Problème d'affichage liés à un virus
nad
-
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,
j'ai réçement eu un virus sur mon ordi et depuis j'ai des bandes colorés,comme des codes barres rouges sur l'écran ,j'ai tenter une restauration system mais impossible ...que faire !? je suis débutante en informatique
j'ai réçement eu un virus sur mon ordi et depuis j'ai des bandes colorés,comme des codes barres rouges sur l'écran ,j'ai tenter une restauration system mais impossible ...que faire !? je suis débutante en informatique
A voir également:
- Problème d'affichage liés à un virus
- Virus mcafee - Accueil - Piratage
- Affichage double ecran - Guide
- Problème affichage fenêtre windows 10 - Guide
- Windows 11 affichage classique - Guide
- Problème affichage facebook ✓ - Forum Facebook
11 réponses
slt
scan avec malwarebyte et colle le rapport:
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
__________________
colle un rapport hijackthis
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
manuel :
http://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html
Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.
ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste
Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."
scan avec malwarebyte et colle le rapport:
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
__________________
colle un rapport hijackthis
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
manuel :
http://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html
Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.
ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste
Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."
par contre j'ai foiré pour la sauvegarde car le lien que j'ai trouver pour hijackthis mener directement à l'instalation j'ai renomer l'exe mais ...
merci pour ta réponse,voici le rapport de malwarebyts
Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1262
Windows 5.1.2600 Service Pack 2
13/10/2008 23:45:59
mbam-log-2008-10-13 (23-45-59).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 111978
Temps écoulé: 1 hour(s), 18 minute(s), 17 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1262
Windows 5.1.2600 Service Pack 2
13/10/2008 23:45:59
mbam-log-2008-10-13 (23-45-59).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 111978
Temps écoulé: 1 hour(s), 18 minute(s), 17 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
je viens d'essayer de telecharger hijackthis mais le lien ne me conduit pas vers son lien de telechargement mais sur celui de house call ,et le lien vers le blog est mort ...
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
bon j'ai trouver un autre lien avec l'install
voilà le rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:07:22, on 14/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O5 "LPT1:" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P41 "EPSON Stylus Photo RX420 Series (Copie 1)" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [SystemDoctor 2006 Free] C:\Program Files\SystemDoctor 2006 Free\sd2006.exe -scan
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: CD du logiciel supplémentaire.lnk = ?
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
voilà le rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:07:22, on 14/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O5 "LPT1:" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P41 "EPSON Stylus Photo RX420 Series (Copie 1)" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [SystemDoctor 2006 Free] C:\Program Files\SystemDoctor 2006 Free\sd2006.exe -scan
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: CD du logiciel supplémentaire.lnk = ?
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
télécharge combofix (par sUBs) ici :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
Tu as un tutoriel complet ici :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
Tu as un tutoriel complet ici :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
voici le rapport
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]
"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
C:\Documents and Settings\Nadine Kmieczak\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.X264"= x264vfw.dll
"vidc.3IV2"= 3ivxVfWCodec.dll
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm
[HKLM\~\startupfolder\C:^Documents and Settings^Nadine Kmieczak^Menu Démarrer^Programmes^Démarrage^Outil de détection de support de Cyber-shot Viewer.lnk]
