CiD - Page 2

Précédent
  • 1
  • 2
  1. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    /!\ Seul gouraii peut suivre cette procédure /!\

    1/

    ---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

    ---> Copie le texte ci-dessous par sélection puis Ctrl+C :

    KillAll::

    Driver::
    Planificateur LiveUpdate automatique

    File::
    C:\Documents and Settings\François\Cookies\françois@247realmedia[2].txt
    C:\Documents and Settings\François\Cookies\françois@fastclick[1].txt
    C:\Lop SD\Backup-Lop\DOCUME~1\FRANOI~1\Cookies\françois@pacificpoke­r[1].txt
    C:\Documents and Settings\François\Cookies\françois@xiti[1].txt
    C:\Documents and Settings\François\Cookies\françois@serving-sys[3].txt
    C:\Documents and Settings\François\Cookies\françois@serving-sys[2].txt
    C:\Documents and Settings\François\Cookies\françois@bs.serving-sys[2].txt
    C:\Documents and Settings\Stéphanie\Cookies\stéphanie@888[1].txt
    C:\Documents and Settings\François\Cookies\françois@weborama[1].txt
    C:\Lop SD\Backup-Lop\DOCUME~1\FRANOI~1\Cookies\françois@advertising­[1].txt
    C:\Documents and Settings\François\Cookies\françois@bluestreak[2].txt
    C:\Documents and Settings\François\Cookies\françois@bluestreak[1].txt
    C:\Documents and Settings\François\Cookies\françois@adrevolver[2].txt
    C:\Lop SD\Backup-Lop\DOCUME~1\FRANOI~1\Cookies\françois@adultfriend­finder[2].txt
    C:\Documents and Settings\François\Cookies\françois@ads.addynamix[1].txt
    C:\Program Files\BSINSTALL.exe
    C:\RECYCLER\S-1-5-21-1257724701-2681699156-3766971089-1005\D­c2.exe

    Registry::
    [-hkey_local_machine\software\microsoft\windows\currentversion­\app management\arpcache\altnetdm]
    [-hkey_classes_root\clsid\{66fc8717-efa7-4546-8c4a-e224f3a80c7­6}]
    [-HKEY_LOCAL_MACHINE\software\classes\CLSID\{66FC8717-EFA7-454­6-8C4A-E224F3A80C76}]
    [-HKEY_CLASSES_ROOT\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3­617D3}]
    [-hkey_local_machine\software\need2find]
    [-hkey_current_user\software\need2find]
    [-hkey_local_machine\software\microsoft\windows\currentversion­\uninstall\need2findbar uninstall]
    [-HKEY_CLASSES_ROOT\TypeLib\{C881E6FC-C673-4FDD-AEF8-B36DFB10E­401}]

    ---> Colle la sélection dans le bloc-notes

    ---> Enregistre ce fichier sur le bureau (Impératif)

    ---> Nom du fichier : CFScript
    ---> Type du fichier : tous les fichiers
    ---> Clique sur Enregistrer
    ---> Quitte le bloc-notes

    2/

    ---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
    http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

    [*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

    [*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
    Ne touche à rien tant que le scan n'est pas terminé.

    [*] Une fois le scan achevé, un rapport va s'afficher : poste-le

    [*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix\Combofix.txt
    0
    1. gouraii Messages postés 94 Statut Membre
       
      Voila le rapport
      ComboFix 08-12-14.04 - François 2008-12-15 7:24:10.2 - NTFSx86
      Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.2038.1488 [GMT 1:00]
      Lancé depuis: c:\documents and settings\François\Bureau\ComboFix.exe
      Commutateurs utilisés :: c:\documents and settings\François\Bureau\cfscript.txt
      * Un nouveau point de restauration a été créé

