Ya une fenetre qui 'ouvre tout seul sur le bu
sangonesall6
Messages postés
83
Statut
Membre
-
geoffrey5 Messages postés 14008 Statut Contributeur sécurité -
geoffrey5 Messages postés 14008 Statut Contributeur sécurité -
Bonjour,
Depuis ce matin une fenétre nommée exodia s'ouvre sans arret sur mon bureau. Il met unable to write to c:\autorun.inf. Et parfois il met login incorrect. Même si je ferme ça revient toujours. Merci d'avance
Depuis ce matin une fenétre nommée exodia s'ouvre sans arret sur mon bureau. Il met unable to write to c:\autorun.inf. Et parfois il met login incorrect. Même si je ferme ça revient toujours. Merci d'avance
Configuration: Windows Vista Internet Explorer 7.0
12 réponses
-
Salut!!
▶ Fais un rapport hijackthis pour que je puisse vérifier les infections de ton pc stp
▶ Télécharge hijackthis et enregistre le fichier d'installation sur ton bureau.
▶ Ensuite double-cliques sur le fichier d'installation puis sur "exécuter".
▶ Cliques sur "Install" en vérifiant que le chemin d'installation est bien dans tes programmes et puis sur "I Accept".
▶ Cliques sur "Do a system scan and save a logfile".
▶ Laisse l'analyse se terminer jusqu'à l'apparition du rapport dans le bloc note.
▶ Ensuite fais un copié/collé du rapport dans ta prochaine réponse sur le forum
Comment copier/coller le rapport :
Quand tu as le rapport à l écran, tu fais ctrl A pour "sélectionner tout" puis ctrl C pour "copier".
ensuite tu viens sur le forum pour me répondre et tu fais ctrl V pour "coller" le rapport. -
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:53:47, on 06/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Larousse\Petit Larousse 2009\bin\Hyperappel.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
H:\lsass.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.sn/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Hyperappel du Petit Larousse 2009.lnk = C:\Program Files\Larousse\Petit Larousse 2009\bin\Hyperappel.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwaredetection_3_0_3_4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
-
-
Ok...
▶ Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
▶ Va dans démarrer puis panneau de configuration
▶ Double Clique sur l'icône "Comptes d'utilisateurs"
▶ Clique ensuite sur désactiver et valide.
▶ Telecharge UsbFix sur ton bureau
▶ Lance l installation avec les parametres par default
▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir
▶ Double clic sur le raccourci UsbFix sur ton bureau
▶ Le pc va redémarer
▶ Apres redémarrage post le rapport UsbFix.txt
* Note : le rapport UsbFix.txt est sauvegardé a la racine du disque
* Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" ,
"Nouvelle tâche" , tapes explorer.exe et valides -
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
-
-------------- UsbFix V2.395 ---------------
* User : TOSHIBA - PC-DE-TOSHIBA
* Outils mis a jours le 03/11/2008 par Chiquitine29 et Chimay8
* Recherche effectuée à 9:47:19 le 06/11/2008
* Windows Vista - Internet Explorer 7.0.6001.18000
--------------- [ Processus actifs ] ----------------
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\taskeng.exe
C:\Windows\lsass.exe
C:\Windows\system32\Dwm.exe
C:\Users\TOSHIBA\AppData\Local\Temp\E2B0.tmp\b2e.exe
C:\Windows\system32\conime.exe
--------------- [ Informations lecteurs ] ----------------
C: - Lecteur fixe
D: - Lecteur fixe
E: - Lecteur fixe
H: - Lecteur amovible
I: - Lecteur amovible
+- Contenu de l'autorun : H:\autorun.inf
[Autorun]
Open=lsass.exe
Shellexe cute=SSCVIHOST.exe
Shell\Open\command=lsass.exe
Shell=Open
shell\open\Default=1
--------------- [ Registre / Startup ] ----------------
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide
IgfxTray REG_SZ C:\Windows\system32\igfxtray.exe
HotKeysCmds REG_SZ C:\Windows\system32\hkcmd.exe
Persistence REG_SZ C:\Windows\system32\igfxpers.exe
Apoint REG_SZ C:\Program Files\Apoint2K\Apoint.exe
SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Camera Assistant Software REG_SZ "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
nod32kui REG_SZ "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
IAAnotif REG_SZ C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Sidebar REG_SZ C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
DAEMON Tools Lite REG_SZ "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe
ehTray.exe REG_SZ C:\Windows\ehome\ehTray.exe
eMuleAutoStart REG_SZ C:\Program Files\eMule\emule.exe -AutoStart
--------------- [ Registre / Mountpoint2 ] ----------------
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33a93256-a721-11dd-8434-001e6846d806}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{80ab24c2-a5dd-11dd-a3fc-001e6846d806}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{80ab24c2-a5dd-11dd-a3fc-001e6846d806}\Shell\open\Command
--------------- [ Nettoyage des disques ] ----------------
Supprimé ! - [06/11/2008 09:45] H:\autorun.inf
Supprimé ! - [08/03/2008 21:54] I:\b.com
--------------- [ Listing des fichiers présents ] ----------------
-> /!\ Le resultat doit etre interprété par un spécialiste /!\
[18/09/2006 21:43][--a------] C:\autoexec.bat
[01/07/2008 10:58][-r-hs----] C:\lsass.exe
[01/07/2008 10:58][-r-hs----] D:\lsass.exe
[01/07/2008 10:58][-r-hs----] E:\lsass.exe
[01/07/2008 10:58][-r-hs----] H:\lsass.exe
[01/07/2008 10:58][-r-hs----] I:\lsass.exe
--------------- ! Fin du rapport ! ----------------
-
-
▶ Télécharge Combofix de sUBs
▶ et enregistre le sur le Bureau.
▶ désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware)
Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
ensuite envois le rapport et refais un nouveau rapport hijackthis stp-
ComboFix 08-11-05.02 - TOSHIBA 2008-11-06 10:36:27.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1887 [GMT 0:00]
Lancé depuis: c:\users\TOSHIBA\Downloads\ComboFix.exe
* Un nouveau point de restauration a été créé
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\lsass.exe
c:\windows\lsass.exe
D:\lsass.exe
E:\lsass.exe
H:\lsass.exe
I:\lsass.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-06 au 2008-11-06 ))))))))))))))))))))))))))))))))))))
.
2008-11-06 09:28 . 2008-11-06 09:47 <REP> d-------- c:\program files\UsbFix
2008-11-06 08:53 . 2008-11-06 08:53 <REP> d-------- c:\program files\Trend Micro
2008-11-05 00:38 . 2008-11-05 00:38 <REP> d-------- c:\users\All Users\Messenger Plus!
2008-11-05 00:38 . 2008-11-05 00:38 <REP> d-------- c:\programdata\Messenger Plus!
2008-11-05 00:00 . 2008-11-05 00:00 <REP> d-------- c:\program files\Messenger Plus! Live
2008-11-05 00:00 . 2008-11-05 00:00 <REP> d-------- c:\program files\Circle Developement
2008-11-04 03:01 . 2007-11-08 09:04 11,967,524 --a------ c:\windows\System32\korwbrkr.lex
2008-11-03 22:14 . 2008-04-26 08:26 891,448 --a------ c:\windows\System32\drivers\tcpip.sys
2008-11-03 22:14 . 2008-04-12 03:32 784,896 --a------ c:\windows\System32\rpcrt4.dll
2008-11-03 22:14 . 2008-04-05 01:21 72,192 --a------ c:\windows\System32\drivers\pacer.sys
2008-11-03 22:14 . 2008-04-05 03:34 15,360 --a------ c:\windows\System32\pacerprf.dll
2008-11-03 21:25 . 2008-11-03 21:25 17,408 --a------ c:\windows\System32\rpcnetp.exe
2008-11-03 21:25 . 2008-11-03 21:25 17,408 --a------ c:\windows\System32\rpcnetp.dll
2008-11-01 19:37 . 2008-11-01 19:38 <REP> d-------- c:\users\All Users\Yahoo!
2008-11-01 19:37 . 2008-11-01 19:38 <REP> d-------- c:\programdata\Yahoo!
2008-11-01 19:37 . 2008-11-01 19:37 <REP> d-------- c:\program files\Yahoo!
