmieczak\Application Data\Mozilla\Firefox\Profiles\l7jjd50n.default\
    FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-14 18:09:48
    Windows 5.1.2600 Service Pack 2 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************
    .
    Heure de fin: 2008-10-14 18:12:18
    ComboFix-quarantined-files.txt 2008-10-14 16:12:12
    ComboFix2.txt 2008-10-14 14:46:25

    Avant-CF: 9 167 368 192 octets libres
    Après-CF: 9,144,557,568 octets libres

    257 --- E O F --- 2008-10-11 17:38:43

    faut il comme il est ecrit sur le tutoriel installer une console de recuperation ? merci nad
    0
  10. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    il manque le début du rapport
    0
  11. nad
     
    ComboFix 08-10-12.01 - Nadine Kmieczak 2008-10-15 18:15:02.3 - NTFSx86
    Lancé depuis: C:\Documents and Settings\Nadine Kmieczak\Bureau\ComboFix.exe

    [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
    .

    ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-15 au 2008-10-15 ))))))))))))))))))))))))))))))))))))
    .

    2008-10-14 00:06 . 2008-10-14 00:06 <REP> d-------- C:\Program Files\Trend Micro
    2008-10-13 23:52 . 2008-10-13 23:52 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\.housecall6.6
    2008-10-13 21:31 . 2008-10-13 21:31 <REP> d-------- C:\Program Files\CCleaner
    2008-10-13 20:56 . 2008-10-13 21:33 <REP> d-------- C:\WINDOWS\SxsCaPendDel
    2008-10-13 20:28 . 2008-10-13 21:31 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\Application Data\CCleanup
    2008-10-13 19:00 . 2008-10-13 19:00 <REP> d-------- C:\Documents and Settings\LocalService\Bureau
    2008-10-13 15:25 . 2008-10-15 17:41 3,021 --a------ C:\rollback.ini
    2008-10-13 15:17 . 2008-10-13 15:17 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\Application Data\MailFrontier
    2008-10-13 15:15 . 2008-10-15 18:20 3,594,784 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-10-13 15:15 . 2008-10-15 02:30 48,332 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
    2008-10-13 15:09 . 2008-10-13 20:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
    2008-10-13 15:09 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
    2008-10-13 15:09 . 2008-07-09 09:05 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
    2008-10-13 15:09 . 2008-07-09 09:05 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
    2008-10-13 15:09 . 2008-07-09 09:05 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
    2008-10-13 15:09 . 2008-07-09 09:05 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
    2008-10-13 15:09 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
    2008-10-13 15:09 . 2008-10-15 17:32 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
    2008-10-13 15:08 . 2008-10-13 15:08 <REP> d-------- C:\Program Files\Zone Labs
    2008-10-13 13:13 . 2008-10-13 13:13 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-10-13 13:13 . 2008-10-13 13:13 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\Application Data\Malwarebytes
    2008-10-13 13:13 . 2008-10-13 13:13 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-10-13 13:13 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-10-13 13:13 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-10-11 18:37 . 2008-10-15 01:22 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
    2008-10-11 14:59 . 2008-10-13 13:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-10-11 14:59 . 2008-10-11 14:59 1,409 --a------ C:\WINDOWS\QTFont.for

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-10-14 23:05 700,133 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
    2008-10-14 16:01 17,094 ----a-w C:\Documents and Settings\Nadine Kmieczak\Application Data\wklnhst.dat
    2008-10-13 19:32 --------- d-----w C:\Program Files\MSN Messenger
    2008-09-27 14:25 --------- d-----w C:\Program Files\Resolume-2-2
    2007-01-22 08:41 24,632 -c--a-w C:\Program Files\Fichiers communs\security
    2006-07-03 08:11 793,126 -c--a-w C:\Program Files\Internet Explorer.rar
    .