path=C:\Documents and Settings\Nadine Kmieczak\Menu Démarrer\Programmes\Démarrage\Outil de détection de support de Cyber-shot Viewer.lnk
backup=C:\WINDOWS\pss\Outil de détection de support de Cyber-shot Viewer.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Resolume-2-2\\resolume.exe"=
"C:\\Program Files\\aestesis\\elektronika live\\elektronika.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18376:TCP"= 18376:TCP:*:Disabled:NortonAV
"13086:TCP"= 13086:TCP:*:Disabled:NortonAV
"14270:TCP"= 14270:TCP:*:Disabled:NortonAV
"16759:TCP"= 16759:TCP:*:Disabled:NortonAV
"17559:TCP"= 17559:TCP:*:Disabled:NortonAV
"18067:TCP"= 18067:TCP:*:Disabled:NortonAV
"13888:TCP"= 13888:TCP:*:Disabled:NortonAV
"13153:TCP"= 13153:TCP:*:Disabled:NortonAV
"17959:TCP"= 17959:TCP:*:Disabled:NortonAV
"17511:TCP"= 17511:TCP:*:Disabled:NortonAV
"13709:TCP"= 13709:TCP:*:Disabled:NortonAV
"12279:TCP"= 12279:TCP:*:Disabled:NortonAV
"18611:TCP"= 18611:TCP:*:Disabled:NortonAV
"15177:TCP"= 15177:TCP:*:Disabled:NortonAV
"16112:TCP"= 16112:TCP:*:Disabled:NortonAV
"17110:TCP"= 17110:TCP:*:Disabled:NortonAV
"14146:TCP"= 14146:TCP:*:Disabled:NortonAV
"16718:TCP"= 16718:TCP:*:Disabled:NortonAV
"17789:TCP"= 17789:TCP:*:Disabled:NortonAV
"12879:TCP"= 12879:TCP:*:Disabled:NortonAV
"12966:TCP"= 12966:TCP:*:Disabled:NortonAV
"13696:TCP"= 13696:TCP:*:Disabled:NortonAV
"14178:TCP"= 14178:TCP:*:Disabled:NortonAV
"13285:TCP"= 13285:TCP:*:Disabled:NortonAV
"18156:TCP"= 18156:TCP:*:Disabled:NortonAV
"17566:TCP"= 17566:TCP:*:Disabled:NortonAV
"16727:TCP"= 16727:TCP:*:Disabled:NortonAV
"16158:TCP"= 16158:TCP:*:Disabled:NortonAV
"16364:TCP"= 16364:TCP:*:Disabled:NortonAV
"16675:TCP"= 16675:TCP:*:Disabled:NortonAV
"18592:TCP"= 18592:TCP:*:Disabled:NortonAV
"13599:TCP"= 13599:TCP:*:Disabled:NortonAV
"12143:TCP"= 12143:TCP:*:Disabled:NortonAV
"17725:TCP"= 17725:TCP:*:Disabled:NortonAV
"16730:TCP"= 16730:TCP:*:Disabled:NortonAV
"18049:TCP"= 18049:TCP:*:Disabled:NortonAV
"18918:TCP"= 18918:TCP:*:Disabled:NortonAV
"17886:TCP"= 17886:TCP:*:Disabled:NortonAV
"18825:TCP"= 18825:TCP:*:Disabled:NortonAV
"16884:TCP"= 16884:TCP:*:Disabled:NortonAV
"17743:TCP"= 17743:TCP:*:Disabled:NortonAV
"17711:TCP"= 17711:TCP:*:Disabled:NortonAV
"14693:TCP"= 14693:TCP:*:Disabled:NortonAV
"15947:TCP"= 15947:TCP:*:Disabled:NortonAV
"16557:TCP"= 16557:TCP:*:Disabled:NortonAV
"13012:TCP"= 13012:TCP:*:Disabled:NortonAV
"17079:TCP"= 17079:TCP:*:Disabled:NortonAV
"15998:TCP"= 15998:TCP:NortonAV
"12782:TCP"= 12782:TCP:NortonAV
"13691:TCP"= 13691:TCP:NortonAV
"17185:TCP"= 17185:TCP:NortonAV
"18303:TCP"= 18303:TCP:NortonAV
"13886:TCP"= 13886:TCP:NortonAV
"18768:TCP"= 18768:TCP:NortonAV
"13280:TCP"= 13280:TCP:NortonAV
"13049:TCP"= 13049:TCP:NortonAV
"13036:TCP"= 13036:TCP:NortonAV
"16070:TCP"= 16070:TCP:NortonAV
"15645:TCP"= 15645:TCP:NortonAV
"13096:TCP"= 13096:TCP:NortonAV
"15807:TCP"= 15807:TCP:NortonAV
"18883:TCP"= 18883:TCP:NortonAV
"18411:TCP"= 18411:TCP:NortonAV
"18460:TCP"= 18460:TCP:NortonAV
"15251:TCP"= 15251:TCP:NortonAV
"17128:TCP"= 17128:TCP:NortonAV
"17464:TCP"= 17464:TCP:NortonAV
"13166:TCP"= 13166:TCP:NortonAV
"17577:TCP"= 17577:TCP:NortonAV
"17513:TCP"= 17513:TCP:NortonAV
"14801:TCP"= 14801:TCP:NortonAV
"13969:TCP"= 13969:TCP:NortonAV
"14359:TCP"= 14359:TCP:NortonAV
"15469:TCP"= 15469:TCP:NortonAV
"13935:TCP"= 13935:TCP:NortonAV
"12216:TCP"= 12216:TCP:NortonAV
"12967:TCP"= 12967:TCP:NortonAV
"12281:TCP"= 12281:TCP:NortonAV
"13653:TCP"= 13653:TCP:NortonAV
"15398:TCP"= 15398:TCP:NortonAV
"15254:TCP"= 15254:TCP:NortonAV
"18876:TCP"= 18876:TCP:NortonAV
"16724:TCP"= 16724:TCP:NortonAV
"15525:TCP"= 15525:TCP:NortonAV
"16309:TCP"= 16309:TCP:NortonAV
"13562:TCP"= 13562:TCP:NortonAV
"14124:TCP"= 14124:TCP:NortonAV
"15681:TCP"= 15681:TCP:NortonAV
"17870:TCP"= 17870:TCP:NortonAV
"18942:TCP"= 18942:TCP:NortonAV
"14336:TCP"= 14336:TCP:NortonAV
"17523:TCP"= 17523:TCP:NortonAV
"17504:TCP"= 17504:TCP:NortonAV
"18418:TCP"= 18418:TCP:NortonAV
"16717:TCP"= 16717:TCP:NortonAV
"15560:TCP"= 15560:TCP:NortonAV
"14927:TCP"= 14927:TCP:NortonAV
"16418:TCP"= 16418:TCP:NortonAV
"17512:TCP"= 17512:TCP:NortonAV
"16254:TCP"= 16254:TCP:NortonAV
"14156:TCP"= 14156:TCP:NortonAV
"17065:TCP"= 17065:TCP:NortonAV
"18743:TCP"= 18743:TCP:NortonAV
"17301:TCP"= 17301:TCP:NortonAV
S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2004-07-07 22272]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96cd8170-b4ab-11dc-a976-0012f01a97bf}]
\Shell\AutoRun\command - 3wcxx91.cmd
\Shell\explore\Command - 3wcxx91.cmd
\Shell\open\Command - 3wcxx91.cmd
.