2008-11-01 19:33 . 2008-11-01 19:33 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\gtk-2.0
2008-11-01 19:32 . 2008-11-01 19:35 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\.purple
2008-11-01 19:23 . 2008-11-01 19:37 <REP> d-------- c:\program files\Pidgin
2008-11-01 19:23 . 2008-11-01 19:37 <REP> d-------- c:\program files\Common Files\GTK
2008-11-01 19:05 . 2008-11-01 19:05 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-11-01 18:49 . 2008-11-01 18:49 <REP> d-------- C:\PerfLogs
2008-11-01 18:25 . 2008-11-01 18:25 <REP> d-------- C:\3842c41e3a4954a3a1
2008-11-01 16:53 . 2008-05-10 03:35 885,248 --a------ c:\windows\System32\RacEngn.dll
2008-11-01 16:53 . 2008-05-09 22:22 9,127 --a------ c:\windows\System32\RacUR.xml
2008-11-01 16:53 . 2008-05-09 22:22 153 --a------ c:\windows\System32\RacUREx.xml
2008-11-01 16:11 . 2008-09-03 03:59 468,992 --a------ c:\windows\System32\newdev.dll
2008-11-01 16:11 . 2008-09-03 03:58 74,752 --a------ c:\windows\System32\newdev.exe
2008-11-01 15:31 . 2008-11-01 15:31 <REP> d-------- c:\windows\LARAUDIO
2008-11-01 15:31 . 2008-11-01 15:31 2,416 --a------ c:\windows\TTSDRV.INI
2008-11-01 15:31 . 2008-11-01 15:31 297 --a------ c:\windows\ADAPTA.INI
2008-11-01 14:27 . 2008-11-01 14:27 <REP> d-------- c:\windows\USB Vibration
2008-11-01 14:27 . 2008-11-01 14:27 <REP> d-------- c:\program files\USB Vibration
2008-10-31 12:39 . 2008-10-31 12:39 <REP> d-------- c:\users\TOSHIBA\NFS Underground2
2008-10-31 12:16 . 2008-10-31 12:16 <REP> d-------- c:\program files\EA GAMES
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d----c--- c:\windows\System32\DRVSTORE
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\Apple Computer
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\program files\iTunes
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\program files\iPod
2008-10-31 12:12 . 2008-04-17 13:12 107,368 --a------ c:\windows\System32\GEARAspi.dll
2008-10-31 12:12 . 2008-04-17 13:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys
2008-10-31 12:11 . 2008-10-31 12:11 <REP> d-------- c:\program files\QuickTime
2008-10-31 12:11 . 2008-10-31 12:11 <REP> d-------- c:\program files\Bonjour
2008-10-31 12:09 . 2008-10-31 12:09 <REP> d-------- c:\program files\DAEMON Tools Lite
2008-10-31 12:08 . 2008-10-31 12:08 <REP> d-------- c:\program files\Apple Software Update
2008-10-31 12:07 . 2008-10-31 12:11 <REP> d-------- c:\program files\Common Files\Apple
2008-10-30 22:34 . 2008-01-19 07:33 2,623,488 --a------ c:\windows\System32\SLsvc.exe
2008-10-30 22:34 . 2008-01-19 07:36 1,541,120 --a------ c:\windows\System32\onex.dll
2008-10-30 22:32 . 2008-01-19 07:33 8,139,264 --a------ c:\windows\System32\ssBranded.scr
2008-10-30 22:31 . 2008-01-19 06:06 8,147,456 --a------ c:\windows\System32\wmploc.DLL
2008-10-30 22:30 . 2008-01-19 07:36 704,512 --a------ c:\windows\System32\SmiEngine.dll
2008-10-30 22:30 . 2008-01-19 07:36 357,888 --a------ c:\windows\System32\wbemcomn.dll
2008-10-30 22:30 . 2008-01-19 07:34 305,152 --a------ c:\windows\System32\msdelta.dll
2008-10-30 22:30 . 2008-01-19 07:34 258,560 --a------ c:\windows\System32\dpx.dll
2008-10-30 22:30 . 2008-01-19 07:34 246,784 --a------ c:\windows\System32\drvstore.dll
2008-10-30 22:30 . 2008-01-19 07:36 218,624 --a------ c:\windows\System32\wdscore.dll
2008-10-30 22:30 . 2008-01-19 07:36 139,264 --a------ c:\windows\System32\SmiInstaller.dll
2008-10-30 22:30 . 2008-01-19 07:33 130,560 --a------ c:\windows\System32\PkgMgr.exe
2008-10-30 22:30 . 2008-01-19 07:36 129,536 --a------ c:\windows\System32\sqmapi.dll
2008-10-30 22:30 . 2008-01-19 07:35 35,328 --a------ c:\windows\System32\mspatcha.dll
2008-10-30 19:52 . 2007-09-13 14:14 184,320 --a------ c:\windows\System32\igfxres.dll
2008-10-30 12:08 . 2008-10-30 12:08 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\DAEMON Tools
2008-10-30 12:08 . 2008-10-30 12:08 717,296 --a------ c:\windows\System32\drivers\sptd.sys
2008-10-30 10:46 . 2008-10-30 10:46 <REP> d-------- c:\program files\KONAMI
2008-10-30 07:03 . 2008-10-30 07:03 <REP> d-------- c:\program files\Free Music Zilla
2008-10-30 03:05 . 2008-10-30 03:05 269,312 --a------ c:\windows\System32\es.dll
2008-10-30 00:51 . 2008-10-30 00:51 <REP> d-------- c:\users\All Users\eMule
2008-10-30 00:51 . 2008-10-30 00:51 <REP> d-------- c:\programdata\eMule
2008-10-30 00:50 . 2008-11-05 10:23 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\LimeWire
2008-10-30 00:49 . 2008-10-30 00:49 <REP> d-------- c:\program files\Dactylo
2008-10-30 00:48 . 2008-10-30 00:49 <REP> d-------- c:\program files\PhotoFiltre Studio
2008-10-30 00:48 . 2008-10-30 00:48 45 ---h----- c:\windows\dvis5054.dat
2008-10-30 00:47 . 2008-10-30 00:48 <REP> d-------- c:\program files\Java
2008-10-30 00:47 . 2008-10-30 00:47 <REP> d-------- c:\program files\Common Files\Java
2008-10-30 00:20 . 2008-11-01 15:39 <REP> d-------- c:\program files\adslTV
2008-10-30 00:09 . 2008-10-30 00:10 <REP> d-------- c:\program files\Common Files\Adobe
2008-10-30 00:03 . 2008-10-30 00:03 <REP> d-------- c:\windows\System32\Adobe
2008-10-30 00:02 . 2008-10-30 00:02 <REP> dr------- c:\windows\System32\config\systemprofile\Music
2008-10-29 23:56 . 2008-10-29 23:56 <REP> d-------- c:\program files\Lavalys
2008-10-29 23:53 . 2008-10-29 23:53 <REP> d-------- c:\program files\Xilisoft
2008-10-29 23:52 . 2008-10-29 23:52 <REP> d-------- c:\program files\Xvid
2008-10-29 23:52 . 2008-10-29 23:52 <REP> d-------- c:\program files\DsNET Corp
2008-10-29 23:52 . 2007-06-28 18:52 765,952 --a------ c:\windows\System32\xvidcore.dll
2008-10-29 23:52 . 2007-06-28 18:54 180,224 --a------ c:\windows\System32\xvidvfw.dll
2008-10-29 23:52 . 2007-06-28 18:55 77,824 --a------ c:\windows\System32\xvid.ax
2008-10-29 23:51 . 2008-10-29 23:51 <REP> d-------- c:\program files\WinAVI MP4 Converter
2008-10-29 23:47 . 2008-10-29 23:47 <REP> d-------- c:\program files\WinISO
2008-10-29 23:45 . 2008-10-31 12:12 <REP> d-------- c:\users\All Users\Apple Computer
2008-10-29 23:45 . 2008-10-31 12:12 <REP> d-------- c:\programdata\Apple Computer
2008-10-29 23:44 . 2008-10-29 23:44 <REP> d-------- c:\users\All Users\Apple
2008-10-29 23:44 . 2008-10-29 23:44 <REP> d-------- c:\programdata\Apple
2008-10-29 23:42 . 2008-10-29 23:46 <REP> d-------- c:\program files\LimeWire
2008-10-29 23:41 . 2008-10-29 23:42 <REP> d-------- c:\program files\eMule
2008-10-29 23:41 . 2008-10-29 23:41 <REP> d-------- c:\program files\Ares
2008-10-29 23:40 . 2008-10-29 23:40 <REP> d-------- c:\program files\Opera
2008-10-29 23:40 . 2008-10-29 23:40 <REP> d-------- c:\program files\CCleaner
2008-10-29 23:38 . 2008-11-04 10:19 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\vlc
2008-10-29 23:24 . 2008-11-06 06:50 <REP> d-------- c:\program files\Larousse
2008-10-29 23:24 . 2008-10-29 23:24 <REP> d-------- c:\program files\directx
2008-10-29 23:24 . 1998-06-17 19:07 57,344 --a------ c:\windows\System32\Mfc42loc.dll
2008-10-29 21:22 . 2008-10-29 21:30 <REP> d-------- c:\program files\Windows Live Safety Center
2008-10-29 19:52 . 2008-10-30 17:18 <REP> d-------- c:\users\TOSHIBA\Logiciel
2008-10-29 19:52 . 2008-11-05 09:19 <REP> d-------- c:\users\TOSHIBA\BEM
2008-10-29 19:30 . 2008-07-20 17:44 324,120 --a------ c:\windows\System32\drivers\iaStor.sys
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\TOSHIBA\Roaming
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\Intel
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\Public\Roaming
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\Default\Roaming
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\All Users\Roaming
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\programdata\Roaming
2008-10-29 19:28 . 2008-10-29 19:28 <REP> d-------- c:\users\All Users\Intel
2008-10-29 19:28 . 2008-10-29 19:28 <REP> d-------- c:\programdata\Intel
2008-10-29 19:28 . 2008-10-29 19:28 <REP> d-------- c:\program files\Common Files\Intel
2008-10-29 19:28 . 2008-10-29 19:28 <REP> d-------- c:\program files\Cisco
2008-10-29 19:27 . 2008-10-29 19:27 <REP> d-------- c:\program files\Toshiba
2008-10-29 19:23 . 2008-10-29 19:23 <REP> d-------- c:\users\All Users\ma-config.com
2008-10-29 19:23 . 2008-10-29 19:23 <REP> d-------- c:\programdata\ma-config.com
2008-10-29 19:23 . 2008-10-29 19:24 <REP> d-------- c:\program files\ma-config.com
2008-10-29 19:00 . 2008-10-29 19:00 361,984 --a------ c:\windows\System32\IPSECSVC.DLL
2008-10-29 19:00 . 2008-10-29 19:00 272,896 --a------ c:\windows\System32\polstore.dll
2008-10-29 19:00 . 2008-10-29 19:00 61,440 --a------ c:\windows\System32\winipsec.dll
2008-10-29 19:00 . 2008-10-29 19:00 28,672 --a------ c:\windows\System32\FwRemoteSvr.dll
2008-10-29 18:59 . 2008-10-29 18:59 1,820 --a------ c:\windows\System32\rasctrnm.h
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-01 18:59 174 --sha-w c:\program files\desktop.ini
2008-11-01 18:52 --------- d-----w c:\program files\Windows Sidebar
