TROJAN VIRTUMONDE
Résolu/Fermé
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
-
29 oct. 2008 à 15:59
Utilisateur anonyme - 2 nov. 2008 à 22:33
Utilisateur anonyme - 2 nov. 2008 à 22:33
A voir également:
- TROJAN VIRTUMONDE
- Trojan remover - Télécharger - Antivirus & Antimalwares
- Trojan agent ✓ - Forum Virus
- Trojan b901 ✓ - Forum Virus
- Csrss.exe trojan ✓ - Forum Virus
- [Virus] Trojan ou virus dans csrss.exe et spo - Forum Virus
27 réponses
Il existe Vundofix il me semble pour cette infection, mais si tu cherches bien sur le net, il en faut d'autres. Il y a plusieurs tutos de dispo pour regler ce prob. Google est ton ami :)
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
29 oct. 2008 à 18:04
29 oct. 2008 à 18:04
Merci Je vais Essayer pour se qui est de vundofix ,, mais il me semble que google est déjà mon meilleur ami
à+
à+
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
29 oct. 2008 à 18:15
29 oct. 2008 à 18:15
Voilà J'ai Essayer Mais le trojan Est en Mode Masquer Vundofix Ne le Detecte Pas
:s
:s
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
29 oct. 2008 à 20:40
29 oct. 2008 à 20:40
Aidez Moii S'il vous Plait :
Peut être que sa peut aider :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:38:56, on 29/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Windows\system32\conime.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Anne-laure\HiJackThis.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O1 - Hosts: 92.48.81.32 iHabbixReloaded
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1358859215-3497976692-2764473087-1005\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'vero')
O4 - HKUS\S-1-5-21-1358859215-3497976692-2764473087-1005\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'vero')
O4 - HKUS\S-1-5-21-1358859215-3497976692-2764473087-1005\..\Run: [EPSON Stylus D92 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE /FU "C:\Windows\TEMP\E_SC4E5.tmp" /EF "HKCU" (User 'vero')
O4 - Startup: Outil de notification Live Search.lnk = Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Anne-laure\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Véronique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
Peut être que sa peut aider :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:38:56, on 29/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Windows\system32\conime.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Anne-laure\HiJackThis.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O1 - Hosts: 92.48.81.32 iHabbixReloaded
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1358859215-3497976692-2764473087-1005\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'vero')
O4 - HKUS\S-1-5-21-1358859215-3497976692-2764473087-1005\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'vero')
O4 - HKUS\S-1-5-21-1358859215-3497976692-2764473087-1005\..\Run: [EPSON Stylus D92 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE /FU "C:\Windows\TEMP\E_SC4E5.tmp" /EF "HKCU" (User 'vero')
O4 - Startup: Outil de notification Live Search.lnk = Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Anne-laure\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Véronique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
30 oct. 2008 à 08:39
30 oct. 2008 à 08:39
Oui , Je voudrais
Merci . Comment je faiis?
Merci . Comment je faiis?
--bonjour
Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.
ensuite fais ceci:
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
a+
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...
Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.
ensuite fais ceci:
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
a+
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
30 oct. 2008 à 10:20
30 oct. 2008 à 10:20
Voilà J'ai fais Exactement Se Que Vous Avez Dit , J'éspere que ça à marcher , voilà le rapport :
ComboFix 08-10-30.04 - Anne-laure 2008-10-30 9:58:32.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1222 [GMT 1:00]
Lancé depuis: C:\Users\Anne-laure\Desktop\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\FBrowserAdvisor
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk
C:\Users\Véronique\AppData\Roaming\inst.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-30 ))))))))))))))))))))))))))))))))))))
.
2008-10-29 20:37 . 2008-10-29 20:37 401,720 --a------ C:\Users\Anne-laure\HiJackThis.exe
2008-10-29 19:52 . 2008-10-29 19:52 <REP> d-------- C:\Program Files\Trend Micro
2008-10-29 18:04 . 2008-10-29 18:04 <REP> d-------- C:\VundoFix Backups
2008-10-29 15:48 . 2008-10-29 15:55 <REP> d-------- C:\Users\Anne-laure\DoctorWeb
2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-10-29 13:09 . 2008-10-29 13:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-29 11:00 . 2008-10-29 11:00 <REP> d-------- C:\Program Files\Defenza
2008-10-29 11:00 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\System32\Machnm1.exe
2008-10-29 11:00 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\System32\Machnm64.sys
2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\System32\118290.54
2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\118294.78
2008-10-29 11:00 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\System32\Machnm32.sys
2008-10-29 08:38 . 2008-08-12 04:39 443,392 --a------ C:\WINDOWS\System32\win32spl.dll
2008-10-29 08:38 . 2008-09-18 05:56 147,456 --a------ C:\WINDOWS\System32\Faultrep.dll
2008-10-29 08:38 . 2008-09-18 05:56 125,952 --a------ C:\WINDOWS\System32\wersvc.dll
2008-10-28 09:31 . 2008-10-28 09:32 <REP> d-------- C:\Program Files\Photo Story 3 for Windows
2008-10-26 19:53 . 2008-10-28 20:35 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-10-26 10:28 . 2008-10-26 10:28 <REP> d-------- C:\Program Files\The Cleaner Demo
2008-10-26 10:12 . 2008-10-26 10:57 <REP> d-------- C:\Program Files\Trojan Remover
2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\Users\All Users\UDL
2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\ProgramData\UDL
2008-10-23 20:24 . 2006-12-08 03:04 76,800 --a------ C:\WINDOWS\System32\E_FLBBZE.DLL
2008-10-23 20:24 . 2006-04-19 03:00 62,976 --a------ C:\WINDOWS\System32\E_FD4BBZE.DLL
2008-10-23 20:24 . 2004-09-10 21:12 49,152 --a------ C:\WINDOWS\System32\E_DCINST.DLL
2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\Users\All Users\EPSON
2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\ProgramData\EPSON
2008-10-23 20:23 . 2008-10-23 20:32 <REP> d-------- C:\Program Files\EPSON
2008-10-23 20:22 . 2008-10-23 20:22 25 --a------ C:\WINDOWS\CDED92Euro.ini
2008-10-23 07:55 . 2008-08-05 10:49 428,544 --a------ C:\WINDOWS\System32\EncDec.dll
2008-10-23 07:55 . 2008-08-05 10:49 293,376 --a------ C:\WINDOWS\System32\psisdecd.dll
2008-10-23 07:55 . 2008-08-05 10:48 217,088 --a------ C:\WINDOWS\System32\psisrndr.ax
2008-10-23 07:55 . 2008-08-05 10:48 177,664 --a------ C:\WINDOWS\System32\mpg2splt.ax
2008-10-23 07:55 . 2008-08-05 10:48 80,896 --a------ C:\WINDOWS\System32\MSNP.ax
2008-10-18 19:12 . 2008-10-26 10:23 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Hamachi
2008-10-18 19:11 . 2008-10-18 19:11 25,280 --a------ C:\WINDOWS\System32\drivers\hamachi.sys
2008-10-18 17:10 . 2008-10-18 17:55 <REP> d-------- C:\Program Files\Dofus
2008-10-15 10:11 . 2008-10-15 10:11 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Media Player Classic
2008-10-15 07:40 . 2008-09-18 06:09 3,601,464 --a------ C:\WINDOWS\System32\ntkrnlpa.exe
2008-10-15 07:40 . 2008-09-18 06:09 3,549,240 --a------ C:\WINDOWS\System32\ntoskrnl.exe
2008-10-15 07:40 . 2008-09-18 03:16 2,032,640 --a------ C:\WINDOWS\System32\win32k.sys
2008-10-15 07:40 . 2008-10-02 04:49 827,392 --a------ C:\WINDOWS\System32\wininet.dll
2008-10-15 07:40 . 2008-09-03 04:59 468,992 --a------ C:\WINDOWS\System32\newdev.dll
2008-10-15 07:40 . 2008-08-27 02:06 288,768 --a------ C:\WINDOWS\System32\drivers\srv.sys
2008-10-15 07:40 . 2008-09-03 04:58 74,752 --a------ C:\WINDOWS\System32\newdev.exe
2008-10-15 07:39 . 2008-10-02 02:32 1,383,424 --a------ C:\WINDOWS\System32\mshtml.tlb
2008-10-14 18:21 . 2008-10-14 18:21 <REP> d-------- C:\Program Files\Audacity
2008-10-14 18:16 . 2008-10-14 18:16 <REP> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT
2008-10-14 18:16 . 2002-01-05 14:37 344,064 --a------ C:\WINDOWS\System32\msvcr70.dll
2008-10-14 17:42 . 2008-03-21 21:30 3,596,288 --a------ C:\WINDOWS\System32\qt-dx331.dll
2008-10-14 17:42 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\System32\xvidcore.dll
2008-10-14 17:42 . 2008-03-31 22:25 682,496 --a------ C:\WINDOWS\System32\divx.dll
2008-10-14 17:42 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\System32\lameACM.acm
2008-10-14 17:42 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\System32\yv12vfw.dll
2008-10-14 17:42 . 2007-09-04 17:56 164,352 --a------ C:\WINDOWS\System32\unrar.dll
2008-10-14 17:42 . 2008-01-10 13:16 159,839 --a------ C:\WINDOWS\System32\xvidvfw.dll
2008-10-14 17:42 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\System32\ac3acm.acm
2008-10-14 17:42 . 2008-03-21 21:28 81,920 --a------ C:\WINDOWS\System32\dpl100.dll
2008-10-14 17:42 . 2007-10-03 16:03 414 --a------ C:\WINDOWS\System32\lame_acm.xml
2008-10-14 17:41 . 2008-10-14 17:42 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2008-10-14 17:41 . 2008-03-28 18:41 7,680 --a------ C:\WINDOWS\System32\ff_vfw.dll
2008-10-14 17:41 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\System32\ff_vfw.dll.manifest
2008-10-12 20:24 . 2008-10-28 13:14 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\LimeWire
2008-10-11 21:56 . 2008-10-26 10:48 <REP> d-------- C:\Program Files\Windows Live Toolbar
2008-10-11 21:56 . 2008-10-11 21:56 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-10-11 21:20 . 2006-11-29 12:06 3,426,072 --a------ C:\WINDOWS\System32\d3dx9_32.dll
2008-10-11 21:17 . 2008-06-26 04:21 712,704 --a------ C:\WINDOWS\System32\WindowsCodecs.dll
2008-10-11 21:17 . 2008-06-26 04:21 347,648 --a------ C:\WINDOWS\System32\WindowsCodecsExt.dll
2008-10-11 21:14 . 2008-10-11 21:14 <REP> d-------- C:\Program Files\Microsoft
2008-10-11 21:10 . 2008-10-11 21:10 <REP> d-------- C:\Program Files\Common Files\Windows Live
2008-10-11 21:07 . 2008-10-23 20:44 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-10-11 17:17 . 2008-10-11 17:19 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\SecondLife
2008-10-10 11:38 . 2008-04-17 12:12 107,368 --a------ C:\WINDOWS\System32\GEARAspi.dll
2008-10-10 11:38 . 2008-04-17 12:12 15,464 --a------ C:\WINDOWS\System32\drivers\GEARAspiWDM.sys
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Program Files\iTunes
2008-10-10 11:37 . 2008-10-10 11:37 <REP> d-------- C:\Program Files\iPod
2008-10-10 11:36 . 2008-10-10 11:36 <REP> d-------- C:\Program Files\Bonjour
2008-10-10 11:28 . 2008-10-10 11:28 <REP> d-------- C:\Program Files\Apple Software Update
2008-10-09 19:49 . 2008-10-09 19:49 <REP> d-------- C:\Program Files\Conjugaison
2008-10-09 19:24 . 2008-10-29 08:32 <REP> d-------- C:\Users\vero\AppData\Roaming\F-Secure
2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\Users\All Users\TomTom
2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\ProgramData\TomTom
2008-10-09 18:26 . 2008-10-30 09:53 <REP> d-------- C:\Program Files\TomTom HOME
2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\TomTom
2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\InstallShield
2008-10-09 18:24 . 2008-10-09 18:24 <REP> d-------- C:\Program Files\TomTom HOME 2
2008-10-09 18:23 . 2008-10-09 18:23 <REP> d-------- C:\Program Files\TomTom DesktopSuite
2008-10-08 12:24 . 2008-10-08 12:24 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\InstallShield
2008-10-08 11:24 . 2008-10-08 11:24 <REP> d-------- C:\Users\vero\AppData\Roaming\Apple Computer
2008-10-07 02:10 . 2008-07-16 02:32 2,048 --a------ C:\WINDOWS\System32\tzres.dll
2008-10-06 16:35 . 2008-10-29 10:49 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\F-Secure
2008-10-06 16:25 . 2008-04-23 17:15 572,512 --a------ C:\WINDOWS\System32\msvcp50.dll
2008-10-06 16:25 . 2008-10-29 10:36 60,064 --a------ C:\WINDOWS\System32\drivers\fsdfw.sys
2008-10-06 16:25 . 2008-04-23 17:11 34,752 --a------ C:\WINDOWS\System32\drivers\fses.sys
2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\Users\All Users\F-Secure
2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\ProgramData\F-Secure
2008-10-06 16:22 . 2008-10-06 16:22 <REP> d-------- C:\Program Files\Orange
2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\Users\All Users\fssg
2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\ProgramData\fssg
2008-10-06 15:08 . 2008-06-26 02:45 12,240,896 --a------ C:\WINDOWS\System32\NlsLexicons0007.dll
2008-10-06 15:08 . 2008-06-26 02:45 2,644,480 --a------ C:\WINDOWS\System32\NlsLexicons0009.dll
2008-10-06 15:07 . 2008-06-26 04:29 801,280 --a------ C:\WINDOWS\System32\NaturalLanguage6.dll
2008-10-06 15:05 . 2008-07-31 02:13 4,240,384 --a------ C:\WINDOWS\System32\GameUXLegacyGDFs.dll
2008-10-06 15:05 . 2008-04-26 09:26 891,448 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
2008-10-06 15:05 . 2008-04-12 04:32 784,896 --a------ C:\WINDOWS\System32\rpcrt4.dll
2008-10-06 15:05 . 2008-06-19 04:31 361,984 --a------ C:\WINDOWS\System32\IPSECSVC.DLL
2008-10-06 15:05 . 2008-04-05 02:21 72,192 --a------ C:\WINDOWS\System32\drivers\pacer.sys
2008-10-06 15:05 . 2008-07-31 04:32 28,160 --a------ C:\WINDOWS\System32\Apphlpdm.dll
2008-10-06 15:05 . 2008-04-05 04:34 15,360 --a------ C:\WINDOWS\System32\pacerprf.dll
2008-10-06 14:41 . 2008-07-19 06:09 1,811,656 --a------ C:\WINDOWS\System32\wuaueng.dll
2008-10-06 14:41 . 2008-07-19 04:44 1,524,736 --a------ C:\WINDOWS\System32\wucltux.dll
2008-10-06 14:41 . 2008-07-19 06:09 563,912 --a------ C:\WINDOWS\System32\wuapi.dll
2008-10-06 14:41 . 2008-07-19 04:44 83,456 --a------ C:\WINDOWS\System32\wudriver.dll
2008-10-06 14:41 . 2008-07-19 06:10 53,448 --a------ C:\WINDOWS\System32\wuauclt.exe
2008-10-06 14:41 . 2008-07-19 06:10 45,768 --a------ C:\WINDOWS\System32\wups2.dll
2008-10-06 14:41 . 2008-07-19 06:10 36,552 --a------ C:\WINDOWS\System32\wups.dll