Contenu du dossier 'Tâches planifiées'
2008-10-03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 18:13]
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Nadine Kmieczak\Application Data\Mozilla\Firefox\Profiles\l7jjd50n.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-14 18:09:48
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-10-14 18:12:18
ComboFix-quarantined-files.txt 2008-10-14 16:12:12
ComboFix2.txt 2008-10-14 14:46:25
Avant-CF: 9 167 368 192 octets libres
Après-CF: 9,144,557,568 octets libres
257 --- E O F --- 2008-10-11 17:38:43
faut il comme il est ecrit sur le tutoriel installer une console de recuperation ? merci nad
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]
"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
C:\Documents and Settings\Nadine Kmieczak\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.X264"= x264vfw.dll
"vidc.3IV2"= 3ivxVfWCodec.dll
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm
[HKLM\~\startupfolder\C:^Documents and Settings^Nadine Kmieczak^Menu Démarrer^Programmes^Démarrage^Outil de détection de support de Cyber-shot Viewer.lnk]
path=C:\Documents and Settings\Nadine Kmieczak\Menu Démarrer\Programmes\Démarrage\Outil de détection de support de Cyber-shot Viewer.lnk
backup=C:\WINDOWS\pss\Outil de détection de support de Cyber-shot Viewer.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Resolume-2-2\\resolume.exe"=
"C:\\Program Files\\aestesis\\elektronika live\\elektronika.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18376:TCP"= 18376:TCP:*:Disabled:NortonAV
"13086:TCP"= 13086:TCP:*:Disabled:NortonAV
"14270:TCP"= 14270:TCP:*:Disabled:NortonAV
"16759:TCP"= 16759:TCP:*:Disabled:NortonAV
"17559:TCP"= 17559:TCP:*:Disabled:NortonAV
"18067:TCP"= 18067:TCP:*:Disabled:NortonAV
"13888:TCP"= 13888:TCP:*:Disabled:NortonAV
"13153:TCP"= 13153:TCP:*:Disabled:NortonAV
"17959:TCP"= 17959:TCP:*:Disabled:NortonAV
"17511:TCP"= 17511:TCP:*:Disabled:NortonAV
"13709:TCP"= 13709:TCP:*:Disabled:NortonAV
"12279:TCP"= 12279:TCP:*:Disabled:NortonAV
"18611:TCP"= 18611:TCP:*:Disabled:NortonAV
"15177:TCP"= 15177:TCP:*:Disabled:NortonAV
"16112:TCP"= 16112:TCP:*:Disabled:NortonAV
"17110:TCP"= 17110:TCP:*:Disabled:NortonAV
"14146:TCP"= 14146:TCP:*:Disabled:NortonAV
"16718:TCP"= 16718:TCP:*:Disabled:NortonAV
"17789:TCP"= 17789:TCP:*:Disabled:NortonAV
"12879:TCP"= 12879:TCP:*:Disabled:NortonAV
"12966:TCP"= 12966:TCP:*:Disabled:NortonAV
"13696:TCP"= 13696:TCP:*:Disabled:NortonAV
"14178:TCP"= 14178:TCP:*:Disabled:NortonAV
"13285:TCP"= 13285:TCP:*:Disabled:NortonAV
"18156:TCP"= 18156:TCP:*:Disabled:NortonAV
"17566:TCP"= 17566:TCP:*:Disabled:NortonAV
"16727:TCP"= 16727:TCP:*:Disabled:NortonAV
"16158:TCP"= 16158:TCP:*:Disabled:NortonAV
"16364:TCP"= 16364:TCP:*:Disabled:NortonAV
"16675:TCP"= 16675:TCP:*:Disabled:NortonAV
"18592:TCP"= 18592:TCP:*:Disabled:NortonAV
"13599:TCP"= 13599:TCP:*:Disabled:NortonAV
"12143:TCP"= 12143:TCP:*:Disabled:NortonAV
"17725:TCP"= 17725:TCP:*:Disabled:NortonAV
"16730:TCP"= 16730:TCP:*:Disabled:NortonAV
"18049:TCP"= 18049:TCP:*:Disabled:NortonAV
"18918:TCP"= 18918:TCP:*:Disabled:NortonAV
"17886:TCP"= 17886:TCP:*:Disabled:NortonAV
"18825:TCP"= 18825:TCP:*:Disabled:NortonAV
"16884:TCP"= 16884:TCP:*:Disabled:NortonAV
"17743:TCP"= 17743:TCP:*:Disabled:NortonAV
"17711:TCP"= 17711:TCP:*:Disabled:NortonAV
"14693:TCP"= 14693:TCP:*:Disabled:NortonAV
"15947:TCP"= 15947:TCP:*:Disabled:NortonAV
"16557:TCP"= 16557:TCP:*:Disabled:NortonAV
"13012:TCP"= 13012:TCP:*:Disabled:NortonAV
"17079:TCP"= 17079:TCP:*:Disabled:NortonAV
"15998:TCP"= 15998:TCP:NortonAV
"12782:TCP"= 12782:TCP:NortonAV
"13691:TCP"= 13691:TCP:NortonAV
"17185:TCP"= 17185:TCP:NortonAV
"18303:TCP"= 18303:TCP:NortonAV
"13886:TCP"= 13886:TCP:NortonAV
"18768:TCP"= 18768:TCP:NortonAV
"13280:TCP"= 13280:TCP:NortonAV
"13049:TCP"= 13049:TCP:NortonAV
"13036:TCP"= 13036:TCP:NortonAV
"16070:TCP"= 16070:TCP:NortonAV
"15645:TCP"= 15645:TCP:NortonAV
"13096:TCP"= 13096:TCP:NortonAV
"15807:TCP"= 15807:TCP:NortonAV
"18883:TCP"= 18883:TCP:NortonAV
"18411:TCP"= 18411:TCP:NortonAV
"18460:TCP"= 18460:TCP:NortonAV
"15251:TCP"= 15251:TCP:NortonAV
"17128:TCP"= 17128:TCP:NortonAV
"17464:TCP"= 17464:TCP:NortonAV
"13166:TCP"= 13166:TCP:NortonAV
"17577:TCP"= 17577:TCP:NortonAV
"17513:TCP"= 17513:TCP:NortonAV
"14801:TCP"= 14801:TCP:NortonAV
"13969:TCP"= 13969:TCP:NortonAV
"14359:TCP"= 14359:TCP:NortonAV
"15469:TCP"= 15469:TCP:NortonAV
"13935:TCP"= 13935:TCP:NortonAV
"12216:TCP"= 12216:TCP:NortonAV
"12967:TCP"= 12967:TCP:NortonAV
"12281:TCP"= 12281:TCP:NortonAV
"13653:TCP"= 13653:TCP:NortonAV
"15398:TCP"= 15398:TCP:NortonAV
"15254:TCP"= 15254:TCP:NortonAV
"18876:TCP"= 18876:TCP:NortonAV
"16724:TCP"= 16724:TCP:NortonAV