2008-11-01 18:52 --------- d-----w c:\program files\Windows Photo Gallery
2008-11-01 18:52 --------- d-----w c:\program files\Windows Mail
2008-11-01 18:52 --------- d-----w c:\program files\Windows Journal
2008-11-01 18:52 --------- d-----w c:\program files\Windows Collaboration
2008-11-01 18:52 --------- d-----w c:\program files\Windows Calendar
2008-11-01 18:51 --------- d-----w c:\program files\Windows Defender
2008-11-01 18:29 82,432 ----a-w c:\windows\System32\axaltocm.dll
2008-11-01 18:29 101,888 ----a-w c:\windows\System32\ifxcardm.dll
2008-10-29 18:58 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-10-29 18:58 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-10-29 18:58 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
2008-10-29 18:58 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-10-29 18:58 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-10-29 18:35 801,280 ----a-w c:\windows\System32\NaturalLanguage6.dll
2008-10-29 13:10 --------- d-----w c:\program files\MSBuild
2008-10-29 10:28 --------- d-sh--w c:\programdata\Modèles
2008-10-29 10:28 --------- d-sh--w c:\programdata\Menu Démarrer
2008-10-29 10:28 --------- d-sh--w c:\programdata\Favoris
2008-10-29 10:28 --------- d-sh--w c:\programdata\Bureau
2008-10-29 10:28 --------- d-sh--w c:\program files\Fichiers communs
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-08-29 10:18 87,336 ----a-w c:\windows\System32\dns-sd.exe
2008-08-29 09:53 61,440 ----a-w c:\windows\System32\dnssd.dll
2008-08-20 16:24 774,144 ----a-w c:\windows\System32\wlihvui.dll
2008-08-20 16:18 987,136 ----a-w c:\windows\System32\iwmssvc.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"eMuleAutoStart"="c:\program files\eMule\emule.exe" [2008-08-01 5480448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-25 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-25 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-25 129560]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-12-15 184320]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-29 1029416]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-10-25 413696]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-10-29 949376]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Hyperappel du Petit Larousse 2009.lnk - c:\program files\Larousse\Petit Larousse 2009\bin\Hyperappel.exe [2008-11-06 237568]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7DE29AAA-CF77-4573-9C62-192BF414065A}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{2218B1AF-E0FD-4880-8B2E-F46719BDB171}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{B98B3EF2-8558-49F2-8206-973F3900DFBF}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{E5576112-D07F-4381-B12D-4B7545226AA9}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{7F49B2AC-8C84-44A2-AEAE-D2AB8C2CB298}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{5AC1AF45-1C3E-4A1F-ACF2-99C7F639F2A5}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{93DFF1A9-C917-42B4-9E86-2379665BF836}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{3F93EABF-596E-4E68-ACC5-D96D37F549DD}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"TCP Query User{A1DAE003-BF0C-41F4-BE7C-992D7C6308C8}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{7C324F92-8DE2-42C3-B38C-008E0F1F24C4}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{3A6DD3C3-BA15-4E60-87C1-04176CAE3444}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{0925CBC1-59A5-4C42-BA0A-BA27D79FCC24}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{A3BB271A-33BB-41EE-BCD2-2A3AA106ECC1}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{C62E622B-1091-4C8E-B25E-C226513A38F1}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{E610001E-AA17-4905-AF96-9279C2779DE0}c:\\program files\\konami\\pro evolution soccer 6\\pes6.exe"= UDP:c:\program files\konami\pro evolution soccer 6\pes6.exe:pes6.exe
"UDP Query User{651DEA55-CFDD-408B-A2C8-F21B2EC5F72E}c:\\program files\\konami\\pro evolution soccer 6\\pes6.exe"= TCP:c:\program files\konami\pro evolution soccer 6\pes6.exe:pes6.exe
"{CB199C02-737D-42A1-8141-F6BEFBC65466}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{0BE5EFD7-C00A-47FE-9652-B39FDF186AEA}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{03239B30-CDDB-4B27-AC73-7906BB8BC6E9}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{7FE57755-644F-420F-96AF-141485E63DF4}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{62EDDBD9-8BFE-4029-8B3D-84DB336644D9}c:\\program files\\ea games\\need for speed underground 2\\speed2.exe"= UDP:c:\program files\ea games\need for speed underground 2\speed2.exe:speed2
"UDP Query User{13929A16-05D4-47AF-B1A1-24131B741815}c:\\program files\\ea games\\need for speed underground 2\\speed2.exe"= TCP:c:\program files\ea games\need for speed underground 2\speed2.exe:speed2
"{6668C407-4EEB-4CE1-B505-09916628035B}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{5E41161C-4E46-4469-B257-DB6C317B1403}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{E7635AFE-5345-40FF-85A2-1E2AB28A3CF4}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"TCP Query User{E4E7D761-3BA9-4D7F-8F34-9C17E553F9C9}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{F6EB45D1-E8F8-49E4-ADBC-A7031E02FACE}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{B93D1CCE-2750-4B9C-8466-7EEFB85F3FCE}c:\\program files\\ea games\\need for speed underground 2\\speed2.exe"= UDP:c:\program files\ea games\need for speed underground 2\speed2.exe:speed2
"UDP Query User{6BF1B7CA-CB4D-444E-8633-D432D559EA6F}c:\\program files\\ea games\\need for speed underground 2\\speed2.exe"= TCP:c:\program files\ea games\need for speed underground 2\speed2.exe:speed2
R3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDART.sys [2008-02-01 187904]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-08-28 3664384]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2008-01-15 48472]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [2008-08-25 77824]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk60x86.sys [2007-12-28 298496]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\system32\drivers\royal.sys [2008-10-29 240128]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-10-28 195752]
S3 RTL8187B;Adaptateur réseau USB 2.0 54Mbps, 802.11b/g sans fil Realtek RTL8187B;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-12-26 290304]
S3 RTL85n86;Pilote du périphérique sans fil Realtek 8180/8185 Extensible 802.11;c:\windows\system32\DRIVERS\RTL85n86.sys [2006-11-02 311808]
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-11-06 c:\windows\Tasks\User_Feed_Synchronization-{B282DC8A-121F-42D5-A3DE-78D9D5B277D7}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 07:33]
.
.
------- Examen supplémentaire -------
.
O8 -: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://ma-config.com/activex/hardwaredetection_3_0_3_4.cab
c:\windows\Downloaded Program Files\hardwaredetection.inf
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-06 10:44:55
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-11-06 10:46:45
ComboFix-quarantined-files.txt 2008-11-06 10:46:41
Avant-CF: 39 179 800 576 octets libres
Après-CF: 38,938,095,616 octets libres
268 --- E O F --- 2008-11-05 14:12:44
-
-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:53:47, on 06/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Larousse\Petit Larousse 2009\bin\Hyperappel.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
H:\lsass.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.sn/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Hyperappel du Petit Larousse 2009.lnk = C:\Program Files\Larousse\Petit Larousse 2009\bin\Hyperappel.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwaredetection_3_0_3_4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
-
ok maintenant refais un nouveau rapport hijackthis stp
-
▶ Copie le texte en gras ci-dessous :
File::
C:\lsass.exe
c:\windows\lsass.exe
D:\lsass.exe
E:\lsass.exe
H:\lsass.exe
I:\lsass.exe
Folder::
Registry::
▶ Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
▶ Sauvegarde ce fichier sous le nom de CFScript.txt.
▶ Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif
▶ Cela va relancer Combofix,
▶ Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
▶ Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
▶ Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
▶ S'il n'y a pas de rédémarrage, poste quand même les rapports.-
ComboFix 08-11-05.02 - TOSHIBA 2008-11-06 15:05:43.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1698 [GMT 0:00]
Lancé depuis: c:\users\TOSHIBA\Downloads\ComboFix.exe
Commutateurs utilisés :: c:\users\TOSHIBA\Downloads\CFScript.txt
* Un nouveau point de restauration a été créé
* Resident AV is active
FILE ::
C:\lsass.exe
c:\windows\lsass.exe
D:\lsass.exe
E:\lsass.exe
H:\lsass.exe
I:\lsass.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-06 au 2008-11-06 ))))))))))))))))))))))))))))))))))))
.