      FILE ::
      c:\documents and settings\François\Cookies\françois@247realmedia[2].txt
      c:\documents and settings\François\Cookies\françois@adrevolver[2].txt
      c:\documents and settings\François\Cookies\françois@ads.addynamix[1].txt
      c:\documents and settings\François\Cookies\françois@bluestreak[1].txt
      c:\documents and settings\François\Cookies\françois@bluestreak[2].txt
      c:\documents and settings\François\Cookies\françois@bs.serving-sys[2].txt
      c:\documents and settings\François\Cookies\françois@fastclick[1].txt
      c:\documents and settings\François\Cookies\françois@serving-sys[2].txt
      c:\documents and settings\François\Cookies\françois@serving-sys[3].txt
      c:\documents and settings\François\Cookies\françois@weborama[1].txt
      c:\documents and settings\François\Cookies\françois@xiti[1].txt
      c:\documents and settings\Stéphanie\Cookies\stéphanie@888[1].txt
      c:\lop sd\Backup-Lop\DOCUME~1\FRANOI~1\Cookies\françois@adultfriend­finder[2].txt
      c:\lop sd\Backup-Lop\DOCUME~1\FRANOI~1\Cookies\françois@advertising­[1].txt
      c:\lop sd\Backup-Lop\DOCUME~1\FRANOI~1\Cookies\françois@pacificpoke­r[1].txt
      c:\program files\BSINSTALL.exe
      c:\recycler\S-1-5-21-1257724701-2681699156-3766971089-1005\D­c2.exe
      .

      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .

      c:\documents and settings\François\Cookies\françois@247realmedia[2].txt
      c:\documents and settings\François\Cookies\françois@adrevolver[2].txt
      c:\documents and settings\François\Cookies\françois@ads.addynamix[1].txt
      c:\documents and settings\François\Cookies\françois@bluestreak[1].txt
      c:\documents and settings\François\Cookies\françois@bluestreak[2].txt
      c:\documents and settings\François\Cookies\françois@bs.serving-sys[2].txt
      c:\documents and settings\François\Cookies\françois@fastclick[1].txt
      c:\documents and settings\François\Cookies\françois@serving-sys[2].txt
      c:\documents and settings\François\Cookies\françois@serving-sys[3].txt
      c:\documents and settings\François\Cookies\françois@weborama[1].txt
      c:\documents and settings\François\Cookies\françois@xiti[1].txt
      c:\documents and settings\Stéphanie\Cookies\stéphanie@888[1].txt
      c:\program files\BSINSTALL.exe

      .
      ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      -------\Legacy_PLANIFICATEUR_LIVEUPDATE_AUTOMATIQUE
      -------\Service_Planificateur LiveUpdate automatique


      ((((((((((((((((((((((((((((( Fichiers créés du 2008-11-15 au 2008-12-15 ))))))))))))))))))))))))))))))))))))
      .

