Problème d'affichage liés à un virus

nad -  
Bonjour,
j'ai réçement eu un virus sur mon ordi et depuis j'ai des bandes colorés,comme des codes barres rouges sur l'écran ,j'ai tenter une restauration system mais impossible ...que faire !? je suis débutante en informatique
Configuration: Windows XP
Firefox 2.0.0.17

11 réponses

  1. jlpjlp Contributeur sécurité
    slt

    scan avec malwarebyte et colle le rapport:
    https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

    __________________

    colle un rapport hijackthis

    http://www.trendsecure.com/portal/en-US/tools/security_tools­/hijackthis/download

    manuel :

    http://leblogdeclaude.blogspot.com/2006/10/informatique-sect­ion-hijackthis.html

    Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

    ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

    Ensuite avec Explorer créer un dossier c:\hijackthis
    Décompresser Hijackthis dans ce dossier.
    C'est important pour les sauvegardes."
    1
    1. nad
      par contre j'ai foiré pour la sauvegarde car le lien que j'ai trouver pour hijackthis mener directement à l'instalation j'ai renomer l'exe mais ...
      1
      1. nad
        merci pour ta réponse,voici le rapport de malwarebyts

        Malwarebytes' Anti-Malware 1.28
        Version de la base de données: 1262
        Windows 5.1.2600 Service Pack 2

        13/10/2008 23:45:59
        mbam-log-2008-10-13 (23-45-59).txt

        Type de recherche: Examen complet (C:\|D:\|)
        Eléments examinés: 111978
        Temps écoulé: 1 hour(s), 18 minute(s), 17 second(s)

        Processus mémoire infecté(s): 0
        Module(s) mémoire infecté(s): 0
        Clé(s) du Registre infectée(s): 0
        Valeur(s) du Registre infectée(s): 0
        Elément(s) de données du Registre infecté(s): 0
        Dossier(s) infecté(s): 0
        Fichier(s) infecté(s): 0

        Processus mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Module(s) mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Clé(s) du Registre infectée(s):
        (Aucun élément nuisible détecté)

        Valeur(s) du Registre infectée(s):
        (Aucun élément nuisible détecté)

        Elément(s) de données du Registre infecté(s):
        (Aucun élément nuisible détecté)

        Dossier(s) infecté(s):
        (Aucun élément nuisible détecté)

        Fichier(s) infecté(s):
        (Aucun élément nuisible détecté)
        0
        1. nad
          je viens d'essayer de telecharger hijackthis mais le lien ne me conduit pas vers son lien de telechargement mais sur celui de house call ,et le lien vers le blog est mort ...
          0
          2. nad
            bon j'ai trouver un autre lien avec l'install
            voilà le rapport

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 00:07:22, on 14/10/2008
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.6000.16705)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\Ati2evxx.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\ZoneLabs\vsmon.exe
            C:\WINDOWS\system32\Ati2evxx.exe
            C:\WINDOWS\Explorer.EXE
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
            C:\WINDOWS\system32\DVDRAMSV.exe
            C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
            C:\Program Files\Canon\CAL\CALMAIN.exe
            C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
            C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
            C:\Program Files\Toshiba\Tvs\TvsTray.exe
            C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
            C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
            C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
            C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
            C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
            C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
            C:\Program Files\QuickTime\qttask.exe
            C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
            C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
            C:\WINDOWS\system32\LVCOMSX.EXE
            C:\WINDOWS\system32\TPSBattM.exe
            C:\Program Files\ltmoh\Ltmoh.exe
            C:\Program Files\Logitech\Video\LogiTray.exe
            C:\WINDOWS\system32\dla\tfswctrl.exe
            C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
            C:\WINDOWS\AGRSMMSG.exe
            C:\WINDOWS\system32\atwtusb.exe
            C:\Program Files\iTunes\iTunesHelper.exe
            C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
            C:\WINDOWS\system32\RAMASST.exe
            C:\Program Files\iPod\bin\iPodService.exe
            C:\Program Files\Logitech\Video\FxSvr2.exe
            C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
            C:\Program Files\Mozilla Firefox\firefox.exe
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
            O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
            O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
            O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
            O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
            O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O5 "LPT1:" /M "Stylus Photo RX420"
            O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P41 "EPSON Stylus Photo RX420 Series (Copie 1)" /O6 "USB001" /M "Stylus Photo RX420"
            O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
            O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
            O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
            O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
            O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
            O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
            O4 - HKLM\..\Run: [SystemDoctor 2006 Free] C:\Program Files\SystemDoctor 2006 Free\sd2006.exe -scan
            O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
            O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
            O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
            O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
            O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
            O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
            O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
            O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
            O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
            O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
            O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
            O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
            O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
            O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
            O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
            O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
            O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
            O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
            O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
            O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
            O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
            O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
            O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
            O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
            O4 - Global Startup: CD du logiciel supplémentaire.lnk = ?
            O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
            O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
            O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
            O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
            O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
            O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
            O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
            O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
            O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
            0
            1. nad
              bon bé si quelqun à une idée ,car je suis bien embêter :(
              0
              1. jlpjlp Contributeur sécurité
                télécharge combofix (par sUBs) ici :