2008-11-06 09:28 . 2008-11-06 09:47 <REP> d-------- c:\program files\UsbFix
2008-11-06 08:53 . 2008-11-06 08:53 <REP> d-------- c:\program files\Trend Micro
2008-11-05 00:38 . 2008-11-05 00:38 <REP> d-------- c:\users\All Users\Messenger Plus!
2008-11-05 00:38 . 2008-11-05 00:38 <REP> d-------- c:\programdata\Messenger Plus!
2008-11-05 00:00 . 2008-11-05 00:00 <REP> d-------- c:\program files\Messenger Plus! Live
2008-11-05 00:00 . 2008-11-05 00:00 <REP> d-------- c:\program files\Circle Developement
2008-11-03 22:14 . 2008-04-26 08:26 891,448 --a------ c:\windows\System32\drivers\tcpip.sys
2008-11-03 22:14 . 2008-04-12 03:32 784,896 --a------ c:\windows\System32\rpcrt4.dll
2008-11-03 22:14 . 2008-04-05 01:21 72,192 --a------ c:\windows\System32\drivers\pacer.sys
2008-11-03 22:14 . 2008-04-05 03:34 15,360 --a------ c:\windows\System32\pacerprf.dll
2008-11-03 21:25 . 2008-11-03 21:25 17,408 --a------ c:\windows\System32\rpcnetp.exe
2008-11-03 21:25 . 2008-11-03 21:25 17,408 --a------ c:\windows\System32\rpcnetp.dll
2008-11-01 19:37 . 2008-11-01 19:38 <REP> d-------- c:\users\All Users\Yahoo!
2008-11-01 19:37 . 2008-11-01 19:38 <REP> d-------- c:\programdata\Yahoo!
2008-11-01 19:37 . 2008-11-01 19:37 <REP> d-------- c:\program files\Yahoo!
2008-11-01 19:33 . 2008-11-01 19:33 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\gtk-2.0
2008-11-01 19:32 . 2008-11-01 19:35 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\.purple
2008-11-01 19:23 . 2008-11-01 19:37 <REP> d-------- c:\program files\Pidgin
2008-11-01 19:23 . 2008-11-01 19:37 <REP> d-------- c:\program files\Common Files\GTK
2008-11-01 19:05 . 2008-11-01 19:05 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-11-01 18:49 . 2008-11-01 18:49 <REP> d-------- C:\PerfLogs
2008-11-01 18:25 . 2008-11-01 18:25 <REP> d-------- C:\3842c41e3a4954a3a1
2008-11-01 16:53 . 2008-05-10 03:35 885,248 --a------ c:\windows\System32\RacEngn.dll
2008-11-01 16:53 . 2008-05-09 22:22 9,127 --a------ c:\windows\System32\RacUR.xml
2008-11-01 16:53 . 2008-05-09 22:22 153 --a------ c:\windows\System32\RacUREx.xml
2008-11-01 16:11 . 2008-09-03 03:59 468,992 --a------ c:\windows\System32\newdev.dll
2008-11-01 16:11 . 2008-09-03 03:58 74,752 --a------ c:\windows\System32\newdev.exe
2008-11-01 15:31 . 2008-11-01 15:31 <REP> d-------- c:\windows\LARAUDIO
2008-11-01 15:31 . 2008-11-01 15:31 2,416 --a------ c:\windows\TTSDRV.INI
2008-11-01 15:31 . 2008-11-01 15:31 297 --a------ c:\windows\ADAPTA.INI
2008-11-01 14:27 . 2008-11-01 14:27 <REP> d-------- c:\windows\USB Vibration
2008-11-01 14:27 . 2008-11-01 14:27 <REP> d-------- c:\program files\USB Vibration
2008-10-31 12:39 . 2008-10-31 12:39 <REP> d-------- c:\users\TOSHIBA\NFS Underground2
2008-10-31 12:16 . 2008-10-31 12:16 <REP> d-------- c:\program files\EA GAMES
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d----c--- c:\windows\System32\DRVSTORE
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\Apple Computer
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\program files\iTunes
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\program files\iPod
2008-10-31 12:12 . 2008-04-17 13:12 107,368 --a------ c:\windows\System32\GEARAspi.dll
2008-10-31 12:12 . 2008-04-17 13:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys
2008-10-31 12:11 . 2008-10-31 12:11 <REP> d-------- c:\program files\QuickTime
2008-10-31 12:11 . 2008-10-31 12:11 <REP> d-------- c:\program files\Bonjour
2008-10-31 12:09 . 2008-10-31 12:09 <REP> d-------- c:\program files\DAEMON Tools Lite
2008-10-31 12:08 . 2008-10-31 12:08 <REP> d-------- c:\program files\Apple Software Update
2008-10-31 12:07 . 2008-10-31 12:11 <REP> d-------- c:\program files\Common Files\Apple
2008-10-30 22:34 . 2008-01-19 07:33 2,623,488 --a------ c:\windows\System32\SLsvc.exe
2008-10-30 22:34 . 2008-01-19 07:36 1,541,120 --a------ c:\windows\System32\onex.dll
2008-10-30 22:32 . 2008-01-19 07:33 8,139,264 --a------ c:\windows\System32\ssBranded.scr
2008-10-30 22:31 . 2008-01-19 06:06 8,147,456 --a------ c:\windows\System32\wmploc.DLL
2008-10-30 22:30 . 2008-01-19 07:36 704,512 --a------ c:\windows\System32\SmiEngine.dll
2008-10-30 22:30 . 2008-01-19 07:36 357,888 --a------ c:\windows\System32\wbemcomn.dll
2008-10-30 22:30 . 2008-01-19 07:34 305,152 --a------ c:\windows\System32\msdelta.dll
2008-10-30 22:30 . 2008-01-19 07:34 258,560 --a------ c:\windows\System32\dpx.dll
2008-10-30 22:30 . 2008-01-19 07:34 246,784 --a------ c:\windows\System32\drvstore.dll
2008-10-30 22:30 . 2008-01-19 07:36 218,624 --a------ c:\windows\System32\wdscore.dll
2008-10-30 22:30 . 2008-01-19 07:36 139,264 --a------ c:\windows\System32\SmiInstaller.dll
2008-10-30 22:30 . 2008-01-19 07:33 130,560 --a------ c:\windows\System32\PkgMgr.exe
2008-10-30 22:30 . 2008-01-19 07:36 129,536 --a------ c:\windows\System32\sqmapi.dll
2008-10-30 22:30 . 2008-01-19 07:35 35,328 --a------ c:\windows\System32\mspatcha.dll
2008-10-30 19:52 . 2007-09-13 14:14 184,320 --a------ c:\windows\System32\igfxres.dll
2008-10-30 12:08 . 2008-10-30 12:08 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\DAEMON Tools
2008-10-30 12:08 . 2008-10-30 12:08 717,296 --a------ c:\windows\System32\drivers\sptd.sys
2008-10-30 10:46 . 2008-10-30 10:46 <REP> d-------- c:\program files\KONAMI
2008-10-30 07:03 . 2008-10-30 07:03 <REP> d-------- c:\program files\Free Music Zilla
2008-10-30 03:05 . 2008-10-30 03:05 269,312 --a------ c:\windows\System32\es.dll
2008-10-30 00:51 . 2008-10-30 00:51 <REP> d-------- c:\users\All Users\eMule
2008-10-30 00:51 . 2008-10-30 00:51 <REP> d-------- c:\programdata\eMule
2008-10-30 00:50 . 2008-11-05 10:23 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\LimeWire
2008-10-30 00:49 . 2008-10-30 00:49 <REP> d-------- c:\program files\Dactylo
2008-10-30 00:48 . 2008-10-30 00:49 <REP> d-------- c:\program files\PhotoFiltre Studio
2008-10-30 00:48 . 2008-10-30 00:48 45 ---h----- c:\windows\dvis5054.dat
2008-10-30 00:47 . 2008-10-30 00:48 <REP> d-------- c:\program files\Java
2008-10-30 00:47 . 2008-10-30 00:47 <REP> d-------- c:\program files\Common Files\Java
2008-10-30 00:20 . 2008-11-01 15:39 <REP> d-------- c:\program files\adslTV
2008-10-30 00:09 . 2008-10-30 00:10 <REP> d-------- c:\program files\Common Files\Adobe
2008-10-30 00:03 . 2008-10-30 00:03 <REP> d-------- c:\windows\System32\Adobe
2008-10-30 00:02 . 2008-10-30 00:02 <REP> dr------- c:\windows\System32\config\systemprofile\Music
2008-10-29 23:56 . 2008-10-29 23:56 <REP> d-------- c:\program files\Lavalys
2008-10-29 23:53 . 2008-10-29 23:53 <REP> d-------- c:\program files\Xilisoft
2008-10-29 23:52 . 2008-10-29 23:52 <REP> d-------- c:\program files\Xvid
2008-10-29 23:52 . 2008-10-29 23:52 <REP> d-------- c:\program files\DsNET Corp
2008-10-29 23:52 . 2007-06-28 18:52 765,952 --a------ c:\windows\System32\xvidcore.dll
2008-10-29 23:52 . 2007-06-28 18:54 180,224 --a------ c:\windows\System32\xvidvfw.dll
2008-10-29 23:52 . 2007-06-28 18:55 77,824 --a------ c:\windows\System32\xvid.ax
2008-10-29 23:51 . 2008-10-29 23:51 <REP> d-------- c:\program files\WinAVI MP4 Converter
2008-10-29 23:47 . 2008-10-29 23:47 <REP> d-------- c:\program files\WinISO
2008-10-29 23:45 . 2008-10-31 12:12 <REP> d-------- c:\users\All Users\Apple Computer
2008-10-29 23:45 . 2008-10-31 12:12 <REP> d-------- c:\programdata\Apple Computer
2008-10-29 23:44 . 2008-10-29 23:44 <REP> d-------- c:\users\All Users\Apple
2008-10-29 23:44 . 2008-10-29 23:44 <REP> d-------- c:\programdata\Apple
2008-10-29 23:42 . 2008-10-29 23:46 <REP> d-------- c:\program files\LimeWire