2008-10-06 14:40 . 2008-07-18 21:08 163,904 --a------ C:\WINDOWS\System32\wuwebv.dll
2008-10-06 14:40 . 2008-07-18 19:44 31,232 --a------ C:\WINDOWS\System32\wuapp.exe
2008-10-06 14:24 . 2008-10-06 14:24 <REP> d-------- C:\Program Files\Securitoo
2008-10-06 14:24 . 2006-11-28 19:46 28,224 --a------ C:\WINDOWS\System32\drivers\PCAMp50.sys
2008-10-06 14:24 . 2006-11-28 19:46 27,072 --a------ C:\WINDOWS\System32\drivers\PCASp50.sys
2008-10-06 14:22 . 2008-10-06 14:49 <REP> d-------- C:\Program Files\OrangeHSS
2008-10-06 14:22 . 2007-12-11 19:22 65,536 --a------ C:\WINDOWS\System32\Autodial2000.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
2008-10-29 09:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-26 09:38 --------- d-----w C:\Program Files\Hamachi
2008-10-23 19:36 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-10-20 10:28 --------- d-----w C:\Program Files\Windows Live
2008-10-16 01:13 --------- d-----w C:\Program Files\Windows Mail
2008-10-16 01:04 --------- d-----w C:\ProgramData\Microsoft Help
2008-10-12 19:24 --------- d-----w C:\Program Files\LimeWire
2008-10-11 20:50 --------- d-----w C:\ProgramData\WLInstaller
2008-10-10 10:36 --------- d-----w C:\Program Files\QuickTime
2008-10-10 10:35 --------- d-----w C:\Program Files\Common Files\Apple
2008-10-08 11:31 --------- d-----w C:\Program Files\FinePixViewer
2008-10-08 11:27 --------- d-----w C:\Users\Anne-laure\AppData\Roaming\FUJIFILM
2008-10-08 11:23 --------- d-----w C:\Users\Véronique\AppData\Roaming\FUJIFILM
2008-08-29 08:18 87,336 ----a-w C:\Windows\System32\dns-sd.exe
2008-08-29 07:53 61,440 ----a-w C:\Windows\System32\dnssd.dll
2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-20 17:38 1,435,224 ----a-w C:\Users\nanou\TMPGEnc-2.524.63.181-Free.zip
2008-06-20 17:05 1,665,325 ----a-w C:\Users\nanou\agfreesetup.exe
2008-06-20 16:31 1,579,972 ----a-w C:\Users\nanou\dvdaudioextractor.exe
2008-06-10 19:38 20,019 ----a-w C:\Users\nanou\unfreez.zip
2008-05-31 19:45 3,115,008 ----a-w C:\Users\nanou\AudioVideo_To_Exe(English).exe
2008-05-28 09:46 47,360 ----a-w C:\Users\Véronique\AppData\Roaming\pcouffin.sys
2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
2008-04-28 01:45 174 --sha-w C:\Program Files\desktop.ini
2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-04-27 07:45 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 C:\WINDOWS\System32\oobefldr.dll]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"au"="C:\Program Files\Dealio\DealioAU.exe" [2008-04-16 591200]
"ORAHSSSessionManager"="C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
"F-Secure Manager"="C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2008-04-23 182936]
"F-Secure TNB"="C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2008-04-23 744032]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 3770024]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"PCDAS"="C:\Program Files\Defenza\pcd-as.exe" [2006-12-15 1359872]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="C:\Windows\SMINST\launcher.exe" [2007-03-07 44168]
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Outil de notification Live Search.lnk - C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-10-20 143360]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2008-06-15 303104]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2BF1B30A-E70B-40C0-A49B-E32E0357E594}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5DE2C203-A710-4888-A4A0-B03BC6F9F7EE}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AB26A2BA-3E21-4EDC-BA86-74252A1E9B60}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{0F718442-4349-481B-B9BE-0434243B45CC}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{2584FB02-825A-4197-BCA8-5DEFEA1D7FC3}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{7D89EE86-9CF5-4C71-B679-C896786B9327}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{23CCE833-C21A-4284-942A-1E2BDC544952}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{158F0404-1BBA-48A7-B105-4CFF6C637FA8}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"TCP Query User{E4240EF3-695C-4EAC-834B-580750BF9B6A}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{BA578043-7B5F-4C14-A5F0-DD1203936051}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{FB00228A-A7BB-43F6-A5BF-73A7D28205CB}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{440986FF-83C0-400D-93B1-ECA44E786697}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"TCP Query User{AECC5E9E-BAE8-4888-9F67-6301045DAADA}C:\\program files\\hamachi\\hamachi.exe"= UDP:C:\program files\hamachi\hamachi.exe:Hamachi Client
"UDP Query User{23AB184E-67A6-4A61-8C12-79AEB04D7169}C:\\program files\\hamachi\\hamachi.exe"= TCP:C:\program files\hamachi\hamachi.exe:Hamachi Client
"TCP Query User{E3F29125-A2B2-4113-8259-25657DFDBDB6}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{9E030592-428F-49C6-A9A2-23D22441CF1A}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{63C96D9E-C7A9-44CE-88BE-0C515539437C}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{2192EAE9-5368-4EE8-8CD3-9C66A8912293}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{6D454281-F9A4-42A7-86FC-C5AE502DEEBA}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{A03C0C98-1D14-4B69-8834-7AF18EE7CBC7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{AD2F44F6-5754-4B64-A8A8-4F6C6A2FA4BF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{112DB924-3F00-438F-ACB8-1C1D58D9EBA6}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{48480C3F-4276-4B3B-9D8B-488BD0F40DEA}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Orange\AntivirusFirewall\HIPS\fshs.sys [2008-10-29 41184]
R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2008-04-23 34752]
R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2008-10-29 60064]
R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsvista.sys [2008-04-23 12896]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2008-04-23 62048]
S3 Brndis;External USB Cable Modem;C:\Windows\system32\DRIVERS\Brndis.sys [2004-02-06 16512]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2008-04-23 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2008-04-23 25184]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f5f6184-012e-11dd-8acc-806e6f6e6963}]
\shell\AutoRun\command - E:\EPSETUP.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{990fee76-9538-11dd-9d90-001bb97e2318}]
\shell\AutoRun\command - J:\InstallTomTomHOME.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9f1fc82-990f-11dd-bed9-001bb97e2318}]
\shell\AutoRun\command - K:\start.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{2D2B0467-6BFE-4217-82E0-E7D63BCEFB92}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{A3BD8618-9E38-4205-94E6-90329DCC055B}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
- - - - ORPHELINS SUPPRIMES - - - -
WebBrowser-{21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Users\Anne-laure\AppData\Roaming\Mozilla\Firefox\Profiles\leichzot.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-30 10:04:59
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
ComboFix 08-10-30.04 - Anne-laure 2008-10-30 9:58:32.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1222 [GMT 1:00]
Lancé depuis: C:\Users\Anne-laure\Desktop\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\FBrowserAdvisor
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk
C:\Users\Véronique\AppData\Roaming\inst.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-30 ))))))))))))))))))))))))))))))))))))
.
2008-10-29 20:37 . 2008-10-29 20:37 401,720 --a------ C:\Users\Anne-laure\HiJackThis.exe
2008-10-29 19:52 . 2008-10-29 19:52 <REP> d-------- C:\Program Files\Trend Micro
2008-10-29 18:04 . 2008-10-29 18:04 <REP> d-------- C:\VundoFix Backups
2008-10-29 15:48 . 2008-10-29 15:55 <REP> d-------- C:\Users\Anne-laure\DoctorWeb
2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-10-29 13:09 . 2008-10-29 13:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-29 11:00 . 2008-10-29 11:00 <REP> d-------- C:\Program Files\Defenza
2008-10-29 11:00 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\System32\Machnm1.exe
2008-10-29 11:00 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\System32\Machnm64.sys
2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\System32\118290.54
2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\118294.78
2008-10-29 11:00 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\System32\Machnm32.sys
2008-10-29 08:38 . 2008-08-12 04:39 443,392 --a------ C:\WINDOWS\System32\win32spl.dll
2008-10-29 08:38 . 2008-09-18 05:56 147,456 --a------ C:\WINDOWS\System32\Faultrep.dll
2008-10-29 08:38 . 2008-09-18 05:56 125,952 --a------ C:\WINDOWS\System32\wersvc.dll
2008-10-28 09:31 . 2008-10-28 09:32 <REP> d-------- C:\Program Files\Photo Story 3 for Windows
2008-10-26 19:53 . 2008-10-28 20:35 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-10-26 10:28 . 2008-10-26 10:28 <REP> d-------- C:\Program Files\The Cleaner Demo
2008-10-26 10:12 . 2008-10-26 10:57 <REP> d-------- C:\Program Files\Trojan Remover
2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\Users\All Users\UDL
2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\ProgramData\UDL
2008-10-23 20:24 . 2006-12-08 03:04 76,800 --a------ C:\WINDOWS\System32\E_FLBBZE.DLL
2008-10-23 20:24 . 2006-04-19 03:00 62,976 --a------ C:\WINDOWS\System32\E_FD4BBZE.DLL
2008-10-23 20:24 . 2004-09-10 21:12 49,152 --a------ C:\WINDOWS\System32\E_DCINST.DLL
2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\Users\All Users\EPSON
2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\ProgramData\EPSON
2008-10-23 20:23 . 2008-10-23 20:32 <REP> d-------- C:\Program Files\EPSON
2008-10-23 20:22 . 2008-10-23 20:22 25 --a------ C:\WINDOWS\CDED92Euro.ini
2008-10-23 07:55 . 2008-08-05 10:49 428,544 --a------ C:\WINDOWS\System32\EncDec.dll
2008-10-23 07:55 . 2008-08-05 10:49 293,376 --a------ C:\WINDOWS\System32\psisdecd.dll
2008-10-23 07:55 . 2008-08-05 10:48 217,088 --a------ C:\WINDOWS\System32\psisrndr.ax
2008-10-23 07:55 . 2008-08-05 10:48 177,664 --a------ C:\WINDOWS\System32\mpg2splt.ax
2008-10-23 07:55 . 2008-08-05 10:48 80,896 --a------ C:\WINDOWS\System32\MSNP.ax
2008-10-18 19:12 . 2008-10-26 10:23 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Hamachi
2008-10-18 19:11 . 2008-10-18 19:11 25,280 --a------ C:\WINDOWS\System32\drivers\hamachi.sys
2008-10-18 17:10 . 2008-10-18 17:55 <REP> d-------- C:\Program Files\Dofus
2008-10-15 10:11 . 2008-10-15 10:11 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Media Player Classic
2008-10-15 07:40 . 2008-09-18 06:09 3,601,464 --a------ C:\WINDOWS\System32\ntkrnlpa.exe
2008-10-15 07:40 . 2008-09-18 06:09 3,549,240 --a------ C:\WINDOWS\System32\ntoskrnl.exe
2008-10-15 07:40 . 2008-09-18 03:16 2,032,640 --a------ C:\WINDOWS\System32\win32k.sys
2008-10-15 07:40 . 2008-10-02 04:49 827,392 --a------ C:\WINDOWS\System32\wininet.dll
2008-10-15 07:40 . 2008-09-03 04:59 468,992 --a------ C:\WINDOWS\System32\newdev.dll
2008-10-15 07:40 . 2008-08-27 02:06 288,768 --a------ C:\WINDOWS\System32\drivers\srv.sys
2008-10-15 07:40 . 2008-09-03 04:58 74,752 --a------ C:\WINDOWS\System32\newdev.exe
2008-10-15 07:39 . 2008-10-02 02:32 1,383,424 --a------ C:\WINDOWS\System32\mshtml.tlb
2008-10-14 18:21 . 2008-10-14 18:21 <REP> d-------- C:\Program Files\Audacity
2008-10-14 18:16 . 2008-10-14 18:16 <REP> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT
2008-10-14 18:16 . 2002-01-05 14:37 344,064 --a------ C:\WINDOWS\System32\msvcr70.dll
2008-10-14 17:42 . 2008-03-21 21:30 3,596,288 --a------ C:\WINDOWS\System32\qt-dx331.dll
2008-10-14 17:42 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\System32\xvidcore.dll
2008-10-14 17:42 . 2008-03-31 22:25 682,496 --a------ C:\WINDOWS\System32\divx.dll
2008-10-14 17:42 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\System32\lameACM.acm
2008-10-14 17:42 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\System32\yv12vfw.dll
2008-10-14 17:42 . 2007-09-04 17:56 164,352 --a------ C:\WINDOWS\System32\unrar.dll
2008-10-14 17:42 . 2008-01-10 13:16 159,839 --a------ C:\WINDOWS\System32\xvidvfw.dll
2008-10-14 17:42 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\System32\ac3acm.acm
2008-10-14 17:42 . 2008-03-21 21:28 81,920 --a------ C:\WINDOWS\System32\dpl100.dll
2008-10-14 17:42 . 2007-10-03 16:03 414 --a------ C:\WINDOWS\System32\lame_acm.xml
2008-10-14 17:41 . 2008-10-14 17:42 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2008-10-14 17:41 . 2008-03-28 18:41 7,680 --a------ C:\WINDOWS\System32\ff_vfw.dll
2008-10-14 17:41 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\System32\ff_vfw.dll.manifest
2008-10-12 20:24 . 2008-10-28 13:14 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\LimeWire
2008-10-11 21:56 . 2008-10-26 10:48 <REP> d-------- C:\Program Files\Windows Live Toolbar
2008-10-11 21:56 . 2008-10-11 21:56 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-10-11 21:20 . 2006-11-29 12:06 3,426,072 --a------ C:\WINDOWS\System32\d3dx9_32.dll
2008-10-11 21:17 . 2008-06-26 04:21 712,704 --a------ C:\WINDOWS\System32\WindowsCodecs.dll
2008-10-11 21:17 . 2008-06-26 04:21 347,648 --a------ C:\WINDOWS\System32\WindowsCodecsExt.dll
2008-10-11 21:14 . 2008-10-11 21:14 <REP> d-------- C:\Program Files\Microsoft
2008-10-11 21:10 . 2008-10-11 21:10 <REP> d-------- C:\Program Files\Common Files\Windows Live
2008-10-11 21:07 . 2008-10-23 20:44 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-10-11 17:17 . 2008-10-11 17:19 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\SecondLife
2008-10-10 11:38 . 2008-04-17 12:12 107,368 --a------ C:\WINDOWS\System32\GEARAspi.dll
2008-10-10 11:38 . 2008-04-17 12:12 15,464 --a------ C:\WINDOWS\System32\drivers\GEARAspiWDM.sys
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Program Files\iTunes
2008-10-10 11:37 . 2008-10-10 11:37 <REP> d-------- C:\Program Files\iPod
2008-10-10 11:36 . 2008-10-10 11:36 <REP> d-------- C:\Program Files\Bonjour
2008-10-10 11:28 . 2008-10-10 11:28 <REP> d-------- C:\Program Files\Apple Software Update