                http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                et enregistre le sur le bureau.

                déconnecte toi d'internet et ferme toutes tes applications.

                désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

                double-clique sur combofix.exe et suis les instructions

                à la fin, il va produire un rapport C:\ComboFix.txt

                réactive ton parefeu, ton antivirus, la garde de ton antispyware

                copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

                Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

                Tu as un tutoriel complet ici :

                https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
                0
                1. nad
                  voici le rapport

                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]
                  "DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

                  C:\Documents and Settings\Nadine Kmieczak\Menu D‚marrer\Programmes\D‚marrage\
                  Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                  "msacm.l3acm"= l3codecp.acm
                  "VIDC.X264"= x264vfw.dll
                  "vidc.3IV2"= 3ivxVfWCodec.dll
                  "vidc.DIV3"= DivXc32.dll
                  "vidc.DIV4"= DivXc32f.dll
                  "msacm.divxa32"= DivXa32.acm

                  [HKLM\~\startupfolder\C:^Documents and Settings^Nadine Kmieczak^Menu Démarrer^Programmes^Démarrage^Outil de détection de support de Cyber-shot Viewer.lnk]
                  path=C:\Documents and Settings\Nadine Kmieczak\Menu Démarrer\Programmes\Démarrage\Outil de détection de support de Cyber-shot Viewer.lnk
                  backup=C:\WINDOWS\pss\Outil de détection de support de Cyber-shot Viewer.lnkStartup

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                  "AntiVirusOverride"=dword:00000001

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
                  "DisableMonitoring"=dword:00000001

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                  "EnableFirewall"= 0 (0x0)

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                  "%windir%\\system32\\sessmgr.exe"=
                  "C:\\Program Files\\Resolume-2-2\\resolume.exe"=
                  "C:\\Program Files\\aestesis\\elektronika live\\elektronika.exe"=
                  "C:\\Program Files\\Messenger\\msmsgs.exe"=
                  "C:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=
                  "C:\\Program Files\\eMule\\emule.exe"=
                  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                  "C:\\Program Files\\iTunes\\iTunes.exe"=

