Infecté par win32/heur
Bonjour,
depuis hier, avg m indique que je suis infecté par win32/heur. Je n arrive pas à virer ce virus et je ne sais pas si il y a un lien de cause a effet, nero ne reconnait plus mon graveur, et chose etrange quand je met un dvd vierge dans celui ci, je ne peux plus ouvrir le tiroir car il m est indiqué que mon lecteur est en cours d utilisation...
Comment me debarrasser de win32/heur ?
Merci:
Ps: c est mon premier cas d infection donc n hesitez pas a m indiquer les logiciels a utiliser et quel rapport vous envoyer!
depuis hier, avg m indique que je suis infecté par win32/heur. Je n arrive pas à virer ce virus et je ne sais pas si il y a un lien de cause a effet, nero ne reconnait plus mon graveur, et chose etrange quand je met un dvd vierge dans celui ci, je ne peux plus ouvrir le tiroir car il m est indiqué que mon lecteur est en cours d utilisation...
Comment me debarrasser de win32/heur ?
Merci:
Ps: c est mon premier cas d infection donc n hesitez pas a m indiquer les logiciels a utiliser et quel rapport vous envoyer!
Configuration: Windows Vista Firefox 3.0.10
26 réponses
Résumé de la discussion
La discussion porte sur une détection AVG de win32/heur et des symptômes sur Windows Vista, notamment un graveur Nero qui ne répond plus et un tiroir bloqué. La meilleure réponse s'appuie sur un rapport détaillé généré par HijackThis et des analyses RSIT pour repérer les éléments suspects dans les processus et le démarrage et estimer l'étendue de l'infection. Le contenu du rapport énumère des éléments suspects, tels que des BHO et barres d’outils (Yahoo!, AVG Safe Search) ainsi que des programmes au démarrage et des entrées de registre. D'autres éléments ajoutent une dimension pratique, comme la présence de rapports d'analyse et d'outils de correction (RSIT, Malwarebytes, ComboFix) et des indices de modifications système.
-
Contributeur sécuritédca bonjour , ouvre ton propre sujet si tu veux trouver de l'aide
-
Bonjour.
Quelqu'un connaitrait-t-il un site qui donne la méthode générale.
Car comment peut-on reconnaitre les mauvaises cles qui sont a supprimer des bonnes?
Sinon, j'ai le même problème que volavoil. Je poste donc mon rapport HijackThis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:25:27, on 07/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\PDF Complete\pdfsty.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe
C:\Program Files\Fichiers communs\Nokia\Service Layer\A\nsl_host_process.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O2 - BHO: IEHlprObj Class - {F171A450-7AF5-43E1-AFED-EDC826A1B0F5} - C:\WINDOWS\system32\bgdferw0.dll (file missing)
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\RunOnce: [PCSuite.exe] C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe -onlytray -install -startgcw
O4 - HKCU\..\RunOnce: [PcSync2.exe] C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe /NoDialog
O4 - .DEFAULT User Startup: CCC.lnk = ? (User 'Default user')
O4 - Startup: CCC.lnk = ?
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{77ABC3CC-620C-44DA-9F02-8EB8CE10C913}: NameServer = 192.168.0.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: APSHook.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: OneCard - C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Update Service (gupdate1c9cfd32bdbfcba) (gupdate1c9cfd32bdbfcba) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Drive Encryption Service (HpFkCryptService) - SafeBoot International - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
-
ModérateurTu as réinstallé ton firewall pour voir si ça changeait quelque chose ?
--> Télécharge UsbFix (de C_XX & Chiquitine29) sur ton Bureau.
--> Lance l'installation avec les paramètres par défaut.
--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.
--> Clique droit sur le raccourci UsbFix sur ton Bureau et choisis Exécuter en tant qu'administrateur.
--> Choisis l'option 1 (Recherche).
--> Laisse travailler l'outil.
--> Poste le rapport UsbFix.txt.
Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).
"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. -
voila le rapport rist
de plus, pour que je puisse naviguer desormais je dois:
eteindre mon firewall, ouvrir mon navigateur, puis rallumer mon firewall pour que tout marche nickel... bizarre
Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-06-02 06:53:24
Microsoft® Windows Vista™ Édition Intégrale Service Pack 2
System drive C: has 9 GB (31%) free of 30 GB
Total RAM: 2046 MB (62% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:53:33, on 02/06/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
D:\programme\iTunesHelper.exe
D:\programme\adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
D:\programme\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Users\Administrateur\Desktop\RSIT.exe
C:\Program Files\trend micro\Administrateur.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://unattendshare.free.fr/index2.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\programme\adobe\/Adobe Contribute CS4/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\programme\adobe\/Adobe Contribute CS4/contributeieplugin.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\programme\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "D:\programme\adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\programme\adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\programme\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Global Startup: RocketDock -.lnk = C:\Program Files\RocketDock\RocketDock.exe
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir au format PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\Windows\System32\avgrsstx.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Look 'n' Stop Service (lnssvcVista) - Unknown owner - C:\Program Files\Soft4Ever\looknstop\LnsSvcVista.exe
-
Modérateur--> Refais un scan RSIT et poste le rapport log.
-
Re
internet remarche apres avoir lancer combofix (efficace ce petit logiciel)
j attends votre analyse sur mon rapport AVG pour savoir si il y a autre chose a faire -
Voici le rapport d avg
par contre juste pour infos, aucun de mes navigateurs n arrivent à aller sur le net ce matin et pourtant thunderbird peut bien aller chercher mes messages... d ou le fait que je reponde depuis l ordi de ma copine
L'Analyse "Analyse complète" est terminée.
Rootkits;"1";"0";"1"
Dossiers sélectionnés pour l'analyse :;"Analyse complète"
Analyse démarrée :;"lundi 1 juin 2009, 09:28:34"
Analyse terminée :;"lundi 1 juin 2009, 11:07:26 (1 heure(s) 38 minute(s) 52 seconde(s))"
Total des objets analysés :;"909722"
Utilisateur ayant exécuté l'analyse :;"Administrateur"
Avertissements
Fichier;"Infection";"Résultat"
C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\cookies.sqlite;"Détection de : Tracking cookie.Clickbank ";"Réparé"
C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\cookies.sqlite:\clickbank.net.82079eb1;"Détection de : Tracking cookie.Clickbank ";"Placé en quarantaine"
C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\cookies.sqlite:\estat.com.efda7a5a;"Détection de : Tracking cookie.Estat ";"Placé en quarantaine"
Rootkits
Fichier;"Infection";"Résultat"
C:\Windows\System32\Drivers\apwnqqjt.SYS;"Pilote masqué";"L'objet est masqué" -
ModérateurFais un scan complet avec AVG.
-
voila
ComboFix 09-05-31.02 - Administrateur 31/05/2009 21:13.2 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6002.2.1252.33.1036.18.2046.1322 [GMT 2:00]
Lancé depuis: c:\users\Administrateur\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Administrateur\Desktop\CFScript.txt
FW: Look 'n' Stop 2.06p3 (Soft4Ever) *disabled* {2A530F53-4A99-4EE0-8471-4A00BA4A47B0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
FILE ::
"C:\Iexplor171.exe"
"C:\Iexplor179.exe"
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Iexplor171.exe
C:\Iexplor179.exe
c:\program files\DAEMON Tools Toolbar
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-28 au 2009-05-31 ))))))))))))))))))))))))))))))))))))
.
