Log Hijackthis : Qu'est ce qui cloche ?
Résolu
Arcueides
Messages postés
34
Statut
Membre
-
Utilisateur anonyme -
Utilisateur anonyme -
Bonjour,
Voila je vous poste mon log hijackthis, histoire de savoir ce qui fait que ma charge dédiée, est si importante et pourquoi mon pc galére autant.
Merci de votre aide.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:46:56, on 14/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\msdtc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Satsuki Decoder Pack\MPC\mplayerc.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Spyware Doctor\unins000.exe
C:\DOCUME~1\Cams\LOCALS~1\Temp\_iu14D2N.tmp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe" autostart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-03.sun.com/s/ESD5/JSCDL/jre/6u10-b92-b/jinstall-6u10-windows-i586-jc.cab?e=1227930279595&h=22827e5f8a44ad626a0dc820efab9510/&filename=jinstall-6u10-windows-i586-jc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CCE53F6-3CD9-4182-9305-D48E66B201F4}: NameServer = 192.168.1.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Voila je vous poste mon log hijackthis, histoire de savoir ce qui fait que ma charge dédiée, est si importante et pourquoi mon pc galére autant.
Merci de votre aide.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:46:56, on 14/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\msdtc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Satsuki Decoder Pack\MPC\mplayerc.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Spyware Doctor\unins000.exe
C:\DOCUME~1\Cams\LOCALS~1\Temp\_iu14D2N.tmp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe" autostart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-03.sun.com/s/ESD5/JSCDL/jre/6u10-b92-b/jinstall-6u10-windows-i586-jc.cab?e=1227930279595&h=22827e5f8a44ad626a0dc820efab9510/&filename=jinstall-6u10-windows-i586-jc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CCE53F6-3CD9-4182-9305-D48E66B201F4}: NameServer = 192.168.1.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
A voir également:
- Log Hijackthis : Qu'est ce qui cloche ?
- Hijackthis - Télécharger - Antivirus & Antimalwares
- Vpn no log - Guide
- View rescue log traduction - Guide
- Log freebox - Forum Freebox
- Log crash windows - Guide
9 réponses
Slt
-Télécharge Toolbar-S&D (Team IDN) sur ton Bureau--> https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
-Lance l'installation du programme en exécutant le fichier téléchargé.
-Double-clique maintenant sur le raccourci de Toolbar-S&D.
-Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
-Choisis maintenant l'option 1 (Recherche).
- Patiente jusqu'à la fin de la recherche.
-Poste le rapport généré. (C:\TB.txt)
-Télécharge Toolbar-S&D (Team IDN) sur ton Bureau--> https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
-Lance l'installation du programme en exécutant le fichier téléchargé.
-Double-clique maintenant sur le raccourci de Toolbar-S&D.
-Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
-Choisis maintenant l'option 1 (Recherche).
- Patiente jusqu'à la fin de la recherche.
-Poste le rapport généré. (C:\TB.txt)
Bonjour,
Voila j'ai suivis tes consignes à la lettre.
-----------\\ ToolBar S&D 1.2.6 XP/Vista
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz )
BIOS : Ver 1.00PARTTBLh
USER : Cams ( Administrator )
BOOT : Normal boot
Firewall : ZoneAlarm Firewall 7.0.483.000 (Activated)
C:\ (Local Disk) - NTFS - Total:102 Go (Free:59 Go)
D:\ (Local Disk) - FAT32 - Total:8 Go (Free:1 Go)
E:\ (CD or DVD)
F:\ (Local Disk) - FAT32 - Total:465 Go (Free:20 Go)
"C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
Option : [1] ( 14/12/2008|11:58 )
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://ie.redirect.hp.com/..."
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
"Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
1 - "C:\ToolBar SD\TB_1.txt" - 14/12/2008|12:00 - Option : [1]
-----------\\ Fin du rapport a 12:00:21,51
Voila j'ai suivis tes consignes à la lettre.
-----------\\ ToolBar S&D 1.2.6 XP/Vista
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz )
BIOS : Ver 1.00PARTTBLh
USER : Cams ( Administrator )
BOOT : Normal boot
Firewall : ZoneAlarm Firewall 7.0.483.000 (Activated)
C:\ (Local Disk) - NTFS - Total:102 Go (Free:59 Go)
D:\ (Local Disk) - FAT32 - Total:8 Go (Free:1 Go)
E:\ (CD or DVD)
F:\ (Local Disk) - FAT32 - Total:465 Go (Free:20 Go)
"C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
Option : [1] ( 14/12/2008|11:58 )
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://ie.redirect.hp.com/..."
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
"Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
1 - "C:\ToolBar SD\TB_1.txt" - 14/12/2008|12:00 - Option : [1]
-----------\\ Fin du rapport a 12:00:21,51
/!\ ATTENTION /!\ Combofix est dangereux si il est victime d'une manipulation aleatoire !
______________________________________________________________________________________
Si aucun helper vous a recommendé d'executer Combofix, n'executez pas ce fix !
______________________________________________________________________________________
Desactive tes protections residentes (Antivirus, anti-spywares..tea-timer de Spybot s&d)
______________________________________________________________________________________
- Télécharge combofix.exe (de sUBs) ->http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-Renomme-le par exemple en vivenoel(ce qui donnera vivenoel.exe)
-enregistre le sur le bureau
-Double clique vivenoel.exe (combofix)
-Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
______________________________________________________________________________________
Si aucun helper vous a recommendé d'executer Combofix, n'executez pas ce fix !