2008-10-29 23:41 . 2008-10-29 23:42 <REP> d-------- c:\program files\eMule
2008-10-29 23:41 . 2008-10-29 23:41 <REP> d-------- c:\program files\Ares
2008-10-29 23:40 . 2008-10-29 23:40 <REP> d-------- c:\program files\Opera
2008-10-29 23:40 . 2008-10-29 23:40 <REP> d-------- c:\program files\CCleaner
2008-10-29 23:38 . 2008-11-06 12:44 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\vlc
2008-10-29 23:24 . 2008-11-06 06:50 <REP> d-------- c:\program files\Larousse
2008-10-29 23:24 . 2008-10-29 23:24 <REP> d-------- c:\program files\directx
2008-10-29 23:24 . 1998-06-17 19:07 57,344 --a------ c:\windows\System32\Mfc42loc.dll
2008-10-29 21:22 . 2008-10-29 21:30 <REP> d-------- c:\program files\Windows Live Safety Center
2008-10-29 19:52 . 2008-10-30 17:18 <REP> d-------- c:\users\TOSHIBA\Logiciel
2008-10-29 19:52 . 2008-11-05 09:19 <REP> d-------- c:\users\TOSHIBA\BEM
2008-10-29 19:30 . 2008-07-20 17:44 324,120 --a------ c:\windows\System32\drivers\iaStor.sys
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\TOSHIBA\Roaming
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\Intel
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\Public\Roaming
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\Default\Roaming
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\All Users\Roaming
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\programdata\Roaming
2008-10-29 19:28 . 2008-10-29 19:28 <REP> d-------- c:\users\All Users\Intel
2008-10-29 19:28 . 2008-10-29 19:28 <REP> d-------- c:\programdata\Intel
2008-10-29 19:28 . 2008-10-29 19:28 <REP> d-------- c:\program files\Common Files\Intel
2008-10-29 19:28 . 2008-10-29 19:28 <REP> d-------- c:\program files\Cisco
2008-10-29 19:27 . 2008-10-29 19:27 <REP> d-------- c:\program files\Toshiba
2008-10-29 19:23 . 2008-10-29 19:23 <REP> d-------- c:\users\All Users\ma-config.com
2008-10-29 19:23 . 2008-10-29 19:23 <REP> d-------- c:\programdata\ma-config.com
2008-10-29 19:23 . 2008-10-29 19:24 <REP> d-------- c:\program files\ma-config.com
2008-10-29 19:00 . 2008-10-29 19:00 361,984 --a------ c:\windows\System32\IPSECSVC.DLL
2008-10-29 19:00 . 2008-10-29 19:00 272,896 --a------ c:\windows\System32\polstore.dll
2008-10-29 19:00 . 2008-10-29 19:00 61,440 --a------ c:\windows\System32\winipsec.dll
2008-10-29 19:00 . 2008-10-29 19:00 28,672 --a------ c:\windows\System32\FwRemoteSvr.dll
2008-10-29 18:59 . 2008-10-29 18:59 1,820 --a------ c:\windows\System32\rasctrnm.h
2008-10-29 18:58 . 2008-10-29 18:58 4,240,384 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-01 18:59 174 --sha-w c:\program files\desktop.ini
2008-11-01 18:52 --------- d-----w c:\program files\Windows Sidebar
2008-11-01 18:52 --------- d-----w c:\program files\Windows Photo Gallery
2008-11-01 18:52 --------- d-----w c:\program files\Windows Mail
2008-11-01 18:52 --------- d-----w c:\program files\Windows Journal
2008-11-01 18:52 --------- d-----w c:\program files\Windows Collaboration
2008-11-01 18:52 --------- d-----w c:\program files\Windows Calendar
2008-11-01 18:51 --------- d-----w c:\program files\Windows Defender
2008-11-01 18:29 82,432 ----a-w c:\windows\System32\axaltocm.dll
2008-11-01 18:29 101,888 ----a-w c:\windows\System32\ifxcardm.dll
2008-10-29 18:58 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-10-29 18:58 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-10-29 18:58 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
2008-10-29 18:58 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-10-29 18:58 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-10-29 18:35 801,280 ----a-w c:\windows\System32\NaturalLanguage6.dll
2008-10-29 13:10 --------- d-----w c:\program files\MSBuild
2008-10-29 10:28 --------- d-sh--w c:\programdata\Modèles
2008-10-29 10:28 --------- d-sh--w c:\programdata\Menu Démarrer
2008-10-29 10:28 --------- d-sh--w c:\programdata\Favoris
2008-10-29 10:28 --------- d-sh--w c:\programdata\Bureau
2008-10-29 10:28 --------- d-sh--w c:\program files\Fichiers communs
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-08-29 10:18 87,336 ----a-w c:\windows\System32\dns-sd.exe
2008-08-29 09:53 61,440 ----a-w c:\windows\System32\dnssd.dll
2008-08-20 16:24 774,144 ----a-w c:\windows\System32\wlihvui.dll
2008-08-20 16:18 987,136 ----a-w c:\windows\System32\iwmssvc.dll
.
((((((((((((((((((((((((((((( snapshot@2008-11-06_10.45.35,55 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-06 09:46:55 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-11-06 10:53:10 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-11-06 09:46:55 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-11-06 10:53:10 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-11-06 09:48:23 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-11-06 15:04:51 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-11-06 15:04:51 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-11-06 09:48:18 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-06 12:05:26 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-06 12:05:26 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
+ 2008-11-06 12:59:22 2,456 ----a-w c:\windows\System32\networklist\icons\{200BEA1B-B8DD-4860-A10D-19C68A873AC5}_24.bin
+ 2008-11-06 12:59:22 4,280 ----a-w c:\windows\System32\networklist\icons\{200BEA1B-B8DD-4860-A10D-19C68A873AC5}_32.bin
+ 2008-11-06 12:59:22 9,560 ----a-w c:\windows\System32\networklist\icons\{200BEA1B-B8DD-4860-A10D-19C68A873AC5}_48.bin
- 2008-11-06 09:53:42 102,094 ----a-w c:\windows\System32\perfc009.dat
+ 2008-11-06 15:07:10 102,094 ----a-w c:\windows\System32\perfc009.dat
- 2008-11-06 09:53:42 124,434 ----a-w c:\windows\System32\perfc00C.dat
+ 2008-11-06 15:07:10 124,434 ----a-w c:\windows\System32\perfc00C.dat
- 2008-11-06 09:53:42 590,082 ----a-w c:\windows\System32\perfh009.dat
+ 2008-11-06 15:07:10 590,082 ----a-w c:\windows\System32\perfh009.dat
- 2008-11-06 09:53:42 672,322 ----a-w c:\windows\System32\perfh00C.dat
+ 2008-11-06 15:07:10 672,322 ----a-w c:\windows\System32\perfh00C.dat
- 2008-11-06 09:48:52 6,548 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1800692337-3776960856-3704569264-1000_UserData.bin
+ 2008-11-06 10:55:00 6,588 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1800692337-3776960856-3704569264-1000_UserData.bin
- 2008-11-06 09:48:52 61,888 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-11-06 10:54:59 62,070 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-11-06 10:52:11 1,662 ----a-w c:\windows\System32\WDI\ERCQueuedResolutions.dat