2009-05-31 19:15 . 2009-05-31 19:18 -------- d-----w- c:\users\Administrateur\AppData\Local\temp
2009-05-31 15:58 . 2009-05-31 18:46 -------- d-----w- c:\program files\trend micro
2009-05-31 15:58 . 2009-05-31 15:59 -------- d-----w- C:\rsit
2009-05-31 15:13 . 2009-05-31 15:13 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Malwarebytes
2009-05-31 15:13 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-31 15:13 . 2009-05-31 15:13 -------- d-----w- c:\programdata\Malwarebytes
2009-05-31 15:13 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-30 12:05 . 2009-05-31 16:36 -------- d--h--w- C:\$AVG8.VAULT$
2009-05-28 18:17 . 2009-05-28 18:17 -------- d-----w- c:\program files\Microsoft Works
2009-05-28 18:16 . 2009-05-28 18:16 -------- d-----w- c:\windows\PCHEALTH
2009-05-28 18:16 . 2009-05-28 18:16 -------- d-----w- c:\program files\Microsoft.NET
2009-05-28 18:14 . 2009-05-28 18:14 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-05-28 18:13 . 2009-05-28 18:13 -------- d-----w- c:\users\Administrateur\AppData\Local\Microsoft Help
2009-05-28 18:13 . 2009-05-28 18:18 -------- d-----w- c:\programdata\Microsoft Help
2009-05-28 18:10 . 2009-05-28 18:10 -------- d--h--r- C:\MSOCache
2009-05-28 17:46 . 2009-05-31 15:49 -------- d-----w- c:\users\Administrateur\AppData\Local\QuickPar
2009-05-27 04:57 . 2009-05-31 19:18 -------- d-----r- c:\users\Public\Recorded TV
2009-05-21 16:45 . 2009-05-21 16:45 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Nero
2009-05-21 16:32 . 2009-05-21 16:32 -------- d-----w- c:\programdata\SlySoft
2009-05-21 16:29 . 2009-05-21 16:38 -------- d-----w- c:\programdata\DVD Shrink
2009-05-18 20:31 . 2009-05-18 20:31 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Yahoo!
2009-05-18 20:31 . 2009-05-18 20:31 -------- d-----w- c:\programdata\Yahoo! Companion
2009-05-18 19:39 . 2009-05-21 13:59 -------- d-----w- c:\users\Administrateur\AppData\Roaming\uTorrent
2009-05-18 17:28 . 2009-05-18 17:28 10134 ----a-r- c:\users\Administrateur\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-05-18 17:28 . 2009-05-18 17:28 -------- d-----w- c:\program files\Microsoft WSE
2009-05-18 17:23 . 2009-05-18 17:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-18 17:17 . 2009-05-18 17:17 -------- d-----w- c:\programdata\DAEMON Tools Lite
2009-05-18 17:14 . 2009-05-18 17:19 -------- d-----w- c:\users\Administrateur\AppData\Roaming\DAEMON Tools Lite
2009-05-18 15:13 . 2009-05-16 20:34 10520 ----a-w- c:\programdata\avg8\update\backup\avgrsstx.dll
2009-05-18 15:13 . 2009-05-16 20:34 12552 ----a-w- c:\programdata\avg8\update\backup\avgrkx86.sys
2009-05-18 15:13 . 2009-05-16 20:34 107912 ----a-w- c:\programdata\avg8\update\backup\avgtdix.sys
2009-05-18 15:13 . 2009-05-16 20:34 325640 ----a-w- c:\programdata\avg8\update\backup\avgldx86.sys
2009-05-18 15:13 . 2009-05-16 20:34 485144 ----a-w- c:\programdata\avg8\update\backup\avgrsx.exe
2009-05-18 15:13 . 2009-05-16 20:34 27656 ----a-w- c:\programdata\avg8\update\backup\avgmfx86.sys
2009-05-18 15:10 . 2009-05-16 20:34 1057024 ----a-w- c:\programdata\avg8\update\backup\avgupd.exe
2009-05-18 15:10 . 2009-05-16 20:34 745240 ----a-w- c:\programdata\avg8\update\backup\avginet.dll
2009-05-18 15:10 . 2009-05-16 20:34 578840 ----a-w- c:\programdata\avg8\update\backup\avgiproxy.exe
2009-05-18 15:10 . 2009-05-16 20:34 1424152 ----a-w- c:\programdata\avg8\update\backup\avgupd.dll
2009-05-17 15:12 . 2009-05-17 15:12 -------- d-----w- c:\programdata\WindowsSearch
2009-05-17 15:08 . 2009-05-17 15:08 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Media Player Classic
2009-05-17 13:28 . 2009-05-17 14:33 -------- d-----w- c:\users\Administrateur\AppData\Local\Apple Computer
2009-05-17 13:28 . 2009-05-17 13:34 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Apple Computer
2009-05-17 13:28 . 2009-05-17 13:28 -------- dc----w- c:\windows\system32\DRVSTORE
2009-05-17 13:28 . 2009-03-19 14:32 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-17 13:28 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-05-17 13:27 . 2009-05-17 13:27 -------- d-----w- c:\program files\iPod
2009-05-17 13:27 . 2009-05-17 13:28 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-17 13:26 . 2009-05-17 13:27 -------- d-----w- c:\program files\Common Files\Apple
2009-05-17 13:23 . 2009-05-17 13:23 -------- d-----w- c:\program files\Bonjour
2009-05-17 13:22 . 2009-05-17 13:27 -------- d-----w- c:\programdata\Apple Computer
2009-05-17 13:22 . 2009-05-17 13:23 -------- d-----w- c:\program files\QuickTime
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\users\Administrateur\AppData\Local\Apple
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\program files\Apple Software Update
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\programdata\Apple
2009-05-17 13:04 . 2009-05-31 18:48 -------- d-----w- c:\programdata\FLEXnet
2009-05-17 12:38 . 2009-05-17 12:41 -------- d-----w- c:\users\Administrateur\AppData\Local\looknstop
2009-05-17 11:56 . 2009-05-17 11:56 -------- d-----w- c:\programdata\ALM
2009-05-17 11:41 . 2009-05-17 11:41 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-05-17 11:16 . 2008-04-07 03:38 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
2009-05-17 11:07 . 2009-05-17 11:07 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-17 11:04 . 2009-05-17 11:04 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-05-17 10:54 . 2009-05-17 10:54 79232 ----a-w- c:\windows\system32\drivers\lnsfw1.sys
2009-05-17 10:54 . 2009-05-17 10:54 58232 ----a-w- c:\windows\system32\drivers\lnsfw.sys
2009-05-17 10:54 . 2009-05-17 10:54 36864 ----a-w- c:\windows\system32\fwapi.dll
2009-05-17 10:53 . 2009-05-17 10:55 -------- d-----w- c:\program files\Soft4Ever
2009-05-17 10:37 . 2009-05-17 10:38 -------- d-----w- c:\program files\NewsBin
2009-05-17 10:28 . 2009-05-31 15:49 -------- d-----w- c:\users\Administrateur\AppData\Roaming\NewsBin
2009-05-17 10:28 . 2009-05-17 10:28 -------- d-----w- c:\programdata\NewsBin
2009-05-17 10:19 . 2009-05-17 10:26 -------- d-----w- c:\users\Administrateur\AppData\Roaming\GrabIt
2009-05-17 10:12 . 2009-05-17 10:12 -------- d-----w- c:\program files\GrabIt
2009-05-16 21:31 . 2009-05-16 21:31 -------- d-----w- c:\program files\Sunbelt Software
2009-05-16 21:19 . 2009-05-16 21:19 0 ----a-w- c:\windows\nsreg.dat
2009-05-16 21:19 . 2009-05-16 21:35 -------- d-----w- c:\users\Administrateur\AppData\Local\Thunderbird
2009-05-16 21:19 . 2009-05-16 21:19 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Thunderbird
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\users\Administrateur\AppData\Roaming\ATI
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\users\Administrateur\AppData\Local\ATI
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\programdata\ATI
2009-05-16 20:41 . 2009-05-16 20:41 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-05-16 20:34 . 2009-05-18 15:12 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-16 20:34 . 2009-05-18 15:12 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-05-16 20:34 . 2009-05-18 15:12 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-16 20:34 . 2009-05-18 15:12 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-16 20:34 . 2009-05-31 09:47 -------- d-----w- c:\windows\system32\drivers\Avg
2009-05-16 20:34 . 2009-05-18 15:12 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-16 20:34 . 2009-05-31 13:11 -------- d-----w- c:\programdata\avg8
2009-05-16 20:34 . 2009-05-16 20:34 -------- d-----w- c:\program files\AVG
2009-05-16 20:27 . 2009-05-16 20:27 9158 ----a-w- c:\users\Administrateur\AppData\Roaming\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-05-16 20:27 . 2009-05-16 20:27 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-05-16 20:19 . 2009-05-16 20:19 -------- d-----w- C:\WPI
2009-05-16 20:19 . 2007-03-01 13:38 4390912 ----a-w- c:\windows\RtHDVCpl.exe
2009-05-16 20:19 . 2007-01-16 08:39 1191936 ----a-w- c:\windows\RtlUpd.exe
2009-05-16 20:19 . 2009-05-16 20:25 -------- d-----w- C:\drivers