"15525:TCP"= 15525:TCP:NortonAV
"16309:TCP"= 16309:TCP:NortonAV
"13562:TCP"= 13562:TCP:NortonAV
"14124:TCP"= 14124:TCP:NortonAV
"15681:TCP"= 15681:TCP:NortonAV
"17870:TCP"= 17870:TCP:NortonAV
"18942:TCP"= 18942:TCP:NortonAV
"14336:TCP"= 14336:TCP:NortonAV
"17523:TCP"= 17523:TCP:NortonAV
"17504:TCP"= 17504:TCP:NortonAV
"18418:TCP"= 18418:TCP:NortonAV
"16717:TCP"= 16717:TCP:NortonAV
"15560:TCP"= 15560:TCP:NortonAV
"14927:TCP"= 14927:TCP:NortonAV
"16418:TCP"= 16418:TCP:NortonAV
"17512:TCP"= 17512:TCP:NortonAV
"16254:TCP"= 16254:TCP:NortonAV
"14156:TCP"= 14156:TCP:NortonAV
"17065:TCP"= 17065:TCP:NortonAV
"18743:TCP"= 18743:TCP:NortonAV
"17301:TCP"= 17301:TCP:NortonAV
S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2004-07-07 22272]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96cd8170-b4ab-11dc-a976-0012f01a97bf}]
\Shell\AutoRun\command - 3wcxx91.cmd
\Shell\explore\Command - 3wcxx91.cmd
\Shell\open\Command - 3wcxx91.cmd
.
Contenu du dossier 'Tâches planifiées'
2008-10-03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 18:13]
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Nadine Kmieczak\Application Data\Mozilla\Firefox\Profiles\l7jjd50n.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-14 18:09:48
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-10-14 18:12:18
ComboFix-quarantined-files.txt 2008-10-14 16:12:12
ComboFix2.txt 2008-10-14 14:46:25
Avant-CF: 9 167 368 192 octets libres
Après-CF: 9,144,557,568 octets libres
257 --- E O F --- 2008-10-11 17:38:43
faut il comme il est ecrit sur le tutoriel installer une console de recuperation ? merci nad
ComboFix 08-10-12.01 - Nadine Kmieczak 2008-10-15 18:15:02.3 - NTFSx86
Lancé depuis: C:\Documents and Settings\Nadine Kmieczak\Bureau\ComboFix.exe
[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-15 au 2008-10-15 ))))))))))))))))))))))))))))))))))))
.
2008-10-14 00:06 . 2008-10-14 00:06 <REP> d-------- C:\Program Files\Trend Micro
2008-10-13 23:52 . 2008-10-13 23:52 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\.housecall6.6
2008-10-13 21:31 . 2008-10-13 21:31 <REP> d-------- C:\Program Files\CCleaner
2008-10-13 20:56 . 2008-10-13 21:33 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2008-10-13 20:28 . 2008-10-13 21:31 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\Application Data\CCleanup
2008-10-13 19:00 . 2008-10-13 19:00 <REP> d-------- C:\Documents and Settings\LocalService\Bureau
2008-10-13 15:25 . 2008-10-15 17:41 3,021 --a------ C:\rollback.ini
2008-10-13 15:17 . 2008-10-13 15:17 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\Application Data\MailFrontier
2008-10-13 15:15 . 2008-10-15 18:20 3,594,784 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-13 15:15 . 2008-10-15 02:30 48,332 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-13 15:09 . 2008-10-13 20:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-10-13 15:09 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-10-13 15:09 . 2008-07-09 09:05 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
2008-10-13 15:09 . 2008-07-09 09:05 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2008-10-13 15:09 . 2008-07-09 09:05 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
2008-10-13 15:09 . 2008-07-09 09:05 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-10-13 15:09 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2008-10-13 15:09 . 2008-10-15 17:32 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-10-13 15:08 . 2008-10-13 15:08 <REP> d-------- C:\Program Files\Zone Labs
2008-10-13 13:13 . 2008-10-13 13:13 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-13 13:13 . 2008-10-13 13:13 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\Application Data\Malwarebytes
2008-10-13 13:13 . 2008-10-13 13:13 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-13 13:13 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-13 13:13 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-11 18:37 . 2008-10-15 01:22 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-10-11 14:59 . 2008-10-13 13:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-10-11 14:59 . 2008-10-11 14:59 1,409 --a------ C:\WINDOWS\QTFont.for
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-14 23:05 700,133 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-10-14 16:01 17,094 ----a-w C:\Documents and Settings\Nadine Kmieczak\Application Data\wklnhst.dat
2008-10-13 19:32 --------- d-----w C:\Program Files\MSN Messenger
2008-09-27 14:25 --------- d-----w C:\Program Files\Resolume-2-2
2007-01-22 08:41 24,632 -c--a-w C:\Program Files\Fichiers communs\security
2006-07-03 08:11 793,126 -c--a-w C:\Program Files\Internet Explorer.rar
.