- 2008-11-06 09:48:48 33,948 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-11-06 10:54:58 34,004 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"eMuleAutoStart"="c:\program files\eMule\emule.exe" [2008-08-01 5480448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-25 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-25 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-25 129560]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-12-15 184320]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-29 1029416]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-10-25 413696]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-10-29 949376]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Hyperappel du Petit Larousse 2009.lnk - c:\program files\Larousse\Petit Larousse 2009\bin\Hyperappel.exe [2008-11-06 237568]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7DE29AAA-CF77-4573-9C62-192BF414065A}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{2218B1AF-E0FD-4880-8B2E-F46719BDB171}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{B98B3EF2-8558-49F2-8206-973F3900DFBF}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{E5576112-D07F-4381-B12D-4B7545226AA9}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{7F49B2AC-8C84-44A2-AEAE-D2AB8C2CB298}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{5AC1AF45-1C3E-4A1F-ACF2-99C7F639F2A5}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{93DFF1A9-C917-42B4-9E86-2379665BF836}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{3F93EABF-596E-4E68-ACC5-D96D37F549DD}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"TCP Query User{A1DAE003-BF0C-41F4-BE7C-992D7C6308C8}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{7C324F92-8DE2-42C3-B38C-008E0F1F24C4}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{3A6DD3C3-BA15-4E60-87C1-04176CAE3444}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{0925CBC1-59A5-4C42-BA0A-BA27D79FCC24}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{A3BB271A-33BB-41EE-BCD2-2A3AA106ECC1}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{C62E622B-1091-4C8E-B25E-C226513A38F1}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{E610001E-AA17-4905-AF96-9279C2779DE0}c:\\program files\\konami\\pro evolution soccer 6\\pes6.exe"= UDP:c:\program files\konami\pro evolution soccer 6\pes6.exe:pes6.exe
"UDP Query User{651DEA55-CFDD-408B-A2C8-F21B2EC5F72E}c:\\program files\\konami\\pro evolution soccer 6\\pes6.exe"= TCP:c:\program files\konami\pro evolution soccer 6\pes6.exe:pes6.exe
"{CB199C02-737D-42A1-8141-F6BEFBC65466}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{0BE5EFD7-C00A-47FE-9652-B39FDF186AEA}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{03239B30-CDDB-4B27-AC73-7906BB8BC6E9}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{7FE57755-644F-420F-96AF-141485E63DF4}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{62EDDBD9-8BFE-4029-8B3D-84DB336644D9}c:\\program files\\ea games\\need for speed underground 2\\speed2.exe"= UDP:c:\program files\ea games\need for speed underground 2\speed2.exe:speed2
"UDP Query User{13929A16-05D4-47AF-B1A1-24131B741815}c:\\program files\\ea games\\need for speed underground 2\\speed2.exe"= TCP:c:\program files\ea games\need for speed underground 2\speed2.exe:speed2
"{6668C407-4EEB-4CE1-B505-09916628035B}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{5E41161C-4E46-4469-B257-DB6C317B1403}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{E7635AFE-5345-40FF-85A2-1E2AB28A3CF4}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"TCP Query User{E4E7D761-3BA9-4D7F-8F34-9C17E553F9C9}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{F6EB45D1-E8F8-49E4-ADBC-A7031E02FACE}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{B93D1CCE-2750-4B9C-8466-7EEFB85F3FCE}c:\\program files\\ea games\\need for speed underground 2\\speed2.exe"= UDP:c:\program files\ea games\need for speed underground 2\speed2.exe:speed2
"UDP Query User{6BF1B7CA-CB4D-444E-8633-D432D559EA6F}c:\\program files\\ea games\\need for speed underground 2\\speed2.exe"= TCP:c:\program files\ea games\need for speed underground 2\speed2.exe:speed2
R3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDART.sys [2008-02-01 187904]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-08-28 3664384]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2008-01-15 48472]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [2008-08-25 77824]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk60x86.sys [2007-12-28 298496]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\system32\drivers\royal.sys [2008-10-29 240128]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-10-28 195752]
S3 RTL8187B;Adaptateur réseau USB 2.0 54Mbps, 802.11b/g sans fil Realtek RTL8187B;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-12-26 290304]
S3 RTL85n86;Pilote du périphérique sans fil Realtek 8180/8185 Extensible 802.11;c:\windows\system32\DRIVERS\RTL85n86.sys [2006-11-02 311808]
.
Contenu du dossier 'Tâches planifiées'
2008-11-06 c:\windows\Tasks\User_Feed_Synchronization-{B282DC8A-121F-42D5-A3DE-78D9D5B277D7}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 07:33]
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-06 15:13:22
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
c:\users\TOSHIBA\AppData\Local\Temp\~DF9AA.tmp 16384 bytes
c:\users\TOSHIBA\AppData\Local\Temp\~DFA46.tmp 512 bytes
c:\users\TOSHIBA\AppData\Local\Temp\~DFFEC1.tmp 163840 bytes
c:\users\TOSHIBA\AppData\Local\Temp\~DFFECA.tmp 512 bytes
Scan terminé avec succès
Fichiers cachés: 4
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
PROCESSUS: c:\windows\Explorer.exe
-> g:\windows\system32\Normaliz.dll
.
Heure de fin: 2008-11-06 15:15:05
ComboFix-quarantined-files.txt 2008-11-06 15:14:58
ComboFix2.txt 2008-11-06 10:46:46
Avant-CF: 37 907 935 232 octets libres
Après-CF: 37,662,593,024 octets libres
298 --- E O F --- 2008-11-05 14:12:44
-
-
refais un nouveau rapport hijackthis stp
-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:53:47, on 06/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Larousse\Petit Larousse 2009\bin\Hyperappel.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
H:\lsass.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.sn/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Hyperappel du Petit Larousse 2009.lnk = C:\Program Files\Larousse\Petit Larousse 2009\bin\Hyperappel.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwaredetection_3_0_3_4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
-
-
supprime combofix et retélécharges le en l installant sur le bureau stp
ensuite refais une analyse et poste son rapport stp (il était mal installé)-
ComboFix 08-11-05.02 - TOSHIBA 2008-11-06 16:34:47.3 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1663 [GMT 0:00]
Lancé depuis: c:\users\TOSHIBA\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\TOSHIBA\Desktop\CFScript.txt
* Un nouveau point de restauration a été créé
* Resident AV is active
FILE ::
C:\lsass.exe
c:\windows\lsass.exe
D:\lsass.exe
E:\lsass.exe
H:\lsass.exe
I:\lsass.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-06 au 2008-11-06 ))))))))))))))))))))))))))))))))))))
.
2008-11-06 09:28 . 2008-11-06 09:47 <REP> d-------- c:\program files\UsbFix
2008-11-06 08:53 . 2008-11-06 08:53 <REP> d-------- c:\program files\Trend Micro
2008-11-05 00:38 . 2008-11-05 00:38 <REP> d-------- c:\users\All Users\Messenger Plus!
2008-11-05 00:38 . 2008-11-05 00:38 <REP> d-------- c:\programdata\Messenger Plus!
2008-11-05 00:00 . 2008-11-05 00:00 <REP> d-------- c:\program files\Messenger Plus! Live
2008-11-05 00:00 . 2008-11-05 00:00 <REP> d-------- c:\program files\Circle Developement
2008-11-03 22:14 . 2008-04-26 08:26 891,448 --a------ c:\windows\System32\drivers\tcpip.sys
2008-11-03 22:14 . 2008-04-12 03:32 784,896 --a------ c:\windows\System32\rpcrt4.dll
2008-11-03 22:14 . 2008-04-05 01:21 72,192 --a------ c:\windows\System32\drivers\pacer.sys
2008-11-03 22:14 . 2008-04-05 03:34 15,360 --a------ c:\windows\System32\pacerprf.dll
2008-11-03 21:25 . 2008-11-03 21:25 17,408 --a------ c:\windows\System32\rpcnetp.exe
2008-11-03 21:25 . 2008-11-03 21:25 17,408 --a------ c:\windows\System32\rpcnetp.dll
2008-11-01 19:37 . 2008-11-01 19:38 <REP> d-------- c:\users\All Users\Yahoo!
2008-11-01 19:37 . 2008-11-01 19:38 <REP> d-------- c:\programdata\Yahoo!
2008-11-01 19:37 . 2008-11-01 19:37 <REP> d-------- c:\program files\Yahoo!