2009-05-16 20:15 . 2009-05-16 20:15 -------- d-----w- c:\users\Administrateur\AppData\Local\Cooliris
2009-05-16 20:15 . 2009-05-16 20:15 -------- d-----w- c:\users\Administrateur\AppData\Local\Mozilla
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Xtremsplit
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Messenger Plus! Live
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Microsoft
2009-05-16 20:09 . 2009-05-31 14:42 -------- d-----w- c:\users\Administrateur\AppData\Local\Downloaded Installations
2009-05-16 20:09 . 2009-05-16 20:09 -------- d---a-w- C:\WPI_Audio
2009-05-16 20:06 . 2009-05-28 19:25 78736 ----a-w- c:\users\Administrateur\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-16 20:06 . 2009-05-16 20:06 -------- d-----w- c:\program files\System
2009-05-16 20:06 . 2009-03-31 14:21 345670 ----a-w- c:\windows\Windows 7_Calculator.exe
2009-05-16 20:06 . 2009-03-31 02:39 412813 ----a-w- c:\windows\Wordpad_2009.exe
2009-05-16 20:05 . 2008-03-21 23:16 1347584 ----a-w- c:\programdata\Nero\DrWeb\DRWEB32.DLL
2009-05-16 20:05 . 2009-05-31 14:36 -------- d-----w- c:\program files\Common Files\Nero
2009-05-16 20:05 . 2009-05-31 14:30 -------- d-----w- c:\programdata\Nero
2009-05-16 20:05 . 2009-05-31 14:26 -------- d-----w- c:\program files\Nero
2009-05-16 20:05 . 2009-05-16 20:05 -------- d-----w- c:\program files\7-Zip
2009-05-16 20:05 . 2009-05-26 04:46 -------- d-----w- c:\windows\system32\Macromed
2009-05-16 19:42 . 2009-05-16 19:42 -------- d-----w- c:\program files\Microsoft Silverlight
2009-05-16 19:42 . 2009-05-31 15:01 -------- d-sh--w- c:\windows\Installer
2009-05-16 19:42 . 2009-05-18 17:14 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-05-16 19:42 . 2009-05-16 19:42 -------- d-----w- c:\program files\Notepad2
2009-05-16 19:33 . 2009-05-16 21:10 -------- d-----w- c:\windows\system32\RTCOM
2009-05-16 19:33 . 2009-05-16 19:33 -------- d-----w- c:\program files\Realtek
2009-05-09 23:40 . 2009-05-09 23:40 103872 ----a-w- c:\windows\system32\drivers\AnyDVD.sys
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-31 19:16 . 2009-04-12 15:21 12 ----a-w- c:\windows\bthservsdp.dat
2009-05-31 17:22 . 2008-01-21 08:04 669328 ----a-w- c:\windows\system32\perfh00C.dat
2009-05-31 17:22 . 2008-01-21 08:04 123350 ----a-w- c:\windows\system32\perfc00C.dat
2009-05-28 18:16 . 2006-11-02 12:35 -------- d-----w- c:\program files\MSBuild
2009-05-17 13:31 . 2009-05-17 13:31 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-05-17 12:46 . 2009-05-16 20:12 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-16 21:42 . 2009-05-16 20:12 -------- d-----w- c:\program files\FileZilla
2009-05-16 20:36 . 2009-05-16 19:43 680 ----a-w- c:\users\Administrateur\AppData\Local\d3d9caps.dat
2009-05-16 20:27 . 2009-05-16 20:26 -------- d-----w- c:\program files\ATI Technologies
2009-05-16 20:26 . 2009-05-16 20:26 -------- d-----w- c:\program files\ATI
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\Notepad++
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Notepad++
2009-05-16 20:12 . 2009-05-16 20:12 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\Java
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\HashTab Shell Extension
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\PowerISO
2009-05-16 20:11 . 2009-05-16 20:10 -------- d-----w- c:\program files\Windows Live
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Resource Hacker
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\QuickPar
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Yahoo!
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\programdata\ACD Systems
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\ACD Systems
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Modèles
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Menu Démarrer
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Favoris
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Documents
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Bureau
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\program files\Fichiers communs
2009-05-16 19:27 . 2009-05-16 19:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-04-19 12:12 . 2009-04-19 12:12 -------- d-----w- c:\program files\CCleaner
2009-04-19 12:11 . 2009-04-19 12:11 -------- d-----w- c:\program files\uTorrent
2009-04-19 08:41 . 2006-11-02 07:26 30051328 ----a-w- c:\windows\system32\imageres.dll
2009-04-17 11:49 . 2009-04-17 13:09 -------- d-----w- c:\program files\IconWorkshopPortable
2009-04-17 11:49 . 2009-04-17 13:10 -------- d-----w- c:\program files\RocketDock
2009-04-17 11:49 . 2009-04-17 13:09 -------- d-----w- c:\program files\Diskeeper
2009-04-17 11:48 . 2009-04-17 13:09 -------- d-----w- c:\program files\PhotoshopPortable
2009-04-17 11:47 . 2009-04-17 13:09 -------- d-----w- c:\program files\NeroPortable
2009-04-14 18:21 . 2009-04-14 18:21 705024 ----a-w- c:\windows\system32\sbe.dll
2009-04-14 18:19 . 2009-04-14 18:19 604672 ----a-w- c:\windows\system32\CPFilters.dll
2009-04-14 18:19 . 2009-04-14 18:19 450048 ----a-w- c:\windows\system32\psisdecd.dll
2009-04-14 18:19 . 2009-04-14 18:19 153088 ----a-w- c:\windows\system32\sbeio.dll
2009-04-14 18:05 . 2009-04-14 18:05 -------- d-----w- c:\program files\Hyper-V
2009-04-14 18:05 . 2009-04-14 18:05 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-04-14 18:05 . 2009-04-14 18:05 43544 ----a-w- c:\windows\system32\wups2.dll
2009-04-14 18:05 . 2009-04-14 18:05 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-04-14 18:05 . 2009-04-14 18:05 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-04-14 18:05 . 2009-04-14 18:05 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-04-14 18:05 . 2009-04-14 18:05 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-04-14 18:05 . 2009-04-14 18:05 34328 ----a-w- c:\windows\system32\wups.dll
2009-04-14 18:05 . 2009-04-14 18:05 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-04-14 18:05 . 2009-04-14 18:05 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-04-14 18:04 . 2009-04-14 18:04 762880 ----a-w- c:\windows\system32\MSDTVVDEC.DLL
2009-04-14 18:00 . 2009-04-14 18:00 2198528 ----a-w- c:\windows\system32\MSVidCtl.dll
2009-04-14 18:00 . 2009-04-14 18:00 53248 ----a-w- c:\windows\system32\Mcx2Svc.dll
2009-04-14 18:00 . 2009-04-14 18:00 140288 ----a-w- c:\windows\system32\iTVData.dll
2009-04-14 18:00 . 2009-04-14 18:00 65024 ----a-w- c:\windows\system32\cca.dll
2009-04-14 18:00 . 2009-04-14 18:00 65536 ----a-w- c:\windows\system32\sberes.dll
2009-04-14 18:00 . 2009-04-14 18:00 357376 ----a-w- c:\windows\system32\msdri.dll
2009-04-14 18:00 . 2009-04-14 18:00 27136 ----a-w- c:\windows\system32\tvratings.dll
2009-04-14 18:00 . 2009-04-14 18:00 657408 ----a-w- c:\windows\system32\MSDTVADEC.DLL
2009-04-14 18:00 . 2009-04-14 18:00 413208 ----a-w- c:\windows\system32\MCEWMDRMNDBootstrap.dll
2009-04-14 18:00 . 2009-04-14 18:00 86016 ----a-w- c:\windows\system32\mcsrchPH.dll
2009-04-14 17:55 . 2009-04-14 17:55 44032 ----a-w- c:\windows\system32\vmclusex.dll
2009-04-14 17:55 . 2009-04-14 17:55 140288 ----a-w- c:\windows\system32\RemoteFileBrowse.dll
2009-04-14 17:54 . 2009-04-14 17:54 12288 ----a-w- c:\windows\system32\rsatclient.dll
2009-04-14 17:52 . 2009-04-14 17:52 9728 ----a-w- c:\windows\system32\ftlx041e.dll
2009-04-14 17:52 . 2009-04-14 17:52 9216 ----a-w- c:\windows\system32\ftlx0411.dll
2009-04-14 17:52 . 2009-04-14 17:52 296960 ----a-w- c:\windows\winhlp32.exe
2009-04-14 17:52 . 2009-04-14 17:52 194560 ----a-w- c:\windows\system32\ftsrch.dll
2009-04-12 19:22 . 2009-04-12 19:22 233888 ----a-w- c:\windows\system32\DreamScene.dll
2009-04-12 19:22 . 2009-04-12 19:22 -------- d-----w- c:\program files\BitLocker
2009-04-12 19:22 . 2009-04-12 19:22 1171848 ----a-w- c:\windows\system32\SecureKeyBackupCPL.dll
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Calendar
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Sidebar
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Photo Gallery
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Journal
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Collaboration