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                  "18376:TCP"= 18376:TCP:*:Disabled:NortonAV
                  "13086:TCP"= 13086:TCP:*:Disabled:NortonAV
                  "14270:TCP"= 14270:TCP:*:Disabled:NortonAV
                  "16759:TCP"= 16759:TCP:*:Disabled:NortonAV
                  "17559:TCP"= 17559:TCP:*:Disabled:NortonAV
                  "18067:TCP"= 18067:TCP:*:Disabled:NortonAV
                  "13888:TCP"= 13888:TCP:*:Disabled:NortonAV
                  "13153:TCP"= 13153:TCP:*:Disabled:NortonAV
                  "17959:TCP"= 17959:TCP:*:Disabled:NortonAV
                  "17511:TCP"= 17511:TCP:*:Disabled:NortonAV
                  "13709:TCP"= 13709:TCP:*:Disabled:NortonAV
                  "12279:TCP"= 12279:TCP:*:Disabled:NortonAV
                  "18611:TCP"= 18611:TCP:*:Disabled:NortonAV
                  "15177:TCP"= 15177:TCP:*:Disabled:NortonAV
                  "16112:TCP"= 16112:TCP:*:Disabled:NortonAV
                  "17110:TCP"= 17110:TCP:*:Disabled:NortonAV
                  "14146:TCP"= 14146:TCP:*:Disabled:NortonAV
                  "16718:TCP"= 16718:TCP:*:Disabled:NortonAV
                  "17789:TCP"= 17789:TCP:*:Disabled:NortonAV
                  "12879:TCP"= 12879:TCP:*:Disabled:NortonAV
                  "12966:TCP"= 12966:TCP:*:Disabled:NortonAV
                  "13696:TCP"= 13696:TCP:*:Disabled:NortonAV
                  "14178:TCP"= 14178:TCP:*:Disabled:NortonAV
                  "13285:TCP"= 13285:TCP:*:Disabled:NortonAV
                  "18156:TCP"= 18156:TCP:*:Disabled:NortonAV
                  "17566:TCP"= 17566:TCP:*:Disabled:NortonAV
                  "16727:TCP"= 16727:TCP:*:Disabled:NortonAV
                  "16158:TCP"= 16158:TCP:*:Disabled:NortonAV
                  "16364:TCP"= 16364:TCP:*:Disabled:NortonAV
                  "16675:TCP"= 16675:TCP:*:Disabled:NortonAV
                  "18592:TCP"= 18592:TCP:*:Disabled:NortonAV
                  "13599:TCP"= 13599:TCP:*:Disabled:NortonAV
                  "12143:TCP"= 12143:TCP:*:Disabled:NortonAV
                  "17725:TCP"= 17725:TCP:*:Disabled:NortonAV
                  "16730:TCP"= 16730:TCP:*:Disabled:NortonAV
                  "18049:TCP"= 18049:TCP:*:Disabled:NortonAV
                  "18918:TCP"= 18918:TCP:*:Disabled:NortonAV
                  "17886:TCP"= 17886:TCP:*:Disabled:NortonAV
                  "18825:TCP"= 18825:TCP:*:Disabled:NortonAV
                  "16884:TCP"= 16884:TCP:*:Disabled:NortonAV
                  "17743:TCP"= 17743:TCP:*:Disabled:NortonAV
                  "17711:TCP"= 17711:TCP:*:Disabled:NortonAV
                  "14693:TCP"= 14693:TCP:*:Disabled:NortonAV
                  "15947:TCP"= 15947:TCP:*:Disabled:NortonAV
                  "16557:TCP"= 16557:TCP:*:Disabled:NortonAV
                  "13012:TCP"= 13012:TCP:*:Disabled:NortonAV
                  "17079:TCP"= 17079:TCP:*:Disabled:NortonAV
                  "15998:TCP"= 15998:TCP:NortonAV
                  "12782:TCP"= 12782:TCP:NortonAV
                  "13691:TCP"= 13691:TCP:NortonAV
                  "17185:TCP"= 17185:TCP:NortonAV
                  "18303:TCP"= 18303:TCP:NortonAV
                  "13886:TCP"= 13886:TCP:NortonAV
                  "18768:TCP"= 18768:TCP:NortonAV
                  "13280:TCP"= 13280:TCP:NortonAV
                  "13049:TCP"= 13049:TCP:NortonAV
                  "13036:TCP"= 13036:TCP:NortonAV
                  "16070:TCP"= 16070:TCP:NortonAV
                  "15645:TCP"= 15645:TCP:NortonAV
                  "13096:TCP"= 13096:TCP:NortonAV
                  "15807:TCP"= 15807:TCP:NortonAV
                  "18883:TCP"= 18883:TCP:NortonAV
                  "18411:TCP"= 18411:TCP:NortonAV
                  "18460:TCP"= 18460:TCP:NortonAV
                  "15251:TCP"= 15251:TCP:NortonAV
                  "17128:TCP"= 17128:TCP:NortonAV
                  "17464:TCP"= 17464:TCP:NortonAV
                  "13166:TCP"= 13166:TCP:NortonAV
                  "17577:TCP"= 17577:TCP:NortonAV
                  "17513:TCP"= 17513:TCP:NortonAV
                  "14801:TCP"= 14801:TCP:NortonAV
                  "13969:TCP"= 13969:TCP:NortonAV
                  "14359:TCP"= 14359:TCP:NortonAV
                  "15469:TCP"= 15469:TCP:NortonAV
                  "13935:TCP"= 13935:TCP:NortonAV
                  "12216:TCP"= 12216:TCP:NortonAV
                  "12967:TCP"= 12967:TCP:NortonAV
                  "12281:TCP"= 12281:TCP:NortonAV
                  "13653:TCP"= 13653:TCP:NortonAV
                  "15398:TCP"= 15398:TCP:NortonAV
                  "15254:TCP"= 15254:TCP:NortonAV
                  "18876:TCP"= 18876:TCP:NortonAV
                  "16724:TCP"= 16724:TCP:NortonAV
                  "15525:TCP"= 15525:TCP:NortonAV
                  "16309:TCP"= 16309:TCP:NortonAV
                  "13562:TCP"= 13562:TCP:NortonAV
                  "14124:TCP"= 14124:TCP:NortonAV
                  "15681:TCP"= 15681:TCP:NortonAV
                  "17870:TCP"= 17870:TCP:NortonAV
                  "18942:TCP"= 18942:TCP:NortonAV
                  "14336:TCP"= 14336:TCP:NortonAV
                  "17523:TCP"= 17523:TCP:NortonAV
                  "17504:TCP"= 17504:TCP:NortonAV
                  "18418:TCP"= 18418:TCP:NortonAV
                  "16717:TCP"= 16717:TCP:NortonAV
                  "15560:TCP"= 15560:TCP:NortonAV
                  "14927:TCP"= 14927:TCP:NortonAV
                  "16418:TCP"= 16418:TCP:NortonAV
                  "17512:TCP"= 17512:TCP:NortonAV
                  "16254:TCP"= 16254:TCP:NortonAV
                  "14156:TCP"= 14156:TCP:NortonAV
                  "17065:TCP"= 17065:TCP:NortonAV
                  "18743:TCP"= 18743:TCP:NortonAV
                  "17301:TCP"= 17301:TCP:NortonAV