2008-10-09 19:49 . 2008-10-09 19:49 <REP> d-------- C:\Program Files\Conjugaison
2008-10-09 19:24 . 2008-10-29 08:32 <REP> d-------- C:\Users\vero\AppData\Roaming\F-Secure
2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\Users\All Users\TomTom
2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\ProgramData\TomTom
2008-10-09 18:26 . 2008-10-30 09:53 <REP> d-------- C:\Program Files\TomTom HOME
2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\TomTom
2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\InstallShield
2008-10-09 18:24 . 2008-10-09 18:24 <REP> d-------- C:\Program Files\TomTom HOME 2
2008-10-09 18:23 . 2008-10-09 18:23 <REP> d-------- C:\Program Files\TomTom DesktopSuite
2008-10-08 12:24 . 2008-10-08 12:24 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\InstallShield
2008-10-08 11:24 . 2008-10-08 11:24 <REP> d-------- C:\Users\vero\AppData\Roaming\Apple Computer
2008-10-07 02:10 . 2008-07-16 02:32 2,048 --a------ C:\WINDOWS\System32\tzres.dll
2008-10-06 16:35 . 2008-10-29 10:49 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\F-Secure
2008-10-06 16:25 . 2008-04-23 17:15 572,512 --a------ C:\WINDOWS\System32\msvcp50.dll
2008-10-06 16:25 . 2008-10-29 10:36 60,064 --a------ C:\WINDOWS\System32\drivers\fsdfw.sys
2008-10-06 16:25 . 2008-04-23 17:11 34,752 --a------ C:\WINDOWS\System32\drivers\fses.sys
2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\Users\All Users\F-Secure
2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\ProgramData\F-Secure
2008-10-06 16:22 . 2008-10-06 16:22 <REP> d-------- C:\Program Files\Orange
2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\Users\All Users\fssg
2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\ProgramData\fssg
2008-10-06 15:08 . 2008-06-26 02:45 12,240,896 --a------ C:\WINDOWS\System32\NlsLexicons0007.dll
2008-10-06 15:08 . 2008-06-26 02:45 2,644,480 --a------ C:\WINDOWS\System32\NlsLexicons0009.dll
2008-10-06 15:07 . 2008-06-26 04:29 801,280 --a------ C:\WINDOWS\System32\NaturalLanguage6.dll
2008-10-06 15:05 . 2008-07-31 02:13 4,240,384 --a------ C:\WINDOWS\System32\GameUXLegacyGDFs.dll
2008-10-06 15:05 . 2008-04-26 09:26 891,448 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
2008-10-06 15:05 . 2008-04-12 04:32 784,896 --a------ C:\WINDOWS\System32\rpcrt4.dll
2008-10-06 15:05 . 2008-06-19 04:31 361,984 --a------ C:\WINDOWS\System32\IPSECSVC.DLL
2008-10-06 15:05 . 2008-04-05 02:21 72,192 --a------ C:\WINDOWS\System32\drivers\pacer.sys
2008-10-06 15:05 . 2008-07-31 04:32 28,160 --a------ C:\WINDOWS\System32\Apphlpdm.dll
2008-10-06 15:05 . 2008-04-05 04:34 15,360 --a------ C:\WINDOWS\System32\pacerprf.dll
2008-10-06 14:41 . 2008-07-19 06:09 1,811,656 --a------ C:\WINDOWS\System32\wuaueng.dll
2008-10-06 14:41 . 2008-07-19 04:44 1,524,736 --a------ C:\WINDOWS\System32\wucltux.dll
2008-10-06 14:41 . 2008-07-19 06:09 563,912 --a------ C:\WINDOWS\System32\wuapi.dll
2008-10-06 14:41 . 2008-07-19 04:44 83,456 --a------ C:\WINDOWS\System32\wudriver.dll
2008-10-06 14:41 . 2008-07-19 06:10 53,448 --a------ C:\WINDOWS\System32\wuauclt.exe
2008-10-06 14:41 . 2008-07-19 06:10 45,768 --a------ C:\WINDOWS\System32\wups2.dll
2008-10-06 14:41 . 2008-07-19 06:10 36,552 --a------ C:\WINDOWS\System32\wups.dll
2008-10-06 14:40 . 2008-07-18 21:08 163,904 --a------ C:\WINDOWS\System32\wuwebv.dll
2008-10-06 14:40 . 2008-07-18 19:44 31,232 --a------ C:\WINDOWS\System32\wuapp.exe
2008-10-06 14:24 . 2008-10-06 14:24 <REP> d-------- C:\Program Files\Securitoo
2008-10-06 14:24 . 2006-11-28 19:46 28,224 --a------ C:\WINDOWS\System32\drivers\PCAMp50.sys
2008-10-06 14:24 . 2006-11-28 19:46 27,072 --a------ C:\WINDOWS\System32\drivers\PCASp50.sys
2008-10-06 14:22 . 2008-10-06 14:49 <REP> d-------- C:\Program Files\OrangeHSS
2008-10-06 14:22 . 2007-12-11 19:22 65,536 --a------ C:\WINDOWS\System32\Autodial2000.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
2008-10-29 09:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-26 09:38 --------- d-----w C:\Program Files\Hamachi
2008-10-23 19:36 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-10-20 10:28 --------- d-----w C:\Program Files\Windows Live
2008-10-16 01:13 --------- d-----w C:\Program Files\Windows Mail
2008-10-16 01:04 --------- d-----w C:\ProgramData\Microsoft Help
2008-10-12 19:24 --------- d-----w C:\Program Files\LimeWire
2008-10-11 20:50 --------- d-----w C:\ProgramData\WLInstaller
2008-10-10 10:36 --------- d-----w C:\Program Files\QuickTime
2008-10-10 10:35 --------- d-----w C:\Program Files\Common Files\Apple
2008-10-08 11:31 --------- d-----w C:\Program Files\FinePixViewer
2008-10-08 11:27 --------- d-----w C:\Users\Anne-laure\AppData\Roaming\FUJIFILM
2008-10-08 11:23 --------- d-----w C:\Users\Véronique\AppData\Roaming\FUJIFILM
2008-08-29 08:18 87,336 ----a-w C:\Windows\System32\dns-sd.exe
2008-08-29 07:53 61,440 ----a-w C:\Windows\System32\dnssd.dll
2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-20 17:38 1,435,224 ----a-w C:\Users\nanou\TMPGEnc-2.524.63.181-Free.zip
2008-06-20 17:05 1,665,325 ----a-w C:\Users\nanou\agfreesetup.exe
2008-06-20 16:31 1,579,972 ----a-w C:\Users\nanou\dvdaudioextractor.exe
2008-06-10 19:38 20,019 ----a-w C:\Users\nanou\unfreez.zip
2008-05-31 19:45 3,115,008 ----a-w C:\Users\nanou\AudioVideo_To_Exe(English).exe
2008-05-28 09:46 47,360 ----a-w C:\Users\Véronique\AppData\Roaming\pcouffin.sys
2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
2008-04-28 01:45 174 --sha-w C:\Program Files\desktop.ini
2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-04-27 07:45 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 C:\WINDOWS\System32\oobefldr.dll]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"au"="C:\Program Files\Dealio\DealioAU.exe" [2008-04-16 591200]
"ORAHSSSessionManager"="C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
"F-Secure Manager"="C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2008-04-23 182936]
"F-Secure TNB"="C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2008-04-23 744032]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 3770024]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"PCDAS"="C:\Program Files\Defenza\pcd-as.exe" [2006-12-15 1359872]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="C:\Windows\SMINST\launcher.exe" [2007-03-07 44168]
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Outil de notification Live Search.lnk - C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-10-20 143360]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2008-06-15 303104]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2BF1B30A-E70B-40C0-A49B-E32E0357E594}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5DE2C203-A710-4888-A4A0-B03BC6F9F7EE}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AB26A2BA-3E21-4EDC-BA86-74252A1E9B60}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{0F718442-4349-481B-B9BE-0434243B45CC}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{2584FB02-825A-4197-BCA8-5DEFEA1D7FC3}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{7D89EE86-9CF5-4C71-B679-C896786B9327}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{23CCE833-C21A-4284-942A-1E2BDC544952}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{158F0404-1BBA-48A7-B105-4CFF6C637FA8}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"TCP Query User{E4240EF3-695C-4EAC-834B-580750BF9B6A}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{BA578043-7B5F-4C14-A5F0-DD1203936051}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{FB00228A-A7BB-43F6-A5BF-73A7D28205CB}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{440986FF-83C0-400D-93B1-ECA44E786697}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"TCP Query User{AECC5E9E-BAE8-4888-9F67-6301045DAADA}C:\\program files\\hamachi\\hamachi.exe"= UDP:C:\program files\hamachi\hamachi.exe:Hamachi Client
"UDP Query User{23AB184E-67A6-4A61-8C12-79AEB04D7169}C:\\program files\\hamachi\\hamachi.exe"= TCP:C:\program files\hamachi\hamachi.exe:Hamachi Client
"TCP Query User{E3F29125-A2B2-4113-8259-25657DFDBDB6}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{9E030592-428F-49C6-A9A2-23D22441CF1A}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{63C96D9E-C7A9-44CE-88BE-0C515539437C}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{2192EAE9-5368-4EE8-8CD3-9C66A8912293}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{6D454281-F9A4-42A7-86FC-C5AE502DEEBA}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{A03C0C98-1D14-4B69-8834-7AF18EE7CBC7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{AD2F44F6-5754-4B64-A8A8-4F6C6A2FA4BF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{112DB924-3F00-438F-ACB8-1C1D58D9EBA6}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{48480C3F-4276-4B3B-9D8B-488BD0F40DEA}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Orange\AntivirusFirewall\HIPS\fshs.sys [2008-10-29 41184]
R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2008-04-23 34752]
R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2008-10-29 60064]
R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsvista.sys [2008-04-23 12896]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2008-04-23 62048]
S3 Brndis;External USB Cable Modem;C:\Windows\system32\DRIVERS\Brndis.sys [2004-02-06 16512]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2008-04-23 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2008-04-23 25184]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f5f6184-012e-11dd-8acc-806e6f6e6963}]
\shell\AutoRun\command - E:\EPSETUP.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{990fee76-9538-11dd-9d90-001bb97e2318}]
\shell\AutoRun\command - J:\InstallTomTomHOME.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9f1fc82-990f-11dd-bed9-001bb97e2318}]
\shell\AutoRun\command - K:\start.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{2D2B0467-6BFE-4217-82E0-E7D63BCEFB92}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{A3BD8618-9E38-4205-94E6-90329DCC055B}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
- - - - ORPHELINS SUPPRIMES - - - -
WebBrowser-{21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Users\Anne-laure\AppData\Roaming\Mozilla\Firefox\Profiles\leichzot.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-30 10:04:59
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
30 oct. 2008 à 10:20
30 oct. 2008 à 10:20
Voilà J'ai fais Exactement Se Que Vous Avez Dit , J'éspere que ça à marcher , voilà le rapport :
ComboFix 08-10-30.04 - Anne-laure 2008-10-30 9:58:32.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1222 [GMT 1:00]
Lancé depuis: C:\Users\Anne-laure\Desktop\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\FBrowserAdvisor
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk
C:\Users\Véronique\AppData\Roaming\inst.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-30 ))))))))))))))))))))))))))))))))))))
.
2008-10-29 20:37 . 2008-10-29 20:37 401,720 --a------ C:\Users\Anne-laure\HiJackThis.exe
2008-10-29 19:52 . 2008-10-29 19:52 <REP> d-------- C:\Program Files\Trend Micro
2008-10-29 18:04 . 2008-10-29 18:04 <REP> d-------- C:\VundoFix Backups
2008-10-29 15:48 . 2008-10-29 15:55 <REP> d-------- C:\Users\Anne-laure\DoctorWeb
2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-10-29 13:09 . 2008-10-29 13:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-29 11:00 . 2008-10-29 11:00 <REP> d-------- C:\Program Files\Defenza
2008-10-29 11:00 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\System32\Machnm1.exe
2008-10-29 11:00 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\System32\Machnm64.sys
2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\System32\118290.54
2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\118294.78
2008-10-29 11:00 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\System32\Machnm32.sys
2008-10-29 08:38 . 2008-08-12 04:39 443,392 --a------ C:\WINDOWS\System32\win32spl.dll
2008-10-29 08:38 . 2008-09-18 05:56 147,456 --a------ C:\WINDOWS\System32\Faultrep.dll
2008-10-29 08:38 . 2008-09-18 05:56 125,952 --a------ C:\WINDOWS\System32\wersvc.dll
2008-10-28 09:31 . 2008-10-28 09:32 <REP> d-------- C:\Program Files\Photo Story 3 for Windows
2008-10-26 19:53 . 2008-10-28 20:35 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-10-26 10:28 . 2008-10-26 10:28 <REP> d-------- C:\Program Files\The Cleaner Demo
2008-10-26 10:12 . 2008-10-26 10:57 <REP> d-------- C:\Program Files\Trojan Remover
2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\Users\All Users\UDL
2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\ProgramData\UDL
2008-10-23 20:24 . 2006-12-08 03:04 76,800 --a------ C:\WINDOWS\System32\E_FLBBZE.DLL
2008-10-23 20:24 . 2006-04-19 03:00 62,976 --a------ C:\WINDOWS\System32\E_FD4BBZE.DLL
2008-10-23 20:24 . 2004-09-10 21:12 49,152 --a------ C:\WINDOWS\System32\E_DCINST.DLL
2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\Users\All Users\EPSON
2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\ProgramData\EPSON
2008-10-23 20:23 . 2008-10-23 20:32 <REP> d-------- C:\Program Files\EPSON
2008-10-23 20:22 . 2008-10-23 20:22 25 --a------ C:\WINDOWS\CDED92Euro.ini
2008-10-23 07:55 . 2008-08-05 10:49 428,544 --a------ C:\WINDOWS\System32\EncDec.dll
2008-10-23 07:55 . 2008-08-05 10:49 293,376 --a------ C:\WINDOWS\System32\psisdecd.dll
2008-10-23 07:55 . 2008-08-05 10:48 217,088 --a------ C:\WINDOWS\System32\psisrndr.ax
2008-10-23 07:55 . 2008-08-05 10:48 177,664 --a------ C:\WINDOWS\System32\mpg2splt.ax
2008-10-23 07:55 . 2008-08-05 10:48 80,896 --a------ C:\WINDOWS\System32\MSNP.ax
2008-10-18 19:12 . 2008-10-26 10:23 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Hamachi
2008-10-18 19:11 . 2008-10-18 19:11 25,280 --a------ C:\WINDOWS\System32\drivers\hamachi.sys
2008-10-18 17:10 . 2008-10-18 17:55 <REP> d-------- C:\Program Files\Dofus
2008-10-15 10:11 . 2008-10-15 10:11 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Media Player Classic
2008-10-15 07:40 . 2008-09-18 06:09 3,601,464 --a------ C:\WINDOWS\System32\ntkrnlpa.exe
2008-10-15 07:40 . 2008-09-18 06:09 3,549,240 --a------ C:\WINDOWS\System32\ntoskrnl.exe