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Defender
2009-04-12 16:18 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-04-03 20:25 . 2009-04-12 16:07 56320 ----a-w- c:\windows\system32\xmlfilter.dll
2009-04-03 20:24 . 2009-04-12 16:07 73216 ----a-w- c:\windows\system32\msiexec.exe
2009-04-03 20:18 . 2009-04-12 16:07 37376 ----a-w- c:\windows\system32\cdd.dll
2009-04-03 19:40 . 2009-04-12 16:08 93696 ----a-w- c:\windows\system32\drivers\bridge.sys
2009-04-03 18:54 . 2009-04-12 16:07 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-04-03 18:52 . 2009-04-12 16:07 2048 ----a-w- c:\windows\system32\mferror.dll
2009-04-03 18:49 . 2009-04-12 16:08 248320 ----a-w- c:\windows\system32\drivers\rdpdr.sys
2009-04-03 18:48 . 2009-04-12 16:08 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2009-04-03 18:44 . 2009-04-12 16:07 273920 ----a-w- c:\windows\system32\drivers\afd.sys
2009-04-03 18:44 . 2009-04-12 16:08 69120 ----a-w- c:\windows\system32\drivers\rassstp.sys
2009-04-03 18:44 . 2009-04-12 16:07 121344 ----a-w- c:\windows\system32\drivers\ndiswan.sys
2009-04-03 18:44 . 2009-04-12 16:08 41472 ----a-w- c:\windows\system32\drivers\raspppoe.sys
2009-04-03 18:43 . 2009-04-12 16:07 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2009-04-03 18:43 . 2009-04-12 16:08 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2009-04-03 18:43 . 2009-04-12 16:07 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-04-03 18:43 . 2009-04-12 16:07 72192 ----a-w- c:\windows\system32\drivers\tdx.sys
2009-04-03 18:43 . 2009-04-12 16:08 72192 ----a-w- c:\windows\system32\drivers\pacer.sys
2009-04-03 18:43 . 2009-04-12 16:07 185856 ----a-w- c:\windows\system32\drivers\netbt.sys
2009-04-03 18:42 . 2009-04-12 16:08 113664 ----a-w- c:\windows\system32\drivers\rmcast.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-05-31_16.50.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-31 17:15 . 2009-05-31 17:15 44032 c:\windows\assembly\NativeImages_v2.0.50727_32\stdole\52a46f3dd36f111d1836b3097fee5a70\stdole.ni.dll
- 2009-05-17 11:40 . 2009-05-17 11:40 88064 c:\windows\assembly\NativeImages_v2.0.50727_32\InspectVhdDialog\6213ae2ede752dde2a3be772ab2ac04c\InspectVhdDialog.ni.exe
+ 2009-05-31 17:15 . 2009-05-31 17:15 88064 c:\windows\assembly\NativeImages_v2.0.50727_32\InspectVhdDialog\6213ae2ede752dde2a3be772ab2ac04c\InspectVhdDialog.ni.exe
+ 2009-05-31 17:15 . 2009-05-31 17:15 47616 c:\windows\assembly\NativeImages_v2.0.50727_32\ehiActivScp\78a2e752b27b91e1b4a78bec105d96e4\ehiActivScp.ni.dll
- 2009-05-31 16:45 . 2009-05-31 16:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-05-31 19:16 . 2009-05-31 19:16 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2006-11-02 10:33 . 2009-05-31 16:44 586980 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-05-31 17:22 586980 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-05-31 17:22 101052 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-05-31 16:44 101052 c:\windows\System32\perfc009.dat
+ 2009-05-31 17:16 . 2009-05-31 17:16 479232 c:\windows\assembly\NativeImages_v2.0.50727_32\vmconnect\ee38c3e6b9f03692bf4ea1462c0bec6b\vmconnect.ni.exe
- 2009-05-17 11:41 . 2009-05-17 11:41 479232 c:\windows\assembly\NativeImages_v2.0.50727_32\vmconnect\ee38c3e6b9f03692bf4ea1462c0bec6b\vmconnect.ni.exe
+ 2009-05-31 17:15 . 2009-05-31 17:15 835072 c:\windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\[u]0/u28a510b64c8632110c43f056e08f45d\ehiVidCtl.ni.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnhancedStorageShell]
@="{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}"
[HKEY_CLASSES_ROOT\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}]
2009-04-03 20:25 114176 ----a-w- c:\windows\System32\EhStorShell.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-03 1233920]
"DAEMON Tools Lite"="d:\programme\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-04-14 135680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-03-30 7289376]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-18 1947928]
"Look 'n' Stop"="c:\program files\Soft4Ever\looknstop\looknstop.exe" [2009-05-17 557056]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\programme\iTunesHelper.exe" [2009-04-02 342312]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
RocketDock -.lnk - c:\program files\RocketDock\RocketDock.exe [2009-4-17 495616]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableInstallerDetection"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"BindDirectlyToPropertySetStorage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):21,84,fc,44,8b,bb,c9,01
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{511A0F25-EB6A-436E-9571-F2D36BD2DDD9}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{A8D388CD-32BD-4AB3-8E7B-BA3702BCF05C}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe
"{D3408CDD-83C3-442D-924F-BAC10760A7B8}"= c:\program files\AVG\AVG8\avgdiag.exe:avgdiag.exe
"{5EEAFA7F-B134-4700-AFD4-B65D369969AD}"= c:\program files\AVG\AVG8\avgdiagex.exe:avgdiagex.exe
"{32142CEF-8088-4B87-97FB-4C17ECDAE608}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{3847FD50-F7EF-4537-BDA7-FAB9394ED644}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{D07568B7-4D5B-4BC5-AA1E-758E98210613}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{25DDA7D6-BD8B-4D89-A454-91AF12466375}"= UDP:5353:Adobe CSI CS4
"{63841FEB-4F1E-49BD-9AA5-E81862617A8E}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{13CE020D-7895-4B8C-AA22-17A8DA9C0E72}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{C1961A97-BC7A-4851-9F2C-03AD257BF8B5}"= UDP:3703:Adobe Version Cue CS4 Server
"{B847146F-6A13-4E99-8A86-3097550E39E7}"= UDP:3704:Adobe Version Cue CS4 Server
"{1D168581-D9AF-4A4E-A0CC-55DC1081CB22}"= UDP:51000:Adobe Version Cue CS4 Server
"{4C1019E6-D6A6-4763-B7B2-C7A2D4F2FC5D}"= UDP:51001:Adobe Version Cue CS4 Server
"{156B9E22-8E6E-4311-90CF-3D5534BA2795}"= UDP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server
"{6B7BCBB3-454D-479A-A2EA-1429EFC55B85}"= TCP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server
"{9FB10FB9-F95B-4992-8626-1FAC9EEE7FAA}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{292EE44C-97B9-48D2-9BE8-608E635357AC}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{4DCC8BCA-D4C0-495D-8C6D-6097C322014E}"= UDP:d:\programme\iTunes.exe:iTunes
"{12548456-98C6-4E65-AEC5-7D8AEBC6CE42}"= TCP:d:\programme\iTunes.exe:iTunes
"{94EC5EF2-12F9-4CEE-897E-4F78058E9A47}"= UDP:d:\programme\uTorrent.exe:µTorrent (TCP-In)
"{235F28AE-2E98-4478-B693-27345D9C57D4}"= TCP:d:\programme\uTorrent.exe:µTorrent (UDP-In)
"{D69D428D-B9A1-4610-8D58-3B8865BA75F2}"= UDP:c:\program files\uTorrent\App\uTorrent\utorrent.exe:µTorrent (TCP-In)
"{1C5C82FC-D8A6-4D2A-B25D-B836332E123D}"= TCP:c:\program files\uTorrent\App\uTorrent\utorrent.exe:µTorrent (UDP-In)
"{297B1F05-80DB-4FB1-A030-DD7C76C47908}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [16/05/2009 22:34 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [16/05/2009 22:34 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [16/05/2009 22:34 108552]
R1 lnsfw1;lnsfw1;c:\windows\System32\drivers\lnsfw1.sys [17/05/2009 12:54 79232]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [16/05/2009 22:34 908568]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [16/05/2009 22:34 298776]
R2 lnssvcVista;Look 'n' Stop Service;c:\program files\Soft4Ever\looknstop\LnsSvcVista.exe -r --> c:\program files\Soft4Ever\looknstop\LnsSvcVista.exe -r [?]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 05:46 284016]
S4 USB_FPRd;FingerPrinterReader;c:\windows\System32\drivers\UT_FPRd.sys [14/04/2009 20:55 16128]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - sptd
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
%SystemRoot%\system32\soundschemes2.exe /AddRegistration
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://unattendshare.free.fr/index2.html
uInternet Settings,ProxyOverride = *.local
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.fr