______________________________________________________________________________________
Desactive tes protections residentes (Antivirus, anti-spywares..tea-timer de Spybot s&d)
______________________________________________________________________________________
- Télécharge combofix.exe (de sUBs) ->http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-Renomme-le par exemple en vivenoel(ce qui donnera vivenoel.exe)
-enregistre le sur le bureau
-Double clique vivenoel.exe (combofix)
-Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Voila le rapport,
ComboFix 08-12-13.03 - Cams 2008-12-14 12:11:46.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1022.366 [GMT 1:00]
Lancé depuis: c:\documents and settings\Cams\Bureau\Jaimelecrabe.exe
* Un nouveau point de restauration a été créé
[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\npf.sys
c:\windows\system32\packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\wanpacket.dll
c:\windows\system32\wpcap.dll
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_NPF
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-14 au 2008-12-14 ))))))))))))))))))))))))))))))))))))
.
2008-12-14 11:57 . 2008-12-14 12:00 <REP> d-------- C:\ToolBar SD
2008-12-14 01:17 . 2008-12-14 01:17 <REP> d-------- c:\documents and settings\All Users\Application Data\Avg8
2008-12-14 01:15 . 2008-12-14 01:15 <REP> d-------- c:\program files\Fichiers communs\Diskeeper Corporation
2008-12-14 01:15 . 2008-12-14 01:15 <REP> d-------- c:\program files\Diskeeper Corporation
2008-12-14 01:15 . 2008-12-14 01:15 <REP> d-------- c:\documents and settings\All Users\Application Data\Diskeeper Corporation
2008-12-14 01:04 . 2008-12-14 01:04 <REP> d-------- c:\program files\RamBoost XP
2008-12-13 21:09 . 2008-12-13 21:09 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-13 21:09 . 2008-12-13 21:09 <REP> d-------- c:\documents and settings\Cams\Application Data\Malwarebytes
2008-12-13 21:09 . 2008-12-13 21:09 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-13 21:09 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-13 21:09 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-13 01:47 . 2008-12-13 01:47 603,904 --a------ c:\windows\system32\TUProgSt.exe
2008-12-13 01:45 . 2008-12-14 01:00 <REP> d-------- c:\program files\TuneUp Utilities 2009
2008-12-13 01:45 . 2008-12-13 01:45 <REP> d-------- c:\documents and settings\Cams\Application Data\TuneUp Software
2008-12-13 01:45 . 2008-12-13 01:45 <REP> d-------- c:\documents and settings\All Users\Application Data\TuneUp Software
2008-12-13 01:44 . 2008-12-13 01:44 <REP> d--hs---- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2008-12-12 16:45 . 2008-12-12 16:45 <REP> d-------- c:\program files\WinPcap
2008-12-12 15:57 . 2008-12-12 15:57 <REP> d-------- c:\program files\Trend Micro
2008-12-11 23:28 . 2008-10-03 11:03 247,326 --------- c:\windows\system32\dllcache\strmdll.dll
2008-12-11 02:45 . 2008-12-11 02:45 664 --a------ c:\windows\system32\d3d9caps.dat
2008-12-10 12:35 . 2008-12-10 12:35 0 --a------ c:\windows\nsreg.dat
2008-12-09 13:21 . 2008-12-14 12:09 <REP> d-------- c:\documents and settings\Cams\Application Data\Azureus
2008-12-09 13:21 . 2008-12-09 13:21 <REP> d-------- c:\documents and settings\All Users\Application Data\Azureus
2008-12-09 13:19 . 2008-12-09 13:20 <REP> d-------- c:\program files\Vuze
2008-12-04 16:13 . 2008-12-04 16:13 <REP> d-------- c:\windows\system32\LogFiles
2008-12-02 19:55 . 2001-08-23 17:04 12,288 --a------ c:\windows\system32\drivers\mouhid.sys
2008-12-02 19:55 . 2001-08-23 17:04 12,288 --a------ c:\windows\system32\dllcache\mouhid.sys
2008-11-30 20:05 . 2008-11-30 20:05 <REP> d-------- c:\documents and settings\Cams\Application Data\OpenOffice.org
2008-11-30 19:40 . 2008-04-13 19:45 26,368 --a------ c:\windows\system32\dllcache\usbstor.sys
2008-11-30 14:10 . 2008-12-03 10:11 <REP> d-------- c:\documents and settings\Cams\Contacts
2008-11-30 00:54 . 2008-11-30 00:54 <REP> d-------- c:\documents and settings\Cams\Application Data\Media Player Classic
2008-11-30 00:52 . 2008-11-30 00:53 <REP> d-------- c:\program files\Satsuki Decoder Pack
2008-11-29 19:24 . 2008-11-29 19:24 <REP> d-------- c:\program files\SixaxisDriver
2008-11-29 19:24 . 2006-12-24 05:15 27,904 --a------ c:\windows\system32\drivers\xPADFL02.sys
2008-11-29 19:21 . 2008-04-13 19:45 10,368 --a------ c:\windows\system32\drivers\hidusb.sys
2008-11-29 19:21 . 2008-04-13 19:45 10,368 --a------ c:\windows\system32\dllcache\hidusb.sys
2008-11-29 11:44 . 2008-11-29 11:44 4,096 --a------ c:\windows\d3dx.dat
2008-11-29 10:57 . 2008-11-29 19:19 <REP> d-------- c:\program files\PlayOnline
2008-11-29 10:57 . 2008-11-29 10:57 <REP> d-------- c:\program files\Fichiers communs\PlayOnline
2008-11-29 10:44 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2008-11-29 10:44 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2008-11-29 04:44 . 2008-11-29 04:44 <REP> d-------- c:\windows\Sun