      2008-12-14 22:39 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
      2008-12-14 22:38 . 2008-12-14 22:38 <REP> d-------- c:\program files\Panda Security
      2008-12-14 20:49 . 2008-12-14 20:49 <REP> d-------- c:\windows\system32\Kaspersky Lab
      2008-12-02 06:18 . 2008-12-02 06:18 <REP> d-------- C:\rsit
      2008-11-30 17:06 . 2008-12-02 06:16 <REP> d-------- c:\program files\Ad-remover
      2008-11-30 16:57 . 2008-11-30 16:57 <REP> d-------- C:\_OTMoveIt
      2008-11-30 16:41 . 2008-12-02 06:16 <REP> d-------- c:\program files\UsbFix
      2008-11-30 16:03 . 2008-11-30 16:03 <REP> d-------- c:\documents and settings\All Users\Application Data\NortonInstaller
      2008-11-30 15:58 . 2008-11-10 05:43 410,984 --a------ c:\windows\system32\deploytk.dll
      2008-11-30 15:14 . 2008-11-30 15:52 <REP> d-------- c:\program files\NOS
      2008-11-30 15:14 . 2008-11-30 15:52 <REP> d-------- c:\documents and settings\All Users\Application Data\NOS
      2008-11-18 21:08 . 2008-11-18 21:08 <REP> d-------- c:\program files\Realtek
      2008-11-18 21:08 . 2008-05-19 04:46 108,032 -ra------ c:\windows\system32\drivers\Rtenicxp.sys
      2008-11-18 21:05 . 2008-11-18 21:05 13,004 --a------ c:\windows\Ascd_tmp.ini
      2008-11-18 21:04 . 2007-08-01 04:39 12,536 --a------ c:\windows\system32\drivers\ASUSHWIO.SYS
      2008-11-18 20:58 . 2008-11-18 20:58 <REP> d-------- c:\windows\system32\Lang
      2008-11-18 20:58 . 2008-03-21 04:34 920,088 -ra------ c:\windows\system32\igxpun.exe
      2008-11-18 20:56 . 2008-11-18 20:56 <REP> d-------- c:\program files\Intel
      2008-11-18 20:56 . 2008-11-18 20:56 <REP> d-------- C:\Intel
      2008-11-18 20:54 . 2008-02-14 07:12 1,389,056 -ra------ c:\windows\system32\drivers\monfilt.sys
      2008-11-18 20:54 . 2008-02-14 04:36 222,976 -ra------ c:\windows\system32\drivers\viahduaa.sys
      2008-11-18 20:45 . 2008-01-21 10:45 8,192 -ra------ c:\windows\system32\drivers\ASACPI.sys
      2008-11-18 20:40 . 2001-08-23 17:15 3,328 --a------ c:\windows\system32\drivers\pciide.sys
      2008-11-18 15:27 . 2008-12-11 01:11 <REP> d--h----- c:\windows\$hf_mig$
      2008-11-18 15:27 . 2008-12-11 01:11 1,393 --a------ c:\windows\imsins.BAK
      2008-11-18 15:26 . 2008-11-18 15:26 12,540 --a------ c:\windows\system32\wpa.bak
      2008-11-18 15:08 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
      2008-11-18 15:08 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
      2008-11-18 15:08 . 2007-07-27 10:30 8,704 -ra------ c:\windows\system32\viahdcpl.cpl
      2008-11-18 15:07 . 2008-11-18 15:08 <REP> d-------- c:\program files\VIA

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-12-15 06:29 --------- d-----w c:\program files\DNA
      2008-12-14 20:16 --------- d-----w c:\program files\eMule
      2008-12-03 12:56 --------- d-----w c:\program files\Java
      2008-12-02 05:18 --------- d-----w c:\program files\trend micro
      2008-11-30 15:03 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
      2008-11-30 14:43 --------- d-----w c:\program files\Fichiers communs\Adobe
      2008-11-18 14:08 --------- d--h--w c:\program files\InstallShield Installation Information
      2008-11-11 14:05 --------- d-----w c:\program files\Smart PC
      2008-11-11 14:00 --------- d-----w c:\program files\Google
      2008-11-11 13:58 --------- d-----w c:\program files\TribalWeb.net
      2008-11-07 12:34 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
      2008-11-07 12:33 --------- d-----w c:\program files\Lavasoft
      2008-11-07 12:32 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
      2008-11-07 10:24 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
      2008-11-07 10:24 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
      2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
      2008-10-22 15:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
      2008-10-22 15:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
      2006-03-16 12:48 534,112 ----a-w c:\program files\psa30se_ytb612_a707_DLM_fr_fr.exe
      2005-07-28 05:34 807,288 ----a-w c:\program files\template.ps
      2005-07-19 17:53 4,877,784 ----a-w c:\program files\Firefox Setup 1.0.5.exe
      2005-06-18 06:20 533,574 ----a-w c:\program files\pllangs.exe
      2005-06-18 06:17 2,855,080 ----a-w c:\program files\ad aware 106.exe
      2005-05-13 21:01 7,412,936 ----a-w c:\program files\INSTALL_MSN_MESSENGER_DL.EXE
      2005-02-18 18:05 2,636,408 ----a-w c:\program files\aawsepersonal.exe
      2004-11-07 18:32 9,304,688 ----a-w c:\program files\MPSetupXP.exe
      2004-08-10 07:57 1,471,912 ----a-w c:\program files\Acoustica-MP3-Audio-Mixer-Installer 2.02.exe
      .

