Probleme serieux
koudoc
Messages postés
86
Statut
Membre
-
Utilisateur anonyme -
Utilisateur anonyme -
Bonjour,
j'ai un probleme avec mon avast il n'i a plus d'icone et je n'arive plus a faire des analise je veux le desinstalé mai je trouve pa le logiciel afain de pouvoir le desinstalé .
svp aidé moi car mon poste est sans anti virus
j'ai un probleme avec mon avast il n'i a plus d'icone et je n'arive plus a faire des analise je veux le desinstalé mai je trouve pa le logiciel afain de pouvoir le desinstalé .
svp aidé moi car mon poste est sans anti virus
49 réponses
--------------------\\ Lop S&D 4.2.4-9c XP/Vista
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Processeur Intel Pentium III )
BIOS : 686P2 v2.04
USER : christian koudo ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 080923-0] 4.8.1229 (Activated)
A:\ (USB)
C:\ (Local Disk) - FAT32 - Total:5 Go (Free:0 Go)
D:\ (CD or DVD)
F:\ (USB) - FAT32 - Total:494 Mo (Free:0 Go)
"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [2] ( 05/11/2008|14:43 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing des dossiers dans APPLIC~1
[14/08/2008|14:39] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[02/09/2008|19:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[18/08/2008|16:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apowersoft
[01/09/2008|08:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg7
[29/10/2008|07:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Babylon
[01/10/2008|16:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY
[11/09/2008|09:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DFX
[22/08/2008|15:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[21/08/2008|10:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
[04/09/2008|09:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
[25/10/2008|18:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ma-config.com
[26/08/2008|21:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MAGIX
[14/08/2008|14:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[29/08/2008|22:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PY_Software
[19/10/2008|09:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\RapidSolution
[22/08/2008|15:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SpeedBit
[22/08/2008|15:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[18/08/2008|16:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Tiger Install
[16/08/2008|13:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[24/08/2008|15:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[18/08/2008|13:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Winferno
[23/08/2008|10:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
[05/09/2008|19:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[14/08/2008|14:39] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[14/08/2008|14:39] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[16/08/2008|09:19] C:\DOCUME~1\CHRIST~1\APPLIC~1\Adobe
[19/08/2008|15:40] C:\DOCUME~1\CHRIST~1\APPLIC~1\Apple Computer
[29/10/2008|07:11] C:\DOCUME~1\CHRIST~1\APPLIC~1\Babylon
[17/08/2008|13:39] C:\DOCUME~1\CHRIST~1\APPLIC~1\Clickteam
[20/08/2008|15:11] C:\DOCUME~1\CHRIST~1\APPLIC~1\Clone Hunter
[23/08/2008|16:57] C:\DOCUME~1\CHRIST~1\APPLIC~1\DeepBurner
[18/08/2008|15:38] C:\DOCUME~1\CHRIST~1\APPLIC~1\FDRLab
[25/08/2008|16:03] C:\DOCUME~1\CHRIST~1\APPLIC~1\Gaijin Ent
[22/08/2008|15:47] C:\DOCUME~1\CHRIST~1\APPLIC~1\Google
[25/08/2008|15:13] C:\DOCUME~1\CHRIST~1\APPLIC~1\Help
[14/08/2008|17:24] C:\DOCUME~1\CHRIST~1\APPLIC~1\Identities
[16/08/2008|20:49] C:\DOCUME~1\CHRIST~1\APPLIC~1\LimeWire
[14/08/2008|18:45] C:\DOCUME~1\CHRIST~1\APPLIC~1\Macromedia
[26/08/2008|21:22] C:\DOCUME~1\CHRIST~1\APPLIC~1\MAGIX
[02/09/2008|17:48] C:\DOCUME~1\CHRIST~1\APPLIC~1\Media Player Classic
[14/08/2008|14:39] C:\DOCUME~1\CHRIST~1\APPLIC~1\Microsoft
[03/09/2008|08:46] C:\DOCUME~1\CHRIST~1\APPLIC~1\Mozilla
[18/08/2008|18:24] C:\DOCUME~1\CHRIST~1\APPLIC~1\Real
[21/09/2008|15:09] C:\DOCUME~1\CHRIST~1\APPLIC~1\SmartFTP
[18/09/2008|19:51] C:\DOCUME~1\CHRIST~1\APPLIC~1\Sun
[19/08/2008|18:33] C:\DOCUME~1\CHRIST~1\APPLIC~1\Talkback
[27/08/2008|14:23] C:\DOCUME~1\CHRIST~1\APPLIC~1\TeraCopy
[01/09/2008|17:20] C:\DOCUME~1\CHRIST~1\APPLIC~1\Todae
[29/09/2008|12:42] C:\DOCUME~1\CHRIST~1\APPLIC~1\Uniblue
[06/10/2008|13:40] C:\DOCUME~1\CHRIST~1\APPLIC~1\WinRAR
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[05/11/2008 07:46][--a------] C:\WINDOWS\tasks\SpeedOptimizer Startup.job
[05/11/2008 13:08][--ah-----] C:\WINDOWS\tasks\SA.DAT
[28/08/2001 18:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing des dossiers dans C:\Program Files
[23/10/2008|10:18] C:\Program Files\Adobe
[29/08/2008|22:49] C:\Program Files\AIMP2
[24/10/2008|21:19] C:\Program Files\Alawar
[14/08/2008|17:34] C:\Program Files\Alwil Software
[14/08/2008|14:40] C:\Program Files\Fichiers communs
[03/10/2008|17:46] C:\Program Files\InstallShield Installation Information
[14/08/2008|14:56] C:\Program Files\Internet Explorer
[18/09/2008|20:00] C:\Program Files\Java
[14/08/2008|19:03] C:\Program Files\LocobuxBCC
[14/08/2008|15:03] C:\Program Files\microsoft frontpage
[14/08/2008|14:56] C:\Program Files\Movie Maker
[14/08/2008|14:53] C:\Program Files\MSN Gaming Zone
[25/10/2008|20:19] C:\Program Files\MyWebSearch
[14/08/2008|14:56] C:\Program Files\NetMeeting
[14/08/2008|14:53] C:\Program Files\Online Services
[14/08/2008|14:56] C:\Program Files\Outlook Express
[20/08/2008|18:23] C:\Program Files\plugins
[14/08/2008|14:58] C:\Program Files\Services en ligne
[30/08/2008|11:23] C:\Program Files\SuperCopier2
[22/10/2008|08:16] C:\Program Files\Total Video Converter
[14/08/2008|17:24] C:\Program Files\Uninstall Information
[01/09/2008|17:07] C:\Program Files\Vista Start Menu
[14/08/2008|14:53] C:\Program Files\Windows Media Player
[14/08/2008|14:52] C:\Program Files\Windows NT
[14/08/2008|14:58] C:\Program Files\WindowsUpdate
[26/10/2008|13:05] C:\Program Files\WinRAR
[18/09/2008|19:42] C:\Program Files\WordBiz
[14/08/2008|15:03] C:\Program Files\xerox
[28/10/2008|08:53] C:\Program Files\Zelda Return of the Hylian
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[23/10/2008|10:18] C:\Program Files\Fichiers communs\Adobe
[27/10/2008|20:49] C:\Program Files\Fichiers communs\BOONTY Shared
[30/08/2008|10:45] C:\Program Files\Fichiers communs\Cisco Systems
[11/09/2008|09:57] C:\Program Files\Fichiers communs\DFX
[23/08/2008|08:50] C:\Program Files\Fichiers communs\InstallShield
[18/09/2008|19:59] C:\Program Files\Fichiers communs\Java
[24/10/2008|20:42] C:\Program Files\Fichiers communs\Logitech
[26/08/2008|21:20] C:\Program Files\Fichiers communs\MAGIX Shared
[14/08/2008|14:40] C:\Program Files\Fichiers communs\Microsoft Shared
[14/08/2008|14:56] C:\Program Files\Fichiers communs\MSSoap
[31/08/2008|13:53] C:\Program Files\Fichiers communs\ODBC
[03/10/2008|11:35] C:\Program Files\Fichiers communs\Real
[14/08/2008|14:56] C:\Program Files\Fichiers communs\Services
[14/08/2008|14:40] C:\Program Files\Fichiers communs\SpeechEngines
[14/08/2008|14:56] C:\Program Files\Fichiers communs\System
[05/09/2008|19:44] C:\Program Files\Fichiers communs\WindowsLiveInstaller
--------------------\\ Process
( 42 Processes )
... OK !