((((((((((((((((((((((((((((( snapshot@2008-10-14_16.45.31,11 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-14 23:24:45 10,508 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{31F80E72-1933-4F8D-89A6-7A85CF1B9A2D}.bin
- 2008-03-30 10:55:31 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-10-14 15:16:48 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-03-30 10:55:31 49,054 ----a-w C:\WINDOWS\system32\perfc00C.dat
+ 2008-10-14 15:16:48 49,054 ----a-w C:\WINDOWS\system32\perfc00C.dat
- 2008-03-30 10:55:31 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-10-14 15:16:48 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-03-30 10:55:31 368,314 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2008-10-14 15:16:48 368,314 ----a-w C:\WINDOWS\system32\perfh00C.dat
- 2008-10-14 14:08:28 342,640 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat
+ 2008-10-15 15:41:30 364,628 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-15 65536]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [X]
"EPSON Stylus Photo RX420 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE" [2004-04-09 98304]
"EPSON Stylus Photo RX420 Series (Copie 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE" [2004-04-09 98304]
"Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2004-11-12 73728]
"THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2005-01-14 352256]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-15 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-15 688218]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544]
"SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2004-12-21 118784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 282624]
"PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-11-17 1077327]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 221184]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2003-09-06 184320]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 217088]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 458752]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-03 122939]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-07 344064]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"TPSMain"="TPSMain.exe" [2005-01-21 C:\WINDOWS\system32\TPSMain.exe]
"TFncKy"="TFncKy.exe" [BU]
"NDSTray.exe"="NDSTray.exe" [BU]
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-28 C:\WINDOWS\agrsmmsg.exe]
"atwtusb"="atwtusb.exe" [2005-09-21 C:\WINDOWS\system32\ATWTUSB.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]
"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
C:\Documents and Settings\Nadine Kmieczak\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.X264"= x264vfw.dll
"vidc.3IV2"= 3ivxVfWCodec.dll
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm
[HKLM\~\startupfolder\C:^Documents and Settings^Nadine Kmieczak^Menu Démarrer^Programmes^Démarrage^Outil de détection de support de Cyber-shot Viewer.lnk]
path=C:\Documents and Settings\Nadine Kmieczak\Menu Démarrer\Programmes\Démarrage\Outil de détection de support de Cyber-shot Viewer.lnk
backup=C:\WINDOWS\pss\Outil de détection de support de Cyber-shot Viewer.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Resolume-2-2\\resolume.exe"=
"C:\\Program Files\\aestesis\\elektronika live\\elektronika.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18376:TCP"= 18376:TCP:*:Disabled:NortonAV
"13086:TCP"= 13086:TCP:*:Disabled:NortonAV
"14270:TCP"= 14270:TCP:*:Disabled:NortonAV
"16759:TCP"= 16759:TCP:*:Disabled:NortonAV
"17559:TCP"= 17559:TCP:*:Disabled:NortonAV
"18067:TCP"= 18067:TCP:*:Disabled:NortonAV
"13888:TCP"= 13888:TCP:*:Disabled:NortonAV
"13153:TCP"= 13153:TCP:*:Disabled:NortonAV
"17959:TCP"= 17959:TCP:*:Disabled:NortonAV
"17511:TCP"= 17511:TCP:*:Disabled:NortonAV
"13709:TCP"= 13709:TCP:*:Disabled:NortonAV
"12279:TCP"= 12279:TCP:*:Disabled:NortonAV
"18611:TCP"= 18611:TCP:*:Disabled:NortonAV
"15177:TCP"= 15177:TCP:*:Disabled:NortonAV
"16112:TCP"= 16112:TCP:*:Disabled:NortonAV
"17110:TCP"= 17110:TCP:*:Disabled:NortonAV
"14146:TCP"= 14146:TCP:*:Disabled:NortonAV
"16718:TCP"= 16718:TCP:*:Disabled:NortonAV
"17789:TCP"= 17789:TCP:*:Disabled:NortonAV
"12879:TCP"= 12879:TCP:*:Disabled:NortonAV
"12966:TCP"= 12966:TCP:*:Disabled:NortonAV
"13696:TCP"= 13696:TCP:*:Disabled:NortonAV
"14178:TCP"= 14178:TCP:*:Disabled:NortonAV
"13285:TCP"= 13285:TCP:*:Disabled:NortonAV
"18156:TCP"= 18156:TCP:*:Disabled:NortonAV
"17566:TCP"= 17566:TCP:*:Disabled:NortonAV
"16727:TCP"= 16727:TCP:*:Disabled:NortonAV
"16158:TCP"= 16158:TCP:*:Disabled:NortonAV
"16364:TCP"= 16364:TCP:*:Disabled:NortonAV
"16675:TCP"= 16675:TCP:*:Disabled:NortonAV
"18592:TCP"= 18592:TCP:*:Disabled:NortonAV
"13599:TCP"= 13599:TCP:*:Disabled:NortonAV
"12143:TCP"= 12143:TCP:*:Disabled:NortonAV
"17725:TCP"= 17725:TCP:*:Disabled:NortonAV
"16730:TCP"= 16730:TCP:*:Disabled:NortonAV
"18049:TCP"= 18049:TCP:*:Disabled:NortonAV
"18918:TCP"= 18918:TCP:*:Disabled:NortonAV
"17886:TCP"= 17886:TCP:*:Disabled:NortonAV
"18825:TCP"= 18825:TCP:*:Disabled:NortonAV
"16884:TCP"= 16884:TCP:*:Disabled:NortonAV
"17743:TCP"= 17743:TCP:*:Disabled:NortonAV
"17711:TCP"= 17711:TCP:*:Disabled:NortonAV
"14693:TCP"= 14693:TCP:*:Disabled:NortonAV
"15947:TCP"= 15947:TCP:*:Disabled:NortonAV
"16557:TCP"= 16557:TCP:*:Disabled:NortonAV
"13012:TCP"= 13012:TCP:*:Disabled:NortonAV
"17079:TCP"= 17079:TCP:*:Disabled:NortonAV
"15998:TCP"= 15998:TCP:NortonAV
"12782:TCP"= 12782:TCP:NortonAV
"13691:TCP"= 13691:TCP:NortonAV
"17185:TCP"= 17185:TCP:NortonAV
"18303:TCP"= 18303:TCP:NortonAV