                  S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2004-07-07 22272]
                  S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [ ]

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96cd8170-b4ab-11dc-a976-0012f01a97bf}]
                  \Shell\AutoRun\command - 3wcxx91.cmd
                  \Shell\explore\Command - 3wcxx91.cmd
                  \Shell\open\Command - 3wcxx91.cmd
                  .
                  Contenu du dossier 'Tâches planifiées'

                  2008-10-03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
                  - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 18:13]
                  .
                  .
                  ------- Examen supplémentaire -------
                  .
                  FireFox -: Profile - C:\Documents and Settings\Nadine Kmieczak\Application Data\Mozilla\Firefox\Profiles\l7jjd50n.default\
                  FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
                  .

                  **************************************************************************

                  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2008-10-14 18:09:48
                  Windows 5.1.2600 Service Pack 2 NTFS

                  Recherche de processus cachés ...

                  Recherche d'éléments en démarrage automatique cachés ...

                  Recherche de fichiers cachés ...

                  Scan terminé avec succès
                  Fichiers cachés: 0

                  **************************************************************************
                  .
                  Heure de fin: 2008-10-14 18:12:18
                  ComboFix-quarantined-files.txt 2008-10-14 16:12:12
                  ComboFix2.txt 2008-10-14 14:46:25

                  Avant-CF: 9 167 368 192 octets libres
                  Après-CF: 9,144,557,568 octets libres

                  257 --- E O F --- 2008-10-11 17:38:43

                  faut il comme il est ecrit sur le tutoriel installer une console de recuperation ? merci nad
                  0
                  1. jlpjlp Contributeur sécurité
                    il manque le début du rapport
                    0
                    1. nad
                      ComboFix 08-10-12.01 - Nadine Kmieczak 2008-10-15 18:15:02.3 - NTFSx86
                      Lancé depuis: C:\Documents and Settings\Nadine Kmieczak\Bureau\ComboFix.exe

                      [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
                      .

                      ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-15 au 2008-10-15 ))))))))))))))))))))))))))))))))))))
                      .