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-05 14:50:47
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
[F:1][D:0]-> C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp
[F:22][D:0]-> C:\DOCUME~1\CHRIST~1\Cookies
[F:1][D:0]-> C:\DOCUME~1\CHRIST~1\LOCALS~1\TEMPOR~1\content.IE5
[F:2][D:0]-> C:\Recycled
1 - "C:\Lop SD\LopR_1.txt" - 05/11/2008|14:02 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 05/11/2008|14:56 - Option : [2]
--------------------\\ Fin du rapport a 14:56:27
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Processeur Intel Pentium III )
BIOS : 686P2 v2.04
USER : christian koudo ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 080923-0] 4.8.1229 (Activated)
A:\ (USB)
C:\ (Local Disk) - FAT32 - Total:5 Go (Free:0 Go)
D:\ (CD or DVD)
F:\ (USB) - FAT32 - Total:494 Mo (Free:0 Go)
"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [2] ( 05/11/2008|14:43 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing des dossiers dans APPLIC~1
[14/08/2008|14:39] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[02/09/2008|19:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[18/08/2008|16:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apowersoft
[01/09/2008|08:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg7
[29/10/2008|07:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Babylon
[01/10/2008|16:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY
[11/09/2008|09:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DFX
[22/08/2008|15:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[21/08/2008|10:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
[04/09/2008|09:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
[25/10/2008|18:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ma-config.com
[26/08/2008|21:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MAGIX
[14/08/2008|14:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[29/08/2008|22:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PY_Software
[19/10/2008|09:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\RapidSolution
[22/08/2008|15:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SpeedBit
[22/08/2008|15:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[18/08/2008|16:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Tiger Install
[16/08/2008|13:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[24/08/2008|15:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[18/08/2008|13:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Winferno
[23/08/2008|10:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
[05/09/2008|19:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[14/08/2008|14:39] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[14/08/2008|14:39] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[16/08/2008|09:19] C:\DOCUME~1\CHRIST~1\APPLIC~1\Adobe
[19/08/2008|15:40] C:\DOCUME~1\CHRIST~1\APPLIC~1\Apple Computer
[29/10/2008|07:11] C:\DOCUME~1\CHRIST~1\APPLIC~1\Babylon
[17/08/2008|13:39] C:\DOCUME~1\CHRIST~1\APPLIC~1\Clickteam
[20/08/2008|15:11] C:\DOCUME~1\CHRIST~1\APPLIC~1\Clone Hunter
[23/08/2008|16:57] C:\DOCUME~1\CHRIST~1\APPLIC~1\DeepBurner
[18/08/2008|15:38] C:\DOCUME~1\CHRIST~1\APPLIC~1\FDRLab
[25/08/2008|16:03] C:\DOCUME~1\CHRIST~1\APPLIC~1\Gaijin Ent
[22/08/2008|15:47] C:\DOCUME~1\CHRIST~1\APPLIC~1\Google
[25/08/2008|15:13] C:\DOCUME~1\CHRIST~1\APPLIC~1\Help
[14/08/2008|17:24] C:\DOCUME~1\CHRIST~1\APPLIC~1\Identities
[16/08/2008|20:49] C:\DOCUME~1\CHRIST~1\APPLIC~1\LimeWire
[14/08/2008|18:45] C:\DOCUME~1\CHRIST~1\APPLIC~1\Macromedia
[26/08/2008|21:22] C:\DOCUME~1\CHRIST~1\APPLIC~1\MAGIX
[02/09/2008|17:48] C:\DOCUME~1\CHRIST~1\APPLIC~1\Media Player Classic
[14/08/2008|14:39] C:\DOCUME~1\CHRIST~1\APPLIC~1\Microsoft
[03/09/2008|08:46] C:\DOCUME~1\CHRIST~1\APPLIC~1\Mozilla
[18/08/2008|18:24] C:\DOCUME~1\CHRIST~1\APPLIC~1\Real
[21/09/2008|15:09] C:\DOCUME~1\CHRIST~1\APPLIC~1\SmartFTP
[18/09/2008|19:51] C:\DOCUME~1\CHRIST~1\APPLIC~1\Sun
[19/08/2008|18:33] C:\DOCUME~1\CHRIST~1\APPLIC~1\Talkback
[27/08/2008|14:23] C:\DOCUME~1\CHRIST~1\APPLIC~1\TeraCopy
[01/09/2008|17:20] C:\DOCUME~1\CHRIST~1\APPLIC~1\Todae
[29/09/2008|12:42] C:\DOCUME~1\CHRIST~1\APPLIC~1\Uniblue
[06/10/2008|13:40] C:\DOCUME~1\CHRIST~1\APPLIC~1\WinRAR
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[05/11/2008 07:46][--a------] C:\WINDOWS\tasks\SpeedOptimizer Startup.job
[05/11/2008 13:08][--ah-----] C:\WINDOWS\tasks\SA.DAT
[28/08/2001 18:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing des dossiers dans C:\Program Files
[23/10/2008|10:18] C:\Program Files\Adobe
[29/08/2008|22:49] C:\Program Files\AIMP2
[24/10/2008|21:19] C:\Program Files\Alawar
[14/08/2008|17:34] C:\Program Files\Alwil Software
[14/08/2008|14:40] C:\Program Files\Fichiers communs
[03/10/2008|17:46] C:\Program Files\InstallShield Installation Information
[14/08/2008|14:56] C:\Program Files\Internet Explorer
[18/09/2008|20:00] C:\Program Files\Java
[14/08/2008|19:03] C:\Program Files\LocobuxBCC
[14/08/2008|15:03] C:\Program Files\microsoft frontpage
[14/08/2008|14:56] C:\Program Files\Movie Maker