      ((((((((((((((((((((((((((((( snapshot@2008-12-01_ 7.16.38,20 )))))))))))))))))))))))))))))))))))))))))
      .
      + 2008-10-23 10:17:49 62,976 ----a-w c:\windows\$hf_mig$\KB955839\SP3QFE\tzchange.exe
      + 2007-11-30 11:19:06 18,296 ----a-w c:\windows\$hf_mig$\KB955839\spmsg.dll
      + 2007-11-30 11:19:06 234,872 ----a-w c:\windows\$hf_mig$\KB955839\spuninst.exe
      + 2007-11-30 11:19:06 26,488 ----a-w c:\windows\$hf_mig$\KB955839\update\spcustom.dll
      + 2007-11-30 12:39:29 767,352 ----a-w c:\windows\$hf_mig$\KB955839\update\update.exe
      + 2007-11-30 12:39:31 406,392 ----a-w c:\windows\$hf_mig$\KB955839\update\updspapi.dll
      + 2008-10-23 12:44:51 286,720 ----a-w c:\windows\$hf_mig$\KB956802\SP3QFE\gdi32.dll
      + 2008-07-08 13:03:54 18,296 ----a-w c:\windows\$hf_mig$\KB956802\spmsg.dll
      + 2008-07-08 13:03:55 234,872 ----a-w c:\windows\$hf_mig$\KB956802\spuninst.exe
      + 2008-07-08 13:03:54 26,488 ----a-w c:\windows\$hf_mig$\KB956802\update\spcustom.dll
      + 2008-07-09 07:40:26 767,352 ----a-w c:\windows\$hf_mig$\KB956802\update\update.exe
      + 2008-07-09 07:40:35 406,392 ----a-w c:\windows\$hf_mig$\KB956802\update\updspapi.dll
      + 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
      - 2008-11-18 17:41:38 1,233,112 ----a-w c:\windows\system32\aswBoot.exe
      + 2008-11-26 17:21:30 1,236,208 ----a-w c:\windows\system32\aswBoot.exe
      - 2008-11-18 17:35:22 97,480 ----a-w c:\windows\system32\AvastSS.scr
      + 2008-11-26 17:15:10 97,480 ----a-w c:\windows\system32\AvastSS.scr
      + 2008-10-23 12:36:51 286,720 -c----w c:\windows\system32\dllcache\gdi32.dll
      - 2006-10-18 19:03:58 100,864 -c--a-w c:\windows\system32\dllcache\logagent.exe
      + 2008-06-18 00:09:22 100,864 -c--a-w c:\windows\system32\dllcache\logagent.exe
      - 2008-08-20 05:10:12 3,088,896 -c----w c:\windows\system32\dllcache\mshtml.dll
      + 2008-10-16 01:01:39 3,088,896 -c----w c:\windows\system32\dllcache\mshtml.dll
      - 2008-08-20 05:10:11 1,499,648 -c----w c:\windows\system32\dllcache\shdocvw.dll
      + 2008-10-16 01:01:37 1,499,648 -c----w c:\windows\system32\dllcache\shdocvw.dll
      - 2008-04-14 02:33:46 246,814 -c--a-w c:\windows\system32\dllcache\strmdll.dll
      + 2008-10-03 10:03:53 247,326 -c--a-w c:\windows\system32\dllcache\strmdll.dll
      - 2008-08-20 05:10:11 620,544 -c----w c:\windows\system32\dllcache\urlmon.dll
      + 2008-10-16 01:01:38 620,544 -c----w c:\windows\system32\dllcache\urlmon.dll
      - 2008-08-20 05:10:11 670,208 -c----w c:\windows\system32\dllcache\wininet.dll
      + 2008-10-16 01:01:38 670,208 -c----w c:\windows\system32\dllcache\wininet.dll
      - 2006-10-18 20:47:20 937,984 -c--a-w c:\windows\system32\dllcache\wmnetmgr.dll
      + 2008-06-18 04:03:08 938,496 -c--a-w c:\windows\system32\dllcache\WMNetmgr.dll
      - 2006-10-18 20:47:22 2,450,944 -c--a-w c:\windows\system32\dllcache\wmvcore.dll
      + 2008-06-18 04:03:14 2,458,112 -c--a-w c:\windows\system32\dllcache\WMVCore.dll
      - 2008-11-18 18:00:11 26,944 ----a-w c:\windows\system32\drivers\aavmker4.sys
      + 2008-11-26 17:15:35 26,944 ----a-w c:\windows\system32\drivers\aavmker4.sys
      - 2008-11-18 18:02:43 20,560 ----a-w c:\windows\system32\drivers\aswFsBlk.sys
      + 2008-11-26 17:17:25 20,560 ----a-w c:\windows\system32\drivers\aswFsBlk.sys
      - 2008-11-18 18:04:36 93,296 ----a-w c:\windows\system32\drivers\aswmon.sys
      + 2008-11-26 17:18:25 93,296 ----a-w c:\windows\system32\drivers\aswmon.sys
      - 2008-11-18 18:04:21 94,032 ----a-w c:\windows\system32\drivers\aswmon2.sys
      + 2008-11-26 17:18:18 94,032 ----a-w c:\windows\system32\drivers\aswmon2.sys
      - 2008-11-18 18:01:09 23,152 ----a-w c:\windows\system32\drivers\aswRdr.sys
      + 2008-11-26 17:16:29 23,152 ----a-w c:\windows\system32\drivers\aswRdr.sys
      - 2008-11-18 18:03:33 110,160 ----a-w c:\windows\system32\drivers\aswSP.sys