2008-10-15 07:40 . 2008-09-18 03:16 2,032,640 --a------ C:\WINDOWS\System32\win32k.sys
2008-10-15 07:40 . 2008-10-02 04:49 827,392 --a------ C:\WINDOWS\System32\wininet.dll
2008-10-15 07:40 . 2008-09-03 04:59 468,992 --a------ C:\WINDOWS\System32\newdev.dll
2008-10-15 07:40 . 2008-08-27 02:06 288,768 --a------ C:\WINDOWS\System32\drivers\srv.sys
2008-10-15 07:40 . 2008-09-03 04:58 74,752 --a------ C:\WINDOWS\System32\newdev.exe
2008-10-15 07:39 . 2008-10-02 02:32 1,383,424 --a------ C:\WINDOWS\System32\mshtml.tlb
2008-10-14 18:21 . 2008-10-14 18:21 <REP> d-------- C:\Program Files\Audacity
2008-10-14 18:16 . 2008-10-14 18:16 <REP> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT
2008-10-14 18:16 . 2002-01-05 14:37 344,064 --a------ C:\WINDOWS\System32\msvcr70.dll
2008-10-14 17:42 . 2008-03-21 21:30 3,596,288 --a------ C:\WINDOWS\System32\qt-dx331.dll
2008-10-14 17:42 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\System32\xvidcore.dll
2008-10-14 17:42 . 2008-03-31 22:25 682,496 --a------ C:\WINDOWS\System32\divx.dll
2008-10-14 17:42 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\System32\lameACM.acm
2008-10-14 17:42 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\System32\yv12vfw.dll
2008-10-14 17:42 . 2007-09-04 17:56 164,352 --a------ C:\WINDOWS\System32\unrar.dll
2008-10-14 17:42 . 2008-01-10 13:16 159,839 --a------ C:\WINDOWS\System32\xvidvfw.dll
2008-10-14 17:42 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\System32\ac3acm.acm
2008-10-14 17:42 . 2008-03-21 21:28 81,920 --a------ C:\WINDOWS\System32\dpl100.dll
2008-10-14 17:42 . 2007-10-03 16:03 414 --a------ C:\WINDOWS\System32\lame_acm.xml
2008-10-14 17:41 . 2008-10-14 17:42 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2008-10-14 17:41 . 2008-03-28 18:41 7,680 --a------ C:\WINDOWS\System32\ff_vfw.dll
2008-10-14 17:41 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\System32\ff_vfw.dll.manifest
2008-10-12 20:24 . 2008-10-28 13:14 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\LimeWire
2008-10-11 21:56 . 2008-10-26 10:48 <REP> d-------- C:\Program Files\Windows Live Toolbar
2008-10-11 21:56 . 2008-10-11 21:56 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-10-11 21:20 . 2006-11-29 12:06 3,426,072 --a------ C:\WINDOWS\System32\d3dx9_32.dll
2008-10-11 21:17 . 2008-06-26 04:21 712,704 --a------ C:\WINDOWS\System32\WindowsCodecs.dll
2008-10-11 21:17 . 2008-06-26 04:21 347,648 --a------ C:\WINDOWS\System32\WindowsCodecsExt.dll
2008-10-11 21:14 . 2008-10-11 21:14 <REP> d-------- C:\Program Files\Microsoft
2008-10-11 21:10 . 2008-10-11 21:10 <REP> d-------- C:\Program Files\Common Files\Windows Live
2008-10-11 21:07 . 2008-10-23 20:44 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-10-11 17:17 . 2008-10-11 17:19 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\SecondLife
2008-10-10 11:38 . 2008-04-17 12:12 107,368 --a------ C:\WINDOWS\System32\GEARAspi.dll
2008-10-10 11:38 . 2008-04-17 12:12 15,464 --a------ C:\WINDOWS\System32\drivers\GEARAspiWDM.sys
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Program Files\iTunes
2008-10-10 11:37 . 2008-10-10 11:37 <REP> d-------- C:\Program Files\iPod
2008-10-10 11:36 . 2008-10-10 11:36 <REP> d-------- C:\Program Files\Bonjour
2008-10-10 11:28 . 2008-10-10 11:28 <REP> d-------- C:\Program Files\Apple Software Update
2008-10-09 19:49 . 2008-10-09 19:49 <REP> d-------- C:\Program Files\Conjugaison
2008-10-09 19:24 . 2008-10-29 08:32 <REP> d-------- C:\Users\vero\AppData\Roaming\F-Secure
2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\Users\All Users\TomTom
2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\ProgramData\TomTom
2008-10-09 18:26 . 2008-10-30 09:53 <REP> d-------- C:\Program Files\TomTom HOME
2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\TomTom
2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\InstallShield
2008-10-09 18:24 . 2008-10-09 18:24 <REP> d-------- C:\Program Files\TomTom HOME 2
2008-10-09 18:23 . 2008-10-09 18:23 <REP> d-------- C:\Program Files\TomTom DesktopSuite
2008-10-08 12:24 . 2008-10-08 12:24 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\InstallShield
2008-10-08 11:24 . 2008-10-08 11:24 <REP> d-------- C:\Users\vero\AppData\Roaming\Apple Computer
2008-10-07 02:10 . 2008-07-16 02:32 2,048 --a------ C:\WINDOWS\System32\tzres.dll
2008-10-06 16:35 . 2008-10-29 10:49 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\F-Secure
2008-10-06 16:25 . 2008-04-23 17:15 572,512 --a------ C:\WINDOWS\System32\msvcp50.dll
2008-10-06 16:25 . 2008-10-29 10:36 60,064 --a------ C:\WINDOWS\System32\drivers\fsdfw.sys
2008-10-06 16:25 . 2008-04-23 17:11 34,752 --a------ C:\WINDOWS\System32\drivers\fses.sys
2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\Users\All Users\F-Secure
2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\ProgramData\F-Secure
2008-10-06 16:22 . 2008-10-06 16:22 <REP> d-------- C:\Program Files\Orange
2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\Users\All Users\fssg
2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\ProgramData\fssg
2008-10-06 15:08 . 2008-06-26 02:45 12,240,896 --a------ C:\WINDOWS\System32\NlsLexicons0007.dll
2008-10-06 15:08 . 2008-06-26 02:45 2,644,480 --a------ C:\WINDOWS\System32\NlsLexicons0009.dll
2008-10-06 15:07 . 2008-06-26 04:29 801,280 --a------ C:\WINDOWS\System32\NaturalLanguage6.dll
2008-10-06 15:05 . 2008-07-31 02:13 4,240,384 --a------ C:\WINDOWS\System32\GameUXLegacyGDFs.dll
2008-10-06 15:05 . 2008-04-26 09:26 891,448 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
2008-10-06 15:05 . 2008-04-12 04:32 784,896 --a------ C:\WINDOWS\System32\rpcrt4.dll
2008-10-06 15:05 . 2008-06-19 04:31 361,984 --a------ C:\WINDOWS\System32\IPSECSVC.DLL
2008-10-06 15:05 . 2008-04-05 02:21 72,192 --a------ C:\WINDOWS\System32\drivers\pacer.sys
2008-10-06 15:05 . 2008-07-31 04:32 28,160 --a------ C:\WINDOWS\System32\Apphlpdm.dll
2008-10-06 15:05 . 2008-04-05 04:34 15,360 --a------ C:\WINDOWS\System32\pacerprf.dll
2008-10-06 14:41 . 2008-07-19 06:09 1,811,656 --a------ C:\WINDOWS\System32\wuaueng.dll
2008-10-06 14:41 . 2008-07-19 04:44 1,524,736 --a------ C:\WINDOWS\System32\wucltux.dll
2008-10-06 14:41 . 2008-07-19 06:09 563,912 --a------ C:\WINDOWS\System32\wuapi.dll
2008-10-06 14:41 . 2008-07-19 04:44 83,456 --a------ C:\WINDOWS\System32\wudriver.dll
2008-10-06 14:41 . 2008-07-19 06:10 53,448 --a------ C:\WINDOWS\System32\wuauclt.exe
2008-10-06 14:41 . 2008-07-19 06:10 45,768 --a------ C:\WINDOWS\System32\wups2.dll
2008-10-06 14:41 . 2008-07-19 06:10 36,552 --a------ C:\WINDOWS\System32\wups.dll
2008-10-06 14:40 . 2008-07-18 21:08 163,904 --a------ C:\WINDOWS\System32\wuwebv.dll
2008-10-06 14:40 . 2008-07-18 19:44 31,232 --a------ C:\WINDOWS\System32\wuapp.exe
2008-10-06 14:24 . 2008-10-06 14:24 <REP> d-------- C:\Program Files\Securitoo
2008-10-06 14:24 . 2006-11-28 19:46 28,224 --a------ C:\WINDOWS\System32\drivers\PCAMp50.sys
2008-10-06 14:24 . 2006-11-28 19:46 27,072 --a------ C:\WINDOWS\System32\drivers\PCASp50.sys
2008-10-06 14:22 . 2008-10-06 14:49 <REP> d-------- C:\Program Files\OrangeHSS
2008-10-06 14:22 . 2007-12-11 19:22 65,536 --a------ C:\WINDOWS\System32\Autodial2000.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
2008-10-29 09:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-26 09:38 --------- d-----w C:\Program Files\Hamachi
2008-10-23 19:36 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-10-20 10:28 --------- d-----w C:\Program Files\Windows Live
2008-10-16 01:13 --------- d-----w C:\Program Files\Windows Mail
2008-10-16 01:04 --------- d-----w C:\ProgramData\Microsoft Help
2008-10-12 19:24 --------- d-----w C:\Program Files\LimeWire
2008-10-11 20:50 --------- d-----w C:\ProgramData\WLInstaller
2008-10-10 10:36 --------- d-----w C:\Program Files\QuickTime
2008-10-10 10:35 --------- d-----w C:\Program Files\Common Files\Apple
2008-10-08 11:31 --------- d-----w C:\Program Files\FinePixViewer
2008-10-08 11:27 --------- d-----w C:\Users\Anne-laure\AppData\Roaming\FUJIFILM
2008-10-08 11:23 --------- d-----w C:\Users\Véronique\AppData\Roaming\FUJIFILM
2008-08-29 08:18 87,336 ----a-w C:\Windows\System32\dns-sd.exe
2008-08-29 07:53 61,440 ----a-w C:\Windows\System32\dnssd.dll
2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-20 17:38 1,435,224 ----a-w C:\Users\nanou\TMPGEnc-2.524.63.181-Free.zip
2008-06-20 17:05 1,665,325 ----a-w C:\Users\nanou\agfreesetup.exe
2008-06-20 16:31 1,579,972 ----a-w C:\Users\nanou\dvdaudioextractor.exe
2008-06-10 19:38 20,019 ----a-w C:\Users\nanou\unfreez.zip
2008-05-31 19:45 3,115,008 ----a-w C:\Users\nanou\AudioVideo_To_Exe(English).exe
2008-05-28 09:46 47,360 ----a-w C:\Users\Véronique\AppData\Roaming\pcouffin.sys
2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
2008-04-28 01:45 174 --sha-w C:\Program Files\desktop.ini
2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-04-27 07:45 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 C:\WINDOWS\System32\oobefldr.dll]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"au"="C:\Program Files\Dealio\DealioAU.exe" [2008-04-16 591200]
"ORAHSSSessionManager"="C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
"F-Secure Manager"="C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2008-04-23 182936]
"F-Secure TNB"="C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2008-04-23 744032]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 3770024]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"PCDAS"="C:\Program Files\Defenza\pcd-as.exe" [2006-12-15 1359872]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="C:\Windows\SMINST\launcher.exe" [2007-03-07 44168]
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Outil de notification Live Search.lnk - C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-10-20 143360]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2008-06-15 303104]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2BF1B30A-E70B-40C0-A49B-E32E0357E594}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5DE2C203-A710-4888-A4A0-B03BC6F9F7EE}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AB26A2BA-3E21-4EDC-BA86-74252A1E9B60}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{0F718442-4349-481B-B9BE-0434243B45CC}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{2584FB02-825A-4197-BCA8-5DEFEA1D7FC3}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{7D89EE86-9CF5-4C71-B679-C896786B9327}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{23CCE833-C21A-4284-942A-1E2BDC544952}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{158F0404-1BBA-48A7-B105-4CFF6C637FA8}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"TCP Query User{E4240EF3-695C-4EAC-834B-580750BF9B6A}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{BA578043-7B5F-4C14-A5F0-DD1203936051}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{FB00228A-A7BB-43F6-A5BF-73A7D28205CB}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{440986FF-83C0-400D-93B1-ECA44E786697}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"TCP Query User{AECC5E9E-BAE8-4888-9F67-6301045DAADA}C:\\program files\\hamachi\\hamachi.exe"= UDP:C:\program files\hamachi\hamachi.exe:Hamachi Client
"UDP Query User{23AB184E-67A6-4A61-8C12-79AEB04D7169}C:\\program files\\hamachi\\hamachi.exe"= TCP:C:\program files\hamachi\hamachi.exe:Hamachi Client
"TCP Query User{E3F29125-A2B2-4113-8259-25657DFDBDB6}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{9E030592-428F-49C6-A9A2-23D22441CF1A}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{63C96D9E-C7A9-44CE-88BE-0C515539437C}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{2192EAE9-5368-4EE8-8CD3-9C66A8912293}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{6D454281-F9A4-42A7-86FC-C5AE502DEEBA}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{A03C0C98-1D14-4B69-8834-7AF18EE7CBC7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{AD2F44F6-5754-4B64-A8A8-4F6C6A2FA4BF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{112DB924-3F00-438F-ACB8-1C1D58D9EBA6}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{48480C3F-4276-4B3B-9D8B-488BD0F40DEA}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Orange\AntivirusFirewall\HIPS\fshs.sys [2008-10-29 41184]
R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2008-04-23 34752]
R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2008-10-29 60064]
R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsvista.sys [2008-04-23 12896]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2008-04-23 62048]
S3 Brndis;External USB Cable Modem;C:\Windows\system32\DRIVERS\Brndis.sys [2004-02-06 16512]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2008-04-23 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2008-04-23 25184]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f5f6184-012e-11dd-8acc-806e6f6e6963}]
\shell\AutoRun\command - E:\EPSETUP.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{990fee76-9538-11dd-9d90-001bb97e2318}]
\shell\AutoRun\command - J:\InstallTomTomHOME.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9f1fc82-990f-11dd-bed9-001bb97e2318}]
\shell\AutoRun\command - K:\start.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{2D2B0467-6BFE-4217-82E0-E7D63BCEFB92}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{A3BD8618-9E38-4205-94E6-90329DCC055B}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
- - - - ORPHELINS SUPPRIMES - - - -
WebBrowser-{21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Users\Anne-laure\AppData\Roaming\Mozilla\Firefox\Profiles\leichzot.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-30 10:04:59
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
ComboFix 08-10-30.04 - Anne-laure 2008-10-30 9:58:32.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1222 [GMT 1:00]
Lancé depuis: C:\Users\Anne-laure\Desktop\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\FBrowserAdvisor
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk
C:\Users\Véronique\AppData\Roaming\inst.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-30 ))))))))))))))))))))))))))))))))))))
.