[14/08/2008|14:53] C:\Program Files\MSN Gaming Zone
[25/10/2008|20:19] C:\Program Files\MyWebSearch
[14/08/2008|14:56] C:\Program Files\NetMeeting
[14/08/2008|14:53] C:\Program Files\Online Services
[14/08/2008|14:56] C:\Program Files\Outlook Express
[20/08/2008|18:23] C:\Program Files\plugins
[14/08/2008|14:58] C:\Program Files\Services en ligne
[30/08/2008|11:23] C:\Program Files\SuperCopier2
[22/10/2008|08:16] C:\Program Files\Total Video Converter
[14/08/2008|17:24] C:\Program Files\Uninstall Information
[01/09/2008|17:07] C:\Program Files\Vista Start Menu
[14/08/2008|14:53] C:\Program Files\Windows Media Player
[14/08/2008|14:52] C:\Program Files\Windows NT
[14/08/2008|14:58] C:\Program Files\WindowsUpdate
[26/10/2008|13:05] C:\Program Files\WinRAR
[18/09/2008|19:42] C:\Program Files\WordBiz
[14/08/2008|15:03] C:\Program Files\xerox
[28/10/2008|08:53] C:\Program Files\Zelda Return of the Hylian
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[23/10/2008|10:18] C:\Program Files\Fichiers communs\Adobe
[27/10/2008|20:49] C:\Program Files\Fichiers communs\BOONTY Shared
[30/08/2008|10:45] C:\Program Files\Fichiers communs\Cisco Systems
[11/09/2008|09:57] C:\Program Files\Fichiers communs\DFX
[23/08/2008|08:50] C:\Program Files\Fichiers communs\InstallShield
[18/09/2008|19:59] C:\Program Files\Fichiers communs\Java
[24/10/2008|20:42] C:\Program Files\Fichiers communs\Logitech
[26/08/2008|21:20] C:\Program Files\Fichiers communs\MAGIX Shared
[14/08/2008|14:40] C:\Program Files\Fichiers communs\Microsoft Shared
[14/08/2008|14:56] C:\Program Files\Fichiers communs\MSSoap
[31/08/2008|13:53] C:\Program Files\Fichiers communs\ODBC
[03/10/2008|11:35] C:\Program Files\Fichiers communs\Real
[14/08/2008|14:56] C:\Program Files\Fichiers communs\Services
[14/08/2008|14:40] C:\Program Files\Fichiers communs\SpeechEngines
[14/08/2008|14:56] C:\Program Files\Fichiers communs\System
[05/09/2008|19:44] C:\Program Files\Fichiers communs\WindowsLiveInstaller
--------------------\\ Process
( 42 Processes )
... OK !
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-05 14:50:47
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
[F:1][D:0]-> C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp
[F:22][D:0]-> C:\DOCUME~1\CHRIST~1\Cookies
[F:1][D:0]-> C:\DOCUME~1\CHRIST~1\LOCALS~1\TEMPOR~1\content.IE5
[F:2][D:0]-> C:\Recycled
1 - "C:\Lop SD\LopR_1.txt" - 05/11/2008|14:02 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 05/11/2008|14:56 - Option : [2]
--------------------\\ Fin du rapport a 14:56:27
Salut,
Pour avancer::::
Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...
Fais exactement ce qui suit :
Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide :
--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation (si jamais tu en as et que je ne les ai pas vu sur le rapport hijackthis....)
---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...
Tuto ici : TUTO
---------------------------------------------------------------------------------------------------------------------------------
Ensuite :
Double-clique sur C-Fix.exe (= combofix.exe ) .
Appuie sur une touche pour démarrer le scan .
Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer
Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp
Pour avancer::::
Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...
Fais exactement ce qui suit :
Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide :
--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation (si jamais tu en as et que je ne les ai pas vu sur le rapport hijackthis....)
---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...
Tuto ici : TUTO
---------------------------------------------------------------------------------------------------------------------------------
Ensuite :
Double-clique sur C-Fix.exe (= combofix.exe ) .
Appuie sur une touche pour démarrer le scan .
Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer
Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp
ComboFix 08-11-04.02 - christian koudo 2008-11-05 16:10:37.1 - [color=red][b]FAT32/b/colorx86
Lancé depuis: c:\liberkey\Apps\Firefox\App\firefox\ComboFix.exe
.
[color=purple]Les fichiers ci-dessous ont été désactivés pendant l'exécution:/color
c:\program files\SuperCopier2\SC2Hook.dll
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\[u]0/u8dgu.com
C:\[u]0/uu.cmd
C:\9.cmd
C:\Autorun.inf
C:\b0j6j16.bat
C:\bo1dhu.bat
C:\ev60a2.cmd
C:\fe.bat
C:\itsduel.exe
C:\n6t1h.cmd
C:\nfdmg.com
C:\otyh.cmd
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
C:\vva0hc0p.cmd
c:\windows\system32\Cache
c:\windows\system32\ckvo.exe
c:\windows\system32\ckvo0.dll
c:\windows\system32\ckvo1.dll
c:\windows\system32\InM64proc32.dll
c:\windows\system32\OutM64proc32.dll
c:\windows\system32\skinboxer43.dll
C:\wjlfhtfm.cmd
C:\xih9.cmd
C:\yew.bat
F:\autorun.inf
F:\xih9.cmd
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_BOONTY_GAMES
-------\Legacy_FREEZESCREENSAVER
-------\Service_Boonty Games
-------\Service_FreezeScreenSaver
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-05 au 2008-11-05 ))))))))))))))))))))))))))))))))))))
.