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\extensions\doudehou@gmail.com\components\statusbarEx.dll
FF - component: c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\programme\Mozilla Plugins\npitunes.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-31 21:17
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2e,74,05,1d,17,af,47,49,b9,a1,75,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2e,74,05,1d,17,af,47,49,b9,a1,75,\
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AU"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.avi"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.CDA"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ThunderbirdEML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="jpegfile"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.M3U"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MP3"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]
@Denied: (2) (Administrator)
"Progid"="AcroExch.Document"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AU"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.URL"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10o\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10o"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10p\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10p"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10pf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10pf"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAV"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMA"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMD"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMS"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMV"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMZ"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WPL"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WVX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.xmp"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'Explorer.exe'(5732)
c:\program files\RocketDock\RocketDock.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\Ati2evxx.exe
c:\program files\Soft4Ever\looknstop\LnSSvcVista.exe
c:\program files\AVG\AVG8\avgtray.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\System32\WUDFHost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\ehome\ehsched.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\System32\wbem\WmiApSrv.exe
.
**************************************************************************
.
Heure de fin: 2009-05-31 21:21 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-05-31 19:20
ComboFix2.txt 2009-05-31 16:52
Avant-CF: 8 702 521 344 octets libres
Après-CF: 8 457 478 144 octets libres
571 -
Modérateur/!\ Seul volavoil peut suivre cette procédure. /!\
1/
---> Ouvre le Bloc-notes.
---> Copie le texte ci-dessous par sélection puis Ctrl+C :
KillAll::
File::
C:\Iexplor179.exe
C:\Iexplor171.exe
Folder::
C:\Program Files\DAEMON Tools Toolbar
Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{074C1DC5-9320-4A9A-947D-C042949C6216}]
--> Colle la sélection dans le Bloc-notes.
--> Enregistre ce fichier sur le Bureau (Impératif).
--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.
2/
--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif
--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.
--> Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
--> Une fois le scan achevé, un rapport va s'afficher : poste-le.
--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt -
voici le rapport du log
Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-05-31 20:46:26
Microsoft® Windows Vista™ Édition Intégrale Service Pack 2
System drive C: has 8 GB (28%) free of 30 GB
Total RAM: 2046 MB (50% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:46:32, on 31/05/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrateur\Desktop\RSIT.exe
C:\Program Files\trend micro\Administrateur.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://unattendshare.free.fr/index2.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (file missing)
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\programme\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\programme\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Global Startup: RocketDock -.lnk = C:\Program Files\RocketDock\RocketDock.exe
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\Windows\System32\avgrsstx.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Look 'n' Stop Service (lnssvcVista) - Unknown owner - C:\Program Files\Soft4Ever\looknstop\LnsSvcVista.exe
-
ModérateurTu as bien supprimé les infections trouvées par MBAM ?
--> Refais un scan RSIT et poste le rapport log. -
le rapport du scan rapide est il suffisant ?
-
voici le rapport rapide de malware
Malwarebytes' Anti-Malware 1.37
Version de la base de données: 2201
Windows 6.0.6002 Service Pack 2
31/05/2009 19:07:21
mbam-log-2009-05-31 (19-07-18).txt
Type de recherche: Examen rapide
Eléments examinés: 70637
Temps écoulé: 2 minute(s), 33 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
c:\Iexplor171.exe (Trojan.Dropper) -> No action taken. -
ModérateurTu vas pouvoir faire ton scan avec MBAM désormais.
-
voici le rapport de combofix
ComboFix 09-05-30.06 - Administrateur 31/05/2009 18:46.1 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6002.2.1252.33.1036.18.2046.1031 [GMT 2:00]
Lancé depuis: d:\téléchargement\ComboFix.exe
FW: Look 'n' Stop 2.06p3 (Soft4Ever) *enabled* {2A530F53-4A99-4EE0-8471-4A00BA4A47B0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\drivers\kungsfdnbwecsp.sys
c:\windows\system32\drivers\kungsfdnbwecsp.sys.rmv
c:\windows\system32\kungsfawlxdyoc.dat
c:\windows\system32\kungsfawlxdyoc.dat.rmv
c:\windows\system32\kungsfepvtemes.dat
c:\windows\system32\kungsfkimgdxpx.dll
c:\windows\system32\kungsfkimgdxpx.dll.rmv
c:\windows\system32\kungsftvybitop.dll
c:\windows\system32\kungsftvybitop.dll.rmv
----- BITS: Il y a peut-être des sites infectés -----
hxxp://binuser.fileave.com
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_kungsfiuhcrrrj
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-28 au 2009-05-31 ))))))))))))))))))))))))))))))))))))
.
2009-05-31 16:50 . 2009-05-31 16:50 -------- d-----w- c:\users\Administrateur\AppData\Local\temp
2009-05-31 15:58 . 2009-05-31 15:59 -------- d-----w- c:\program files\trend micro
2009-05-31 15:58 . 2009-05-31 15:59 -------- d-----w- C:\rsit
2009-05-31 15:13 . 2009-05-31 15:13 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Malwarebytes
2009-05-31 15:13 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-31 15:13 . 2009-05-31 15:13 -------- d-----w- c:\programdata\Malwarebytes
2009-05-31 15:13 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-30 12:05 . 2009-05-31 16:36 -------- d--h--w- C:\$AVG8.VAULT$
2009-05-30 01:46 . 2009-05-30 01:46 48640 ----a-w- C:\Iexplor179.exe
2009-05-28 20:47 . 2009-05-28 20:47 25600 ----a-w- C:\Iexplor171.exe
2009-05-28 18:17 . 2009-05-28 18:17 -------- d-----w- c:\program files\Microsoft Works
2009-05-28 18:16 . 2009-05-28 18:16 -------- d-----w- c:\windows\PCHEALTH
2009-05-28 18:16 . 2009-05-28 18:16 -------- d-----w- c:\program files\Microsoft.NET
2009-05-28 18:14 . 2009-05-28 18:14 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-05-28 18:13 . 2009-05-28 18:13 -------- d-----w- c:\users\Administrateur\AppData\Local\Microsoft Help
2009-05-28 18:13 . 2009-05-28 18:18 -------- d-----w- c:\programdata\Microsoft Help
2009-05-28 18:10 . 2009-05-28 18:10 -------- d--h--r- C:\MSOCache
2009-05-28 17:46 . 2009-05-31 15:49 -------- d-----w- c:\users\Administrateur\AppData\Local\QuickPar
2009-05-27 04:57 . 2009-05-31 16:35 -------- d-----r- c:\users\Public\Recorded TV
2009-05-21 16:45 . 2009-05-21 16:45 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Nero
2009-05-21 16:32 . 2009-05-21 16:32 -------- d-----w- c:\programdata\SlySoft
2009-05-21 16:29 . 2009-05-21 16:38 -------- d-----w- c:\programdata\DVD Shrink
2009-05-18 20:31 . 2009-05-18 20:31 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Yahoo!