2008-11-29 04:44 . 2008-11-29 04:44 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-29 04:40 . 2008-11-29 04:41 <REP> d-------- c:\windows\system32\Adobe
2008-11-29 04:11 . 2008-10-16 21:18 459,264 --------- c:\windows\system32\dllcache\msfeeds.dll
2008-11-29 04:11 . 2008-10-16 21:18 267,776 --------- c:\windows\system32\dllcache\iertutil.dll
2008-11-29 04:11 . 2008-10-16 21:18 52,224 --------- c:\windows\system32\dllcache\msfeedsbs.dll
2008-11-29 04:11 . 2008-10-16 14:11 13,824 --------- c:\windows\system32\dllcache\ieudinit.exe
2008-11-29 04:10 . 2008-10-16 21:18 6,066,176 --------- c:\windows\system32\dllcache\ieframe.dll
2008-11-29 04:10 . 2007-04-17 10:32 2,455,488 --------- c:\windows\system32\dllcache\ieapfltr.dat
2008-11-29 04:10 . 2007-03-08 06:10 1,048,576 --------- c:\windows\system32\dllcache\ieframe.dll.mui
2008-11-29 04:10 . 2008-10-16 21:18 383,488 --------- c:\windows\system32\dllcache\ieapfltr.dll
2008-11-29 04:10 . 2008-10-16 21:18 63,488 --------- c:\windows\system32\dllcache\icardie.dll
2008-11-29 04:04 . 2008-11-29 04:04 <REP> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2008-11-29 04:01 . 2008-11-29 04:01 <REP> d-------- c:\program files\MSXML 4.0
2008-11-29 04:00 . 2008-10-15 17:35 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
2008-11-29 03:48 . 2008-11-29 04:11 <REP> d-------- c:\windows\system32\fr-fr
2008-11-29 03:48 . 2008-11-29 03:48 <REP> d-------- c:\windows\system32\fr
2008-11-29 03:48 . 2008-11-29 03:48 <REP> d-------- c:\windows\system32\bits
2008-11-29 03:48 . 2008-11-29 03:48 <REP> d-------- c:\windows\l2schemas
2008-11-29 03:42 . 2008-11-29 03:48 <REP> d-------- c:\windows\ServicePackFiles
2008-11-29 03:33 . 2008-12-12 17:24 <REP> d-------- c:\program files\Fichiers communs\Adobe
2008-11-29 03:18 . 2008-06-14 18:33 272,768 --------- c:\windows\system32\dllcache\bthport.sys
2008-11-29 03:17 . 2008-09-15 16:26 1,846,528 --------- c:\windows\system32\dllcache\win32k.sys
2008-11-29 03:17 . 2008-09-08 11:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
2008-11-29 03:17 . 2008-08-14 11:04 138,496 --------- c:\windows\system32\dllcache\afd.sys
2008-11-29 03:16 . 2008-08-14 14:23 2,191,232 --------- c:\windows\system32\dllcache\ntoskrnl.exe
2008-11-29 03:16 . 2008-08-14 14:23 2,147,328 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-11-29 03:16 . 2008-08-14 14:23 2,068,096 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-29 03:16 . 2008-08-14 14:23 2,025,984 --------- c:\windows\system32\dllcache\ntkrpamp.exe
2008-11-29 03:09 . 2008-11-29 03:09 <REP> d-------- c:\program files\OpenOffice.org 3
2008-11-29 03:09 . 2008-06-11 02:58 2,330,624 --------- c:\windows\system32\dllcache\WMVCore.dll
2008-11-29 03:09 . 2008-10-24 12:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-29 03:09 . 2008-05-08 15:02 203,136 --------- c:\windows\system32\dllcache\rmcast.sys
2008-11-29 03:08 . 2008-12-14 12:20 <REP> d-------- c:\documents and settings\Cams\Application Data\skypePM
2008-11-29 03:08 . 2008-04-11 20:05 691,712 --------- c:\windows\system32\dllcache\inetcomm.dll
2008-11-29 03:08 . 2008-05-01 15:36 331,776 --------- c:\windows\system32\dllcache\msadce.dll
2008-11-29 03:08 . 2008-11-29 03:08 56 --ah----- c:\windows\system32\ezsidmv.dat
2008-11-29 03:07 . 2008-12-14 12:20 <REP> d-------- c:\documents and settings\Cams\Application Data\Skype
2008-11-29 03:06 . 2008-11-29 03:06 <REP> d-------- c:\program files\Skype
2008-11-29 03:06 . 2008-11-29 03:06 <REP> d-------- c:\program files\Fichiers communs\Skype
2008-11-29 03:06 . 2008-11-29 03:06 <REP> d-------- c:\documents and settings\All Users\Application Data\Skype
2008-11-29 03:01 . 2008-11-30 14:09 <REP> d--hsc--- c:\program files\Fichiers communs\WindowsLiveInstaller
2008-11-29 03:00 . 2008-11-30 14:09 <REP> d-------- c:\program files\Windows Live
2008-11-29 03:00 . 2008-11-30 14:06 <REP> d-------- c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-29 02:57 . 2008-09-04 18:16 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll
2008-11-29 02:47 . 2008-12-14 12:21 12,189,728 --ahs---- c:\windows\system32\drivers\fidbox.dat
2008-11-29 02:47 . 2008-12-14 12:16 143,852 --ahs---- c:\windows\system32\drivers\fidbox.idx
2008-11-29 02:45 . 2008-11-29 02:45 <REP> d-------- c:\documents and settings\All Users\Application Data\MailFrontier
2008-11-29 02:44 . 2008-07-09 09:05 75,248 --a------ c:\windows\zllsputility.exe
2008-11-29 02:44 . 2008-07-09 09:05 54,672 --a------ c:\windows\system32\vsutil_loc040c.dll
2008-11-29 02:44 . 2008-07-09 09:05 42,384 --a------ c:\windows\zllsputility_loc040c.dll
2008-11-29 02:44 . 2008-07-09 09:05 21,904 --a------ c:\windows\system32\imsinstall_loc040c.dll
2008-11-29 02:44 . 2008-07-09 09:05 17,808 --a------ c:\windows\system32\imslsp_install_loc040c.dll
2008-11-29 02:44 . 2004-04-27 04:40 11,264 --a------ c:\windows\system32\SpOrder.dll
2008-11-29 02:44 . 2008-11-29 02:45 4,212 ---h----- c:\windows\system32\zllictbl.dat
2008-11-29 02:43 . 2008-11-29 02:43 <REP> d-------- c:\program files\Zone Labs