    ((((((((((((((((((((((((((((( snapshot@2008-10-14_16.45.31,11 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-10-14 23:24:45 10,508 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{31F80E72-1933-4F8D-89A6-7A85CF1B9A2D}.bin
    - 2008-03-30 10:55:31 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
    + 2008-10-14 15:16:48 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
    - 2008-03-30 10:55:31 49,054 ----a-w C:\WINDOWS\system32\perfc00C.dat
    + 2008-10-14 15:16:48 49,054 ----a-w C:\WINDOWS\system32\perfc00C.dat
    - 2008-03-30 10:55:31 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
    + 2008-10-14 15:16:48 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
    - 2008-03-30 10:55:31 368,314 ----a-w C:\WINDOWS\system32\perfh00C.dat
    + 2008-10-14 15:16:48 368,314 ----a-w C:\WINDOWS\system32\perfh00C.dat
    - 2008-10-14 14:08:28 342,640 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat
    + 2008-10-15 15:41:30 364,628 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat
    .
    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360]
    "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-15 65536]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [X]
    "EPSON Stylus Photo RX420 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE" [2004-04-09 98304]
    "EPSON Stylus Photo RX420 Series (Copie 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE" [2004-04-09 98304]
    "Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2004-11-12 73728]
    "THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2005-01-14 352256]
    "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-15 98394]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-15 688218]
    "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544]
    "SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2004-12-21 118784]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 282624]
    "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-11-17 1077327]
    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 221184]
    "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2003-09-06 184320]
    "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 217088]
    "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 458752]
    "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-03 122939]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-07 344064]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
    "TPSMain"="TPSMain.exe" [2005-01-21 C:\WINDOWS\system32\TPSMain.exe]
    "TFncKy"="TFncKy.exe" [BU]
    "NDSTray.exe"="NDSTray.exe" [BU]
    "AGRSMMSG"="AGRSMMSG.exe" [2004-10-28 C:\WINDOWS\agrsmmsg.exe]
    "atwtusb"="atwtusb.exe" [2005-09-21 C:\WINDOWS\system32\ATWTUSB.EXE]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]
    "DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

    C:\Documents and Settings\Nadine Kmieczak\Menu D‚marrer\Programmes\D‚marrage\
    Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.l3acm"= l3codecp.acm
    "VIDC.X264"= x264vfw.dll
    "vidc.3IV2"= 3ivxVfWCodec.dll
    "vidc.DIV3"= DivXc32.dll
    "vidc.DIV4"= DivXc32f.dll
    "msacm.divxa32"= DivXa32.acm