      + 2008-11-26 17:17:36 111,184 ----a-w c:\windows\system32\drivers\aswSP.sys
      - 2008-11-18 18:01:23 50,864 ----a-w c:\windows\system32\drivers\aswTdi.sys
      + 2008-11-26 17:16:38 50,864 ----a-w c:\windows\system32\drivers\aswTdi.sys
      - 2008-04-14 02:33:25 285,184 ----a-w c:\windows\system32\gdi32.dll
      + 2008-10-23 12:36:51 286,720 ----a-w c:\windows\system32\gdi32.dll
      - 2008-11-30 14:58:21 144,792 ----a-w c:\windows\system32\java.exe
      + 2008-11-10 04:43:37 144,792 ----a-w c:\windows\system32\java.exe
      - 2008-11-30 14:58:21 144,792 ----a-w c:\windows\system32\javaw.exe
      + 2008-11-10 04:43:38 144,792 ----a-w c:\windows\system32\javaw.exe
      - 2008-11-30 14:58:21 148,888 ----a-w c:\windows\system32\javaws.exe
      + 2008-11-10 04:43:39 148,888 ----a-w c:\windows\system32\javaws.exe
      + 2005-05-16 18:34:48 213,048 ----a-w c:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
      + 2008-08-13 14:03:26 65,536 ----a-w c:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
      + 2008-08-13 14:03:26 798,720 ----a-w c:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
      - 2006-10-18 19:03:58 100,864 ----a-w c:\windows\system32\logagent.exe
      + 2008-06-18 00:09:22 100,864 ----a-w c:\windows\system32\logagent.exe
      - 2008-11-04 00:10:25 17,318,336 ----a-w c:\windows\system32\MRT.exe
      + 2008-12-09 23:24:37 17,593,280 ----a-w c:\windows\system32\MRT.exe
      - 2008-08-20 05:10:12 3,088,896 ----a-w c:\windows\system32\mshtml.dll
      + 2008-10-16 01:01:39 3,088,896 ----a-w c:\windows\system32\mshtml.dll
      - 2008-08-20 05:10:11 1,499,648 ----a-w c:\windows\system32\shdocvw.dll
      + 2008-10-16 01:01:37 1,499,648 ----a-w c:\windows\system32\shdocvw.dll
      - 2008-07-08 13:03:54 18,296 ------w c:\windows\system32\spmsg.dll
      + 2007-11-30 11:19:06 18,296 ------w c:\windows\system32\spmsg.dll
      - 2008-04-14 02:33:46 246,814 ----a-w c:\windows\system32\strmdll.dll
      + 2008-10-03 10:03:53 247,326 ----a-w c:\windows\system32\strmdll.dll
      - 2008-04-14 02:34:25 60,416 ------w c:\windows\system32\tzchange.exe
      + 2008-10-23 10:06:59 62,976 ------w c:\windows\system32\tzchange.exe
      - 2008-08-20 05:10:11 620,544 ----a-w c:\windows\system32\urlmon.dll
      + 2008-10-16 01:01:38 620,544 ----a-w c:\windows\system32\urlmon.dll
      - 2008-08-20 05:10:11 670,208 ----a-w c:\windows\system32\wininet.dll
      + 2008-10-16 01:01:38 670,208 ----a-w c:\windows\system32\wininet.dll
      - 2006-10-18 20:47:20 937,984 ----a-w c:\windows\system32\wmnetmgr.dll
      + 2008-06-18 04:03:08 938,496 ----a-w c:\windows\system32\WMNetmgr.dll
      - 2006-10-18 20:47:22 2,450,944 ----a-w c:\windows\system32\wmvcore.dll
      + 2008-06-18 04:03:14 2,458,112 ----a-w c:\windows\system32\WMVCore.dll
      + 2008-12-15 06:27:50 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_1a0.dat
      + 2008-12-15 06:27:40 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_5a0.dat
      .
      -- Instantané actualisé --
      .
      ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-11-20 342336]
      "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-25 68856]
      "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" [2007-10-23 1410344]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
      "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
      "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-21 141848]
      "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-21 166424]
      "Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-21 137752]
      "HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-04-10 29757440]
      "NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
      "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
      "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
      "PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
      "vidc.i263"= c:\windows\System32\i263_32.drv
      "vidc.xvid"= xvid.dll