2008-11-29 02:38 . 2008-11-29 04:44 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-11-29 02:32 . 2008-11-29 02:32 <REP> d-------- c:\program files\AVG
2008-11-29 02:27 . 2008-12-14 00:47 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-11-29 02:27 . 2004-08-04 00:38 701,440 --------- c:\windows\system32\drivers\ati2mtag.sys
2008-11-29 02:23 . 2008-12-13 22:05 <REP> d-------- c:\documents and settings\All Users\Application Data\Google Updater
2008-11-29 02:02 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll
2008-11-29 02:02 . 2008-10-16 14:09 35,864 --a------ c:\windows\system32\wucltui.dll.mui
2008-11-29 02:02 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuaucpl.cpl.mui
2008-11-29 02:02 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuapi.dll.mui
2008-11-29 02:02 . 2008-10-16 14:07 19,992 --a------ c:\windows\system32\wuaueng.dll.mui
2008-11-29 02:01 . 2008-11-29 02:01 <REP> d--hs---- c:\documents and settings\Cams\UserData
2008-11-29 00:56 . 2008-12-09 08:36 <REP> d--hs---- c:\documents and settings\Cams\Temporary Internet Files
2008-11-29 00:56 . 2008-11-29 03:58 <REP> d--hs---- c:\documents and settings\Cams\Historique
2008-11-29 00:55 . 2008-11-29 00:56 1,740 -rahs---- c:\windows\system32\drivers\103C_HP_NTBK_HP Pavilion dv9000 (RP923EA#ABF)_YN_0Pavi_QCNF6435GMG_E419857052_46_I30BD_SQuanta_V66.20_BF.05_T061002_WXP2_L40C_M1023_J120_7Intel_8Core2 T5500_91.66_#060919_N8086109A_(RP923EA#ABF)_XMOBILE_CN10_Z.MRK
2008-11-29 00:54 . 2008-12-02 23:36 <REP> d--h----- c:\documents and settings\Cams\Voisinage r‚seau
2008-11-29 00:54 . 2006-09-19 22:41 <REP> d--h----- c:\documents and settings\Cams\Voisinage d'impression
2008-11-29 00:54 . 2008-11-29 09:28 <REP> d--h----- c:\documents and settings\Cams\ModŠles
2008-11-29 00:54 . 2008-12-10 18:41 <REP> dr------- c:\documents and settings\Cams\Mes documents
2008-11-29 00:54 . 2008-11-29 09:28 <REP> dr------- c:\documents and settings\Cams\Menu D‚marrer
2008-11-29 00:54 . 2008-12-09 21:12 <REP> dr------- c:\documents and settings\Cams\Favoris
2008-11-29 00:54 . 2008-12-14 12:07 <REP> d-------- c:\documents and settings\Cams\Bureau
2008-11-29 00:54 . 2008-12-14 12:16 <REP> d-------- c:\documents and settings\Cams
2008-11-29 00:53 . 2008-11-29 09:28 <REP> d-------- c:\windows\system32\config\systemprofile\Application Data\Symantec
2008-11-29 00:49 . 2008-04-14 03:34 20,992 --a------ c:\windows\system32\dshowext.ax
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-14 11:16 3,205,120 ----a-w c:\windows\Internet Logs\xDB1.tmp
2008-11-29 10:42 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-29 08:35 --------- d-----w c:\program files\Windows Plus
2008-11-29 08:35 --------- d-----w c:\program files\Windows Media Connect 2
2008-11-29 08:35 --------- d-----w c:\program files\Synaptics
2008-11-29 08:35 --------- d-----w c:\program files\Sonic
2008-11-29 08:35 --------- d-----w c:\program files\Services en ligne
2008-11-29 08:34 --------- d-----w c:\program files\NetWaiting
2008-11-29 08:34 --------- d-----w c:\program files\Microsoft Works
2008-11-29 08:34 --------- d-----w c:\program files\microsoft frontpage
2008-11-29 08:33 --------- d-----w c:\program files\HP
2008-11-29 08:33 --------- d-----w c:\program files\Hewlett-Packard
2008-11-29 08:32 --------- d-----w c:\program files\GemMasterFrench
2008-11-29 08:32 --------- d-----w c:\program files\FrenchOtto
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\TiVo Shared
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\SureThing Shared
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\Sonic Shared
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\LightScribe
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\Java
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\HP
2008-11-29 08:32 --------- d-----w c:\program files\CONEXANT
2008-11-29 08:28 --------- d-----w c:\documents and settings\All Users\Application Data\Sonic
2008-11-29 08:28 --------- d-----w c:\documents and settings\All Users\Application Data\SBSI
2008-11-29 08:28 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2008-11-29 08:28 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2008-11-29 08:28 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-11-29 03:44 --------- d-----w c:\program files\Java
2008-11-29 01:47 --------- d-----w c:\program files\Google
2008-11-29 01:47 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-11-29 01:46 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-28 23:49 --------- d-----w c:\program files\HPQ
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-17 00:48 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 13:12 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-15 07:06 633,632 ------w c:\windows\system32\dllcache\iexplore.exe