2009-05-18 20:31 . 2009-05-18 20:31 -------- d-----w- c:\programdata\Yahoo! Companion
2009-05-18 19:39 . 2009-05-21 13:59 -------- d-----w- c:\users\Administrateur\AppData\Roaming\uTorrent
2009-05-18 17:28 . 2009-05-18 17:28 10134 ----a-r- c:\users\Administrateur\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-05-18 17:28 . 2009-05-18 17:28 -------- d-----w- c:\program files\Microsoft WSE
2009-05-18 17:23 . 2009-05-18 17:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-18 17:17 . 2009-05-18 17:17 -------- d-----w- c:\programdata\DAEMON Tools Lite
2009-05-18 17:17 . 2009-05-18 17:17 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2009-05-18 17:14 . 2009-05-18 17:19 -------- d-----w- c:\users\Administrateur\AppData\Roaming\DAEMON Tools Lite
2009-05-18 15:13 . 2009-05-16 20:34 10520 ----a-w- c:\programdata\avg8\update\backup\avgrsstx.dll
2009-05-18 15:13 . 2009-05-16 20:34 12552 ----a-w- c:\programdata\avg8\update\backup\avgrkx86.sys
2009-05-18 15:13 . 2009-05-16 20:34 107912 ----a-w- c:\programdata\avg8\update\backup\avgtdix.sys
2009-05-18 15:13 . 2009-05-16 20:34 325640 ----a-w- c:\programdata\avg8\update\backup\avgldx86.sys
2009-05-18 15:13 . 2009-05-16 20:34 485144 ----a-w- c:\programdata\avg8\update\backup\avgrsx.exe
2009-05-18 15:13 . 2009-05-16 20:34 27656 ----a-w- c:\programdata\avg8\update\backup\avgmfx86.sys
2009-05-18 15:10 . 2009-05-16 20:34 1057024 ----a-w- c:\programdata\avg8\update\backup\avgupd.exe
2009-05-18 15:10 . 2009-05-16 20:34 745240 ----a-w- c:\programdata\avg8\update\backup\avginet.dll
2009-05-18 15:10 . 2009-05-16 20:34 578840 ----a-w- c:\programdata\avg8\update\backup\avgiproxy.exe
2009-05-18 15:10 . 2009-05-16 20:34 1424152 ----a-w- c:\programdata\avg8\update\backup\avgupd.dll
2009-05-17 15:12 . 2009-05-17 15:12 -------- d-----w- c:\programdata\WindowsSearch
2009-05-17 15:08 . 2009-05-17 15:08 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Media Player Classic
2009-05-17 13:28 . 2009-05-17 14:33 -------- d-----w- c:\users\Administrateur\AppData\Local\Apple Computer
2009-05-17 13:28 . 2009-05-17 13:34 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Apple Computer
2009-05-17 13:28 . 2009-05-17 13:28 -------- dc----w- c:\windows\system32\DRVSTORE
2009-05-17 13:28 . 2009-03-19 14:32 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-17 13:28 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-05-17 13:27 . 2009-05-17 13:27 -------- d-----w- c:\program files\iPod
2009-05-17 13:27 . 2009-05-17 13:28 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-17 13:26 . 2009-05-17 13:27 -------- d-----w- c:\program files\Common Files\Apple
2009-05-17 13:23 . 2009-05-17 13:23 -------- d-----w- c:\program files\Bonjour
2009-05-17 13:22 . 2009-05-17 13:27 -------- d-----w- c:\programdata\Apple Computer
2009-05-17 13:22 . 2009-05-17 13:23 -------- d-----w- c:\program files\QuickTime
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\users\Administrateur\AppData\Local\Apple
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\program files\Apple Software Update
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\programdata\Apple
2009-05-17 13:04 . 2009-05-17 13:04 -------- d-----w- c:\programdata\FLEXnet
2009-05-17 12:38 . 2009-05-17 12:41 -------- d-----w- c:\users\Administrateur\AppData\Local\looknstop
2009-05-17 11:56 . 2009-05-17 11:56 -------- d-----w- c:\programdata\ALM
2009-05-17 11:41 . 2009-05-17 11:41 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-05-17 11:16 . 2008-04-07 03:38 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
2009-05-17 11:07 . 2009-05-17 11:07 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-17 11:04 . 2009-05-17 11:04 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-05-17 10:54 . 2009-05-17 10:54 79232 ----a-w- c:\windows\system32\drivers\lnsfw1.sys
2009-05-17 10:54 . 2009-05-17 10:54 58232 ----a-w- c:\windows\system32\drivers\lnsfw.sys
2009-05-17 10:54 . 2009-05-17 10:54 36864 ----a-w- c:\windows\system32\fwapi.dll
2009-05-17 10:53 . 2009-05-17 10:55 -------- d-----w- c:\program files\Soft4Ever
2009-05-17 10:37 . 2009-05-17 10:38 -------- d-----w- c:\program files\NewsBin
2009-05-17 10:28 . 2009-05-31 15:49 -------- d-----w- c:\users\Administrateur\AppData\Roaming\NewsBin
2009-05-17 10:28 . 2009-05-17 10:28 -------- d-----w- c:\programdata\NewsBin
2009-05-17 10:19 . 2009-05-17 10:26 -------- d-----w- c:\users\Administrateur\AppData\Roaming\GrabIt
2009-05-17 10:12 . 2009-05-17 10:12 -------- d-----w- c:\program files\GrabIt
2009-05-16 21:31 . 2009-05-16 21:31 -------- d-----w- c:\program files\Sunbelt Software
2009-05-16 21:19 . 2009-05-16 21:19 0 ----a-w- c:\windows\nsreg.dat
2009-05-16 21:19 . 2009-05-16 21:35 -------- d-----w- c:\users\Administrateur\AppData\Local\Thunderbird
2009-05-16 21:19 . 2009-05-16 21:19 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Thunderbird
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\users\Administrateur\AppData\Roaming\ATI
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\users\Administrateur\AppData\Local\ATI
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\programdata\ATI
2009-05-16 20:41 . 2009-05-16 20:41 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-05-16 20:34 . 2009-05-18 15:12 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-16 20:34 . 2009-05-18 15:12 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-05-16 20:34 . 2009-05-18 15:12 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-16 20:34 . 2009-05-18 15:12 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-16 20:34 . 2009-05-31 09:47 -------- d-----w- c:\windows\system32\drivers\Avg
2009-05-16 20:34 . 2009-05-18 15:12 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-16 20:34 . 2009-05-31 13:11 -------- d-----w- c:\programdata\avg8
2009-05-16 20:34 . 2009-05-16 20:34 -------- d-----w- c:\program files\AVG
2009-05-16 20:27 . 2009-05-16 20:27 9158 ----a-w- c:\users\Administrateur\AppData\Roaming\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-05-16 20:27 . 2009-05-16 20:27 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-05-16 20:19 . 2009-05-16 20:19 -------- d-----w- C:\WPI
2009-05-16 20:19 . 2007-03-01 13:38 4390912 ----a-w- c:\windows\RtHDVCpl.exe
2009-05-16 20:19 . 2007-01-16 08:39 1191936 ----a-w- c:\windows\RtlUpd.exe
2009-05-16 20:19 . 2009-05-16 20:25 -------- d-----w- C:\drivers
2009-05-16 20:15 . 2009-05-16 20:15 -------- d-----w- c:\users\Administrateur\AppData\Local\Cooliris
2009-05-16 20:15 . 2009-05-16 20:15 -------- d-----w- c:\users\Administrateur\AppData\Local\Mozilla
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Xtremsplit
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Messenger Plus! Live
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Microsoft
2009-05-16 20:09 . 2009-05-31 14:42 -------- d-----w- c:\users\Administrateur\AppData\Local\Downloaded Installations
2009-05-16 20:09 . 2009-05-16 20:09 -------- d---a-w- C:\WPI_Audio