2008-11-05 15:28 . 2008-10-30 06:04 <REP> d-------- C:\32788R22FWJFW
2008-11-05 15:07 . 2008-11-05 15:07 <REP> d-------- c:\program files\DAP
2008-11-05 13:55 . 2008-11-05 13:55 <REP> d-------- C:\Lop SD
2008-11-05 10:30 . 2008-11-05 10:30 <REP> d--hs---- C:\FOUND.031
2008-11-05 07:25 . 2008-11-05 07:25 <REP> d--hs---- C:\FOUND.030
2008-11-05 06:38 . 2008-11-05 06:38 <REP> d--hs---- C:\FOUND.029
2008-11-05 06:26 . 2008-11-05 06:26 <REP> d--hs---- C:\FOUND.028
2008-11-04 07:30 . 2008-11-04 07:30 <REP> d--hs---- C:\FOUND.027
2008-11-03 08:34 . 2008-11-03 08:34 <REP> d--hs---- C:\FOUND.026
2008-11-02 22:40 . 2008-11-02 22:40 <REP> d--hs---- C:\FOUND.025
2008-11-02 06:25 . 2008-11-02 06:25 <REP> d--hs---- C:\FOUND.024
2008-10-31 13:09 . 2008-10-31 13:09 <REP> d-------- c:\windows\Downloaded Installations
2008-10-31 07:43 . 2008-10-31 07:43 <REP> d--hs---- C:\FOUND.023
2008-10-30 17:37 . 1998-10-29 16:45 306,688 --a------ c:\windows\IsUninst.exe
2008-10-29 21:45 . 2008-10-29 21:45 74,425 --a------ c:\program files\Uninstal.exe
2008-10-29 07:34 . 2008-10-29 07:34 <REP> d--hs---- C:\FOUND.022
2008-10-29 07:11 . 2008-10-29 07:11 <REP> d-------- c:\documents and settings\christian koudo\Application Data\Babylon
2008-10-29 07:11 . 2008-10-29 07:11 <REP> d-------- c:\documents and settings\All Users\Application Data\Babylon
2008-10-28 12:08 . 2008-10-28 12:08 <REP> d--hs---- C:\FOUND.021
2008-10-28 08:53 . 2008-10-28 08:53 <REP> d-------- c:\program files\Zelda Return of the Hylian
2008-10-28 08:29 . 2008-10-28 08:29 <REP> d--hs---- C:\FOUND.020
2008-10-27 20:49 . 2008-10-27 20:49 <REP> d-------- c:\program files\Fichiers communs\BOONTY Shared
2008-10-27 15:55 . 2001-08-23 17:03 320,384 --a------ c:\windows\system32\drivers\mgaum.sys
2008-10-27 15:55 . 2001-08-23 17:03 320,384 --a------ c:\windows\system32\dllcache\mgaum.sys
2008-10-27 15:55 . 2001-08-17 20:50 103,296 --a------ c:\windows\system32\drivers\mtxvideo.sys
2008-10-27 15:55 . 2001-08-17 20:50 103,296 --a------ c:\windows\system32\dllcache\mtxvideo.sys
2008-10-26 17:36 . 2008-10-26 17:36 <REP> d--hs---- C:\FOUND.019
2008-10-26 05:08 . 2008-10-26 05:08 <REP> d--hs---- C:\FOUND.018
2008-10-25 18:09 . 2008-10-25 18:09 <REP> d-------- c:\documents and settings\All Users\Application Data\ma-config.com
2008-10-25 17:34 . 2008-10-25 17:35 161 --a------ c:\windows\MyDrivers.ini
2008-10-25 16:28 . 2008-11-04 11:56 8,224 --a------ c:\windows\system32\GDIPFONTCACHEV1.DAT
2008-10-25 16:12 . 2008-10-25 16:12 244 --ah----- C:\sqmnoopt01.sqm
2008-10-25 16:12 . 2008-10-25 16:12 232 --ah----- C:\sqmdata01.sqm
2008-10-25 16:12 . 2008-10-25 16:12 172 --ah----- C:\sqmnoopt02.sqm
2008-10-25 16:12 . 2008-10-25 16:12 172 --ah----- C:\sqmdata02.sqm
2008-10-25 13:50 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2008-10-25 09:32 . 2008-10-25 09:32 <REP> d--hs---- C:\FOUND.017
2008-10-24 21:19 . 2008-10-24 21:19 <REP> d-------- c:\program files\Alawar
2008-10-24 20:42 . 2008-10-24 20:42 <REP> d-------- c:\program files\Fichiers communs\Logitech
2008-10-24 17:34 . 2008-10-24 17:34 <REP> d-------- c:\windows\Sun
2008-10-24 14:52 . 2008-10-24 14:52 <REP> d--hs---- C:\FOUND.016
2008-10-23 10:18 . 2008-10-23 10:18 <REP> d-------- c:\program files\Fichiers communs\Adobe
2008-10-23 06:54 . 2008-10-23 06:54 <REP> d--hs---- C:\FOUND.015
2008-10-22 12:12 . 2006-03-07 19:55 244,264 --a------ c:\windows\unicows.dll
2008-10-22 08:16 . 2008-10-22 08:16 <REP> d-------- c:\program files\Total Video Converter
2008-10-22 06:39 . 2008-10-22 17:05 104,123 -r-hs---- C:\xlk9.com
2008-10-21 06:12 . 2008-10-21 07:20 105,553 -r-hs---- C:\2fiji.com
2008-10-21 06:10 . 2008-10-21 06:10 <REP> d--hs---- C:\FOUND.014
2008-10-19 12:05 . 1998-04-24 00:00 368,912 --a------ c:\windows\system32\vbar332.dll
2008-10-19 12:05 . 2005-02-28 08:32 24,576 --a------ c:\windows\system32\IdleTrac1.dll
2008-10-19 11:11 . 2008-10-19 11:11 479,298 --a------ c:\windows\system32\wbocx.ocx
2008-10-19 11:11 . 2008-10-19 11:11 172,032 --a------ c:\windows\system32\AniGIF.ocx
2008-10-19 11:11 . 2008-10-19 11:11 50,688 --a------ c:\windows\system32\wbhelp2.dll
2008-10-19 10:37 . 1997-07-19 17:00 604,432 --a------ c:\windows\system32\COMCTL32.OCX
2008-10-19 10:37 . 1998-03-13 11:06 389,120 --a------ c:\windows\system32\Atx32.ocx
2008-10-19 10:37 . 1997-03-21 10:51 346,112 --a------ c:\windows\system32\ppro100.dll
2008-10-19 10:37 . 1997-03-21 15:05 154,528 --a------ c:\windows\system32\ppro100.ocx
2008-10-19 10:37 . 1997-10-24 16:19 78,336 --a------ c:\windows\system32\atx32pic.dll
2008-10-19 10:35 . 1998-03-04 21:32 237,568 --a------ c:\windows\system32\CompPl32.dll
2008-10-19 10:35 . 2005-11-13 16:45 128,512 --a------ c:\windows\system32\iwpsetup.exe
2008-10-19 10:35 . 1997-11-05 20:03 90,624 --a------ c:\windows\system32\CPWCTL32.OCX
2008-10-19 10:35 . 1997-01-16 00:00 29,696 --a------ c:\windows\system32\VB5STKIT.DLL
2008-10-19 10:35 . 1997-01-16 13:42 6,114 --a------ c:\windows\system32\SHELLLNK.TLB
2008-10-19 09:33 . 2008-10-19 09:33 <REP> d-------- c:\documents and settings\All Users\Application Data\RapidSolution
2008-10-19 08:34 . 2008-10-19 08:34 <REP> d-------- c:\documents and settings\christian koudo\WINDOWS
2008-10-19 08:34 . 1998-11-13 11:16 308,224 --a------ c:\windows\IsUn040c.exe
2008-10-12 06:23 . 2008-10-12 06:23 <REP> d--hs---- C:\FOUND.013
2008-10-10 16:24 . 2004-08-19 16:09 159,232 --a------ c:\windows\system32\ptpusd.dll
2008-10-10 16:24 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2008-10-10 16:24 . 2001-08-23 17:47 5,632 --a------ c:\windows\system32\ptpusb.dll
2008-10-06 14:16 . 2008-10-06 14:16 <REP> d-------- c:\documents and settings\christian koudo\amsn
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-03 16:46 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-03 10:35 --------- d-----w c:\program files\Fichiers communs\Real