2008-10-15 07:04 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-10-03 10:03 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 15:26 1,846,528 ----a-w c:\windows\system32\win32k.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-03 458752]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-29 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-20 86016]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 794713]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-19 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-06-19 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"nwiz"="nwiz.exe" [2006-07-20 c:\windows\system32\nwiz.exe]
"MsmqIntCert"="mqrt.dll" [2008-04-14 c:\windows\system32\mqrt.dll]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-02 c:\windows\system32\CHDAudPropShortcut.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NetAnalyse"=c:\program files\NetAnalyse\NetAnalyse.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\Drivers\5U870CAP.sys [2006-06-06 61952]
S3 XPADFL02;XPAD Filter Service 02;c:\windows\system32\DRIVERS\xpadfl02.sys [2008-11-29 27904]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2095f4fd-bf0e-11dd-8377-0016369fe0ae}]
\Shell\AutoRun\command - F:\g.exe
\Shell\explore\Command - F:\g.exe
\Shell\open\Command - F:\g.exe
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-TuneUp MemOptimizer - c:\program files\TuneUp Utilities 2009\MemOptimizer.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
TCP: {0CCE53F6-3CD9-4182-9305-D48E66B201F4} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Cams\Application Data\Mozilla\Firefox\Profiles\yvfv1z3n.default\
FF - plugin: c:\program files\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-14 12:19:02
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ????\??????`?@?????L?@
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ZoneLabs\vsmon.exe
c:\windows\system32\msdtc.exe
c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\mqsvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\system32\dllhost.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\windows\ehome\ehmsas.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\Windows Live\Messenger\usnsvc.exe
.
**************************************************************************
.
Heure de fin: 2008-12-14 12:22:47 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-14 11:22:43
Avant-CF: 63ÿ296ÿ454ÿ656 octets libres
AprÞs-CF: 63,825,403,904 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
314 --- E O F --- 2008-12-11 22:53:25
ComboFix 08-12-13.03 - Cams 2008-12-14 12:11:46.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1022.366 [GMT 1:00]
Lancé depuis: c:\documents and settings\Cams\Bureau\Jaimelecrabe.exe
* Un nouveau point de restauration a été créé
[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\npf.sys
c:\windows\system32\packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\wanpacket.dll
c:\windows\system32\wpcap.dll
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_NPF
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-14 au 2008-12-14 ))))))))))))))))))))))))))))))))))))
.
2008-12-14 11:57 . 2008-12-14 12:00 <REP> d-------- C:\ToolBar SD
2008-12-14 01:17 . 2008-12-14 01:17 <REP> d-------- c:\documents and settings\All Users\Application Data\Avg8
2008-12-14 01:15 . 2008-12-14 01:15 <REP> d-------- c:\program files\Fichiers communs\Diskeeper Corporation
2008-12-14 01:15 . 2008-12-14 01:15 <REP> d-------- c:\program files\Diskeeper Corporation
2008-12-14 01:15 . 2008-12-14 01:15 <REP> d-------- c:\documents and settings\All Users\Application Data\Diskeeper Corporation
2008-12-14 01:04 . 2008-12-14 01:04 <REP> d-------- c:\program files\RamBoost XP
2008-12-13 21:09 . 2008-12-13 21:09 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-13 21:09 . 2008-12-13 21:09 <REP> d-------- c:\documents and settings\Cams\Application Data\Malwarebytes
2008-12-13 21:09 . 2008-12-13 21:09 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-13 21:09 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-13 21:09 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-13 01:47 . 2008-12-13 01:47 603,904 --a------ c:\windows\system32\TUProgSt.exe
2008-12-13 01:45 . 2008-12-14 01:00 <REP> d-------- c:\program files\TuneUp Utilities 2009
2008-12-13 01:45 . 2008-12-13 01:45 <REP> d-------- c:\documents and settings\Cams\Application Data\TuneUp Software
2008-12-13 01:45 . 2008-12-13 01:45 <REP> d-------- c:\documents and settings\All Users\Application Data\TuneUp Software
2008-12-13 01:44 . 2008-12-13 01:44 <REP> d--hs---- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2008-12-12 16:45 . 2008-12-12 16:45 <REP> d-------- c:\program files\WinPcap
2008-12-12 15:57 . 2008-12-12 15:57 <REP> d-------- c:\program files\Trend Micro
2008-12-11 23:28 . 2008-10-03 11:03 247,326 --------- c:\windows\system32\dllcache\strmdll.dll
2008-12-11 02:45 . 2008-12-11 02:45 664 --a------ c:\windows\system32\d3d9caps.dat
2008-12-10 12:35 . 2008-12-10 12:35 0 --a------ c:\windows\nsreg.dat
2008-12-09 13:21 . 2008-12-14 12:09 <REP> d-------- c:\documents and settings\Cams\Application Data\Azureus
2008-12-09 13:21 . 2008-12-09 13:21 <REP> d-------- c:\documents and settings\All Users\Application Data\Azureus