2008-11-01 19:33 . 2008-11-01 19:33 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\gtk-2.0
2008-11-01 19:32 . 2008-11-01 19:35 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\.purple
2008-11-01 19:23 . 2008-11-01 19:37 <REP> d-------- c:\program files\Pidgin
2008-11-01 19:23 . 2008-11-01 19:37 <REP> d-------- c:\program files\Common Files\GTK
2008-11-01 19:05 . 2008-11-01 19:05 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-11-01 18:49 . 2008-11-01 18:49 <REP> d-------- C:\PerfLogs
2008-11-01 18:25 . 2008-11-01 18:25 <REP> d-------- C:\3842c41e3a4954a3a1
2008-11-01 16:53 . 2008-05-10 03:35 885,248 --a------ c:\windows\System32\RacEngn.dll
2008-11-01 16:53 . 2008-05-09 22:22 9,127 --a------ c:\windows\System32\RacUR.xml
2008-11-01 16:53 . 2008-05-09 22:22 153 --a------ c:\windows\System32\RacUREx.xml
2008-11-01 16:11 . 2008-09-03 03:59 468,992 --a------ c:\windows\System32\newdev.dll
2008-11-01 16:11 . 2008-09-03 03:58 74,752 --a------ c:\windows\System32\newdev.exe
2008-11-01 15:31 . 2008-11-01 15:31 <REP> d-------- c:\windows\LARAUDIO
2008-11-01 15:31 . 2008-11-01 15:31 2,416 --a------ c:\windows\TTSDRV.INI
2008-11-01 15:31 . 2008-11-01 15:31 297 --a------ c:\windows\ADAPTA.INI
2008-11-01 14:27 . 2008-11-01 14:27 <REP> d-------- c:\windows\USB Vibration
2008-11-01 14:27 . 2008-11-01 14:27 <REP> d-------- c:\program files\USB Vibration
2008-10-31 12:39 . 2008-10-31 12:39 <REP> d-------- c:\users\TOSHIBA\NFS Underground2
2008-10-31 12:16 . 2008-10-31 12:16 <REP> d-------- c:\program files\EA GAMES
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d----c--- c:\windows\System32\DRVSTORE
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\Apple Computer
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\program files\iTunes
2008-10-31 12:12 . 2008-10-31 12:12 <REP> d-------- c:\program files\iPod
2008-10-31 12:12 . 2008-04-17 13:12 107,368 --a------ c:\windows\System32\GEARAspi.dll
2008-10-31 12:12 . 2008-04-17 13:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys
2008-10-31 12:11 . 2008-10-31 12:11 <REP> d-------- c:\program files\QuickTime
2008-10-31 12:11 . 2008-10-31 12:11 <REP> d-------- c:\program files\Bonjour
2008-10-31 12:09 . 2008-10-31 12:09 <REP> d-------- c:\program files\DAEMON Tools Lite
2008-10-31 12:08 . 2008-10-31 12:08 <REP> d-------- c:\program files\Apple Software Update
2008-10-31 12:07 . 2008-10-31 12:11 <REP> d-------- c:\program files\Common Files\Apple
2008-10-30 22:34 . 2008-01-19 07:33 2,623,488 --a------ c:\windows\System32\SLsvc.exe
2008-10-30 22:34 . 2008-01-19 07:36 1,541,120 --a------ c:\windows\System32\onex.dll
2008-10-30 22:32 . 2008-01-19 07:33 8,139,264 --a------ c:\windows\System32\ssBranded.scr
2008-10-30 22:31 . 2008-01-19 06:06 8,147,456 --a------ c:\windows\System32\wmploc.DLL
2008-10-30 22:30 . 2008-01-19 07:36 704,512 --a------ c:\windows\System32\SmiEngine.dll
2008-10-30 22:30 . 2008-01-19 07:36 357,888 --a------ c:\windows\System32\wbemcomn.dll
2008-10-30 22:30 . 2008-01-19 07:34 305,152 --a------ c:\windows\System32\msdelta.dll
2008-10-30 22:30 . 2008-01-19 07:34 258,560 --a------ c:\windows\System32\dpx.dll
2008-10-30 22:30 . 2008-01-19 07:34 246,784 --a------ c:\windows\System32\drvstore.dll
2008-10-30 22:30 . 2008-01-19 07:36 218,624 --a------ c:\windows\System32\wdscore.dll
2008-10-30 22:30 . 2008-01-19 07:36 139,264 --a------ c:\windows\System32\SmiInstaller.dll
2008-10-30 22:30 . 2008-01-19 07:33 130,560 --a------ c:\windows\System32\PkgMgr.exe
2008-10-30 22:30 . 2008-01-19 07:36 129,536 --a------ c:\windows\System32\sqmapi.dll
2008-10-30 22:30 . 2008-01-19 07:35 35,328 --a------ c:\windows\System32\mspatcha.dll
2008-10-30 19:52 . 2007-09-13 14:14 184,320 --a------ c:\windows\System32\igfxres.dll
2008-10-30 12:08 . 2008-10-30 12:08 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\DAEMON Tools
2008-10-30 12:08 . 2008-10-30 12:08 717,296 --a------ c:\windows\System32\drivers\sptd.sys
2008-10-30 10:46 . 2008-10-30 10:46 <REP> d-------- c:\program files\KONAMI
2008-10-30 07:03 . 2008-10-30 07:03 <REP> d-------- c:\program files\Free Music Zilla
2008-10-30 03:05 . 2008-10-30 03:05 269,312 --a------ c:\windows\System32\es.dll
2008-10-30 00:51 . 2008-10-30 00:51 <REP> d-------- c:\users\All Users\eMule
2008-10-30 00:51 . 2008-10-30 00:51 <REP> d-------- c:\programdata\eMule
2008-10-30 00:50 . 2008-11-05 10:23 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\LimeWire
2008-10-30 00:49 . 2008-10-30 00:49 <REP> d-------- c:\program files\Dactylo
2008-10-30 00:48 . 2008-10-30 00:49 <REP> d-------- c:\program files\PhotoFiltre Studio
2008-10-30 00:48 . 2008-10-30 00:48 45 ---h----- c:\windows\dvis5054.dat
2008-10-30 00:47 . 2008-10-30 00:48 <REP> d-------- c:\program files\Java
2008-10-30 00:47 . 2008-10-30 00:47 <REP> d-------- c:\program files\Common Files\Java
2008-10-30 00:20 . 2008-11-01 15:39 <REP> d-------- c:\program files\adslTV
2008-10-30 00:09 . 2008-10-30 00:10 <REP> d-------- c:\program files\Common Files\Adobe
2008-10-30 00:03 . 2008-10-30 00:03 <REP> d-------- c:\windows\System32\Adobe
2008-10-30 00:02 . 2008-10-30 00:02 <REP> dr------- c:\windows\System32\config\systemprofile\Music
2008-10-29 23:56 . 2008-10-29 23:56 <REP> d-------- c:\program files\Lavalys
2008-10-29 23:53 . 2008-10-29 23:53 <REP> d-------- c:\program files\Xilisoft
2008-10-29 23:52 . 2008-10-29 23:52 <REP> d-------- c:\program files\Xvid
2008-10-29 23:52 . 2008-10-29 23:52 <REP> d-------- c:\program files\DsNET Corp
2008-10-29 23:52 . 2007-06-28 18:52 765,952 --a------ c:\windows\System32\xvidcore.dll
2008-10-29 23:52 . 2007-06-28 18:54 180,224 --a------ c:\windows\System32\xvidvfw.dll
2008-10-29 23:52 . 2007-06-28 18:55 77,824 --a------ c:\windows\System32\xvid.ax
2008-10-29 23:51 . 2008-10-29 23:51 <REP> d-------- c:\program files\WinAVI MP4 Converter
2008-10-29 23:47 . 2008-10-29 23:47 <REP> d-------- c:\program files\WinISO
2008-10-29 23:45 . 2008-10-31 12:12 <REP> d-------- c:\users\All Users\Apple Computer
2008-10-29 23:45 . 2008-10-31 12:12 <REP> d-------- c:\programdata\Apple Computer
2008-10-29 23:44 . 2008-10-29 23:44 <REP> d-------- c:\users\All Users\Apple
2008-10-29 23:44 . 2008-10-29 23:44 <REP> d-------- c:\programdata\Apple
2008-10-29 23:42 . 2008-10-29 23:46 <REP> d-------- c:\program files\LimeWire
2008-10-29 23:41 . 2008-10-29 23:42 <REP> d-------- c:\program files\eMule
2008-10-29 23:41 . 2008-10-29 23:41 <REP> d-------- c:\program files\Ares
2008-10-29 23:40 . 2008-10-29 23:40 <REP> d-------- c:\program files\Opera
2008-10-29 23:40 . 2008-10-29 23:40 <REP> d-------- c:\program files\CCleaner
2008-10-29 23:38 . 2008-11-06 12:44 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\vlc
2008-10-29 23:24 . 2008-11-06 06:50 <REP> d-------- c:\program files\Larousse
2008-10-29 23:24 . 2008-10-29 23:24 <REP> d-------- c:\program files\directx
2008-10-29 23:24 . 1998-06-17 19:07 57,344 --a------ c:\windows\System32\Mfc42loc.dll
2008-10-29 21:22 . 2008-10-29 21:30 <REP> d-------- c:\program files\Windows Live Safety Center
2008-10-29 19:52 . 2008-10-30 17:18 <REP> d-------- c:\users\TOSHIBA\Logiciel
2008-10-29 19:52 . 2008-11-05 09:19 <REP> d-------- c:\users\TOSHIBA\BEM
2008-10-29 19:30 . 2008-07-20 17:44 324,120 --a------ c:\windows\System32\drivers\iaStor.sys
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\TOSHIBA\Roaming
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\TOSHIBA\AppData\Roaming\Intel
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\Public\Roaming
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\Default\Roaming
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\users\All Users\Roaming
2008-10-29 19:29 . 2008-10-29 19:29 <REP> d-------- c:\programdata\Roaming
2008-10-29 19:28 . 2008-10-29 19:28 <REP> d-------- c:\users\All Users\Intel
2008-10-29 19:28 . 2008-10-29 19:28 <REP> d-------- c:\programdata\Intel
2008-10-29 19:28 . 2008-10-29 19:28 <REP> d-------- c:\program files\Common Files\Intel
2008-10-29 19:28 . 2008-10-29 19:28 <REP> d-------- c:\program files\Cisco
2008-10-29 19:27 . 2008-10-29 19:27 <REP> d-------- c:\program files\Toshiba
2008-10-29 19:23 . 2008-10-29 19:23 <REP> d-------- c:\users\All Users\ma-config.com
2008-10-29 19:23 . 2008-10-29 19:23 <REP> d-------- c:\programdata\ma-config.com
2008-10-29 19:23 . 2008-10-29 19:24 <REP> d-------- c:\program files\ma-config.com
2008-10-29 19:00 . 2008-10-29 19:00 361,984 --a------ c:\windows\System32\IPSECSVC.DLL
2008-10-29 19:00 . 2008-10-29 19:00 272,896 --a------ c:\windows\System32\polstore.dll
2008-10-29 19:00 . 2008-10-29 19:00 61,440 --a------ c:\windows\System32\winipsec.dll
2008-10-29 19:00 . 2008-10-29 19:00 28,672 --a------ c:\windows\System32\FwRemoteSvr.dll
2008-10-29 18:59 . 2008-10-29 18:59 1,820 --a------ c:\windows\System32\rasctrnm.h
2008-10-29 18:58 . 2008-10-29 18:58 4,240,384 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-01 18:59 174 --sha-w c:\program files\desktop.ini
2008-11-01 18:52 --------- d-----w c:\program files\Windows Sidebar
2008-11-01 18:52 --------- d-----w c:\program files\Windows Photo Gallery
2008-11-01 18:52 --------- d-----w c:\program files\Windows Mail
2008-11-01 18:52 --------- d-----w c:\program files\Windows Journal
2008-11-01 18:52 --------- d-----w c:\program files\Windows Collaboration
2008-11-01 18:52 --------- d-----w c:\program files\Windows Calendar
2008-11-01 18:51 --------- d-----w c:\program files\Windows Defender
2008-11-01 18:29 82,432 ----a-w c:\windows\System32\axaltocm.dll
2008-11-01 18:29 101,888 ----a-w c:\windows\System32\ifxcardm.dll
2008-10-29 18:58 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-10-29 18:58 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-10-29 18:58 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
2008-10-29 18:58 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-10-29 18:58 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-10-29 18:35 801,280 ----a-w c:\windows\System32\NaturalLanguage6.dll
2008-10-29 13:10 --------- d-----w c:\program files\MSBuild
2008-10-29 10:28 --------- d-sh--w c:\programdata\Modèles
2008-10-29 10:28 --------- d-sh--w c:\programdata\Menu Démarrer
2008-10-29 10:28 --------- d-sh--w c:\programdata\Favoris
2008-10-29 10:28 --------- d-sh--w c:\programdata\Bureau
2008-10-29 10:28 --------- d-sh--w c:\program files\Fichiers communs
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-08-29 10:18 87,336 ----a-w c:\windows\System32\dns-sd.exe
2008-08-29 09:53 61,440 ----a-w c:\windows\System32\dnssd.dll
2008-08-20 16:24 774,144 ----a-w c:\windows\System32\wlihvui.dll
2008-08-20 16:18 987,136 ----a-w c:\windows\System32\iwmssvc.dll
.