2008-10-29 20:37 . 2008-10-29 20:37 401,720 --a------ C:\Users\Anne-laure\HiJackThis.exe
2008-10-29 19:52 . 2008-10-29 19:52 <REP> d-------- C:\Program Files\Trend Micro
2008-10-29 18:04 . 2008-10-29 18:04 <REP> d-------- C:\VundoFix Backups
2008-10-29 15:48 . 2008-10-29 15:55 <REP> d-------- C:\Users\Anne-laure\DoctorWeb
2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-10-29 13:09 . 2008-10-29 13:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-29 11:00 . 2008-10-29 11:00 <REP> d-------- C:\Program Files\Defenza
2008-10-29 11:00 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\System32\Machnm1.exe
2008-10-29 11:00 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\System32\Machnm64.sys
2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\System32\118290.54
2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\118294.78
2008-10-29 11:00 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\System32\Machnm32.sys
2008-10-29 08:38 . 2008-08-12 04:39 443,392 --a------ C:\WINDOWS\System32\win32spl.dll
2008-10-29 08:38 . 2008-09-18 05:56 147,456 --a------ C:\WINDOWS\System32\Faultrep.dll
2008-10-29 08:38 . 2008-09-18 05:56 125,952 --a------ C:\WINDOWS\System32\wersvc.dll
2008-10-28 09:31 . 2008-10-28 09:32 <REP> d-------- C:\Program Files\Photo Story 3 for Windows
2008-10-26 19:53 . 2008-10-28 20:35 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-10-26 10:28 . 2008-10-26 10:28 <REP> d-------- C:\Program Files\The Cleaner Demo
2008-10-26 10:12 . 2008-10-26 10:57 <REP> d-------- C:\Program Files\Trojan Remover
2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\Users\All Users\UDL
2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\ProgramData\UDL
2008-10-23 20:24 . 2006-12-08 03:04 76,800 --a------ C:\WINDOWS\System32\E_FLBBZE.DLL
2008-10-23 20:24 . 2006-04-19 03:00 62,976 --a------ C:\WINDOWS\System32\E_FD4BBZE.DLL
2008-10-23 20:24 . 2004-09-10 21:12 49,152 --a------ C:\WINDOWS\System32\E_DCINST.DLL
2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\Users\All Users\EPSON
2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\ProgramData\EPSON
2008-10-23 20:23 . 2008-10-23 20:32 <REP> d-------- C:\Program Files\EPSON
2008-10-23 20:22 . 2008-10-23 20:22 25 --a------ C:\WINDOWS\CDED92Euro.ini
2008-10-23 07:55 . 2008-08-05 10:49 428,544 --a------ C:\WINDOWS\System32\EncDec.dll
2008-10-23 07:55 . 2008-08-05 10:49 293,376 --a------ C:\WINDOWS\System32\psisdecd.dll
2008-10-23 07:55 . 2008-08-05 10:48 217,088 --a------ C:\WINDOWS\System32\psisrndr.ax
2008-10-23 07:55 . 2008-08-05 10:48 177,664 --a------ C:\WINDOWS\System32\mpg2splt.ax
2008-10-23 07:55 . 2008-08-05 10:48 80,896 --a------ C:\WINDOWS\System32\MSNP.ax
2008-10-18 19:12 . 2008-10-26 10:23 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Hamachi
2008-10-18 19:11 . 2008-10-18 19:11 25,280 --a------ C:\WINDOWS\System32\drivers\hamachi.sys
2008-10-18 17:10 . 2008-10-18 17:55 <REP> d-------- C:\Program Files\Dofus
2008-10-15 10:11 . 2008-10-15 10:11 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Media Player Classic
2008-10-15 07:40 . 2008-09-18 06:09 3,601,464 --a------ C:\WINDOWS\System32\ntkrnlpa.exe
2008-10-15 07:40 . 2008-09-18 06:09 3,549,240 --a------ C:\WINDOWS\System32\ntoskrnl.exe
2008-10-15 07:40 . 2008-09-18 03:16 2,032,640 --a------ C:\WINDOWS\System32\win32k.sys
2008-10-15 07:40 . 2008-10-02 04:49 827,392 --a------ C:\WINDOWS\System32\wininet.dll
2008-10-15 07:40 . 2008-09-03 04:59 468,992 --a------ C:\WINDOWS\System32\newdev.dll
2008-10-15 07:40 . 2008-08-27 02:06 288,768 --a------ C:\WINDOWS\System32\drivers\srv.sys
2008-10-15 07:40 . 2008-09-03 04:58 74,752 --a------ C:\WINDOWS\System32\newdev.exe
2008-10-15 07:39 . 2008-10-02 02:32 1,383,424 --a------ C:\WINDOWS\System32\mshtml.tlb
2008-10-14 18:21 . 2008-10-14 18:21 <REP> d-------- C:\Program Files\Audacity
2008-10-14 18:16 . 2008-10-14 18:16 <REP> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT
2008-10-14 18:16 . 2002-01-05 14:37 344,064 --a------ C:\WINDOWS\System32\msvcr70.dll
2008-10-14 17:42 . 2008-03-21 21:30 3,596,288 --a------ C:\WINDOWS\System32\qt-dx331.dll
2008-10-14 17:42 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\System32\xvidcore.dll
2008-10-14 17:42 . 2008-03-31 22:25 682,496 --a------ C:\WINDOWS\System32\divx.dll
2008-10-14 17:42 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\System32\lameACM.acm
2008-10-14 17:42 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\System32\yv12vfw.dll
2008-10-14 17:42 . 2007-09-04 17:56 164,352 --a------ C:\WINDOWS\System32\unrar.dll
2008-10-14 17:42 . 2008-01-10 13:16 159,839 --a------ C:\WINDOWS\System32\xvidvfw.dll
2008-10-14 17:42 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\System32\ac3acm.acm
2008-10-14 17:42 . 2008-03-21 21:28 81,920 --a------ C:\WINDOWS\System32\dpl100.dll
2008-10-14 17:42 . 2007-10-03 16:03 414 --a------ C:\WINDOWS\System32\lame_acm.xml
2008-10-14 17:41 . 2008-10-14 17:42 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2008-10-14 17:41 . 2008-03-28 18:41 7,680 --a------ C:\WINDOWS\System32\ff_vfw.dll
2008-10-14 17:41 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\System32\ff_vfw.dll.manifest
2008-10-12 20:24 . 2008-10-28 13:14 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\LimeWire
2008-10-11 21:56 . 2008-10-26 10:48 <REP> d-------- C:\Program Files\Windows Live Toolbar
2008-10-11 21:56 . 2008-10-11 21:56 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-10-11 21:20 . 2006-11-29 12:06 3,426,072 --a------ C:\WINDOWS\System32\d3dx9_32.dll
2008-10-11 21:17 . 2008-06-26 04:21 712,704 --a------ C:\WINDOWS\System32\WindowsCodecs.dll
2008-10-11 21:17 . 2008-06-26 04:21 347,648 --a------ C:\WINDOWS\System32\WindowsCodecsExt.dll
2008-10-11 21:14 . 2008-10-11 21:14 <REP> d-------- C:\Program Files\Microsoft
2008-10-11 21:10 . 2008-10-11 21:10 <REP> d-------- C:\Program Files\Common Files\Windows Live
2008-10-11 21:07 . 2008-10-23 20:44 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-10-11 17:17 . 2008-10-11 17:19 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\SecondLife
2008-10-10 11:38 . 2008-04-17 12:12 107,368 --a------ C:\WINDOWS\System32\GEARAspi.dll
2008-10-10 11:38 . 2008-04-17 12:12 15,464 --a------ C:\WINDOWS\System32\drivers\GEARAspiWDM.sys
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Program Files\iTunes
2008-10-10 11:37 . 2008-10-10 11:37 <REP> d-------- C:\Program Files\iPod
2008-10-10 11:36 . 2008-10-10 11:36 <REP> d-------- C:\Program Files\Bonjour
2008-10-10 11:28 . 2008-10-10 11:28 <REP> d-------- C:\Program Files\Apple Software Update
2008-10-09 19:49 . 2008-10-09 19:49 <REP> d-------- C:\Program Files\Conjugaison
2008-10-09 19:24 . 2008-10-29 08:32 <REP> d-------- C:\Users\vero\AppData\Roaming\F-Secure
2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\Users\All Users\TomTom
2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\ProgramData\TomTom
2008-10-09 18:26 . 2008-10-30 09:53 <REP> d-------- C:\Program Files\TomTom HOME
2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\TomTom
2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\InstallShield
2008-10-09 18:24 . 2008-10-09 18:24 <REP> d-------- C:\Program Files\TomTom HOME 2
2008-10-09 18:23 . 2008-10-09 18:23 <REP> d-------- C:\Program Files\TomTom DesktopSuite
2008-10-08 12:24 . 2008-10-08 12:24 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\InstallShield
2008-10-08 11:24 . 2008-10-08 11:24 <REP> d-------- C:\Users\vero\AppData\Roaming\Apple Computer
2008-10-07 02:10 . 2008-07-16 02:32 2,048 --a------ C:\WINDOWS\System32\tzres.dll
2008-10-06 16:35 . 2008-10-29 10:49 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\F-Secure
2008-10-06 16:25 . 2008-04-23 17:15 572,512 --a------ C:\WINDOWS\System32\msvcp50.dll
2008-10-06 16:25 . 2008-10-29 10:36 60,064 --a------ C:\WINDOWS\System32\drivers\fsdfw.sys
2008-10-06 16:25 . 2008-04-23 17:11 34,752 --a------ C:\WINDOWS\System32\drivers\fses.sys
2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\Users\All Users\F-Secure
2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\ProgramData\F-Secure
2008-10-06 16:22 . 2008-10-06 16:22 <REP> d-------- C:\Program Files\Orange
2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\Users\All Users\fssg
2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\ProgramData\fssg
2008-10-06 15:08 . 2008-06-26 02:45 12,240,896 --a------ C:\WINDOWS\System32\NlsLexicons0007.dll
2008-10-06 15:08 . 2008-06-26 02:45 2,644,480 --a------ C:\WINDOWS\System32\NlsLexicons0009.dll
2008-10-06 15:07 . 2008-06-26 04:29 801,280 --a------ C:\WINDOWS\System32\NaturalLanguage6.dll
2008-10-06 15:05 . 2008-07-31 02:13 4,240,384 --a------ C:\WINDOWS\System32\GameUXLegacyGDFs.dll
2008-10-06 15:05 . 2008-04-26 09:26 891,448 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
2008-10-06 15:05 . 2008-04-12 04:32 784,896 --a------ C:\WINDOWS\System32\rpcrt4.dll
2008-10-06 15:05 . 2008-06-19 04:31 361,984 --a------ C:\WINDOWS\System32\IPSECSVC.DLL
2008-10-06 15:05 . 2008-04-05 02:21 72,192 --a------ C:\WINDOWS\System32\drivers\pacer.sys
2008-10-06 15:05 . 2008-07-31 04:32 28,160 --a------ C:\WINDOWS\System32\Apphlpdm.dll
2008-10-06 15:05 . 2008-04-05 04:34 15,360 --a------ C:\WINDOWS\System32\pacerprf.dll
2008-10-06 14:41 . 2008-07-19 06:09 1,811,656 --a------ C:\WINDOWS\System32\wuaueng.dll
2008-10-06 14:41 . 2008-07-19 04:44 1,524,736 --a------ C:\WINDOWS\System32\wucltux.dll
2008-10-06 14:41 . 2008-07-19 06:09 563,912 --a------ C:\WINDOWS\System32\wuapi.dll
2008-10-06 14:41 . 2008-07-19 04:44 83,456 --a------ C:\WINDOWS\System32\wudriver.dll
2008-10-06 14:41 . 2008-07-19 06:10 53,448 --a------ C:\WINDOWS\System32\wuauclt.exe
2008-10-06 14:41 . 2008-07-19 06:10 45,768 --a------ C:\WINDOWS\System32\wups2.dll
2008-10-06 14:41 . 2008-07-19 06:10 36,552 --a------ C:\WINDOWS\System32\wups.dll
2008-10-06 14:40 . 2008-07-18 21:08 163,904 --a------ C:\WINDOWS\System32\wuwebv.dll
2008-10-06 14:40 . 2008-07-18 19:44 31,232 --a------ C:\WINDOWS\System32\wuapp.exe
2008-10-06 14:24 . 2008-10-06 14:24 <REP> d-------- C:\Program Files\Securitoo
2008-10-06 14:24 . 2006-11-28 19:46 28,224 --a------ C:\WINDOWS\System32\drivers\PCAMp50.sys
2008-10-06 14:24 . 2006-11-28 19:46 27,072 --a------ C:\WINDOWS\System32\drivers\PCASp50.sys
2008-10-06 14:22 . 2008-10-06 14:49 <REP> d-------- C:\Program Files\OrangeHSS
2008-10-06 14:22 . 2007-12-11 19:22 65,536 --a------ C:\WINDOWS\System32\Autodial2000.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
2008-10-29 09:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-26 09:38 --------- d-----w C:\Program Files\Hamachi
2008-10-23 19:36 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-10-20 10:28 --------- d-----w C:\Program Files\Windows Live
2008-10-16 01:13 --------- d-----w C:\Program Files\Windows Mail
2008-10-16 01:04 --------- d-----w C:\ProgramData\Microsoft Help
2008-10-12 19:24 --------- d-----w C:\Program Files\LimeWire
2008-10-11 20:50 --------- d-----w C:\ProgramData\WLInstaller
2008-10-10 10:36 --------- d-----w C:\Program Files\QuickTime
2008-10-10 10:35 --------- d-----w C:\Program Files\Common Files\Apple
2008-10-08 11:31 --------- d-----w C:\Program Files\FinePixViewer
2008-10-08 11:27 --------- d-----w C:\Users\Anne-laure\AppData\Roaming\FUJIFILM
2008-10-08 11:23 --------- d-----w C:\Users\Véronique\AppData\Roaming\FUJIFILM
2008-08-29 08:18 87,336 ----a-w C:\Windows\System32\dns-sd.exe
2008-08-29 07:53 61,440 ----a-w C:\Windows\System32\dnssd.dll
2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-20 17:38 1,435,224 ----a-w C:\Users\nanou\TMPGEnc-2.524.63.181-Free.zip
2008-06-20 17:05 1,665,325 ----a-w C:\Users\nanou\agfreesetup.exe
2008-06-20 16:31 1,579,972 ----a-w C:\Users\nanou\dvdaudioextractor.exe
2008-06-10 19:38 20,019 ----a-w C:\Users\nanou\unfreez.zip
2008-05-31 19:45 3,115,008 ----a-w C:\Users\nanou\AudioVideo_To_Exe(English).exe
2008-05-28 09:46 47,360 ----a-w C:\Users\Véronique\AppData\Roaming\pcouffin.sys
2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
2008-04-28 01:45 174 --sha-w C:\Program Files\desktop.ini
2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-04-27 07:45 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 C:\WINDOWS\System32\oobefldr.dll]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"au"="C:\Program Files\Dealio\DealioAU.exe" [2008-04-16 591200]
"ORAHSSSessionManager"="C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
"F-Secure Manager"="C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2008-04-23 182936]
"F-Secure TNB"="C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2008-04-23 744032]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 3770024]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"PCDAS"="C:\Program Files\Defenza\pcd-as.exe" [2006-12-15 1359872]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="C:\Windows\SMINST\launcher.exe" [2007-03-07 44168]
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Outil de notification Live Search.lnk - C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-10-20 143360]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2008-06-15 303104]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2BF1B30A-E70B-40C0-A49B-E32E0357E594}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5DE2C203-A710-4888-A4A0-B03BC6F9F7EE}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AB26A2BA-3E21-4EDC-BA86-74252A1E9B60}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{0F718442-4349-481B-B9BE-0434243B45CC}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{2584FB02-825A-4197-BCA8-5DEFEA1D7FC3}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{7D89EE86-9CF5-4C71-B679-C896786B9327}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{23CCE833-C21A-4284-942A-1E2BDC544952}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{158F0404-1BBA-48A7-B105-4CFF6C637FA8}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"TCP Query User{E4240EF3-695C-4EAC-834B-580750BF9B6A}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{BA578043-7B5F-4C14-A5F0-DD1203936051}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{FB00228A-A7BB-43F6-A5BF-73A7D28205CB}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{440986FF-83C0-400D-93B1-ECA44E786697}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"TCP Query User{AECC5E9E-BAE8-4888-9F67-6301045DAADA}C:\\program files\\hamachi\\hamachi.exe"= UDP:C:\program files\hamachi\hamachi.exe:Hamachi Client
"UDP Query User{23AB184E-67A6-4A61-8C12-79AEB04D7169}C:\\program files\\hamachi\\hamachi.exe"= TCP:C:\program files\hamachi\hamachi.exe:Hamachi Client
"TCP Query User{E3F29125-A2B2-4113-8259-25657DFDBDB6}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{9E030592-428F-49C6-A9A2-23D22441CF1A}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{63C96D9E-C7A9-44CE-88BE-0C515539437C}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{2192EAE9-5368-4EE8-8CD3-9C66A8912293}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{6D454281-F9A4-42A7-86FC-C5AE502DEEBA}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{A03C0C98-1D14-4B69-8834-7AF18EE7CBC7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{AD2F44F6-5754-4B64-A8A8-4F6C6A2FA4BF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{112DB924-3F00-438F-ACB8-1C1D58D9EBA6}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{48480C3F-4276-4B3B-9D8B-488BD0F40DEA}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Orange\AntivirusFirewall\HIPS\fshs.sys [2008-10-29 41184]
R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2008-04-23 34752]
R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2008-10-29 60064]
R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsvista.sys [2008-04-23 12896]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2008-04-23 62048]
S3 Brndis;External USB Cable Modem;C:\Windows\system32\DRIVERS\Brndis.sys [2004-02-06 16512]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2008-04-23 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2008-04-23 25184]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f5f6184-012e-11dd-8acc-806e6f6e6963}]
\shell\AutoRun\command - E:\EPSETUP.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{990fee76-9538-11dd-9d90-001bb97e2318}]
\shell\AutoRun\command - J:\InstallTomTomHOME.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9f1fc82-990f-11dd-bed9-001bb97e2318}]
\shell\AutoRun\command - K:\start.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{2D2B0467-6BFE-4217-82E0-E7D63BCEFB92}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{A3BD8618-9E38-4205-94E6-90329DCC055B}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
- - - - ORPHELINS SUPPRIMES - - - -
WebBrowser-{21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Users\Anne-laure\AppData\Roaming\Mozilla\Firefox\Profiles\leichzot.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-30 10:04:59
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
30 oct. 2008 à 10:21
30 oct. 2008 à 10:21
Voilà J'ai fais Exactement Se Que Vous Avez Dit , J'éspere que ça à marcher , voilà le rapport :
ComboFix 08-10-30.04 - Anne-laure 2008-10-30 9:58:32.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1222 [GMT 1:00]
Lancé depuis: C:\Users\Anne-laure\Desktop\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\FBrowserAdvisor
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk
C:\Users\Véronique\AppData\Roaming\inst.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-30 ))))))))))))))))))))))))))))))))))))
.