2008-12-09 13:19 . 2008-12-09 13:20 <REP> d-------- c:\program files\Vuze
2008-12-04 16:13 . 2008-12-04 16:13 <REP> d-------- c:\windows\system32\LogFiles
2008-12-02 19:55 . 2001-08-23 17:04 12,288 --a------ c:\windows\system32\drivers\mouhid.sys
2008-12-02 19:55 . 2001-08-23 17:04 12,288 --a------ c:\windows\system32\dllcache\mouhid.sys
2008-11-30 20:05 . 2008-11-30 20:05 <REP> d-------- c:\documents and settings\Cams\Application Data\OpenOffice.org
2008-11-30 19:40 . 2008-04-13 19:45 26,368 --a------ c:\windows\system32\dllcache\usbstor.sys
2008-11-30 14:10 . 2008-12-03 10:11 <REP> d-------- c:\documents and settings\Cams\Contacts
2008-11-30 00:54 . 2008-11-30 00:54 <REP> d-------- c:\documents and settings\Cams\Application Data\Media Player Classic
2008-11-30 00:52 . 2008-11-30 00:53 <REP> d-------- c:\program files\Satsuki Decoder Pack
2008-11-29 19:24 . 2008-11-29 19:24 <REP> d-------- c:\program files\SixaxisDriver
2008-11-29 19:24 . 2006-12-24 05:15 27,904 --a------ c:\windows\system32\drivers\xPADFL02.sys
2008-11-29 19:21 . 2008-04-13 19:45 10,368 --a------ c:\windows\system32\drivers\hidusb.sys
2008-11-29 19:21 . 2008-04-13 19:45 10,368 --a------ c:\windows\system32\dllcache\hidusb.sys
2008-11-29 11:44 . 2008-11-29 11:44 4,096 --a------ c:\windows\d3dx.dat
2008-11-29 10:57 . 2008-11-29 19:19 <REP> d-------- c:\program files\PlayOnline
2008-11-29 10:57 . 2008-11-29 10:57 <REP> d-------- c:\program files\Fichiers communs\PlayOnline
2008-11-29 10:44 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2008-11-29 10:44 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2008-11-29 04:44 . 2008-11-29 04:44 <REP> d-------- c:\windows\Sun
2008-11-29 04:44 . 2008-11-29 04:44 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-29 04:40 . 2008-11-29 04:41 <REP> d-------- c:\windows\system32\Adobe
2008-11-29 04:11 . 2008-10-16 21:18 459,264 --------- c:\windows\system32\dllcache\msfeeds.dll
2008-11-29 04:11 . 2008-10-16 21:18 267,776 --------- c:\windows\system32\dllcache\iertutil.dll
2008-11-29 04:11 . 2008-10-16 21:18 52,224 --------- c:\windows\system32\dllcache\msfeedsbs.dll
2008-11-29 04:11 . 2008-10-16 14:11 13,824 --------- c:\windows\system32\dllcache\ieudinit.exe
2008-11-29 04:10 . 2008-10-16 21:18 6,066,176 --------- c:\windows\system32\dllcache\ieframe.dll
2008-11-29 04:10 . 2007-04-17 10:32 2,455,488 --------- c:\windows\system32\dllcache\ieapfltr.dat
2008-11-29 04:10 . 2007-03-08 06:10 1,048,576 --------- c:\windows\system32\dllcache\ieframe.dll.mui
2008-11-29 04:10 . 2008-10-16 21:18 383,488 --------- c:\windows\system32\dllcache\ieapfltr.dll
2008-11-29 04:10 . 2008-10-16 21:18 63,488 --------- c:\windows\system32\dllcache\icardie.dll
2008-11-29 04:04 . 2008-11-29 04:04 <REP> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2008-11-29 04:01 . 2008-11-29 04:01 <REP> d-------- c:\program files\MSXML 4.0
2008-11-29 04:00 . 2008-10-15 17:35 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
2008-11-29 03:48 . 2008-11-29 04:11 <REP> d-------- c:\windows\system32\fr-fr
2008-11-29 03:48 . 2008-11-29 03:48 <REP> d-------- c:\windows\system32\fr
2008-11-29 03:48 . 2008-11-29 03:48 <REP> d-------- c:\windows\system32\bits
2008-11-29 03:48 . 2008-11-29 03:48 <REP> d-------- c:\windows\l2schemas
2008-11-29 03:42 . 2008-11-29 03:48 <REP> d-------- c:\windows\ServicePackFiles
2008-11-29 03:33 . 2008-12-12 17:24 <REP> d-------- c:\program files\Fichiers communs\Adobe
2008-11-29 03:18 . 2008-06-14 18:33 272,768 --------- c:\windows\system32\dllcache\bthport.sys
2008-11-29 03:17 . 2008-09-15 16:26 1,846,528 --------- c:\windows\system32\dllcache\win32k.sys
2008-11-29 03:17 . 2008-09-08 11:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
2008-11-29 03:17 . 2008-08-14 11:04 138,496 --------- c:\windows\system32\dllcache\afd.sys
2008-11-29 03:16 . 2008-08-14 14:23 2,191,232 --------- c:\windows\system32\dllcache\ntoskrnl.exe
2008-11-29 03:16 . 2008-08-14 14:23 2,147,328 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-11-29 03:16 . 2008-08-14 14:23 2,068,096 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-29 03:16 . 2008-08-14 14:23 2,025,984 --------- c:\windows\system32\dllcache\ntkrpamp.exe
2008-11-29 03:09 . 2008-11-29 03:09 <REP> d-------- c:\program files\OpenOffice.org 3
2008-11-29 03:09 . 2008-06-11 02:58 2,330,624 --------- c:\windows\system32\dllcache\WMVCore.dll
2008-11-29 03:09 . 2008-10-24 12:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-29 03:09 . 2008-05-08 15:02 203,136 --------- c:\windows\system32\dllcache\rmcast.sys
2008-11-29 03:08 . 2008-12-14 12:20 <REP> d-------- c:\documents and settings\Cams\Application Data\skypePM
2008-11-29 03:08 . 2008-04-11 20:05 691,712 --------- c:\windows\system32\dllcache\inetcomm.dll
2008-11-29 03:08 . 2008-05-01 15:36 331,776 --------- c:\windows\system32\dllcache\msadce.dll
2008-11-29 03:08 . 2008-11-29 03:08 56 --ah----- c:\windows\system32\ezsidmv.dat
2008-11-29 03:07 . 2008-12-14 12:20 <REP> d-------- c:\documents and settings\Cams\Application Data\Skype