2008-10-01 15:43 --------- d-----w c:\documents and settings\All Users\Application Data\BOONTY
2008-09-29 11:42 --------- d-----w c:\documents and settings\christian koudo\Application Data\Uniblue
2008-09-21 14:09 --------- d-----w c:\documents and settings\christian koudo\Application Data\SmartFTP
2008-09-18 19:00 --------- d-----w c:\program files\Java
2008-09-18 18:59 --------- d-----w c:\program files\Fichiers communs\Java
2008-09-18 18:42 --------- d-----w c:\program files\WordBiz
2008-09-11 08:57 --------- d-----w c:\program files\Fichiers communs\DFX
2008-09-11 08:57 --------- d-----w c:\documents and settings\All Users\Application Data\DFX
2008-09-05 18:44 --------- d-sh--w c:\program files\Fichiers communs\WindowsLiveInstaller
2008-09-05 18:33 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2004-07-22 09:51 3,432,656 ----a-w c:\program files\ManagedDX.CAB
2004-07-19 21:58 1,156,363 ----a-w c:\program files\BDANT.cab
2004-07-19 21:53 976,020 ----a-w c:\program files\BDAXP.cab
2004-07-16 13:30 3,858 ----a-w c:\program files\directx redist.txt
2004-07-09 13:17 13,265,040 ----a-w c:\program files\dxnt.cab
2004-07-09 08:13 703,080 ----a-w c:\program files\BDA.cab
2004-07-09 08:13 15,493,481 ----a-w c:\program files\DirectX.cab
2004-07-09 03:08 472,576 ----a-w c:\program files\dxsetup.exe
2004-07-09 03:08 2,242,560 ----a-w c:\program files\dsetup32.dll
2004-07-09 02:03 62,976 ----a-w c:\program files\DSETUP.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{F4F10C1D-87C7-404A-B4B3-000000000000}"= "c:\progra~1\DAP\SBSearch.dll" [2008-11-05 38384]
[HKEY_CLASSES_ROOT\clsid\{f4f10c1d-87c7-404a-b4b3-000000000000}]
[HKEY_CLASSES_ROOT\SearchHook.SrchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{95EFB171-F3DF-4BEC-9EF7-829A800203E6}]
[HKEY_CLASSES_ROOT\SearchHook.SrchHook]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2005-03-14 1057280]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"DownloadAccelerator"="c:\program files\DAP\DAP.EXE" [2008-11-05 3061248]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 83608]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeStartMenu"= 1 (0x1)
"NoLogOff"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"1"= cmd.exe
"2"= mmc.exe
"3"= rstrui.exe
"4"= regedit.exe
"5"= regedt32.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\System32\\mqsvc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5999:UDP"= 5999:UDP:MaxiVista Server
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 AVWEBCAM;AV WebCam, WDM Video Capture;c:\windows\system32\DRIVERS\avwebcam.sys [2008-01-11 13696]
R3 mgau;mgau;c:\windows\system32\DRIVERS\mgaum.sys [2001-08-23 320384]
S2 BT848;Conexant's BtPCI WDM Video Capture;c:\windows\system32\DRIVERS\BT848.sys [2008-08-30 371349]
S2 MtxVideo;Pilote de distribution/capture WDM Matrox;c:\windows\system32\DRIVERS\MtxVideo.sys [2001-08-17 103296]
S3 maxidemo;Maxi_Vista_Demo_Driver;c:\windows\system32\DRIVERS\maxidemo.sys [ ]
S3 s3m;s3m;c:\windows\system32\DRIVERS\s3m.sys [2001-08-17 166720]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - C:\xih9.cmd
\Shell\explore\Command - C:\xih9.cmd
\Shell\open\Command - C:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{07b39626-8c63-11dd-a253-0002a5551647}]
\Shell\AutoRun\command - E:\b0j6j16.bat
\Shell\explore\Command - E:\b0j6j16.bat
\Shell\open\Command - E:\b0j6j16.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{255d9e7e-92c1-11dd-a265-0002a5551647}]
\Shell\AutoRun\command - E:\vva0hc0p.cmd
\Shell\explore\Command - E:\vva0hc0p.cmd
\Shell\open\Command - E:\vva0hc0p.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4102d060-a8ea-11dd-a2b2-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{44553f67-8d40-11dd-a255-0002a5551647}]
\Shell\AutoRun\command - xlk9.com
\Shell\explore\Command - xlk9.com
\Shell\open\Command - xlk9.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48570954-9e7b-11dd-a27d-0002a5551647}]
\Shell\AutoRun\command - E:\2fiji.com
\Shell\explore\Command - E:\2fiji.com
\Shell\open\Command - E:\2fiji.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{553941d8-a0d2-11dd-a285-0002a5551647}]
\Shell\AutoRun\command - F:\xlk9.com
\Shell\explore\Command - F:\xlk9.com
\Shell\open\Command - F:\xlk9.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5ba64ae9-6aa9-11dd-aca2-0002a5551647}]
\Shell\AutoRun\command - E:\t1ypkh.exe
\Shell\explore\Command - E:\t1ypkh.exe
\Shell\open\Command - E:\t1ypkh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6a5d332f-6cfe-11dd-aca8-0002a5551647}]
\Shell\AutoRun\command - G:\yew.bat
\Shell\explore\Command - G:\yew.bat
\Shell\open\Command - G:\yew.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97870ca4-9f72-11dd-a281-0002a5551647}]
\Shell\AutoRun\command - E:\2fiji.com
\Shell\explore\Command - E:\2fiji.com
\Shell\open\Command - E:\2fiji.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a427c054-ab12-11dd-a2c4-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae1ae3b6-a91e-11dd-a2b4-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af035ebc-a67a-11dd-a2a9-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd4544c2-a021-11dd-a282-0002a5551647}]
\Shell\AutoRun\command - E:\xlk9.com
\Shell\explore\Command - E:\xlk9.com
\Shell\open\Command - E:\xlk9.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ccfc65d6-a502-11dd-a2a2-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d0d52206-aa7a-11dd-a2bf-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db03bfa6-84a7-11dd-a23e-0002a5551647}]
\shell\Setup\command - setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e3534192-976f-11dd-a270-0002a5551647}]
\Shell\AutoRun\command - E:\9.cmd
\Shell\explore\Command - E:\9.cmd
\Shell\open\Command - E:\9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc97845c-a196-11dd-a287-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
.