2008-10-29 20:37 . 2008-10-29 20:37 401,720 --a------ C:\Users\Anne-laure\HiJackThis.exe
2008-10-29 19:52 . 2008-10-29 19:52 <REP> d-------- C:\Program Files\Trend Micro
2008-10-29 18:04 . 2008-10-29 18:04 <REP> d-------- C:\VundoFix Backups
2008-10-29 15:48 . 2008-10-29 15:55 <REP> d-------- C:\Users\Anne-laure\DoctorWeb
2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-10-29 13:09 . 2008-10-29 13:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-29 11:00 . 2008-10-29 11:00 <REP> d-------- C:\Program Files\Defenza
2008-10-29 11:00 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\System32\Machnm1.exe
2008-10-29 11:00 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\System32\Machnm64.sys
2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\System32\118290.54
2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\118294.78
2008-10-29 11:00 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\System32\Machnm32.sys
2008-10-29 08:38 . 2008-08-12 04:39 443,392 --a------ C:\WINDOWS\System32\win32spl.dll
2008-10-29 08:38 . 2008-09-18 05:56 147,456 --a------ C:\WINDOWS\System32\Faultrep.dll
2008-10-29 08:38 . 2008-09-18 05:56 125,952 --a------ C:\WINDOWS\System32\wersvc.dll
2008-10-28 09:31 . 2008-10-28 09:32 <REP> d-------- C:\Program Files\Photo Story 3 for Windows
2008-10-26 19:53 . 2008-10-28 20:35 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-10-26 10:28 . 2008-10-26 10:28 <REP> d-------- C:\Program Files\The Cleaner Demo
2008-10-26 10:12 . 2008-10-26 10:57 <REP> d-------- C:\Program Files\Trojan Remover
2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\Users\All Users\UDL
2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\ProgramData\UDL
2008-10-23 20:24 . 2006-12-08 03:04 76,800 --a------ C:\WINDOWS\System32\E_FLBBZE.DLL
2008-10-23 20:24 . 2006-04-19 03:00 62,976 --a------ C:\WINDOWS\System32\E_FD4BBZE.DLL
2008-10-23 20:24 . 2004-09-10 21:12 49,152 --a------ C:\WINDOWS\System32\E_DCINST.DLL
2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\Users\All Users\EPSON
2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\ProgramData\EPSON
2008-10-23 20:23 . 2008-10-23 20:32 <REP> d-------- C:\Program Files\EPSON
2008-10-23 20:22 . 2008-10-23 20:22 25 --a------ C:\WINDOWS\CDED92Euro.ini
2008-10-23 07:55 . 2008-08-05 10:49 428,544 --a------ C:\WINDOWS\System32\EncDec.dll
2008-10-23 07:55 . 2008-08-05 10:49 293,376 --a------ C:\WINDOWS\System32\psisdecd.dll
2008-10-23 07:55 . 2008-08-05 10:48 217,088 --a------ C:\WINDOWS\System32\psisrndr.ax
2008-10-23 07:55 . 2008-08-05 10:48 177,664 --a------ C:\WINDOWS\System32\mpg2splt.ax
2008-10-23 07:55 . 2008-08-05 10:48 80,896 --a------ C:\WINDOWS\System32\MSNP.ax
2008-10-18 19:12 . 2008-10-26 10:23 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Hamachi
2008-10-18 19:11 . 2008-10-18 19:11 25,280 --a------ C:\WINDOWS\System32\drivers\hamachi.sys
2008-10-18 17:10 . 2008-10-18 17:55 <REP> d-------- C:\Program Files\Dofus
2008-10-15 10:11 . 2008-10-15 10:11 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Media Player Classic
2008-10-15 07:40 . 2008-09-18 06:09 3,601,464 --a------ C:\WINDOWS\System32\ntkrnlpa.exe
2008-10-15 07:40 . 2008-09-18 06:09 3,549,240 --a------ C:\WINDOWS\System32\ntoskrnl.exe
2008-10-15 07:40 . 2008-09-18 03:16 2,032,640 --a------ C:\WINDOWS\System32\win32k.sys
2008-10-15 07:40 . 2008-10-02 04:49 827,392 --a------ C:\WINDOWS\System32\wininet.dll
2008-10-15 07:40 . 2008-09-03 04:59 468,992 --a------ C:\WINDOWS\System32\newdev.dll
2008-10-15 07:40 . 2008-08-27 02:06 288,768 --a------ C:\WINDOWS\System32\drivers\srv.sys
2008-10-15 07:40 . 2008-09-03 04:58 74,752 --a------ C:\WINDOWS\System32\newdev.exe
2008-10-15 07:39 . 2008-10-02 02:32 1,383,424 --a------ C:\WINDOWS\System32\mshtml.tlb
2008-10-14 18:21 . 2008-10-14 18:21 <REP> d-------- C:\Program Files\Audacity
2008-10-14 18:16 . 2008-10-14 18:16 <REP> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT
2008-10-14 18:16 . 2002-01-05 14:37 344,064 --a------ C:\WINDOWS\System32\msvcr70.dll
2008-10-14 17:42 . 2008-03-21 21:30 3,596,288 --a------ C:\WINDOWS\System32\qt-dx331.dll
2008-10-14 17:42 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\System32\xvidcore.dll
2008-10-14 17:42 . 2008-03-31 22:25 682,496 --a------ C:\WINDOWS\System32\divx.dll
2008-10-14 17:42 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\System32\lameACM.acm
2008-10-14 17:42 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\System32\yv12vfw.dll
2008-10-14 17:42 . 2007-09-04 17:56 164,352 --a------ C:\WINDOWS\System32\unrar.dll
2008-10-14 17:42 . 2008-01-10 13:16 159,839 --a------ C:\WINDOWS\System32\xvidvfw.dll
2008-10-14 17:42 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\System32\ac3acm.acm
2008-10-14 17:42 . 2008-03-21 21:28 81,920 --a------ C:\WINDOWS\System32\dpl100.dll
2008-10-14 17:42 . 2007-10-03 16:03 414 --a------ C:\WINDOWS\System32\lame_acm.xml
2008-10-14 17:41 . 2008-10-14 17:42 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2008-10-14 17:41 . 2008-03-28 18:41 7,680 --a------ C:\WINDOWS\System32\ff_vfw.dll
2008-10-14 17:41 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\System32\ff_vfw.dll.manifest
2008-10-12 20:24 . 2008-10-28 13:14 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\LimeWire
2008-10-11 21:56 . 2008-10-26 10:48 <REP> d-------- C:\Program Files\Windows Live Toolbar
2008-10-11 21:56 . 2008-10-11 21:56 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-10-11 21:20 . 2006-11-29 12:06 3,426,072 --a------ C:\WINDOWS\System32\d3dx9_32.dll
2008-10-11 21:17 . 2008-06-26 04:21 712,704 --a------ C:\WINDOWS\System32\WindowsCodecs.dll
2008-10-11 21:17 . 2008-06-26 04:21 347,648 --a------ C:\WINDOWS\System32\WindowsCodecsExt.dll
2008-10-11 21:14 . 2008-10-11 21:14 <REP> d-------- C:\Program Files\Microsoft
2008-10-11 21:10 . 2008-10-11 21:10 <REP> d-------- C:\Program Files\Common Files\Windows Live
2008-10-11 21:07 . 2008-10-23 20:44 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-10-11 17:17 . 2008-10-11 17:19 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\SecondLife
2008-10-10 11:38 . 2008-04-17 12:12 107,368 --a------ C:\WINDOWS\System32\GEARAspi.dll
2008-10-10 11:38 . 2008-04-17 12:12 15,464 --a------ C:\WINDOWS\System32\drivers\GEARAspiWDM.sys
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Program Files\iTunes
2008-10-10 11:37 . 2008-10-10 11:37 <REP> d-------- C:\Program Files\iPod
2008-10-10 11:36 . 2008-10-10 11:36 <REP> d-------- C:\Program Files\Bonjour
2008-10-10 11:28 . 2008-10-10 11:28 <REP> d-------- C:\Program Files\Apple Software Update
2008-10-09 19:49 . 2008-10-09 19:49 <REP> d-------- C:\Program Files\Conjugaison
2008-10-09 19:24 . 2008-10-29 08:32 <REP> d-------- C:\Users\vero\AppData\Roaming\F-Secure
2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\Users\All Users\TomTom
2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\ProgramData\TomTom
2008-10-09 18:26 . 2008-10-30 09:53 <REP> d-------- C:\Program Files\TomTom HOME
2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\TomTom
2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\InstallShield
2008-10-09 18:24 . 2008-10-09 18:24 <REP> d-------- C:\Program Files\TomTom HOME 2
2008-10-09 18:23 . 2008-10-09 18:23 <REP> d-------- C:\Program Files\TomTom DesktopSuite
2008-10-08 12:24 . 2008-10-08 12:24 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\InstallShield
2008-10-08 11:24 . 2008-10-08 11:24 <REP> d-------- C:\Users\vero\AppData\Roaming\Apple Computer
2008-10-07 02:10 . 2008-07-16 02:32 2,048 --a------ C:\WINDOWS\System32\tzres.dll
2008-10-06 16:35 . 2008-10-29 10:49 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\F-Secure
2008-10-06 16:25 . 2008-04-23 17:15 572,512 --a------ C:\WINDOWS\System32\msvcp50.dll
2008-10-06 16:25 . 2008-10-29 10:36 60,064 --a------ C:\WINDOWS\System32\drivers\fsdfw.sys
2008-10-06 16:25 . 2008-04-23 17:11 34,752 --a------ C:\WINDOWS\System32\drivers\fses.sys
2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\Users\All Users\F-Secure
2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\ProgramData\F-Secure
2008-10-06 16:22 . 2008-10-06 16:22 <REP> d-------- C:\Program Files\Orange
2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\Users\All Users\fssg
2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\ProgramData\fssg
2008-10-06 15:08 . 2008-06-26 02:45 12,240,896 --a------ C:\WINDOWS\System32\NlsLexicons0007.dll
2008-10-06 15:08 . 2008-06-26 02:45 2,644,480 --a------ C:\WINDOWS\System32\NlsLexicons0009.dll
2008-10-06 15:07 . 2008-06-26 04:29 801,280 --a------ C:\WINDOWS\System32\NaturalLanguage6.dll
2008-10-06 15:05 . 2008-07-31 02:13 4,240,384 --a------ C:\WINDOWS\System32\GameUXLegacyGDFs.dll
2008-10-06 15:05 . 2008-04-26 09:26 891,448 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
2008-10-06 15:05 . 2008-04-12 04:32 784,896 --a------ C:\WINDOWS\System32\rpcrt4.dll
2008-10-06 15:05 . 2008-06-19 04:31 361,984 --a------ C:\WINDOWS\System32\IPSECSVC.DLL
2008-10-06 15:05 . 2008-04-05 02:21 72,192 --a------ C:\WINDOWS\System32\drivers\pacer.sys
2008-10-06 15:05 . 2008-07-31 04:32 28,160 --a------ C:\WINDOWS\System32\Apphlpdm.dll
2008-10-06 15:05 . 2008-04-05 04:34 15,360 --a------ C:\WINDOWS\System32\pacerprf.dll
2008-10-06 14:41 . 2008-07-19 06:09 1,811,656 --a------ C:\WINDOWS\System32\wuaueng.dll
2008-10-06 14:41 . 2008-07-19 04:44 1,524,736 --a------ C:\WINDOWS\System32\wucltux.dll
2008-10-06 14:41 . 2008-07-19 06:09 563,912 --a------ C:\WINDOWS\System32\wuapi.dll
2008-10-06 14:41 . 2008-07-19 04:44 83,456 --a------ C:\WINDOWS\System32\wudriver.dll
2008-10-06 14:41 . 2008-07-19 06:10 53,448 --a------ C:\WINDOWS\System32\wuauclt.exe
2008-10-06 14:41 . 2008-07-19 06:10 45,768 --a------ C:\WINDOWS\System32\wups2.dll
2008-10-06 14:41 . 2008-07-19 06:10 36,552 --a------ C:\WINDOWS\System32\wups.dll
2008-10-06 14:40 . 2008-07-18 21:08 163,904 --a------ C:\WINDOWS\System32\wuwebv.dll
2008-10-06 14:40 . 2008-07-18 19:44 31,232 --a------ C:\WINDOWS\System32\wuapp.exe
2008-10-06 14:24 . 2008-10-06 14:24 <REP> d-------- C:\Program Files\Securitoo
2008-10-06 14:24 . 2006-11-28 19:46 28,224 --a------ C:\WINDOWS\System32\drivers\PCAMp50.sys
2008-10-06 14:24 . 2006-11-28 19:46 27,072 --a------ C:\WINDOWS\System32\drivers\PCASp50.sys
2008-10-06 14:22 . 2008-10-06 14:49 <REP> d-------- C:\Program Files\OrangeHSS
2008-10-06 14:22 . 2007-12-11 19:22 65,536 --a------ C:\WINDOWS\System32\Autodial2000.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
2008-10-29 09:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-26 09:38 --------- d-----w C:\Program Files\Hamachi
2008-10-23 19:36 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-10-20 10:28 --------- d-----w C:\Program Files\Windows Live
2008-10-16 01:13 --------- d-----w C:\Program Files\Windows Mail
2008-10-16 01:04 --------- d-----w C:\ProgramData\Microsoft Help
2008-10-12 19:24 --------- d-----w C:\Program Files\LimeWire
2008-10-11 20:50 --------- d-----w C:\ProgramData\WLInstaller
2008-10-10 10:36 --------- d-----w C:\Program Files\QuickTime
2008-10-10 10:35 --------- d-----w C:\Program Files\Common Files\Apple
2008-10-08 11:31 --------- d-----w C:\Program Files\FinePixViewer
2008-10-08 11:27 --------- d-----w C:\Users\Anne-laure\AppData\Roaming\FUJIFILM
2008-10-08 11:23 --------- d-----w C:\Users\Véronique\AppData\Roaming\FUJIFILM
2008-08-29 08:18 87,336 ----a-w C:\Windows\System32\dns-sd.exe
2008-08-29 07:53 61,440 ----a-w C:\Windows\System32\dnssd.dll
2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-20 17:38 1,435,224 ----a-w C:\Users\nanou\TMPGEnc-2.524.63.181-Free.zip
2008-06-20 17:05 1,665,325 ----a-w C:\Users\nanou\agfreesetup.exe
2008-06-20 16:31 1,579,972 ----a-w C:\Users\nanou\dvdaudioextractor.exe
2008-06-10 19:38 20,019 ----a-w C:\Users\nanou\unfreez.zip
2008-05-31 19:45 3,115,008 ----a-w C:\Users\nanou\AudioVideo_To_Exe(English).exe
2008-05-28 09:46 47,360 ----a-w C:\Users\Véronique\AppData\Roaming\pcouffin.sys
2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
2008-04-28 01:45 174 --sha-w C:\Program Files\desktop.ini
2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-04-27 07:45 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 C:\WINDOWS\System32\oobefldr.dll]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"au"="C:\Program Files\Dealio\DealioAU.exe" [2008-04-16 591200]
"ORAHSSSessionManager"="C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
"F-Secure Manager"="C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2008-04-23 182936]
"F-Secure TNB"="C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2008-04-23 744032]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 3770024]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"PCDAS"="C:\Program Files\Defenza\pcd-as.exe" [2006-12-15 1359872]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="C:\Windows\SMINST\launcher.exe" [2007-03-07 44168]
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Outil de notification Live Search.lnk - C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-10-20 143360]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2008-06-15 303104]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2BF1B30A-E70B-40C0-A49B-E32E0357E594}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5DE2C203-A710-4888-A4A0-B03BC6F9F7EE}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AB26A2BA-3E21-4EDC-BA86-74252A1E9B60}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{0F718442-4349-481B-B9BE-0434243B45CC}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{2584FB02-825A-4197-BCA8-5DEFEA1D7FC3}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{7D89EE86-9CF5-4C71-B679-C896786B9327}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{23CCE833-C21A-4284-942A-1E2BDC544952}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{158F0404-1BBA-48A7-B105-4CFF6C637FA8}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"TCP Query User{E4240EF3-695C-4EAC-834B-580750BF9B6A}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{BA578043-7B5F-4C14-A5F0-DD1203936051}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{FB00228A-A7BB-43F6-A5BF-73A7D28205CB}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{440986FF-83C0-400D-93B1-ECA44E786697}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"TCP Query User{AECC5E9E-BAE8-4888-9F67-6301045DAADA}C:\\program files\\hamachi\\hamachi.exe"= UDP:C:\program files\hamachi\hamachi.exe:Hamachi Client
"UDP Query User{23AB184E-67A6-4A61-8C12-79AEB04D7169}C:\\program files\\hamachi\\hamachi.exe"= TCP:C:\program files\hamachi\hamachi.exe:Hamachi Client
"TCP Query User{E3F29125-A2B2-4113-8259-25657DFDBDB6}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{9E030592-428F-49C6-A9A2-23D22441CF1A}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{63C96D9E-C7A9-44CE-88BE-0C515539437C}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{2192EAE9-5368-4EE8-8CD3-9C66A8912293}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{6D454281-F9A4-42A7-86FC-C5AE502DEEBA}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{A03C0C98-1D14-4B69-8834-7AF18EE7CBC7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{AD2F44F6-5754-4B64-A8A8-4F6C6A2FA4BF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{112DB924-3F00-438F-ACB8-1C1D58D9EBA6}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{48480C3F-4276-4B3B-9D8B-488BD0F40DEA}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Orange\AntivirusFirewall\HIPS\fshs.sys [2008-10-29 41184]
R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2008-04-23 34752]
R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2008-10-29 60064]
R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsvista.sys [2008-04-23 12896]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2008-04-23 62048]
S3 Brndis;External USB Cable Modem;C:\Windows\system32\DRIVERS\Brndis.sys [2004-02-06 16512]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2008-04-23 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2008-04-23 25184]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f5f6184-012e-11dd-8acc-806e6f6e6963}]
\shell\AutoRun\command - E:\EPSETUP.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{990fee76-9538-11dd-9d90-001bb97e2318}]
\shell\AutoRun\command - J:\InstallTomTomHOME.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9f1fc82-990f-11dd-bed9-001bb97e2318}]
\shell\AutoRun\command - K:\start.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{2D2B0467-6BFE-4217-82E0-E7D63BCEFB92}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{A3BD8618-9E38-4205-94E6-90329DCC055B}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
- - - - ORPHELINS SUPPRIMES - - - -
WebBrowser-{21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Users\Anne-laure\AppData\Roaming\Mozilla\Firefox\Profiles\leichzot.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-30 10:04:59
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
ComboFix 08-10-30.04 - Anne-laure 2008-10-30 9:58:32.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1222 [GMT 1:00]
Lancé depuis: C:\Users\Anne-laure\Desktop\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\FBrowserAdvisor
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk
C:\Users\Véronique\AppData\Roaming\inst.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-30 ))))))))))))))))))))))))))))))))))))
.