((((((((((((((((((((((((((((( snapshot@2008-11-06_10.45.35,55 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-06 09:46:55 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-11-06 10:53:10 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-11-06 09:46:55 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-11-06 10:53:10 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-11-06 09:48:23 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-11-06 15:04:51 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-11-06 15:04:51 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-11-06 09:48:18 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-06 12:05:26 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-06 12:05:26 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
+ 2008-11-06 12:59:22 2,456 ----a-w c:\windows\System32\networklist\icons\{200BEA1B-B8DD-4860-A10D-19C68A873AC5}_24.bin
+ 2008-11-06 12:59:22 4,280 ----a-w c:\windows\System32\networklist\icons\{200BEA1B-B8DD-4860-A10D-19C68A873AC5}_32.bin
+ 2008-11-06 12:59:22 9,560 ----a-w c:\windows\System32\networklist\icons\{200BEA1B-B8DD-4860-A10D-19C68A873AC5}_48.bin
- 2008-11-06 09:53:42 102,094 ----a-w c:\windows\System32\perfc009.dat
+ 2008-11-06 15:07:10 102,094 ----a-w c:\windows\System32\perfc009.dat
- 2008-11-06 09:53:42 124,434 ----a-w c:\windows\System32\perfc00C.dat
+ 2008-11-06 15:07:10 124,434 ----a-w c:\windows\System32\perfc00C.dat
- 2008-11-06 09:53:42 590,082 ----a-w c:\windows\System32\perfh009.dat
+ 2008-11-06 15:07:10 590,082 ----a-w c:\windows\System32\perfh009.dat
- 2008-11-06 09:53:42 672,322 ----a-w c:\windows\System32\perfh00C.dat
+ 2008-11-06 15:07:10 672,322 ----a-w c:\windows\System32\perfh00C.dat
- 2008-11-06 09:48:52 6,548 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1800692337-3776960856-3704569264-1000_UserData.bin
+ 2008-11-06 10:55:00 6,588 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1800692337-3776960856-3704569264-1000_UserData.bin
- 2008-11-06 09:48:52 61,888 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-11-06 10:54:59 62,070 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-11-06 10:52:11 1,662 ----a-w c:\windows\System32\WDI\ERCQueuedResolutions.dat
- 2008-11-06 09:48:48 33,948 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-11-06 10:54:58 34,004 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"eMuleAutoStart"="c:\program files\eMule\emule.exe" [2008-08-01 5480448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-25 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-25 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-25 129560]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-12-15 184320]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-29 1029416]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-10-25 413696]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-10-29 949376]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Hyperappel du Petit Larousse 2009.lnk - c:\program files\Larousse\Petit Larousse 2009\bin\Hyperappel.exe [2008-11-06 237568]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7DE29AAA-CF77-4573-9C62-192BF414065A}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{2218B1AF-E0FD-4880-8B2E-F46719BDB171}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{B98B3EF2-8558-49F2-8206-973F3900DFBF}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{E5576112-D07F-4381-B12D-4B7545226AA9}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{7F49B2AC-8C84-44A2-AEAE-D2AB8C2CB298}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{5AC1AF45-1C3E-4A1F-ACF2-99C7F639F2A5}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{93DFF1A9-C917-42B4-9E86-2379665BF836}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{3F93EABF-596E-4E68-ACC5-D96D37F549DD}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"TCP Query User{A1DAE003-BF0C-41F4-BE7C-992D7C6308C8}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{7C324F92-8DE2-42C3-B38C-008E0F1F24C4}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{3A6DD3C3-BA15-4E60-87C1-04176CAE3444}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{0925CBC1-59A5-4C42-BA0A-BA27D79FCC24}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{A3BB271A-33BB-41EE-BCD2-2A3AA106ECC1}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{C62E622B-1091-4C8E-B25E-C226513A38F1}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{E610001E-AA17-4905-AF96-9279C2779DE0}c:\\program files\\konami\\pro evolution soccer 6\\pes6.exe"= UDP:c:\program files\konami\pro evolution soccer 6\pes6.exe:pes6.exe
"UDP Query User{651DEA55-CFDD-408B-A2C8-F21B2EC5F72E}c:\\program files\\konami\\pro evolution soccer 6\\pes6.exe"= TCP:c:\program files\konami\pro evolution soccer 6\pes6.exe:pes6.exe
"{CB199C02-737D-42A1-8141-F6BEFBC65466}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{0BE5EFD7-C00A-47FE-9652-B39FDF186AEA}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{03239B30-CDDB-4B27-AC73-7906BB8BC6E9}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{7FE57755-644F-420F-96AF-141485E63DF4}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{62EDDBD9-8BFE-4029-8B3D-84DB336644D9}c:\\program files\\ea games\\need for speed underground 2\\speed2.exe"= UDP:c:\program files\ea games\need for speed underground 2\speed2.exe:speed2
"UDP Query User{13929A16-05D4-47AF-B1A1-24131B741815}c:\\program files\\ea games\\need for speed underground 2\\speed2.exe"= TCP:c:\program files\ea games\need for speed underground 2\speed2.exe:speed2
"{6668C407-4EEB-4CE1-B505-09916628035B}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{5E41161C-4E46-4469-B257-DB6C317B1403}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{E7635AFE-5345-40FF-85A2-1E2AB28A3CF4}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"TCP Query User{E4E7D761-3BA9-4D7F-8F34-9C17E553F9C9}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{F6EB45D1-E8F8-49E4-ADBC-A7031E02FACE}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{B93D1CCE-2750-4B9C-8466-7EEFB85F3FCE}c:\\program files\\ea games\\need for speed underground 2\\speed2.exe"= UDP:c:\program files\ea games\need for speed underground 2\speed2.exe:speed2
"UDP Query User{6BF1B7CA-CB4D-444E-8633-D432D559EA6F}c:\\program files\\ea games\\need for speed underground 2\\speed2.exe"= TCP:c:\program files\ea games\need for speed underground 2\speed2.exe:speed2
R3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDART.sys [2008-02-01 187904]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-08-28 3664384]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2008-01-15 48472]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [2008-08-25 77824]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk60x86.sys [2007-12-28 298496]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\system32\drivers\royal.sys [2008-10-29 240128]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-10-28 195752]
S3 RTL8187B;Adaptateur réseau USB 2.0 54Mbps, 802.11b/g sans fil Realtek RTL8187B;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-12-26 290304]
S3 RTL85n86;Pilote du périphérique sans fil Realtek 8180/8185 Extensible 802.11;c:\windows\system32\DRIVERS\RTL85n86.sys [2006-11-02 311808]
.
Contenu du dossier 'Tâches planifiées'
2008-11-06 c:\windows\Tasks\User_Feed_Synchronization-{B282DC8A-121F-42D5-A3DE-78D9D5B277D7}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 07:33]
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-06 16:42:16
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
[0] 0x0FDB3102
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-11-06 16:44:13
ComboFix-quarantined-files.txt 2008-11-06 16:44:06
ComboFix2.txt 2008-11-06 15:15:06
ComboFix3.txt 2008-11-06 10:46:46
Avant-CF: 45 380 345 856 octets libres
Après-CF: 45,133,217,792 octets libres
292 --- E O F --- 2008-11-05 14:12:44
-
-
ok maintenant refais le message 13 stp
http://www.commentcamarche.net/forum/affich 9282319 ya une fenetre qui ouvre tout seul sur le bu?#13