Contenu du dossier 'Tâches planifiées'
2008-11-05 c:\windows\Tasks\SpeedOptimizer Startup.job
- c:\progra~1\speedo~1\SPO.exe []
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-Horloge Parlante ZMSoft - c:\documents and settings\christian koudo\Bureau\HParlante.exe
.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\christian koudo\Application Data\Mozilla\Firefox\Profiles\wacl0acy.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-05 16:24:05
Windows 5.1.2600 Service Pack 2 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ASFWHide]
"ImagePath"="\??\c:\docume~1\CHRIST~1\LOCALS~1\Temp\ASFWHide"
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mchInjDrv]
"ImagePath"="\??\c:\docume~1\CHRIST~1\LOCALS~1\Temp\mc22.tmp"
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE
c:\program files\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
c:\windows\system32\msdtc.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\windows\System32\snmp.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\mqsvc.exe
c:\windows\system32\mqtgsvc.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Heure de fin: 2008-11-05 16:41:01 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-05 15:40:28
Avant-CF: 735 068 160 octets libres
Après-CF: 669,843,456 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
319 --- E O F --- 2008-09-11 04:43:01
Lancé depuis: c:\liberkey\Apps\Firefox\App\firefox\ComboFix.exe
.
[color=purple]Les fichiers ci-dessous ont été désactivés pendant l'exécution:/color
c:\program files\SuperCopier2\SC2Hook.dll
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\[u]0/u8dgu.com
C:\[u]0/uu.cmd
C:\9.cmd
C:\Autorun.inf
C:\b0j6j16.bat
C:\bo1dhu.bat
C:\ev60a2.cmd
C:\fe.bat
C:\itsduel.exe
C:\n6t1h.cmd
C:\nfdmg.com
C:\otyh.cmd
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
C:\vva0hc0p.cmd
c:\windows\system32\Cache
c:\windows\system32\ckvo.exe
c:\windows\system32\ckvo0.dll
c:\windows\system32\ckvo1.dll
c:\windows\system32\InM64proc32.dll
c:\windows\system32\OutM64proc32.dll
c:\windows\system32\skinboxer43.dll
C:\wjlfhtfm.cmd
C:\xih9.cmd
C:\yew.bat
F:\autorun.inf
F:\xih9.cmd
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_BOONTY_GAMES
-------\Legacy_FREEZESCREENSAVER
-------\Service_Boonty Games
-------\Service_FreezeScreenSaver
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-05 au 2008-11-05 ))))))))))))))))))))))))))))))))))))
.
2008-11-05 15:28 . 2008-10-30 06:04 <REP> d-------- C:\32788R22FWJFW
2008-11-05 15:07 . 2008-11-05 15:07 <REP> d-------- c:\program files\DAP
2008-11-05 13:55 . 2008-11-05 13:55 <REP> d-------- C:\Lop SD
2008-11-05 10:30 . 2008-11-05 10:30 <REP> d--hs---- C:\FOUND.031
2008-11-05 07:25 . 2008-11-05 07:25 <REP> d--hs---- C:\FOUND.030
2008-11-05 06:38 . 2008-11-05 06:38 <REP> d--hs---- C:\FOUND.029
2008-11-05 06:26 . 2008-11-05 06:26 <REP> d--hs---- C:\FOUND.028
2008-11-04 07:30 . 2008-11-04 07:30 <REP> d--hs---- C:\FOUND.027
2008-11-03 08:34 . 2008-11-03 08:34 <REP> d--hs---- C:\FOUND.026
2008-11-02 22:40 . 2008-11-02 22:40 <REP> d--hs---- C:\FOUND.025
2008-11-02 06:25 . 2008-11-02 06:25 <REP> d--hs---- C:\FOUND.024
2008-10-31 13:09 . 2008-10-31 13:09 <REP> d-------- c:\windows\Downloaded Installations
2008-10-31 07:43 . 2008-10-31 07:43 <REP> d--hs---- C:\FOUND.023
2008-10-30 17:37 . 1998-10-29 16:45 306,688 --a------ c:\windows\IsUninst.exe
2008-10-29 21:45 . 2008-10-29 21:45 74,425 --a------ c:\program files\Uninstal.exe
2008-10-29 07:34 . 2008-10-29 07:34 <REP> d--hs---- C:\FOUND.022
2008-10-29 07:11 . 2008-10-29 07:11 <REP> d-------- c:\documents and settings\christian koudo\Application Data\Babylon
2008-10-29 07:11 . 2008-10-29 07:11 <REP> d-------- c:\documents and settings\All Users\Application Data\Babylon
2008-10-28 12:08 . 2008-10-28 12:08 <REP> d--hs---- C:\FOUND.021
2008-10-28 08:53 . 2008-10-28 08:53 <REP> d-------- c:\program files\Zelda Return of the Hylian
2008-10-28 08:29 . 2008-10-28 08:29 <REP> d--hs---- C:\FOUND.020
2008-10-27 20:49 . 2008-10-27 20:49 <REP> d-------- c:\program files\Fichiers communs\BOONTY Shared
2008-10-27 15:55 . 2001-08-23 17:03 320,384 --a------ c:\windows\system32\drivers\mgaum.sys
2008-10-27 15:55 . 2001-08-23 17:03 320,384 --a------ c:\windows\system32\dllcache\mgaum.sys
2008-10-27 15:55 . 2001-08-17 20:50 103,296 --a------ c:\windows\system32\drivers\mtxvideo.sys
2008-10-27 15:55 . 2001-08-17 20:50 103,296 --a------ c:\windows\system32\dllcache\mtxvideo.sys
2008-10-26 17:36 . 2008-10-26 17:36 <REP> d--hs---- C:\FOUND.019
2008-10-26 05:08 . 2008-10-26 05:08 <REP> d--hs---- C:\FOUND.018
2008-10-25 18:09 . 2008-10-25 18:09 <REP> d-------- c:\documents and settings\All Users\Application Data\ma-config.com
2008-10-25 17:34 . 2008-10-25 17:35 161 --a------ c:\windows\MyDrivers.ini
2008-10-25 16:28 . 2008-11-04 11:56 8,224 --a------ c:\windows\system32\GDIPFONTCACHEV1.DAT
2008-10-25 16:12 . 2008-10-25 16:12 244 --ah----- C:\sqmnoopt01.sqm
2008-10-25 16:12 . 2008-10-25 16:12 232 --ah----- C:\sqmdata01.sqm
2008-10-25 16:12 . 2008-10-25 16:12 172 --ah----- C:\sqmnoopt02.sqm
2008-10-25 16:12 . 2008-10-25 16:12 172 --ah----- C:\sqmdata02.sqm
2008-10-25 13:50 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2008-10-25 09:32 . 2008-10-25 09:32 <REP> d--hs---- C:\FOUND.017
2008-10-24 21:19 . 2008-10-24 21:19 <REP> d-------- c:\program files\Alawar
2008-10-24 20:42 . 2008-10-24 20:42 <REP> d-------- c:\program files\Fichiers communs\Logitech
2008-10-24 17:34 . 2008-10-24 17:34 <REP> d-------- c:\windows\Sun
2008-10-24 14:52 . 2008-10-24 14:52 <REP> d--hs---- C:\FOUND.016
2008-10-23 10:18 . 2008-10-23 10:18 <REP> d-------- c:\program files\Fichiers communs\Adobe
2008-10-23 06:54 . 2008-10-23 06:54 <REP> d--hs---- C:\FOUND.015
2008-10-22 12:12 . 2006-03-07 19:55 244,264 --a------ c:\windows\unicows.dll
2008-10-22 08:16 . 2008-10-22 08:16 <REP> d-------- c:\program files\Total Video Converter
2008-10-22 06:39 . 2008-10-22 17:05 104,123 -r-hs---- C:\xlk9.com
2008-10-21 06:12 . 2008-10-21 07:20 105,553 -r-hs---- C:\2fiji.com