2008-10-29 20:37 . 2008-10-29 20:37 401,720 --a------ C:\Users\Anne-laure\HiJackThis.exe
2008-10-29 19:52 . 2008-10-29 19:52 <REP> d-------- C:\Program Files\Trend Micro
2008-10-29 18:04 . 2008-10-29 18:04 <REP> d-------- C:\VundoFix Backups
2008-10-29 15:48 . 2008-10-29 15:55 <REP> d-------- C:\Users\Anne-laure\DoctorWeb
2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-10-29 13:09 . 2008-10-29 13:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-29 11:00 . 2008-10-29 11:00 <REP> d-------- C:\Program Files\Defenza
2008-10-29 11:00 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\System32\Machnm1.exe
2008-10-29 11:00 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\System32\Machnm64.sys
2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\System32\118290.54
2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\118294.78
2008-10-29 11:00 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\System32\Machnm32.sys
2008-10-29 08:38 . 2008-08-12 04:39 443,392 --a------ C:\WINDOWS\System32\win32spl.dll
2008-10-29 08:38 . 2008-09-18 05:56 147,456 --a------ C:\WINDOWS\System32\Faultrep.dll
2008-10-29 08:38 . 2008-09-18 05:56 125,952 --a------ C:\WINDOWS\System32\wersvc.dll
2008-10-28 09:31 . 2008-10-28 09:32 <REP> d-------- C:\Program Files\Photo Story 3 for Windows
2008-10-26 19:53 . 2008-10-28 20:35 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-10-26 10:28 . 2008-10-26 10:28 <REP> d-------- C:\Program Files\The Cleaner Demo
2008-10-26 10:12 . 2008-10-26 10:57 <REP> d-------- C:\Program Files\Trojan Remover
2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\Users\All Users\UDL
2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\ProgramData\UDL
2008-10-23 20:24 . 2006-12-08 03:04 76,800 --a------ C:\WINDOWS\System32\E_FLBBZE.DLL
2008-10-23 20:24 . 2006-04-19 03:00 62,976 --a------ C:\WINDOWS\System32\E_FD4BBZE.DLL
2008-10-23 20:24 . 2004-09-10 21:12 49,152 --a------ C:\WINDOWS\System32\E_DCINST.DLL
2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\Users\All Users\EPSON
2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\ProgramData\EPSON
2008-10-23 20:23 . 2008-10-23 20:32 <REP> d-------- C:\Program Files\EPSON
2008-10-23 20:22 . 2008-10-23 20:22 25 --a------ C:\WINDOWS\CDED92Euro.ini
2008-10-23 07:55 . 2008-08-05 10:49 428,544 --a------ C:\WINDOWS\System32\EncDec.dll
2008-10-23 07:55 . 2008-08-05 10:49 293,376 --a------ C:\WINDOWS\System32\psisdecd.dll
2008-10-23 07:55 . 2008-08-05 10:48 217,088 --a------ C:\WINDOWS\System32\psisrndr.ax
2008-10-23 07:55 . 2008-08-05 10:48 177,664 --a------ C:\WINDOWS\System32\mpg2splt.ax
2008-10-23 07:55 . 2008-08-05 10:48 80,896 --a------ C:\WINDOWS\System32\MSNP.ax
2008-10-18 19:12 . 2008-10-26 10:23 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Hamachi
2008-10-18 19:11 . 2008-10-18 19:11 25,280 --a------ C:\WINDOWS\System32\drivers\hamachi.sys
2008-10-18 17:10 . 2008-10-18 17:55 <REP> d-------- C:\Program Files\Dofus
2008-10-15 10:11 . 2008-10-15 10:11 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Media Player Classic
2008-10-15 07:40 . 2008-09-18 06:09 3,601,464 --a------ C:\WINDOWS\System32\ntkrnlpa.exe
2008-10-15 07:40 . 2008-09-18 06:09 3,549,240 --a------ C:\WINDOWS\System32\ntoskrnl.exe
2008-10-15 07:40 . 2008-09-18 03:16 2,032,640 --a------ C:\WINDOWS\System32\win32k.sys
2008-10-15 07:40 . 2008-10-02 04:49 827,392 --a------ C:\WINDOWS\System32\wininet.dll
2008-10-15 07:40 . 2008-09-03 04:59 468,992 --a------ C:\WINDOWS\System32\newdev.dll
2008-10-15 07:40 . 2008-08-27 02:06 288,768 --a------ C:\WINDOWS\System32\drivers\srv.sys
2008-10-15 07:40 . 2008-09-03 04:58 74,752 --a------ C:\WINDOWS\System32\newdev.exe
2008-10-15 07:39 . 2008-10-02 02:32 1,383,424 --a------ C:\WINDOWS\System32\mshtml.tlb
2008-10-14 18:21 . 2008-10-14 18:21 <REP> d-------- C:\Program Files\Audacity
2008-10-14 18:16 . 2008-10-14 18:16 <REP> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT
2008-10-14 18:16 . 2002-01-05 14:37 344,064 --a------ C:\WINDOWS\System32\msvcr70.dll
2008-10-14 17:42 . 2008-03-21 21:30 3,596,288 --a------ C:\WINDOWS\System32\qt-dx331.dll
2008-10-14 17:42 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\System32\xvidcore.dll
2008-10-14 17:42 . 2008-03-31 22:25 682,496 --a------ C:\WINDOWS\System32\divx.dll
2008-10-14 17:42 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\System32\lameACM.acm
2008-10-14 17:42 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\System32\yv12vfw.dll
2008-10-14 17:42 . 2007-09-04 17:56 164,352 --a------ C:\WINDOWS\System32\unrar.dll
2008-10-14 17:42 . 2008-01-10 13:16 159,839 --a------ C:\WINDOWS\System32\xvidvfw.dll
2008-10-14 17:42 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\System32\ac3acm.acm
2008-10-14 17:42 . 2008-03-21 21:28 81,920 --a------ C:\WINDOWS\System32\dpl100.dll
2008-10-14 17:42 . 2007-10-03 16:03 414 --a------ C:\WINDOWS\System32\lame_acm.xml
2008-10-14 17:41 . 2008-10-14 17:42 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2008-10-14 17:41 . 2008-03-28 18:41 7,680 --a------ C:\WINDOWS\System32\ff_vfw.dll
2008-10-14 17:41 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\System32\ff_vfw.dll.manifest
2008-10-12 20:24 . 2008-10-28 13:14 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\LimeWire
2008-10-11 21:56 . 2008-10-26 10:48 <REP> d-------- C:\Program Files\Windows Live Toolbar
2008-10-11 21:56 . 2008-10-11 21:56 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-10-11 21:20 . 2006-11-29 12:06 3,426,072 --a------ C:\WINDOWS\System32\d3dx9_32.dll
2008-10-11 21:17 . 2008-06-26 04:21 712,704 --a------ C:\WINDOWS\System32\WindowsCodecs.dll
2008-10-11 21:17 . 2008-06-26 04:21 347,648 --a------ C:\WINDOWS\System32\WindowsCodecsExt.dll
2008-10-11 21:14 . 2008-10-11 21:14 <REP> d-------- C:\Program Files\Microsoft
2008-10-11 21:10 . 2008-10-11 21:10 <REP> d-------- C:\Program Files\Common Files\Windows Live
2008-10-11 21:07 . 2008-10-23 20:44 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-10-11 17:17 . 2008-10-11 17:19 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\SecondLife
2008-10-10 11:38 . 2008-04-17 12:12 107,368 --a------ C:\WINDOWS\System32\GEARAspi.dll
2008-10-10 11:38 . 2008-04-17 12:12 15,464 --a------ C:\WINDOWS\System32\drivers\GEARAspiWDM.sys
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Program Files\iTunes
2008-10-10 11:37 . 2008-10-10 11:37 <REP> d-------- C:\Program Files\iPod
2008-10-10 11:36 . 2008-10-10 11:36 <REP> d-------- C:\Program Files\Bonjour
2008-10-10 11:28 . 2008-10-10 11:28 <REP> d-------- C:\Program Files\Apple Software Update
2008-10-09 19:49 . 2008-10-09 19:49 <REP> d-------- C:\Program Files\Conjugaison
2008-10-09 19:24 . 2008-10-29 08:32 <REP> d-------- C:\Users\vero\AppData\Roaming\F-Secure
2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\Users\All Users\TomTom
2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\ProgramData\TomTom
2008-10-09 18:26 . 2008-10-30 09:53 <REP> d-------- C:\Program Files\TomTom HOME
2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\TomTom
2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\InstallShield
2008-10-09 18:24 . 2008-10-09 18:24 <REP> d-------- C:\Program Files\TomTom HOME 2
2008-10-09 18:23 . 2008-10-09 18:23 <REP> d-------- C:\Program Files\TomTom DesktopSuite
2008-10-08 12:24 . 2008-10-08 12:24 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\InstallShield
2008-10-08 11:24 . 2008-10-08 11:24 <REP> d-------- C:\Users\vero\AppData\Roaming\Apple Computer
2008-10-07 02:10 . 2008-07-16 02:32 2,048 --a------ C:\WINDOWS\System32\tzres.dll
2008-10-06 16:35 . 2008-10-29 10:49 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\F-Secure
2008-10-06 16:25 . 2008-04-23 17:15 572,512 --a------ C:\WINDOWS\System32\msvcp50.dll
2008-10-06 16:25 . 2008-10-29 10:36 60,064 --a------ C:\WINDOWS\System32\drivers\fsdfw.sys
2008-10-06 16:25 . 2008-04-23 17:11 34,752 --a------ C:\WINDOWS\System32\drivers\fses.sys
2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\Users\All Users\F-Secure
2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\ProgramData\F-Secure
2008-10-06 16:22 . 2008-10-06 16:22 <REP> d-------- C:\Program Files\Orange
2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\Users\All Users\fssg
2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\ProgramData\fssg
2008-10-06 15:08 . 2008-06-26 02:45 12,240,896 --a------ C:\WINDOWS\System32\NlsLexicons0007.dll
2008-10-06 15:08 . 2008-06-26 02:45 2,644,480 --a------ C:\WINDOWS\System32\NlsLexicons0009.dll
2008-10-06 15:07 . 2008-06-26 04:29 801,280 --a------ C:\WINDOWS\System32\NaturalLanguage6.dll
2008-10-06 15:05 . 2008-07-31 02:13 4,240,384 --a------ C:\WINDOWS\System32\GameUXLegacyGDFs.dll
2008-10-06 15:05 . 2008-04-26 09:26 891,448 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
2008-10-06 15:05 . 2008-04-12 04:32 784,896 --a------ C:\WINDOWS\System32\rpcrt4.dll
2008-10-06 15:05 . 2008-06-19 04:31 361,984 --a------ C:\WINDOWS\System32\IPSECSVC.DLL
2008-10-06 15:05 . 2008-04-05 02:21 72,192 --a------ C:\WINDOWS\System32\drivers\pacer.sys
2008-10-06 15:05 . 2008-07-31 04:32 28,160 --a------ C:\WINDOWS\System32\Apphlpdm.dll
2008-10-06 15:05 . 2008-04-05 04:34 15,360 --a------ C:\WINDOWS\System32\pacerprf.dll
2008-10-06 14:41 . 2008-07-19 06:09 1,811,656 --a------ C:\WINDOWS\System32\wuaueng.dll
2008-10-06 14:41 . 2008-07-19 04:44 1,524,736 --a------ C:\WINDOWS\System32\wucltux.dll
2008-10-06 14:41 . 2008-07-19 06:09 563,912 --a------ C:\WINDOWS\System32\wuapi.dll
2008-10-06 14:41 . 2008-07-19 04:44 83,456 --a------ C:\WINDOWS\System32\wudriver.dll
2008-10-06 14:41 . 2008-07-19 06:10 53,448 --a------ C:\WINDOWS\System32\wuauclt.exe
2008-10-06 14:41 . 2008-07-19 06:10 45,768 --a------ C:\WINDOWS\System32\wups2.dll
2008-10-06 14:41 . 2008-07-19 06:10 36,552 --a------ C:\WINDOWS\System32\wups.dll
2008-10-06 14:40 . 2008-07-18 21:08 163,904 --a------ C:\WINDOWS\System32\wuwebv.dll
2008-10-06 14:40 . 2008-07-18 19:44 31,232 --a------ C:\WINDOWS\System32\wuapp.exe
2008-10-06 14:24 . 2008-10-06 14:24 <REP> d-------- C:\Program Files\Securitoo
2008-10-06 14:24 . 2006-11-28 19:46 28,224 --a------ C:\WINDOWS\System32\drivers\PCAMp50.sys
2008-10-06 14:24 . 2006-11-28 19:46 27,072 --a------ C:\WINDOWS\System32\drivers\PCASp50.sys
2008-10-06 14:22 . 2008-10-06 14:49 <REP> d-------- C:\Program Files\OrangeHSS
2008-10-06 14:22 . 2007-12-11 19:22 65,536 --a------ C:\WINDOWS\System32\Autodial2000.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
2008-10-29 09:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-26 09:38 --------- d-----w C:\Program Files\Hamachi
2008-10-23 19:36 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-10-20 10:28 --------- d-----w C:\Program Files\Windows Live
2008-10-16 01:13 --------- d-----w C:\Program Files\Windows Mail
2008-10-16 01:04 --------- d-----w C:\ProgramData\Microsoft Help
2008-10-12 19:24 --------- d-----w C:\Program Files\LimeWire
2008-10-11 20:50 --------- d-----w C:\ProgramData\WLInstaller
2008-10-10 10:36 --------- d-----w C:\Program Files\QuickTime
2008-10-10 10:35 --------- d-----w C:\Program Files\Common Files\Apple
2008-10-08 11:31 --------- d-----w C:\Program Files\FinePixViewer
2008-10-08 11:27 --------- d-----w C:\Users\Anne-laure\AppData\Roaming\FUJIFILM
2008-10-08 11:23 --------- d-----w C:\Users\Véronique\AppData\Roaming\FUJIFILM
2008-08-29 08:18 87,336 ----a-w C:\Windows\System32\dns-sd.exe
2008-08-29 07:53 61,440 ----a-w C:\Windows\System32\dnssd.dll
2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-20 17:38 1,435,224 ----a-w C:\Users\nanou\TMPGEnc-2.524.63.181-Free.zip
2008-06-20 17:05 1,665,325 ----a-w C:\Users\nanou\agfreesetup.exe
2008-06-20 16:31 1,579,972 ----a-w C:\Users\nanou\dvdaudioextractor.exe
2008-06-10 19:38 20,019 ----a-w C:\Users\nanou\unfreez.zip
2008-05-31 19:45 3,115,008 ----a-w C:\Users\nanou\AudioVideo_To_Exe(English).exe
2008-05-28 09:46 47,360 ----a-w C:\Users\Véronique\AppData\Roaming\pcouffin.sys
2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
2008-04-28 01:45 174 --sha-w C:\Program Files\desktop.ini
2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-04-27 07:45 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 C:\WINDOWS\System32\oobefldr.dll]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"au"="C:\Program Files\Dealio\DealioAU.exe" [2008-04-16 591200]
"ORAHSSSessionManager"="C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
"F-Secure Manager"="C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2008-04-23 182936]
"F-Secure TNB"="C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2008-04-23 744032]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 3770024]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"PCDAS"="C:\Program Files\Defenza\pcd-as.exe" [2006-12-15 1359872]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="C:\Windows\SMINST\launcher.exe" [2007-03-07 44168]
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Outil de notification Live Search.lnk - C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-10-20 143360]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2008-06-15 303104]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2BF1B30A-E70B-40C0-A49B-E32E0357E594}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5DE2C203-A710-4888-A4A0-B03BC6F9F7EE}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AB26A2BA-3E21-4EDC-BA86-74252A1E9B60}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{0F718442-4349-481B-B9BE-0434243B45CC}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{2584FB02-825A-4197-BCA8-5DEFEA1D7FC3}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{7D89EE86-9CF5-4C71-B679-C896786B9327}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{23CCE833-C21A-4284-942A-1E2BDC544952}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{158F0404-1BBA-48A7-B105-4CFF6C637FA8}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"TCP Query User{E4240EF3-695C-4EAC-834B-580750BF9B6A}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{BA578043-7B5F-4C14-A5F0-DD1203936051}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{FB00228A-A7BB-43F6-A5BF-73A7D28205CB}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{440986FF-83C0-400D-93B1-ECA44E786697}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"TCP Query User{AECC5E9E-BAE8-4888-9F67-6301045DAADA}C:\\program files\\hamachi\\hamachi.exe"= UDP:C:\program files\hamachi\hamachi.exe:Hamachi Client
"UDP Query User{23AB184E-67A6-4A61-8C12-79AEB04D7169}C:\\program files\\hamachi\\hamachi.exe"= TCP:C:\program files\hamachi\hamachi.exe:Hamachi Client
"TCP Query User{E3F29125-A2B2-4113-8259-25657DFDBDB6}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{9E030592-428F-49C6-A9A2-23D22441CF1A}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{63C96D9E-C7A9-44CE-88BE-0C515539437C}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{2192EAE9-5368-4EE8-8CD3-9C66A8912293}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{6D454281-F9A4-42A7-86FC-C5AE502DEEBA}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{A03C0C98-1D14-4B69-8834-7AF18EE7CBC7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{AD2F44F6-5754-4B64-A8A8-4F6C6A2FA4BF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{112DB924-3F00-438F-ACB8-1C1D58D9EBA6}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{48480C3F-4276-4B3B-9D8B-488BD0F40DEA}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Orange\AntivirusFirewall\HIPS\fshs.sys [2008-10-29 41184]
R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2008-04-23 34752]
R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2008-10-29 60064]
R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsvista.sys [2008-04-23 12896]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2008-04-23 62048]
S3 Brndis;External USB Cable Modem;C:\Windows\system32\DRIVERS\Brndis.sys [2004-02-06 16512]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2008-04-23 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2008-04-23 25184]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f5f6184-012e-11dd-8acc-806e6f6e6963}]
\shell\AutoRun\command - E:\EPSETUP.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{990fee76-9538-11dd-9d90-001bb97e2318}]
\shell\AutoRun\command - J:\InstallTomTomHOME.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9f1fc82-990f-11dd-bed9-001bb97e2318}]
\shell\AutoRun\command - K:\start.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{2D2B0467-6BFE-4217-82E0-E7D63BCEFB92}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{A3BD8618-9E38-4205-94E6-90329DCC055B}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
- - - - ORPHELINS SUPPRIMES - - - -
WebBrowser-{21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Users\Anne-laure\AppData\Roaming\Mozilla\Firefox\Profiles\leichzot.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-30 10:04:59
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
30 oct. 2008 à 10:23
30 oct. 2008 à 10:23
Oula , pardon
TFais un scan avec cet antispyware :
Telecharge malwarebytes + tutoriel :
-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Tu l´instale; le programme va se mettre automatiquement a jour.
Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".
Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".
Puis click sur "rechercher".
Laisse le scanner le pc...
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "yes".
A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copie et colle le rapport stp.
RES BIEN
ce n est pas finit....
ceci maintenant:
Telecharge malwarebytes + tutoriel :
-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Tu l´instale; le programme va se mettre automatiquement a jour.
Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".
Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".
Puis click sur "rechercher".
Laisse le scanner le pc...
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "yes".
A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copie et colle le rapport stp.
RES BIEN
ce n est pas finit....
ceci maintenant:
tres bien...
ce n est pas fini...
ceci maintenant:
Fais un scan avec cet antispyware :
Telecharge malwarebytes + tutoriel :
-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Tu l´instale; le programme va se mettre automatiquement a jour.
Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".
Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".
Puis click sur "rechercher".
Laisse le scanner le pc...
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "yes".
A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copie et colle le rapport stp.
ce n est pas fini...
ceci maintenant:
Fais un scan avec cet antispyware :
Telecharge malwarebytes + tutoriel :
-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Tu l´instale; le programme va se mettre automatiquement a jour.
Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".
Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".
Puis click sur "rechercher".
Laisse le scanner le pc...
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "yes".
A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copie et colle le rapport stp.
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
30 oct. 2008 à 13:01
30 oct. 2008 à 13:01
Désolé du temps ,, 1h40 Que ça Scan
J'en peux plus xD
J'en peux plus xD
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
30 oct. 2008 à 13:29
30 oct. 2008 à 13:29
Enfin !!
Donc voila le rapport :
Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1338
Windows 6.0.6001 Service Pack 1
30/10/2008 13:21:28
mbam-log-2008-10-30 (13-21-28).txt
Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Eléments examinés: 205346
Temps écoulé: 2 hour(s), 0 minute(s), 32 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 8
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Local Page (Hijack.Search) -> Bad: (http://www.iesearch.com/) Good: (https://www.google.com/?gws_rd=ssl -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Users\Véronique\AppData\Local\Temp\temC94F.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Users\Véronique\AppData\Local\Temp\tem4213.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload\BitDownload Downloads.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload\BitDownload Uninstall.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload\BitDownload.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.
C:\Users\Véronique\Desktop\BitDownload Downloads.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
Donc voila le rapport :
Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1338
Windows 6.0.6001 Service Pack 1
30/10/2008 13:21:28
mbam-log-2008-10-30 (13-21-28).txt
Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Eléments examinés: 205346
Temps écoulé: 2 hour(s), 0 minute(s), 32 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 8
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Local Page (Hijack.Search) -> Bad: (http://www.iesearch.com/) Good: (https://www.google.com/?gws_rd=ssl -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Users\Véronique\AppData\Local\Temp\temC94F.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Users\Véronique\AppData\Local\Temp\tem4213.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload\BitDownload Downloads.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload\BitDownload Uninstall.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload\BitDownload.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.
C:\Users\Véronique\Desktop\BitDownload Downloads.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
30 oct. 2008 à 21:53
30 oct. 2008 à 21:53
Voilà :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:52:44, on 30/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\conime.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
c:\Users\Anne-laure\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O1 - Hosts: 92.48.81.32 iHabbixReloaded
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de notification Live Search.lnk = Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Anne-laure\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Véronique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:52:44, on 30/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\conime.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
c:\Users\Anne-laure\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O1 - Hosts: 92.48.81.32 iHabbixReloaded
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de notification Live Search.lnk = Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Anne-laure\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Véronique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
30 oct. 2008 à 21:53
30 oct. 2008 à 21:53
Voilà :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:52:44, on 30/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\conime.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
c:\Users\Anne-laure\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O1 - Hosts: 92.48.81.32 iHabbixReloaded
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de notification Live Search.lnk = Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Anne-laure\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Véronique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:52:44, on 30/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\conime.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
c:\Users\Anne-laure\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O1 - Hosts: 92.48.81.32 iHabbixReloaded
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de notification Live Search.lnk = Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Anne-laure\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Véronique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
ok.....
y a encore des problemes...
fais ceci:
Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) :
http://siri.urz.free.fr/Fix/SmitfraudFix.exe ou http://www.geekstogo.com/forum/files/file/6-smitfraudfix/
- Enregistre-le sur le bureau
- Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée
- Un rapport sera généré, poste-le dans ta prochaine réponse.
[*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]
** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de
a+
y a encore des problemes...
fais ceci:
Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) :
http://siri.urz.free.fr/Fix/SmitfraudFix.exe ou http://www.geekstogo.com/forum/files/file/6-smitfraudfix/
- Enregistre-le sur le bureau
- Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée
- Un rapport sera généré, poste-le dans ta prochaine réponse.
[*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]
** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de
a+
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
30 oct. 2008 à 22:58
30 oct. 2008 à 22:58
alors voilà c'était tou se qu'il fallait faire ?
...
SmitFraudFix v2.369
Scan done at 22:56:11,19, 30/10/2008
Run from C:\Users\Anne-laure\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\Windows\system32\conime.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Windows\system32\taskeng.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\Explorer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
hosts file corrupted !
127.0.0.1 www.legal-at-spybot.info
127.0.0.1 legal-at-spybot.info
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Anne-laure
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Anne-laure\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\ANNE-L~1\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Contrôleur de réseau NVIDIA nForce
DNS Server Search Order: 192.168.1.1
DNS Server Search Order: 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
...
SmitFraudFix v2.369
Scan done at 22:56:11,19, 30/10/2008
Run from C:\Users\Anne-laure\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\Windows\system32\conime.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Windows\system32\taskeng.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\Explorer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
hosts file corrupted !
127.0.0.1 www.legal-at-spybot.info
127.0.0.1 legal-at-spybot.info
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Anne-laure
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Anne-laure\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\ANNE-L~1\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Contrôleur de réseau NVIDIA nForce
DNS Server Search Order: 192.168.1.1
DNS Server Search Order: 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
oui c est tout...
mais choux blanc.....
fait ceci:
Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)
mais choux blanc.....
fait ceci:
Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
31 oct. 2008 à 11:18
31 oct. 2008 à 11:18
Euh ... Le Lien Ne Marchait Pas Donc J'ai CherChé SUr google en esperent ne pas m'etre trompé
Seul probléme je crois que c'est pas ça xD ... vous pouvez me donner le nom exact de se log??
Seul probléme je crois que c'est pas ça xD ... vous pouvez me donner le nom exact de se log??
j ai testé le lien...il marche
mais avant reprend smitfraudfix et fait ceci:
--Suite de la manipe ( nettoyage ), fais exactement ce qui suit :
* Impératif : Redémarrer l'ordinateur en mode sans échec .
Comment aller en Mode sans échec
1) Redémarre ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
( ps : n'oublies pas , en mode sans échec , pas de connexion ! Donc copies ou imprimes bien les info ci-dessous ...)
*Double click sur SmitfraudFix.exe
* Sélectionnes 2 et presses "Entrée" dans le menu pour supprimer les fichiers responsables de l'infection.
-> Si besion :
* A la question: Voulez-vous nettoyer le registre ? répondre O (oui) et presser Entrée afin de débloquer le fond d'écran et supprimer les clés de registre de l'infection.
( Le correctif déterminera si le fichier wininet.dll est infecté.)
* A la question: "Corriger le fichier infecté ?" répondre O (oui) et presser Entrée
pour remplacer le fichier corrompu.
* Un redémarrage sera peut être nécessaire pour terminer la procédure de nettoyage ( sinon fais le manuellement )
Le rapport se trouve à la racine de C\:
(dans le fichier "rapport.txt")
Postes moi ce dernier rapport ... Attention , il va être trop long pour être poster entièrement sur le forum
--> donc postes moi seulement le début et la fin ( coupes la listes des "fichiers hosts" )
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...
mais avant reprend smitfraudfix et fait ceci:
--Suite de la manipe ( nettoyage ), fais exactement ce qui suit :
* Impératif : Redémarrer l'ordinateur en mode sans échec .
Comment aller en Mode sans échec
1) Redémarre ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
( ps : n'oublies pas , en mode sans échec , pas de connexion ! Donc copies ou imprimes bien les info ci-dessous ...)
*Double click sur SmitfraudFix.exe
* Sélectionnes 2 et presses "Entrée" dans le menu pour supprimer les fichiers responsables de l'infection.
-> Si besion :
* A la question: Voulez-vous nettoyer le registre ? répondre O (oui) et presser Entrée afin de débloquer le fond d'écran et supprimer les clés de registre de l'infection.
( Le correctif déterminera si le fichier wininet.dll est infecté.)
* A la question: "Corriger le fichier infecté ?" répondre O (oui) et presser Entrée
pour remplacer le fichier corrompu.
* Un redémarrage sera peut être nécessaire pour terminer la procédure de nettoyage ( sinon fais le manuellement )
Le rapport se trouve à la racine de C\:
(dans le fichier "rapport.txt")
Postes moi ce dernier rapport ... Attention , il va être trop long pour être poster entièrement sur le forum
--> donc postes moi seulement le début et la fin ( coupes la listes des "fichiers hosts" )
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
1 nov. 2008 à 15:13
1 nov. 2008 à 15:13
Bonjur , Excusez Moi pour le temps de réponse je n'ai pas pu venir
Voilà :
Ca C'est Le Début :
SmitFraudFix v2.369
Scan done at 14:52:18,20, 01/11/2008
Run from C:\Users\Anne-laure\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
Et Ca C'est La Fin Du Rapport :
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
Voilà :
Ca C'est Le Début :
SmitFraudFix v2.369
Scan done at 14:52:18,20, 01/11/2008
Run from C:\Users\Anne-laure\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
Et Ca C'est La Fin Du Rapport :
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
1 nov. 2008 à 15:13
1 nov. 2008 à 15:13
Merci d'être la pour m'aider
RE
desinstalle norton avec ceci
--http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924
et colle 1 nouveau scan hijack stp
a+
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...
desinstalle norton avec ceci
--http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924
et colle 1 nouveau scan hijack stp
a+
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
1 nov. 2008 à 16:05
1 nov. 2008 à 16:05
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:05:01, on 01/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\Users\Anne-laure\HiJackThis.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O1 - Hosts: 92.48.81.32 iHabbixReloaded
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de notification Live Search.lnk = Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Anne-laure\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Véronique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
Scan saved at 16:05:01, on 01/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\Users\Anne-laure\HiJackThis.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O1 - Hosts: 92.48.81.32 iHabbixReloaded
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de notification Live Search.lnk = Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Anne-laure\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Véronique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
NORTONest toujours la...
mais on verra apres
fais ceci2- Télécharges FindyKill de Chiquitine29 :
http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe
->Enregistres le sur ton bureau et pas ailleurs !
!! Déconnectes toi et fermes toute applications en cours !!
( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)
-> Cliques sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.
a+
mais on verra apres
fais ceci2- Télécharges FindyKill de Chiquitine29 :
http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe
->Enregistres le sur ton bureau et pas ailleurs !
!! Déconnectes toi et fermes toute applications en cours !!
( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)
-> Cliques sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.
a+
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
1 nov. 2008 à 16:51
1 nov. 2008 à 16:51
Quand j'ouvre Findyfiil apres lavoir instalé comme prévu ça me dit sa :
Des fichiers sont manquants , l'outils est mal installù !
Findykill ne peut continuer a s'éxecuter ..
Appuyer sur une touche pour quitter Fyndikiill
Rann !!! très énervent , jai suivie a la lettre se que vous m'avez dit !
Des fichiers sont manquants , l'outils est mal installù !
Findykill ne peut continuer a s'éxecuter ..
Appuyer sur une touche pour quitter Fyndikiill
Rann !!! très énervent , jai suivie a la lettre se que vous m'avez dit !
essayes ceci:
--https://www.androidworld.fr/
deroule toute la page....
et tout en bas clique sur le n°/18
A+
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...
--https://www.androidworld.fr/
deroule toute la page....
et tout en bas clique sur le n°/18
A+
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...
Help-me-=)
Messages postés
29
Date d'inscription
mercredi 29 octobre 2008
Statut
Membre
Dernière intervention
2 novembre 2008
1 nov. 2008 à 19:20
1 nov. 2008 à 19:20
C'est pareil sa change rien Désolé :s