2008-11-29 03:06 . 2008-11-29 03:06 <REP> d-------- c:\program files\Skype
2008-11-29 03:06 . 2008-11-29 03:06 <REP> d-------- c:\program files\Fichiers communs\Skype
2008-11-29 03:06 . 2008-11-29 03:06 <REP> d-------- c:\documents and settings\All Users\Application Data\Skype
2008-11-29 03:01 . 2008-11-30 14:09 <REP> d--hsc--- c:\program files\Fichiers communs\WindowsLiveInstaller
2008-11-29 03:00 . 2008-11-30 14:09 <REP> d-------- c:\program files\Windows Live
2008-11-29 03:00 . 2008-11-30 14:06 <REP> d-------- c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-29 02:57 . 2008-09-04 18:16 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll
2008-11-29 02:47 . 2008-12-14 12:21 12,189,728 --ahs---- c:\windows\system32\drivers\fidbox.dat
2008-11-29 02:47 . 2008-12-14 12:16 143,852 --ahs---- c:\windows\system32\drivers\fidbox.idx
2008-11-29 02:45 . 2008-11-29 02:45 <REP> d-------- c:\documents and settings\All Users\Application Data\MailFrontier
2008-11-29 02:44 . 2008-07-09 09:05 75,248 --a------ c:\windows\zllsputility.exe
2008-11-29 02:44 . 2008-07-09 09:05 54,672 --a------ c:\windows\system32\vsutil_loc040c.dll
2008-11-29 02:44 . 2008-07-09 09:05 42,384 --a------ c:\windows\zllsputility_loc040c.dll
2008-11-29 02:44 . 2008-07-09 09:05 21,904 --a------ c:\windows\system32\imsinstall_loc040c.dll
2008-11-29 02:44 . 2008-07-09 09:05 17,808 --a------ c:\windows\system32\imslsp_install_loc040c.dll
2008-11-29 02:44 . 2004-04-27 04:40 11,264 --a------ c:\windows\system32\SpOrder.dll
2008-11-29 02:44 . 2008-11-29 02:45 4,212 ---h----- c:\windows\system32\zllictbl.dat
2008-11-29 02:43 . 2008-11-29 02:43 <REP> d-------- c:\program files\Zone Labs
2008-11-29 02:38 . 2008-11-29 04:44 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-11-29 02:32 . 2008-11-29 02:32 <REP> d-------- c:\program files\AVG
2008-11-29 02:27 . 2008-12-14 00:47 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-11-29 02:27 . 2004-08-04 00:38 701,440 --------- c:\windows\system32\drivers\ati2mtag.sys
2008-11-29 02:23 . 2008-12-13 22:05 <REP> d-------- c:\documents and settings\All Users\Application Data\Google Updater
2008-11-29 02:02 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll
2008-11-29 02:02 . 2008-10-16 14:09 35,864 --a------ c:\windows\system32\wucltui.dll.mui
2008-11-29 02:02 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuaucpl.cpl.mui
2008-11-29 02:02 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuapi.dll.mui
2008-11-29 02:02 . 2008-10-16 14:07 19,992 --a------ c:\windows\system32\wuaueng.dll.mui
2008-11-29 02:01 . 2008-11-29 02:01 <REP> d--hs---- c:\documents and settings\Cams\UserData
2008-11-29 00:56 . 2008-12-09 08:36 <REP> d--hs---- c:\documents and settings\Cams\Temporary Internet Files
2008-11-29 00:56 . 2008-11-29 03:58 <REP> d--hs---- c:\documents and settings\Cams\Historique
2008-11-29 00:55 . 2008-11-29 00:56 1,740 -rahs---- c:\windows\system32\drivers\103C_HP_NTBK_HP Pavilion dv9000 (RP923EA#ABF)_YN_0Pavi_QCNF6435GMG_E419857052_46_I30BD_SQuanta_V66.20_BF.05_T061002_WXP2_L40C_M1023_J120_7Intel_8Core2 T5500_91.66_#060919_N8086109A_(RP923EA#ABF)_XMOBILE_CN10_Z.MRK
2008-11-29 00:54 . 2008-12-02 23:36 <REP> d--h----- c:\documents and settings\Cams\Voisinage r‚seau
2008-11-29 00:54 . 2006-09-19 22:41 <REP> d--h----- c:\documents and settings\Cams\Voisinage d'impression
2008-11-29 00:54 . 2008-11-29 09:28 <REP> d--h----- c:\documents and settings\Cams\ModŠles
2008-11-29 00:54 . 2008-12-10 18:41 <REP> dr------- c:\documents and settings\Cams\Mes documents
2008-11-29 00:54 . 2008-11-29 09:28 <REP> dr------- c:\documents and settings\Cams\Menu D‚marrer
2008-11-29 00:54 . 2008-12-09 21:12 <REP> dr------- c:\documents and settings\Cams\Favoris
2008-11-29 00:54 . 2008-12-14 12:07 <REP> d-------- c:\documents and settings\Cams\Bureau
2008-11-29 00:54 . 2008-12-14 12:16 <REP> d-------- c:\documents and settings\Cams
2008-11-29 00:53 . 2008-11-29 09:28 <REP> d-------- c:\windows\system32\config\systemprofile\Application Data\Symantec
2008-11-29 00:49 . 2008-04-14 03:34 20,992 --a------ c:\windows\system32\dshowext.ax
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-14 11:16 3,205,120 ----a-w c:\windows\Internet Logs\xDB1.tmp
2008-11-29 10:42 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-29 08:35 --------- d-----w c:\program files\Windows Plus
2008-11-29 08:35 --------- d-----w c:\program files\Windows Media Connect 2
2008-11-29 08:35 --------- d-----w c:\program files\Synaptics
2008-11-29 08:35 --------- d-----w c:\program files\Sonic
2008-11-29 08:35 --------- d-----w c:\program files\Services en ligne
2008-11-29 08:34 --------- d-----w c:\program files\NetWaiting
2008-11-29 08:34 --------- d-----w c:\program files\Microsoft Works
2008-11-29 08:34 --------- d-----w c:\program files\microsoft frontpage
2008-11-29 08:33 --------- d-----w c:\program files\HP
2008-11-29 08:33 --------- d-----w c:\program files\Hewlett-Packard
2008-11-29 08:32 --------- d-----w c:\program files\GemMasterFrench
2008-11-29 08:32 --------- d-----w c:\program files\FrenchOtto