    [HKLM\~\startupfolder\C:^Documents and Settings^Nadine Kmieczak^Menu Démarrer^Programmes^Démarrage^Outil de détection de support de Cyber-shot Viewer.lnk]
    path=C:\Documents and Settings\Nadine Kmieczak\Menu Démarrer\Programmes\Démarrage\Outil de détection de support de Cyber-shot Viewer.lnk
    backup=C:\WINDOWS\pss\Outil de détection de support de Cyber-shot Viewer.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Resolume-2-2\\resolume.exe"=
    "C:\\Program Files\\aestesis\\elektronika live\\elektronika.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=
    "C:\\Program Files\\eMule\\emule.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "18376:TCP"= 18376:TCP:*:Disabled:NortonAV
    "13086:TCP"= 13086:TCP:*:Disabled:NortonAV
    "14270:TCP"= 14270:TCP:*:Disabled:NortonAV
    "16759:TCP"= 16759:TCP:*:Disabled:NortonAV
    "17559:TCP"= 17559:TCP:*:Disabled:NortonAV
    "18067:TCP"= 18067:TCP:*:Disabled:NortonAV
    "13888:TCP"= 13888:TCP:*:Disabled:NortonAV
    "13153:TCP"= 13153:TCP:*:Disabled:NortonAV
    "17959:TCP"= 17959:TCP:*:Disabled:NortonAV
    "17511:TCP"= 17511:TCP:*:Disabled:NortonAV
    "13709:TCP"= 13709:TCP:*:Disabled:NortonAV
    "12279:TCP"= 12279:TCP:*:Disabled:NortonAV
    "18611:TCP"= 18611:TCP:*:Disabled:NortonAV
    "15177:TCP"= 15177:TCP:*:Disabled:NortonAV
    "16112:TCP"= 16112:TCP:*:Disabled:NortonAV
    "17110:TCP"= 17110:TCP:*:Disabled:NortonAV
    "14146:TCP"= 14146:TCP:*:Disabled:NortonAV
    "16718:TCP"= 16718:TCP:*:Disabled:NortonAV
    "17789:TCP"= 17789:TCP:*:Disabled:NortonAV
    "12879:TCP"= 12879:TCP:*:Disabled:NortonAV
    "12966:TCP"= 12966:TCP:*:Disabled:NortonAV
    "13696:TCP"= 13696:TCP:*:Disabled:NortonAV
    "14178:TCP"= 14178:TCP:*:Disabled:NortonAV
    "13285:TCP"= 13285:TCP:*:Disabled:NortonAV
    "18156:TCP"= 18156:TCP:*:Disabled:NortonAV
    "17566:TCP"= 17566:TCP:*:Disabled:NortonAV
    "16727:TCP"= 16727:TCP:*:Disabled:NortonAV
    "16158:TCP"= 16158:TCP:*:Disabled:NortonAV
    "16364:TCP"= 16364:TCP:*:Disabled:NortonAV
    "16675:TCP"= 16675:TCP:*:Disabled:NortonAV
    "18592:TCP"= 18592:TCP:*:Disabled:NortonAV
    "13599:TCP"= 13599:TCP:*:Disabled:NortonAV
    "12143:TCP"= 12143:TCP:*:Disabled:NortonAV
    "17725:TCP"= 17725:TCP:*:Disabled:NortonAV
    "16730:TCP"= 16730:TCP:*:Disabled:NortonAV
    "18049:TCP"= 18049:TCP:*:Disabled:NortonAV
    "18918:TCP"= 18918:TCP:*:Disabled:NortonAV
    "17886:TCP"= 17886:TCP:*:Disabled:NortonAV
    "18825:TCP"= 18825:TCP:*:Disabled:NortonAV
    "16884:TCP"= 16884:TCP:*:Disabled:NortonAV
    "17743:TCP"= 17743:TCP:*:Disabled:NortonAV
    "17711:TCP"= 17711:TCP:*:Disabled:NortonAV
    "14693:TCP"= 14693:TCP:*:Disabled:NortonAV
    "15947:TCP"= 15947:TCP:*:Disabled:NortonAV
    "16557:TCP"= 16557:TCP:*:Disabled:NortonAV
    "13012:TCP"= 13012:TCP:*:Disabled:NortonAV
    "17079:TCP"= 17079:TCP:*:Disabled:NortonAV
    "15998:TCP"= 15998:TCP:NortonAV
    "12782:TCP"= 12782:TCP:NortonAV
    "13691:TCP"= 13691:TCP:NortonAV
    "17185:TCP"= 17185:TCP:NortonAV
    "18303:TCP"= 18303:TCP:NortonAV
    "13886:TCP"= 13886:TCP:NortonAV
    "18768:TCP"= 18768:TCP:NortonAV
    "13280:TCP"= 13280:TCP:NortonAV
    "13049:TCP"= 13049:TCP:NortonAV
    "13036:TCP"= 13036:TCP:NortonAV
    "16070:TCP"= 16070:TCP:NortonAV
    "15645:TCP"= 15645:TCP:NortonAV
    "13096:TCP"= 13096:TCP:NortonAV
    "15807:TCP"= 15807:TCP:NortonAV
    "18883:TCP"= 18883:TCP:NortonAV
    "18411:TCP"= 18411:TCP:NortonAV
    "18460:TCP"= 18460:TCP:NortonAV
    "15251:TCP"= 15251:TCP:NortonAV
    "17128:TCP"= 17128:TCP:NortonAV
    "17464:TCP"= 17464:TCP:NortonAV
    "13166:TCP"= 13166:TCP:NortonAV
    "17577:TCP"= 17577:TCP:NortonAV
    "17513:TCP"= 17513:TCP:NortonAV
    "14801:TCP"= 14801:TCP:NortonAV
    "13969:TCP"= 13969:TCP:NortonAV
    "14359:TCP"= 14359:TCP:NortonAV
    "15469:TCP"= 15469:TCP:NortonAV
    "13935:TCP"= 13935:TCP:NortonAV
    "12216:TCP"= 12216:TCP:NortonAV
    "12967:TCP"= 12967:TCP:NortonAV
    "12281:TCP"= 12281:TCP:NortonAV
    "13653:TCP"= 13653:TCP:NortonAV
    "15398:TCP"= 15398:TCP:NortonAV
    "15254:TCP"= 15254:TCP:NortonAV
    "18876:TCP"= 18876:TCP:NortonAV
    "16724:TCP"= 16724:TCP:NortonAV
    "15525:TCP"= 15525:TCP:NortonAV
    "16309:TCP"= 16309:TCP:NortonAV
    "13562:TCP"= 13562:TCP:NortonAV
    "14124:TCP"= 14124:TCP:NortonAV
    "15681:TCP"= 15681:TCP:NortonAV
    "17870:TCP"= 17870:TCP:NortonAV
    "18942:TCP"= 18942:TCP:NortonAV
    "14336:TCP"= 14336:TCP:NortonAV
    "17523:TCP"= 17523:TCP:NortonAV
    "17504:TCP"= 17504:TCP:NortonAV
    "18418:TCP"= 18418:TCP:NortonAV
    "16717:TCP"= 16717:TCP:NortonAV
    "15560:TCP"= 15560:TCP:NortonAV
    "14927:TCP"= 14927:TCP:NortonAV
    "16418:TCP"= 16418:TCP:NortonAV
    "17512:TCP"= 17512:TCP:NortonAV
    "16254:TCP"= 16254:TCP:NortonAV
    "14156:TCP"= 14156:TCP:NortonAV
    "17065:TCP"= 17065:TCP:NortonAV
    "18743:TCP"= 18743:TCP:NortonAV
    "17301:TCP"= 17301:TCP:NortonAV