                      2008-10-14 00:06 . 2008-10-14 00:06 <REP> d-------- C:\Program Files\Trend Micro
                      2008-10-13 23:52 . 2008-10-13 23:52 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\.housecall6.6
                      2008-10-13 21:31 . 2008-10-13 21:31 <REP> d-------- C:\Program Files\CCleaner
                      2008-10-13 20:56 . 2008-10-13 21:33 <REP> d-------- C:\WINDOWS\SxsCaPendDel
                      2008-10-13 20:28 . 2008-10-13 21:31 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\Application Data\CCleanup
                      2008-10-13 19:00 . 2008-10-13 19:00 <REP> d-------- C:\Documents and Settings\LocalService\Bureau
                      2008-10-13 15:25 . 2008-10-15 17:41 3,021 --a------ C:\rollback.ini
                      2008-10-13 15:17 . 2008-10-13 15:17 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\Application Data\MailFrontier
                      2008-10-13 15:15 . 2008-10-15 18:20 3,594,784 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
                      2008-10-13 15:15 . 2008-10-15 02:30 48,332 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
                      2008-10-13 15:09 . 2008-10-13 20:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
                      2008-10-13 15:09 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
                      2008-10-13 15:09 . 2008-07-09 09:05 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
                      2008-10-13 15:09 . 2008-07-09 09:05 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
                      2008-10-13 15:09 . 2008-07-09 09:05 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
                      2008-10-13 15:09 . 2008-07-09 09:05 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
                      2008-10-13 15:09 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
                      2008-10-13 15:09 . 2008-10-15 17:32 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
                      2008-10-13 15:08 . 2008-10-13 15:08 <REP> d-------- C:\Program Files\Zone Labs
                      2008-10-13 13:13 . 2008-10-13 13:13 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                      2008-10-13 13:13 . 2008-10-13 13:13 <REP> d-------- C:\Documents and Settings\Nadine Kmieczak\Application Data\Malwarebytes
                      2008-10-13 13:13 . 2008-10-13 13:13 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                      2008-10-13 13:13 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                      2008-10-13 13:13 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                      2008-10-11 18:37 . 2008-10-15 01:22 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
                      2008-10-11 14:59 . 2008-10-13 13:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                      2008-10-11 14:59 . 2008-10-11 14:59 1,409 --a------ C:\WINDOWS\QTFont.for

                      .
                      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      2008-10-14 23:05 700,133 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
                      2008-10-14 16:01 17,094 ----a-w C:\Documents and Settings\Nadine Kmieczak\Application Data\wklnhst.dat
                      2008-10-13 19:32 --------- d-----w C:\Program Files\MSN Messenger
                      2008-09-27 14:25 --------- d-----w C:\Program Files\Resolume-2-2
                      2007-01-22 08:41 24,632 -c--a-w C:\Program Files\Fichiers communs\security
                      2006-07-03 08:11 793,126 -c--a-w C:\Program Files\Internet Explorer.rar
                      .

                      ((((((((((((((((((((((((((((( snapshot@2008-10-14_16.45.31,11 )))))))))))))))))))))))))))))))))))))))))
                      .
                      + 2008-10-14 23:24:45 10,508 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{31F80E72-1933-4F8D-89A6-7A85CF1B9A2D}.bin
                      - 2008-03-30 10:55:31 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
                      + 2008-10-14 15:16:48 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
                      - 2008-03-30 10:55:31 49,054 ----a-w C:\WINDOWS\system32\perfc00C.dat
                      + 2008-10-14 15:16:48 49,054 ----a-w C:\WINDOWS\system32\perfc00C.dat
                      - 2008-03-30 10:55:31 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
                      + 2008-10-14 15:16:48 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
                      - 2008-03-30 10:55:31 368,314 ----a-w C:\WINDOWS\system32\perfh00C.dat
                      + 2008-10-14 15:16:48 368,314 ----a-w C:\WINDOWS\system32\perfh00C.dat
                      - 2008-10-14 14:08:28 342,640 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat
                      + 2008-10-15 15:41:30 364,628 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat
                      .
                      ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      .
                      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                      REGEDIT4

                      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360]
                      "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-15 65536]