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\TiVo Shared
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\SureThing Shared
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\Sonic Shared
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\LightScribe
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\Java
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-11-29 08:32 --------- d-----w c:\program files\Fichiers communs\HP
2008-11-29 08:32 --------- d-----w c:\program files\CONEXANT
2008-11-29 08:28 --------- d-----w c:\documents and settings\All Users\Application Data\Sonic
2008-11-29 08:28 --------- d-----w c:\documents and settings\All Users\Application Data\SBSI
2008-11-29 08:28 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2008-11-29 08:28 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2008-11-29 08:28 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-11-29 03:44 --------- d-----w c:\program files\Java
2008-11-29 01:47 --------- d-----w c:\program files\Google
2008-11-29 01:47 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-11-29 01:46 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-28 23:49 --------- d-----w c:\program files\HPQ
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-17 00:48 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 13:12 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-15 07:06 633,632 ------w c:\windows\system32\dllcache\iexplore.exe
2008-10-15 07:04 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-10-03 10:03 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 15:26 1,846,528 ----a-w c:\windows\system32\win32k.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-03 458752]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-29 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-20 86016]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 794713]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-19 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-06-19 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"nwiz"="nwiz.exe" [2006-07-20 c:\windows\system32\nwiz.exe]
"MsmqIntCert"="mqrt.dll" [2008-04-14 c:\windows\system32\mqrt.dll]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-02 c:\windows\system32\CHDAudPropShortcut.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NetAnalyse"=c:\program files\NetAnalyse\NetAnalyse.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\Drivers\5U870CAP.sys [2006-06-06 61952]
S3 XPADFL02;XPAD Filter Service 02;c:\windows\system32\DRIVERS\xpadfl02.sys [2008-11-29 27904]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2095f4fd-bf0e-11dd-8377-0016369fe0ae}]
\Shell\AutoRun\command - F:\g.exe
\Shell\explore\Command - F:\g.exe
\Shell\open\Command - F:\g.exe
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-TuneUp MemOptimizer - c:\program files\TuneUp Utilities 2009\MemOptimizer.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
TCP: {0CCE53F6-3CD9-4182-9305-D48E66B201F4} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Cams\Application Data\Mozilla\Firefox\Profiles\yvfv1z3n.default\
FF - plugin: c:\program files\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-14 12:19:02
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ????\??????`?@?????L?@
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ZoneLabs\vsmon.exe
c:\windows\system32\msdtc.exe
c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\mqsvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\system32\dllhost.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\windows\ehome\ehmsas.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\Windows Live\Messenger\usnsvc.exe
.
**************************************************************************
.
Heure de fin: 2008-12-14 12:22:47 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-14 11:22:43
Avant-CF: 63ÿ296ÿ454ÿ656 octets libres
AprÞs-CF: 63,825,403,904 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
314 --- E O F --- 2008-12-11 22:53:25
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
UC utilisée, 14-15% charge dédiée aux alentours de 430Mo, Victoire !
Merci de ton aide !
Cependant j'aurais une question, pourrais tu me conseiller un antivirus et un firewall assez léger et efficace ?
Merci de ton aide !
Cependant j'aurais une question, pourrais tu me conseiller un antivirus et un firewall assez léger et efficace ?
Avira Antivir personal classic edition (grauit et francais + efficace) :
http://dlce.antivir.com/down/windows/antivir_workstation_winu_fr_h.exe
tuto pour bien l'installer le configurer : https://www.malekal.com/avira-free-security-antivirus-gratuit/
pare-feu je te conseille celui-la : https://www.malekal.com/tutorial-comodo-firewall/
http://dlce.antivir.com/down/windows/antivir_workstation_winu_fr_h.exe
tuto pour bien l'installer le configurer : https://www.malekal.com/avira-free-security-antivirus-gratuit/
pare-feu je te conseille celui-la : https://www.malekal.com/tutorial-comodo-firewall/