2008-10-21 06:10 . 2008-10-21 06:10 <REP> d--hs---- C:\FOUND.014
2008-10-19 12:05 . 1998-04-24 00:00 368,912 --a------ c:\windows\system32\vbar332.dll
2008-10-19 12:05 . 2005-02-28 08:32 24,576 --a------ c:\windows\system32\IdleTrac1.dll
2008-10-19 11:11 . 2008-10-19 11:11 479,298 --a------ c:\windows\system32\wbocx.ocx
2008-10-19 11:11 . 2008-10-19 11:11 172,032 --a------ c:\windows\system32\AniGIF.ocx
2008-10-19 11:11 . 2008-10-19 11:11 50,688 --a------ c:\windows\system32\wbhelp2.dll
2008-10-19 10:37 . 1997-07-19 17:00 604,432 --a------ c:\windows\system32\COMCTL32.OCX
2008-10-19 10:37 . 1998-03-13 11:06 389,120 --a------ c:\windows\system32\Atx32.ocx
2008-10-19 10:37 . 1997-03-21 10:51 346,112 --a------ c:\windows\system32\ppro100.dll
2008-10-19 10:37 . 1997-03-21 15:05 154,528 --a------ c:\windows\system32\ppro100.ocx
2008-10-19 10:37 . 1997-10-24 16:19 78,336 --a------ c:\windows\system32\atx32pic.dll
2008-10-19 10:35 . 1998-03-04 21:32 237,568 --a------ c:\windows\system32\CompPl32.dll
2008-10-19 10:35 . 2005-11-13 16:45 128,512 --a------ c:\windows\system32\iwpsetup.exe
2008-10-19 10:35 . 1997-11-05 20:03 90,624 --a------ c:\windows\system32\CPWCTL32.OCX
2008-10-19 10:35 . 1997-01-16 00:00 29,696 --a------ c:\windows\system32\VB5STKIT.DLL
2008-10-19 10:35 . 1997-01-16 13:42 6,114 --a------ c:\windows\system32\SHELLLNK.TLB
2008-10-19 09:33 . 2008-10-19 09:33 <REP> d-------- c:\documents and settings\All Users\Application Data\RapidSolution
2008-10-19 08:34 . 2008-10-19 08:34 <REP> d-------- c:\documents and settings\christian koudo\WINDOWS
2008-10-19 08:34 . 1998-11-13 11:16 308,224 --a------ c:\windows\IsUn040c.exe
2008-10-12 06:23 . 2008-10-12 06:23 <REP> d--hs---- C:\FOUND.013
2008-10-10 16:24 . 2004-08-19 16:09 159,232 --a------ c:\windows\system32\ptpusd.dll
2008-10-10 16:24 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2008-10-10 16:24 . 2001-08-23 17:47 5,632 --a------ c:\windows\system32\ptpusb.dll
2008-10-06 14:16 . 2008-10-06 14:16 <REP> d-------- c:\documents and settings\christian koudo\amsn
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-03 16:46 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-03 10:35 --------- d-----w c:\program files\Fichiers communs\Real
2008-10-01 15:43 --------- d-----w c:\documents and settings\All Users\Application Data\BOONTY
2008-09-29 11:42 --------- d-----w c:\documents and settings\christian koudo\Application Data\Uniblue
2008-09-21 14:09 --------- d-----w c:\documents and settings\christian koudo\Application Data\SmartFTP
2008-09-18 19:00 --------- d-----w c:\program files\Java
2008-09-18 18:59 --------- d-----w c:\program files\Fichiers communs\Java
2008-09-18 18:42 --------- d-----w c:\program files\WordBiz
2008-09-11 08:57 --------- d-----w c:\program files\Fichiers communs\DFX
2008-09-11 08:57 --------- d-----w c:\documents and settings\All Users\Application Data\DFX
2008-09-05 18:44 --------- d-sh--w c:\program files\Fichiers communs\WindowsLiveInstaller
2008-09-05 18:33 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2004-07-22 09:51 3,432,656 ----a-w c:\program files\ManagedDX.CAB
2004-07-19 21:58 1,156,363 ----a-w c:\program files\BDANT.cab
2004-07-19 21:53 976,020 ----a-w c:\program files\BDAXP.cab
2004-07-16 13:30 3,858 ----a-w c:\program files\directx redist.txt
2004-07-09 13:17 13,265,040 ----a-w c:\program files\dxnt.cab
2004-07-09 08:13 703,080 ----a-w c:\program files\BDA.cab
2004-07-09 08:13 15,493,481 ----a-w c:\program files\DirectX.cab
2004-07-09 03:08 472,576 ----a-w c:\program files\dxsetup.exe
2004-07-09 03:08 2,242,560 ----a-w c:\program files\dsetup32.dll
2004-07-09 02:03 62,976 ----a-w c:\program files\DSETUP.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{F4F10C1D-87C7-404A-B4B3-000000000000}"= "c:\progra~1\DAP\SBSearch.dll" [2008-11-05 38384]
[HKEY_CLASSES_ROOT\clsid\{f4f10c1d-87c7-404a-b4b3-000000000000}]
[HKEY_CLASSES_ROOT\SearchHook.SrchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{95EFB171-F3DF-4BEC-9EF7-829A800203E6}]
[HKEY_CLASSES_ROOT\SearchHook.SrchHook]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2005-03-14 1057280]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"DownloadAccelerator"="c:\program files\DAP\DAP.EXE" [2008-11-05 3061248]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 83608]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeStartMenu"= 1 (0x1)
"NoLogOff"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"1"= cmd.exe
"2"= mmc.exe
"3"= rstrui.exe
"4"= regedit.exe
"5"= regedt32.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\System32\\mqsvc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5999:UDP"= 5999:UDP:MaxiVista Server
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 AVWEBCAM;AV WebCam, WDM Video Capture;c:\windows\system32\DRIVERS\avwebcam.sys [2008-01-11 13696]
R3 mgau;mgau;c:\windows\system32\DRIVERS\mgaum.sys [2001-08-23 320384]
S2 BT848;Conexant's BtPCI WDM Video Capture;c:\windows\system32\DRIVERS\BT848.sys [2008-08-30 371349]
S2 MtxVideo;Pilote de distribution/capture WDM Matrox;c:\windows\system32\DRIVERS\MtxVideo.sys [2001-08-17 103296]
S3 maxidemo;Maxi_Vista_Demo_Driver;c:\windows\system32\DRIVERS\maxidemo.sys [ ]
S3 s3m;s3m;c:\windows\system32\DRIVERS\s3m.sys [2001-08-17 166720]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - C:\xih9.cmd
\Shell\explore\Command - C:\xih9.cmd
\Shell\open\Command - C:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{07b39626-8c63-11dd-a253-0002a5551647}]
\Shell\AutoRun\command - E:\b0j6j16.bat
\Shell\explore\Command - E:\b0j6j16.bat
\Shell\open\Command - E:\b0j6j16.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{255d9e7e-92c1-11dd-a265-0002a5551647}]
\Shell\AutoRun\command - E:\vva0hc0p.cmd
\Shell\explore\Command - E:\vva0hc0p.cmd
\Shell\open\Command - E:\vva0hc0p.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4102d060-a8ea-11dd-a2b2-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{44553f67-8d40-11dd-a255-0002a5551647}]
\Shell\AutoRun\command - xlk9.com
\Shell\explore\Command - xlk9.com