"13886:TCP"= 13886:TCP:NortonAV
"18768:TCP"= 18768:TCP:NortonAV
"13280:TCP"= 13280:TCP:NortonAV
"13049:TCP"= 13049:TCP:NortonAV
"13036:TCP"= 13036:TCP:NortonAV
"16070:TCP"= 16070:TCP:NortonAV
"15645:TCP"= 15645:TCP:NortonAV
"13096:TCP"= 13096:TCP:NortonAV
"15807:TCP"= 15807:TCP:NortonAV
"18883:TCP"= 18883:TCP:NortonAV
"18411:TCP"= 18411:TCP:NortonAV
"18460:TCP"= 18460:TCP:NortonAV
"15251:TCP"= 15251:TCP:NortonAV
"17128:TCP"= 17128:TCP:NortonAV
"17464:TCP"= 17464:TCP:NortonAV
"13166:TCP"= 13166:TCP:NortonAV
"17577:TCP"= 17577:TCP:NortonAV
"17513:TCP"= 17513:TCP:NortonAV
"14801:TCP"= 14801:TCP:NortonAV
"13969:TCP"= 13969:TCP:NortonAV
"14359:TCP"= 14359:TCP:NortonAV
"15469:TCP"= 15469:TCP:NortonAV
"13935:TCP"= 13935:TCP:NortonAV
"12216:TCP"= 12216:TCP:NortonAV
"12967:TCP"= 12967:TCP:NortonAV
"12281:TCP"= 12281:TCP:NortonAV
"13653:TCP"= 13653:TCP:NortonAV
"15398:TCP"= 15398:TCP:NortonAV
"15254:TCP"= 15254:TCP:NortonAV
"18876:TCP"= 18876:TCP:NortonAV
"16724:TCP"= 16724:TCP:NortonAV
"15525:TCP"= 15525:TCP:NortonAV
"16309:TCP"= 16309:TCP:NortonAV
"13562:TCP"= 13562:TCP:NortonAV
"14124:TCP"= 14124:TCP:NortonAV
"15681:TCP"= 15681:TCP:NortonAV
"17870:TCP"= 17870:TCP:NortonAV
"18942:TCP"= 18942:TCP:NortonAV
"14336:TCP"= 14336:TCP:NortonAV
"17523:TCP"= 17523:TCP:NortonAV
"17504:TCP"= 17504:TCP:NortonAV
"18418:TCP"= 18418:TCP:NortonAV
"16717:TCP"= 16717:TCP:NortonAV
"15560:TCP"= 15560:TCP:NortonAV
"14927:TCP"= 14927:TCP:NortonAV
"16418:TCP"= 16418:TCP:NortonAV
"17512:TCP"= 17512:TCP:NortonAV
"16254:TCP"= 16254:TCP:NortonAV
"14156:TCP"= 14156:TCP:NortonAV
"17065:TCP"= 17065:TCP:NortonAV
"18743:TCP"= 18743:TCP:NortonAV
"17301:TCP"= 17301:TCP:NortonAV
S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2004-07-07 22272]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96cd8170-b4ab-11dc-a976-0012f01a97bf}]
\Shell\AutoRun\command - 3wcxx91.cmd
\Shell\explore\Command - 3wcxx91.cmd
\Shell\open\Command - 3wcxx91.cmd
.
Contenu du dossier 'Tâches planifiées'
2008-10-03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 18:13]
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Nadine Kmieczak\Application Data\Mozilla\Firefox\Profiles\l7jjd50n.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-15 18:19:51
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-10-15 18:22:24
ComboFix-quarantined-files.txt 2008-10-15 16:22:15
ComboFix2.txt 2008-10-14 16:12:20
ComboFix3.txt 2008-10-14 14:46:25
Avant-CF: 8 837 681 152 octets libres
Après-CF: 8,813,125,632 octets libres
259 --- E O F --- 2008-10-11 17:38:43
merci
Lancé depuis: C:\Documents and Settings\Nadine Kmieczak\Bureau\ComboFix.exe
[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-15 au 2008-10-15 ))))))))))))))))))))))))))))))))))))
.
2008-10-14 00:06 . 2008-10-14 00:06 <REP> d-------- C:\Program Files\Trend Micro
2008-10-13 23:52 . 2008-10-13 23:52 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\.housecall6.6
2008-10-13 21:31 . 2008-10-13 21:31 <REP> d-------- C:\Program Files\CCleaner
2008-10-13 20:56 . 2008-10-13 21:33 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2008-10-13 20:28 . 2008-10-13 21:31 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\Application Data\CCleanup
2008-10-13 19:00 . 2008-10-13 19:00 <REP> d-------- C:\Documents and Settings\LocalService\Bureau
2008-10-13 15:25 . 2008-10-15 17:41 3,021 --a------ C:\rollback.ini
2008-10-13 15:17 . 2008-10-13 15:17 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\Application Data\MailFrontier
2008-10-13 15:15 . 2008-10-15 18:20 3,594,784 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-13 15:15 . 2008-10-15 02:30 48,332 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-13 15:09 . 2008-10-13 20:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-10-13 15:09 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-10-13 15:09 . 2008-07-09 09:05 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
2008-10-13 15:09 . 2008-07-09 09:05 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2008-10-13 15:09 . 2008-07-09 09:05 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
2008-10-13 15:09 . 2008-07-09 09:05 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-10-13 15:09 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2008-10-13 15:09 . 2008-10-15 17:32 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-10-13 15:08 . 2008-10-13 15:08 <REP> d-------- C:\Program Files\Zone Labs
2008-10-13 13:13 . 2008-10-13 13:13 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-13 13:13 . 2008-10-13 13:13 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\Application Data\Malwarebytes
2008-10-13 13:13 . 2008-10-13 13:13 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-13 13:13 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-13 13:13 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-11 18:37 . 2008-10-15 01:22 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-10-11 14:59 . 2008-10-13 13:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-10-11 14:59 . 2008-10-11 14:59 1,409 --a------ C:\WINDOWS\QTFont.for
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-14 23:05 700,133 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-10-14 16:01 17,094 ----a-w C:\Documents and Settings\Nadine Kmieczak\Application Data\wklnhst.dat
2008-10-13 19:32 --------- d-----w C:\Program Files\MSN Messenger
2008-09-27 14:25 --------- d-----w C:\Program Files\Resolume-2-2
2007-01-22 08:41 24,632 -c--a-w C:\Program Files\Fichiers communs\security
2006-07-03 08:11 793,126 -c--a-w C:\Program Files\Internet Explorer.rar
.