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [X]
                      "EPSON Stylus Photo RX420 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE" [2004-04-09 98304]
                      "EPSON Stylus Photo RX420 Series (Copie 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE" [2004-04-09 98304]
                      "Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2004-11-12 73728]
                      "THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2005-01-14 352256]
                      "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-15 98394]
                      "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-15 688218]
                      "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544]
                      "SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2004-12-21 118784]
                      "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 282624]
                      "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-11-17 1077327]
                      "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 221184]
                      "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2003-09-06 184320]
                      "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 217088]
                      "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 458752]
                      "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-03 122939]
                      "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-07 344064]
                      "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
                      "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
                      "TPSMain"="TPSMain.exe" [2005-01-21 C:\WINDOWS\system32\TPSMain.exe]
                      "TFncKy"="TFncKy.exe" [BU]
                      "NDSTray.exe"="NDSTray.exe" [BU]
                      "AGRSMMSG"="AGRSMMSG.exe" [2004-10-28 C:\WINDOWS\agrsmmsg.exe]
                      "atwtusb"="atwtusb.exe" [2005-09-21 C:\WINDOWS\system32\ATWTUSB.EXE]

                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]
                      "DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

                      C:\Documents and Settings\Nadine Kmieczak\Menu D‚marrer\Programmes\D‚marrage\
                      Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

                      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                      "msacm.l3acm"= l3codecp.acm
                      "VIDC.X264"= x264vfw.dll
                      "vidc.3IV2"= 3ivxVfWCodec.dll
                      "vidc.DIV3"= DivXc32.dll
                      "vidc.DIV4"= DivXc32f.dll
                      "msacm.divxa32"= DivXa32.acm

                      [HKLM\~\startupfolder\C:^Documents and Settings^Nadine Kmieczak^Menu Démarrer^Programmes^Démarrage^Outil de détection de support de Cyber-shot Viewer.lnk]
                      path=C:\Documents and Settings\Nadine Kmieczak\Menu Démarrer\Programmes\Démarrage\Outil de détection de support de Cyber-shot Viewer.lnk
                      backup=C:\WINDOWS\pss\Outil de détection de support de Cyber-shot Viewer.lnkStartup

                      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                      "AntiVirusOverride"=dword:00000001

                      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
                      "DisableMonitoring"=dword:00000001

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                      "EnableFirewall"= 0 (0x0)

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                      "%windir%\\system32\\sessmgr.exe"=
                      "C:\\Program Files\\Resolume-2-2\\resolume.exe"=
                      "C:\\Program Files\\aestesis\\elektronika live\\elektronika.exe"=
                      "C:\\Program Files\\Messenger\\msmsgs.exe"=
                      "C:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=
                      "C:\\Program Files\\eMule\\emule.exe"=
                      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                      "C:\\Program Files\\iTunes\\iTunes.exe"=