\Shell\open\Command - xlk9.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48570954-9e7b-11dd-a27d-0002a5551647}]
\Shell\AutoRun\command - E:\2fiji.com
\Shell\explore\Command - E:\2fiji.com
\Shell\open\Command - E:\2fiji.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{553941d8-a0d2-11dd-a285-0002a5551647}]
\Shell\AutoRun\command - F:\xlk9.com
\Shell\explore\Command - F:\xlk9.com
\Shell\open\Command - F:\xlk9.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5ba64ae9-6aa9-11dd-aca2-0002a5551647}]
\Shell\AutoRun\command - E:\t1ypkh.exe
\Shell\explore\Command - E:\t1ypkh.exe
\Shell\open\Command - E:\t1ypkh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6a5d332f-6cfe-11dd-aca8-0002a5551647}]
\Shell\AutoRun\command - G:\yew.bat
\Shell\explore\Command - G:\yew.bat
\Shell\open\Command - G:\yew.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97870ca4-9f72-11dd-a281-0002a5551647}]
\Shell\AutoRun\command - E:\2fiji.com
\Shell\explore\Command - E:\2fiji.com
\Shell\open\Command - E:\2fiji.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a427c054-ab12-11dd-a2c4-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae1ae3b6-a91e-11dd-a2b4-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af035ebc-a67a-11dd-a2a9-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd4544c2-a021-11dd-a282-0002a5551647}]
\Shell\AutoRun\command - E:\xlk9.com
\Shell\explore\Command - E:\xlk9.com
\Shell\open\Command - E:\xlk9.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ccfc65d6-a502-11dd-a2a2-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d0d52206-aa7a-11dd-a2bf-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db03bfa6-84a7-11dd-a23e-0002a5551647}]
\shell\Setup\command - setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e3534192-976f-11dd-a270-0002a5551647}]
\Shell\AutoRun\command - E:\9.cmd
\Shell\explore\Command - E:\9.cmd
\Shell\open\Command - E:\9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc97845c-a196-11dd-a287-0002a5551647}]
\Shell\AutoRun\command - E:\xih9.cmd
\Shell\explore\Command - E:\xih9.cmd
\Shell\open\Command - E:\xih9.cmd
.
Contenu du dossier 'Tâches planifiées'
2008-11-05 c:\windows\Tasks\SpeedOptimizer Startup.job
- c:\progra~1\speedo~1\SPO.exe []
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-Horloge Parlante ZMSoft - c:\documents and settings\christian koudo\Bureau\HParlante.exe
.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\christian koudo\Application Data\Mozilla\Firefox\Profiles\wacl0acy.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-05 16:24:05
Windows 5.1.2600 Service Pack 2 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ASFWHide]
"ImagePath"="\??\c:\docume~1\CHRIST~1\LOCALS~1\Temp\ASFWHide"
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mchInjDrv]
"ImagePath"="\??\c:\docume~1\CHRIST~1\LOCALS~1\Temp\mc22.tmp"
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE
c:\program files\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
c:\windows\system32\msdtc.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\windows\System32\snmp.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\mqsvc.exe
c:\windows\system32\mqtgsvc.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Heure de fin: 2008-11-05 16:41:01 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-05 15:40:28
Avant-CF: 735 068 160 octets libres
Après-CF: 669,843,456 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
319 --- E O F --- 2008-09-11 04:43:01
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Salut,
"
goldorack cesse d'intervenir dans tout les postes , beaucoup de postes restent sans reponses , donc arrete d'intervenir dans les postes des autres prend d'autres postes en charges !!!!!!!"
Et quand c'est d'autres qu'il le font tu ne dit rien.
merci
amicalement ! Martin .
"
goldorack cesse d'intervenir dans tout les postes , beaucoup de postes restent sans reponses , donc arrete d'intervenir dans les postes des autres prend d'autres postes en charges !!!!!!!"
Et quand c'est d'autres qu'il le font tu ne dit rien.
merci
amicalement ! Martin .
houla !! y a du lourd !! la !! Goldorak59 , " ne fait pas a autrui , ce que tu ne veux pas que l'ont te fassent " ca ne te dit rien ?!!
Koudoc , desoles pour cette absence, mais j'ai des obligations ;-))
fait ceci :
Telecharge UsbFix sur ton bureau : http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe
--> Lance l installation avec les parametres par default
Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir
--> Double clic sur le raccourci UsbFix sur ton bureau
--> Le pc va redémarer
-->Apres redémarrage post le rapport UsbFix.txt
Note : le rapport UsbFix.txt est sauvegardé a la racine du disque
Koudoc , desoles pour cette absence, mais j'ai des obligations ;-))
fait ceci :
Telecharge UsbFix sur ton bureau : http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe
--> Lance l installation avec les parametres par default
Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir
--> Double clic sur le raccourci UsbFix sur ton bureau
--> Le pc va redémarer
-->Apres redémarrage post le rapport UsbFix.txt
Note : le rapport UsbFix.txt est sauvegardé a la racine du disque
merci j'ai reçu a resoudre le probleme mon bleme maintenant est ke je cherche un bon graveur de donner
bonjour koudoc , bon si tu considere que ton probleme est reglé ! (ce qui me surprend grandement vue l'infection )
voici ce que tu m'a demandé concernant les logiciels de gravures
http://www.commentcamarche.net/faq/sujet 731 logiciels de gravure gratuits
voici ce que tu m'a demandé concernant les logiciels de gravures
http://www.commentcamarche.net/faq/sujet 731 logiciels de gravure gratuits
bonjour koudoc , si tu prefere en rester la , je ne peu te forcer a terminer ta desinfection !
regarde ici concernant les logiciels de gravures
http://www.commentcamarche.net/faq/sujet 731 logiciels de gravure gratuits
regarde ici concernant les logiciels de gravures
http://www.commentcamarche.net/faq/sujet 731 logiciels de gravure gratuits