((((((((((((((((((((((((((((( snapshot@2008-10-14_16.45.31,11 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-14 23:24:45 10,508 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{31F80E72-1933-4F8D-89A6-7A85CF1B9A2D}.bin
- 2008-03-30 10:55:31 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-10-14 15:16:48 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-03-30 10:55:31 49,054 ----a-w C:\WINDOWS\system32\perfc00C.dat
+ 2008-10-14 15:16:48 49,054 ----a-w C:\WINDOWS\system32\perfc00C.dat
- 2008-03-30 10:55:31 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-10-14 15:16:48 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-03-30 10:55:31 368,314 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2008-10-14 15:16:48 368,314 ----a-w C:\WINDOWS\system32\perfh00C.dat
- 2008-10-14 14:08:28 342,640 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat
+ 2008-10-15 15:41:30 364,628 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-15 65536]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [X]
"EPSON Stylus Photo RX420 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE" [2004-04-09 98304]
"EPSON Stylus Photo RX420 Series (Copie 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE" [2004-04-09 98304]
"Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2004-11-12 73728]
"THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2005-01-14 352256]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-15 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-15 688218]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544]
"SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2004-12-21 118784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 282624]
"PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-11-17 1077327]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 221184]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2003-09-06 184320]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 217088]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 458752]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-03 122939]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-07 344064]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"TPSMain"="TPSMain.exe" [2005-01-21 C:\WINDOWS\system32\TPSMain.exe]
"TFncKy"="TFncKy.exe" [BU]
"NDSTray.exe"="NDSTray.exe" [BU]
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-28 C:\WINDOWS\agrsmmsg.exe]
"atwtusb"="atwtusb.exe" [2005-09-21 C:\WINDOWS\system32\ATWTUSB.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]
"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
C:\Documents and Settings\Nadine Kmieczak\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.X264"= x264vfw.dll
"vidc.3IV2"= 3ivxVfWCodec.dll
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm
[HKLM\~\startupfolder\C:^Documents and Settings^Nadine Kmieczak^Menu Démarrer^Programmes^Démarrage^Outil de détection de support de Cyber-shot Viewer.lnk]
path=C:\Documents and Settings\Nadine Kmieczak\Menu Démarrer\Programmes\Démarrage\Outil de détection de support de Cyber-shot Viewer.lnk
backup=C:\WINDOWS\pss\Outil de détection de support de Cyber-shot Viewer.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Resolume-2-2\\resolume.exe"=
"C:\\Program Files\\aestesis\\elektronika live\\elektronika.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18376:TCP"= 18376:TCP:*:Disabled:NortonAV
"13086:TCP"= 13086:TCP:*:Disabled:NortonAV
"14270:TCP"= 14270:TCP:*:Disabled:NortonAV
"16759:TCP"= 16759:TCP:*:Disabled:NortonAV
"17559:TCP"= 17559:TCP:*:Disabled:NortonAV
"18067:TCP"= 18067:TCP:*:Disabled:NortonAV
"13888:TCP"= 13888:TCP:*:Disabled:NortonAV
"13153:TCP"= 13153:TCP:*:Disabled:NortonAV
"17959:TCP"= 17959:TCP:*:Disabled:NortonAV
"17511:TCP"= 17511:TCP:*:Disabled:NortonAV
"13709:TCP"= 13709:TCP:*:Disabled:NortonAV
"12279:TCP"= 12279:TCP:*:Disabled:NortonAV
"18611:TCP"= 18611:TCP:*:Disabled:NortonAV
"15177:TCP"= 15177:TCP:*:Disabled:NortonAV
"16112:TCP"= 16112:TCP:*:Disabled:NortonAV
"17110:TCP"= 17110:TCP:*:Disabled:NortonAV
"14146:TCP"= 14146:TCP:*:Disabled:NortonAV
"16718:TCP"= 16718:TCP:*:Disabled:NortonAV
"17789:TCP"= 17789:TCP:*:Disabled:NortonAV