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                      "18376:TCP"= 18376:TCP:*:Disabled:NortonAV
                      "13086:TCP"= 13086:TCP:*:Disabled:NortonAV
                      "14270:TCP"= 14270:TCP:*:Disabled:NortonAV
                      "16759:TCP"= 16759:TCP:*:Disabled:NortonAV
                      "17559:TCP"= 17559:TCP:*:Disabled:NortonAV
                      "18067:TCP"= 18067:TCP:*:Disabled:NortonAV
                      "13888:TCP"= 13888:TCP:*:Disabled:NortonAV
                      "13153:TCP"= 13153:TCP:*:Disabled:NortonAV
                      "17959:TCP"= 17959:TCP:*:Disabled:NortonAV
                      "17511:TCP"= 17511:TCP:*:Disabled:NortonAV
                      "13709:TCP"= 13709:TCP:*:Disabled:NortonAV
                      "12279:TCP"= 12279:TCP:*:Disabled:NortonAV
                      "18611:TCP"= 18611:TCP:*:Disabled:NortonAV
                      "15177:TCP"= 15177:TCP:*:Disabled:NortonAV
                      "16112:TCP"= 16112:TCP:*:Disabled:NortonAV
                      "17110:TCP"= 17110:TCP:*:Disabled:NortonAV
                      "14146:TCP"= 14146:TCP:*:Disabled:NortonAV
                      "16718:TCP"= 16718:TCP:*:Disabled:NortonAV
                      "17789:TCP"= 17789:TCP:*:Disabled:NortonAV
                      "12879:TCP"= 12879:TCP:*:Disabled:NortonAV
                      "12966:TCP"= 12966:TCP:*:Disabled:NortonAV
                      "13696:TCP"= 13696:TCP:*:Disabled:NortonAV
                      "14178:TCP"= 14178:TCP:*:Disabled:NortonAV
                      "13285:TCP"= 13285:TCP:*:Disabled:NortonAV
                      "18156:TCP"= 18156:TCP:*:Disabled:NortonAV
                      "17566:TCP"= 17566:TCP:*:Disabled:NortonAV
                      "16727:TCP"= 16727:TCP:*:Disabled:NortonAV
                      "16158:TCP"= 16158:TCP:*:Disabled:NortonAV
                      "16364:TCP"= 16364:TCP:*:Disabled:NortonAV
                      "16675:TCP"= 16675:TCP:*:Disabled:NortonAV
                      "18592:TCP"= 18592:TCP:*:Disabled:NortonAV
                      "13599:TCP"= 13599:TCP:*:Disabled:NortonAV
                      "12143:TCP"= 12143:TCP:*:Disabled:NortonAV
                      "17725:TCP"= 17725:TCP:*:Disabled:NortonAV
                      "16730:TCP"= 16730:TCP:*:Disabled:NortonAV
                      "18049:TCP"= 18049:TCP:*:Disabled:NortonAV
                      "18918:TCP"= 18918:TCP:*:Disabled:NortonAV
                      "17886:TCP"= 17886:TCP:*:Disabled:NortonAV
                      "18825:TCP"= 18825:TCP:*:Disabled:NortonAV
                      "16884:TCP"= 16884:TCP:*:Disabled:NortonAV
                      "17743:TCP"= 17743:TCP:*:Disabled:NortonAV
                      "17711:TCP"= 17711:TCP:*:Disabled:NortonAV
                      "14693:TCP"= 14693:TCP:*:Disabled:NortonAV
                      "15947:TCP"= 15947:TCP:*:Disabled:NortonAV
                      "16557:TCP"= 16557:TCP:*:Disabled:NortonAV
                      "13012:TCP"= 13012:TCP:*:Disabled:NortonAV
                      "17079:TCP"= 17079:TCP:*:Disabled:NortonAV
                      "15998:TCP"= 15998:TCP:NortonAV
                      "12782:TCP"= 12782:TCP:NortonAV
                      "13691:TCP"= 13691:TCP:NortonAV
                      "17185:TCP"= 17185:TCP:NortonAV
                      "18303:TCP"= 18303:TCP:NortonAV
                      "13886:TCP"= 13886:TCP:NortonAV
                      "18768:TCP"= 18768:TCP:NortonAV
                      "13280:TCP"= 13280:TCP:NortonAV
                      "13049:TCP"= 13049:TCP:NortonAV
                      "13036:TCP"= 13036:TCP:NortonAV
                      "16070:TCP"= 16070:TCP:NortonAV
                      "15645:TCP"= 15645:TCP:NortonAV
                      "13096:TCP"= 13096:TCP:NortonAV
                      "15807:TCP"= 15807:TCP:NortonAV
                      "18883:TCP"= 18883:TCP:NortonAV
                      "18411:TCP"= 18411:TCP:NortonAV
                      "18460:TCP"= 18460:TCP:NortonAV
                      "15251:TCP"= 15251:TCP:NortonAV
                      "17128:TCP"= 17128:TCP:NortonAV
                      "17464:TCP"= 17464:TCP:NortonAV
                      "13166:TCP"= 13166:TCP:NortonAV
                      "17577:TCP"= 17577:TCP:NortonAV
                      "17513:TCP"= 17513:TCP:NortonAV
                      "14801:TCP"= 14801:TCP:NortonAV
                      "13969:TCP"= 13969:TCP:NortonAV
                      "14359:TCP"= 14359:TCP:NortonAV
                      "15469:TCP"= 15469:TCP:NortonAV
                      "13935:TCP"= 13935:TCP:NortonAV
                      "12216:TCP"= 12216:TCP:NortonAV
                      "12967:TCP"= 12967:TCP:NortonAV
                      "12281:TCP"= 12281:TCP:NortonAV
                      "13653:TCP"= 13653:TCP:NortonAV
                      "15398:TCP"= 15398:TCP:NortonAV
                      "15254:TCP"= 15254:TCP:NortonAV
                      "18876:TCP"= 18876:TCP:NortonAV
                      "16724:TCP"= 16724:TCP:NortonAV
                      "15525:TCP"= 15525:TCP:NortonAV
                      "16309:TCP"= 16309:TCP:NortonAV
                      "13562:TCP"= 13562:TCP:NortonAV
                      "14124:TCP"= 14124:TCP:NortonAV
                      "15681:TCP"= 15681:TCP:NortonAV
                      "17870:TCP"= 17870:TCP:NortonAV
                      "18942:TCP"= 18942:TCP:NortonAV
                      "14336:TCP"= 14336:TCP:NortonAV
                      "17523:TCP"= 17523:TCP:NortonAV
                      "17504:TCP"= 17504:TCP:NortonAV
                      "18418:TCP"= 18418:TCP:NortonAV
                      "16717:TCP"= 16717:TCP:NortonAV
                      "15560:TCP"= 15560:TCP:NortonAV
                      "14927:TCP"= 14927:TCP:NortonAV
                      "16418:TCP"= 16418:TCP:NortonAV
                      "17512:TCP"= 17512:TCP:NortonAV
                      "16254:TCP"= 16254:TCP:NortonAV
                      "14156:TCP"= 14156:TCP:NortonAV
                      "17065:TCP"= 17065:TCP:NortonAV
                      "18743:TCP"= 18743:TCP:NortonAV
                      "17301:TCP"= 17301:TCP:NortonAV