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Picture Package Menu.lnk]
      path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Picture Package Menu.lnk
      backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Picture Package VCD Maker.lnk]
      path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Picture Package VCD Maker.lnk
      backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WinZip Quick Pick.lnk]
      path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
      backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

      [HKLM\~\startupfolder\C:^Documents and Settings^François^Menu Démarrer^Programmes^Démarrage^TribalWeb.lnk]
      path=c:\documents and settings\François\Menu Démarrer\Programmes\Démarrage\TribalWeb.lnk
      backup=c:\windows\pss\TribalWeb.lnkStartup

      [HKLM\~\startupfolder\C:^Documents and Settings^François^Menu Démarrer^Programmes^Démarrage^TribalWeb.net.lnk]
      path=c:\documents and settings\François\Menu Démarrer\Programmes\Démarrage\TribalWeb.net.lnk
      backup=c:\windows\pss\TribalWeb.net.lnkStartup

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
      --a------ 2005-09-26 23:55 155648 c:\program files\QuickTime\qttask.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
      --a------ 2006-10-13 17:20 20058152 c:\program files\Skype\Phone\Skype.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
      "AntiVirusDisableNotify"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"=
      "c:\\Program Files\\Wanadoo Messager\\Wanadoo Messager.exe"=
      "c:\\Program Files\\Messenger\\msmsgs.exe"=
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
      "c:\\Program Files\\DNA\\btdna.exe"=
      "c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=
      "c:\\Program Files\\eMule\\emule.exe"=
      "c:\\Program Files\\Skype\\Phone\\Skype.exe"=

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
      "AllowInboundEchoRequest"= 0 (0x0)
      "AllowOutboundDestinationUnreachable"= 0 (0x0)
      "AllowOutboundSourceQuench"= 0 (0x0)
      "AllowRedirect"= 0 (0x0)
      "AllowOutboundPacketTooBig"= 0 (0x0)

      R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-14 28544]
      R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-09-15 111184]
      R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-09-15 20560]
      R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2008-11-18 222976]
      S3 V90drv;v90drv;c:\windows\system32\DRIVERS\v90drv.sys [2003-01-24 1432836]

      *Newly Created Service* - PAVBOOT
      .
      Contenu du dossier 'Tâches planifiées'

      2008-12-10 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
      - c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2008-07-07 08:42]
      .
      .
      ------- Examen supplémentaire -------
      .
      uSearch Page = hxxp://www.google.com
      uSearch Bar = hxxp://www.google.com/ie
      mDefault_Search_URL = hxxp://www.google.com/ie
      mSearch Bar =
      uSearchAssistant = hxxp://www.google.com/ie
      uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
      mSearchAssistant = hxxp://www.google.com/ie