"12879:TCP"= 12879:TCP:*:Disabled:NortonAV
"12966:TCP"= 12966:TCP:*:Disabled:NortonAV
"13696:TCP"= 13696:TCP:*:Disabled:NortonAV
"14178:TCP"= 14178:TCP:*:Disabled:NortonAV
"13285:TCP"= 13285:TCP:*:Disabled:NortonAV
"18156:TCP"= 18156:TCP:*:Disabled:NortonAV
"17566:TCP"= 17566:TCP:*:Disabled:NortonAV
"16727:TCP"= 16727:TCP:*:Disabled:NortonAV
"16158:TCP"= 16158:TCP:*:Disabled:NortonAV
"16364:TCP"= 16364:TCP:*:Disabled:NortonAV
"16675:TCP"= 16675:TCP:*:Disabled:NortonAV
"18592:TCP"= 18592:TCP:*:Disabled:NortonAV
"13599:TCP"= 13599:TCP:*:Disabled:NortonAV
"12143:TCP"= 12143:TCP:*:Disabled:NortonAV
"17725:TCP"= 17725:TCP:*:Disabled:NortonAV
"16730:TCP"= 16730:TCP:*:Disabled:NortonAV
"18049:TCP"= 18049:TCP:*:Disabled:NortonAV
"18918:TCP"= 18918:TCP:*:Disabled:NortonAV
"17886:TCP"= 17886:TCP:*:Disabled:NortonAV
"18825:TCP"= 18825:TCP:*:Disabled:NortonAV
"16884:TCP"= 16884:TCP:*:Disabled:NortonAV
"17743:TCP"= 17743:TCP:*:Disabled:NortonAV
"17711:TCP"= 17711:TCP:*:Disabled:NortonAV
"14693:TCP"= 14693:TCP:*:Disabled:NortonAV
"15947:TCP"= 15947:TCP:*:Disabled:NortonAV
"16557:TCP"= 16557:TCP:*:Disabled:NortonAV
"13012:TCP"= 13012:TCP:*:Disabled:NortonAV
"17079:TCP"= 17079:TCP:*:Disabled:NortonAV
"15998:TCP"= 15998:TCP:NortonAV
"12782:TCP"= 12782:TCP:NortonAV
"13691:TCP"= 13691:TCP:NortonAV
"17185:TCP"= 17185:TCP:NortonAV
"18303:TCP"= 18303:TCP:NortonAV
"13886:TCP"= 13886:TCP:NortonAV
"18768:TCP"= 18768:TCP:NortonAV
"13280:TCP"= 13280:TCP:NortonAV
"13049:TCP"= 13049:TCP:NortonAV
"13036:TCP"= 13036:TCP:NortonAV
"16070:TCP"= 16070:TCP:NortonAV
"15645:TCP"= 15645:TCP:NortonAV
"13096:TCP"= 13096:TCP:NortonAV
"15807:TCP"= 15807:TCP:NortonAV
"18883:TCP"= 18883:TCP:NortonAV
"18411:TCP"= 18411:TCP:NortonAV
"18460:TCP"= 18460:TCP:NortonAV
"15251:TCP"= 15251:TCP:NortonAV
"17128:TCP"= 17128:TCP:NortonAV
"17464:TCP"= 17464:TCP:NortonAV
"13166:TCP"= 13166:TCP:NortonAV
"17577:TCP"= 17577:TCP:NortonAV
"17513:TCP"= 17513:TCP:NortonAV
"14801:TCP"= 14801:TCP:NortonAV
"13969:TCP"= 13969:TCP:NortonAV
"14359:TCP"= 14359:TCP:NortonAV
"15469:TCP"= 15469:TCP:NortonAV
"13935:TCP"= 13935:TCP:NortonAV
"12216:TCP"= 12216:TCP:NortonAV
"12967:TCP"= 12967:TCP:NortonAV
"12281:TCP"= 12281:TCP:NortonAV
"13653:TCP"= 13653:TCP:NortonAV
"15398:TCP"= 15398:TCP:NortonAV
"15254:TCP"= 15254:TCP:NortonAV
"18876:TCP"= 18876:TCP:NortonAV
"16724:TCP"= 16724:TCP:NortonAV
"15525:TCP"= 15525:TCP:NortonAV
"16309:TCP"= 16309:TCP:NortonAV
"13562:TCP"= 13562:TCP:NortonAV
"14124:TCP"= 14124:TCP:NortonAV
"15681:TCP"= 15681:TCP:NortonAV
"17870:TCP"= 17870:TCP:NortonAV
"18942:TCP"= 18942:TCP:NortonAV
"14336:TCP"= 14336:TCP:NortonAV
"17523:TCP"= 17523:TCP:NortonAV
"17504:TCP"= 17504:TCP:NortonAV
"18418:TCP"= 18418:TCP:NortonAV
"16717:TCP"= 16717:TCP:NortonAV
"15560:TCP"= 15560:TCP:NortonAV
"14927:TCP"= 14927:TCP:NortonAV
"16418:TCP"= 16418:TCP:NortonAV
"17512:TCP"= 17512:TCP:NortonAV
"16254:TCP"= 16254:TCP:NortonAV
"14156:TCP"= 14156:TCP:NortonAV
"17065:TCP"= 17065:TCP:NortonAV
"18743:TCP"= 18743:TCP:NortonAV
"17301:TCP"= 17301:TCP:NortonAV
S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2004-07-07 22272]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96cd8170-b4ab-11dc-a976-0012f01a97bf}]
\Shell\AutoRun\command - 3wcxx91.cmd
\Shell\explore\Command - 3wcxx91.cmd
\Shell\open\Command - 3wcxx91.cmd
.
Contenu du dossier 'Tâches planifiées'
2008-10-03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 18:13]
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Nadine Kmieczak\Application Data\Mozilla\Firefox\Profiles\l7jjd50n.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-15 18:19:51
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-10-15 18:22:24
ComboFix-quarantined-files.txt 2008-10-15 16:22:15
ComboFix2.txt 2008-10-14 16:12:20
ComboFix3.txt 2008-10-14 14:46:25
Avant-CF: 8 837 681 152 octets libres
Après-CF: 8,813,125,632 octets libres
259 --- E O F --- 2008-10-11 17:38:43
merci
colle un scan en ligne avec un des deux:
bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html
Panda en ligne :
http://pandasoftware.fr
bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html
Panda en ligne :
http://pandasoftware.fr