2009-05-16 20:06 . 2009-05-28 19:25 78736 ----a-w- c:\users\Administrateur\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-16 20:06 . 2009-05-16 20:06 -------- d-----w- c:\program files\System
2009-05-16 20:06 . 2009-03-31 14:21 345670 ----a-w- c:\windows\Windows 7_Calculator.exe
2009-05-16 20:06 . 2009-03-31 02:39 412813 ----a-w- c:\windows\Wordpad_2009.exe
2009-05-16 20:05 . 2008-03-21 23:16 1347584 ----a-w- c:\programdata\Nero\DrWeb\DRWEB32.DLL
2009-05-16 20:05 . 2009-05-31 14:36 -------- d-----w- c:\program files\Common Files\Nero
2009-05-16 20:05 . 2009-05-31 14:30 -------- d-----w- c:\programdata\Nero
2009-05-16 20:05 . 2009-05-31 14:26 -------- d-----w- c:\program files\Nero
2009-05-16 20:05 . 2009-05-16 20:05 -------- d-----w- c:\program files\7-Zip
2009-05-16 20:05 . 2009-05-26 04:46 -------- d-----w- c:\windows\system32\Macromed
2009-05-16 19:42 . 2009-05-16 19:42 -------- d-----w- c:\program files\Microsoft Silverlight
2009-05-16 19:42 . 2009-05-31 15:01 -------- d-sh--w- c:\windows\Installer
2009-05-16 19:42 . 2009-05-18 17:14 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-05-16 19:42 . 2009-05-16 19:42 -------- d-----w- c:\program files\Notepad2
2009-05-16 19:33 . 2009-05-16 21:10 -------- d-----w- c:\windows\system32\RTCOM
2009-05-16 19:33 . 2009-05-16 19:33 -------- d-----w- c:\program files\Realtek
2009-05-09 23:40 . 2009-05-09 23:40 103872 ----a-w- c:\windows\system32\drivers\AnyDVD.sys
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-31 16:44 . 2009-04-12 15:21 12 ----a-w- c:\windows\bthservsdp.dat
2009-05-31 16:44 . 2008-01-21 08:04 669328 ----a-w- c:\windows\system32\perfh00C.dat
2009-05-31 16:44 . 2008-01-21 08:04 123350 ----a-w- c:\windows\system32\perfc00C.dat
2009-05-28 18:16 . 2006-11-02 12:35 -------- d-----w- c:\program files\MSBuild
2009-05-17 13:31 . 2009-05-17 13:31 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-05-17 12:46 . 2009-05-16 20:12 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-16 21:42 . 2009-05-16 20:12 -------- d-----w- c:\program files\FileZilla
2009-05-16 20:36 . 2009-05-16 19:43 680 ----a-w- c:\users\Administrateur\AppData\Local\d3d9caps.dat
2009-05-16 20:27 . 2009-05-16 20:26 -------- d-----w- c:\program files\ATI Technologies
2009-05-16 20:26 . 2009-05-16 20:26 -------- d-----w- c:\program files\ATI
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\Notepad++
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Notepad++
2009-05-16 20:12 . 2009-05-16 20:12 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\Java
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\HashTab Shell Extension
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\PowerISO
2009-05-16 20:11 . 2009-05-16 20:10 -------- d-----w- c:\program files\Windows Live
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Resource Hacker
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\QuickPar
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Yahoo!
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\programdata\ACD Systems
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\ACD Systems
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Modèles
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Menu Démarrer
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Favoris
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Documents
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Bureau
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\program files\Fichiers communs
2009-05-16 19:27 . 2009-05-16 19:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-04-19 12:12 . 2009-04-19 12:12 -------- d-----w- c:\program files\CCleaner
2009-04-19 12:11 . 2009-04-19 12:11 -------- d-----w- c:\program files\uTorrent
2009-04-19 08:41 . 2006-11-02 07:26 30051328 ----a-w- c:\windows\system32\imageres.dll
2009-04-17 11:49 . 2009-04-17 13:09 -------- d-----w- c:\program files\IconWorkshopPortable
2009-04-17 11:49 . 2009-04-17 13:10 -------- d-----w- c:\program files\RocketDock
2009-04-17 11:49 . 2009-04-17 13:09 -------- d-----w- c:\program files\Diskeeper
2009-04-17 11:48 . 2009-04-17 13:09 -------- d-----w- c:\program files\PhotoshopPortable
2009-04-17 11:47 . 2009-04-17 13:09 -------- d-----w- c:\program files\NeroPortable
2009-04-14 18:21 . 2009-04-14 18:21 705024 ----a-w- c:\windows\system32\sbe.dll
2009-04-14 18:19 . 2009-04-14 18:19 604672 ----a-w- c:\windows\system32\CPFilters.dll
2009-04-14 18:19 . 2009-04-14 18:19 450048 ----a-w- c:\windows\system32\psisdecd.dll
2009-04-14 18:19 . 2009-04-14 18:19 153088 ----a-w- c:\windows\system32\sbeio.dll
2009-04-14 18:05 . 2009-04-14 18:05 -------- d-----w- c:\program files\Hyper-V
2009-04-14 18:05 . 2009-04-14 18:05 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-04-14 18:05 . 2009-04-14 18:05 43544 ----a-w- c:\windows\system32\wups2.dll
2009-04-14 18:05 . 2009-04-14 18:05 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-04-14 18:05 . 2009-04-14 18:05 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-04-14 18:05 . 2009-04-14 18:05 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-04-14 18:05 . 2009-04-14 18:05 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-04-14 18:05 . 2009-04-14 18:05 34328 ----a-w- c:\windows\system32\wups.dll
2009-04-14 18:05 . 2009-04-14 18:05 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-04-14 18:05 . 2009-04-14 18:05 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-04-14 18:04 . 2009-04-14 18:04 762880 ----a-w- c:\windows\system32\MSDTVVDEC.DLL
2009-04-14 18:00 . 2009-04-14 18:00 2198528 ----a-w- c:\windows\system32\MSVidCtl.dll
2009-04-14 18:00 . 2009-04-14 18:00 53248 ----a-w- c:\windows\system32\Mcx2Svc.dll
2009-04-14 18:00 . 2009-04-14 18:00 140288 ----a-w- c:\windows\system32\iTVData.dll
2009-04-14 18:00 . 2009-04-14 18:00 65024 ----a-w- c:\windows\system32\cca.dll
2009-04-14 18:00 . 2009-04-14 18:00 65536 ----a-w- c:\windows\system32\sberes.dll
2009-04-14 18:00 . 2009-04-14 18:00 357376 ----a-w- c:\windows\system32\msdri.dll
2009-04-14 18:00 . 2009-04-14 18:00 27136 ----a-w- c:\windows\system32\tvratings.dll
2009-04-14 18:00 . 2009-04-14 18:00 657408 ----a-w- c:\windows\system32\MSDTVADEC.DLL
2009-04-14 18:00 . 2009-04-14 18:00 413208 ----a-w- c:\windows\system32\MCEWMDRMNDBootstrap.dll
2009-04-14 18:00 . 2009-04-14 18:00 86016 ----a-w- c:\windows\system32\mcsrchPH.dll
2009-04-14 17:55 . 2009-04-14 17:55 44032 ----a-w- c:\windows\system32\vmclusex.dll
2009-04-14 17:55 . 2009-04-14 17:55 140288 ----a-w- c:\windows\system32\RemoteFileBrowse.dll
2009-04-14 17:54 . 2009-04-14 17:54 12288 ----a-w- c:\windows\system32\rsatclient.dll
2009-04-14 17:52 . 2009-04-14 17:52 9728 ----a-w- c:\windows\system32\ftlx041e.dll
2009-04-14 17:52 . 2009-04-14 17:52 9216 ----a-w- c:\windows\system32\ftlx0411.dll
2009-04-14 17:52 . 2009-04-14 17:52 296960 ----a-w- c:\windows\winhlp32.exe