      O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
      c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

      O16 -: fdjeux - hxxps://www.fdjeux.net/classes/fdjeux.cab
      c:\windows\Downloaded Program Files\fdjeux.osd

      O16 -: Interface Chat Voila - hxxp://chat9.x-echo.com/version3/Applet/vchatsign.cab
      c:\windows\Downloaded Program Files\Interface Chat Voila.osd

      O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
      c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

      c:\windows\Downloaded Program Files\PackageHtml.dll - c:\windows\Downloaded Program Files\CONFLICT.2\PackageHtml.dll
      O16 -: PackageHtmlCab
      hxxp://acces.blonde.com/package/op/PackageHtmlCab.CAB
      c:\windows\Downloaded Program Files\CONFLICT.2\OSD327B.OSD

      O16 -: teleir_cert - hxxps://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
      c:\windows\Downloaded Program Files\teleir_cert.osd

      O16 -: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} - hxxp://minitelweb.minitel.com/imin_data/ocx/MDM.cab
      c:\windows\Downloaded Program Files\MDM.inf

      c:\windows\System32\msvcrt.dll - c:\windows\System32\mfc42.dll
      c:\windows\System32\olepro32.dll
      c:\windows\Downloaded Program Files\telechargement-photoweb.ocx
      O16 -: {380C4261-4FC3-40D0-ADF8-0240A5857CE6}
      hxxp://www.photoweb.fr/order/telechargement-photoweb.cab
      c:\windows\Downloaded Program Files\telechargement-photoweb.inf

      c:\windows\Downloaded Program Files\websetup.dll - O16 -: {A5173EA8-1337-4BAB-A67E-198C9919D9CC}
      hxxp://213.11.100.127/websetup/websetup2.cab
      c:\windows\Downloaded Program Files\websetup.inf

      c:\windows\Downloaded Program Files\SQFViewer10.ocx - O16 -: {CD259AEC-23E6-4E64-8138-7E28D56666D7}
      hxxp://www.natuerlich-birkenstock.de/v1/SQFViewer10.ocx
      .

      **************************************************************************

      catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-12-15 07:29:00
      Windows 5.1.2600 Service Pack 3 NTFS

      Recherche de processus cachés ...

      Recherche d'éléments en démarrage automatique cachés ...

      HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

      Recherche de fichiers cachés ...

      Scan terminé avec succès
      Fichiers cachés: 0

      **************************************************************************
      .
      ------------------------ Autres processus actifs ------------------------
      .
      c:\program files\Lavasoft\Ad-Aware\aawservice.exe
      c:\program files\Alwil Software\Avast4\aswUpdSv.exe
      c:\program files\Alwil Software\Avast4\ashServ.exe
      c:\program files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
      c:\program files\Java\jre6\bin\jqs.exe
      c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
      c:\program files\Alwil Software\Avast4\ashMaiSv.exe
      c:\program files\Alwil Software\Avast4\ashWebSv.exe
      c:\windows\system32\wbem\wmiapsrv.exe
      c:\windows\system32\igfxsrvc.exe
      c:\program files\TRENDnet\TRENDnet TEW-421PC_TEW-423PI\WlanCU.exe
      .
      **************************************************************************
      .
      Heure de fin: 2008-12-15 7:31:08 - La machine a redémarré
      ComboFix-quarantined-files.txt 2008-12-15 06:31:06
      ComboFix2.txt 2008-12-01 06:17:39

      Avant-CF: 39 563 952 128 octets libres
      AprÞs-CF: 39,496,298,496 octets libres

      339 --- E O F --- 2008-12-12 02:01:15
      0
  2. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Ton PC va comment ?
    0
Précédent
  • 1
  • 2

Discussions similaires

Encore les CiD
doudoudim -
doudoudim -

18 réponses
CiD
Bahia -
espion3004 -

1 réponse
Problème CiD
Djemalounet -
Djemalounet -

104 réponses
comment donner les droits sur fichier partage
ch'ti du 57 -
fil1958 -

2 réponses
Image jpg dans mail en HTML ?
Laurent -
math 2000 -

13 réponses