                      S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2004-07-07 22272]
                      S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [ ]

                      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96cd8170-b4ab-11dc-a976-0012f01a97bf}]
                      \Shell\AutoRun\command - 3wcxx91.cmd
                      \Shell\explore\Command - 3wcxx91.cmd
                      \Shell\open\Command - 3wcxx91.cmd
                      .
                      Contenu du dossier 'Tâches planifiées'

                      2008-10-03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
                      - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 18:13]
                      .
                      .
                      ------- Examen supplémentaire -------
                      .
                      FireFox -: Profile - C:\Documents and Settings\Nadine Kmieczak\Application Data\Mozilla\Firefox\Profiles\l7jjd50n.default\
                      FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
                      .

                      **************************************************************************

                      catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-10-15 18:19:51
                      Windows 5.1.2600 Service Pack 2 NTFS

                      Recherche de processus cachés ...

                      Recherche d'éléments en démarrage automatique cachés ...

                      Recherche de fichiers cachés ...

                      Scan terminé avec succès
                      Fichiers cachés: 0

                      **************************************************************************
                      .
                      Heure de fin: 2008-10-15 18:22:24
                      ComboFix-quarantined-files.txt 2008-10-15 16:22:15
                      ComboFix2.txt 2008-10-14 16:12:20
                      ComboFix3.txt 2008-10-14 14:46:25

                      Avant-CF: 8 837 681 152 octets libres
                      Après-CF: 8,813,125,632 octets libres

                      259 --- E O F --- 2008-10-11 17:38:43
                      merci
                      0
                      1. jlpjlp Contributeur sécurité
                        colle un scan en ligne avec un des deux:

                        bitdefender en ligne :
                        http://www.bitdefender.fr/scan_fr/scan8/ie.html

                        Panda en ligne :
                        http://pandasoftware.fr
                        0

                        Discussions similaires

                        league of legend impossible d'initialiser le dispositif d'affichage
                        pascontent

                        5 réponses
                        Facebook ne s'affiche plus correctement.
                        Twibault

                        36 réponses
                        Softonic,est-ce un virus ?
                        techmel1

                        6 réponses
                        Chrome://newtab
                        Nova

                        14 réponses
                        Désinstaller Softonic
                        Diguimette

                        5 réponses