    S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2004-07-07 22272]
    S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [ ]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96cd8170-b4ab-11dc-a976-0012f01a97bf}]
    \Shell\AutoRun\command - 3wcxx91.cmd
    \Shell\explore\Command - 3wcxx91.cmd
    \Shell\open\Command - 3wcxx91.cmd
    .
    Contenu du dossier 'Tâches planifiées'

    2008-10-03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 18:13]
    .
    .
    ------- Examen supplémentaire -------
    .
    FireFox -: Profile - C:\Documents and Settings\Nadine Kmieczak\Application Data\Mozilla\Firefox\Profiles\l7jjd50n.default\
    FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-15 18:19:51
    Windows 5.1.2600 Service Pack 2 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************
    .
    Heure de fin: 2008-10-15 18:22:24
    ComboFix-quarantined-files.txt 2008-10-15 16:22:15
    ComboFix2.txt 2008-10-14 16:12:20
    ComboFix3.txt 2008-10-14 14:46:25

    Avant-CF: 8 837 681 152 octets libres
    Après-CF: 8,813,125,632 octets libres

    259 --- E O F --- 2008-10-11 17:38:43
    merci
    0
  12. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    colle un scan en ligne avec un des deux:

    bitdefender en ligne :
    http://www.bitdefender.fr/scan_fr/scan8/ie.html

    Panda en ligne :
    http://pandasoftware.fr
    0

Discussions similaires

league of legend impossible d'initialiser le dispositif d'affichage
pascontent -
Tsagax -

5 réponses
Facebook ne s'affiche plus correctement.
Twibault -
Delsud -

36 réponses
Chrome://newtab
Nova -
snoopy35_ -

14 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Bug d'affichage sur ma Freebox Revolution
BourrinOman83 -
brupala -

4 réponses