2009-04-14 17:52 . 2009-04-14 17:52 194560 ----a-w- c:\windows\system32\ftsrch.dll
2009-04-12 19:22 . 2009-04-12 19:22 233888 ----a-w- c:\windows\system32\DreamScene.dll
2009-04-12 19:22 . 2009-04-12 19:22 -------- d-----w- c:\program files\BitLocker
2009-04-12 19:22 . 2009-04-12 19:22 1171848 ----a-w- c:\windows\system32\SecureKeyBackupCPL.dll
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Calendar
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Sidebar
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Photo Gallery
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Journal
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Collaboration
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Defender
2009-04-12 16:18 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-04-03 20:25 . 2009-04-12 16:07 56320 ----a-w- c:\windows\system32\xmlfilter.dll
2009-04-03 20:24 . 2009-04-12 16:07 73216 ----a-w- c:\windows\system32\msiexec.exe
2009-04-03 20:18 . 2009-04-12 16:07 37376 ----a-w- c:\windows\system32\cdd.dll
2009-04-03 19:40 . 2009-04-12 16:08 93696 ----a-w- c:\windows\system32\drivers\bridge.sys
2009-04-03 18:54 . 2009-04-12 16:07 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-04-03 18:52 . 2009-04-12 16:07 2048 ----a-w- c:\windows\system32\mferror.dll
2009-04-03 18:49 . 2009-04-12 16:08 248320 ----a-w- c:\windows\system32\drivers\rdpdr.sys
2009-04-03 18:48 . 2009-04-12 16:08 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2009-04-03 18:44 . 2009-04-12 16:07 273920 ----a-w- c:\windows\system32\drivers\afd.sys
2009-04-03 18:44 . 2009-04-12 16:08 69120 ----a-w- c:\windows\system32\drivers\rassstp.sys
2009-04-03 18:44 . 2009-04-12 16:07 121344 ----a-w- c:\windows\system32\drivers\ndiswan.sys
2009-04-03 18:44 . 2009-04-12 16:08 41472 ----a-w- c:\windows\system32\drivers\raspppoe.sys
2009-04-03 18:43 . 2009-04-12 16:07 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2009-04-03 18:43 . 2009-04-12 16:08 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2009-04-03 18:43 . 2009-04-12 16:07 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-04-03 18:43 . 2009-04-12 16:07 72192 ----a-w- c:\windows\system32\drivers\tdx.sys
2009-04-03 18:43 . 2009-04-12 16:08 72192 ----a-w- c:\windows\system32\drivers\pacer.sys
2009-04-03 18:43 . 2009-04-12 16:07 185856 ----a-w- c:\windows\system32\drivers\netbt.sys
2009-04-03 18:42 . 2009-04-12 16:08 113664 ----a-w- c:\windows\system32\drivers\rmcast.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnhancedStorageShell]
@="{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}"
[HKEY_CLASSES_ROOT\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}]
2009-04-03 20:25 114176 ----a-w- c:\windows\System32\EhStorShell.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-03 1233920]
"DAEMON Tools Lite"="d:\programme\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-04-14 135680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-03-30 7289376]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-18 1947928]
"Look 'n' Stop"="c:\program files\Soft4Ever\looknstop\looknstop.exe" [2009-05-17 557056]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\programme\iTunesHelper.exe" [2009-04-02 342312]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
RocketDock -.lnk - c:\program files\RocketDock\RocketDock.exe [2009-4-17 495616]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableInstallerDetection"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"BindDirectlyToPropertySetStorage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):21,84,fc,44,8b,bb,c9,01
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{511A0F25-EB6A-436E-9571-F2D36BD2DDD9}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{A8D388CD-32BD-4AB3-8E7B-BA3702BCF05C}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe
"{D3408CDD-83C3-442D-924F-BAC10760A7B8}"= c:\program files\AVG\AVG8\avgdiag.exe:avgdiag.exe
"{5EEAFA7F-B134-4700-AFD4-B65D369969AD}"= c:\program files\AVG\AVG8\avgdiagex.exe:avgdiagex.exe
"{32142CEF-8088-4B87-97FB-4C17ECDAE608}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{3847FD50-F7EF-4537-BDA7-FAB9394ED644}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{D07568B7-4D5B-4BC5-AA1E-758E98210613}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{25DDA7D6-BD8B-4D89-A454-91AF12466375}"= UDP:5353:Adobe CSI CS4
"{63841FEB-4F1E-49BD-9AA5-E81862617A8E}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{13CE020D-7895-4B8C-AA22-17A8DA9C0E72}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{C1961A97-BC7A-4851-9F2C-03AD257BF8B5}"= UDP:3703:Adobe Version Cue CS4 Server
"{B847146F-6A13-4E99-8A86-3097550E39E7}"= UDP:3704:Adobe Version Cue CS4 Server
"{1D168581-D9AF-4A4E-A0CC-55DC1081CB22}"= UDP:51000:Adobe Version Cue CS4 Server
"{4C1019E6-D6A6-4763-B7B2-C7A2D4F2FC5D}"= UDP:51001:Adobe Version Cue CS4 Server
"{156B9E22-8E6E-4311-90CF-3D5534BA2795}"= UDP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server
"{6B7BCBB3-454D-479A-A2EA-1429EFC55B85}"= TCP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server
"{9FB10FB9-F95B-4992-8626-1FAC9EEE7FAA}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{292EE44C-97B9-48D2-9BE8-608E635357AC}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{4DCC8BCA-D4C0-495D-8C6D-6097C322014E}"= UDP:d:\programme\iTunes.exe:iTunes
"{12548456-98C6-4E65-AEC5-7D8AEBC6CE42}"= TCP:d:\programme\iTunes.exe:iTunes
"{94EC5EF2-12F9-4CEE-897E-4F78058E9A47}"= UDP:d:\programme\uTorrent.exe:µTorrent (TCP-In)
"{235F28AE-2E98-4478-B693-27345D9C57D4}"= TCP:d:\programme\uTorrent.exe:µTorrent (UDP-In)
"{D69D428D-B9A1-4610-8D58-3B8865BA75F2}"= UDP:c:\program files\uTorrent\App\uTorrent\utorrent.exe:µTorrent (TCP-In)
"{1C5C82FC-D8A6-4D2A-B25D-B836332E123D}"= TCP:c:\program files\uTorrent\App\uTorrent\utorrent.exe:µTorrent (UDP-In)
"{297B1F05-80DB-4FB1-A030-DD7C76C47908}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [16/05/2009 22:34 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [16/05/2009 22:34 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [16/05/2009 22:34 108552]
R1 lnsfw1;lnsfw1;c:\windows\System32\drivers\lnsfw1.sys [17/05/2009 12:54 79232]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [16/05/2009 22:34 908568]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [16/05/2009 22:34 298776]
R2 lnssvcVista;Look 'n' Stop Service;c:\program files\Soft4Ever\looknstop\LnsSvcVista.exe -r --> c:\program files\Soft4Ever\looknstop\LnsSvcVista.exe -r [?]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 05:46 284016]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [31/05/2009 17:13 40160]
S4 USB_FPRd;FingerPrinterReader;c:\windows\System32\drivers\UT_FPRd.sys [14/04/2009 20:55 16128]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - sptd
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
%SystemRoot%\system32\soundschemes2.exe /AddRegistration
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
SafeBoot-procexp90.Sys
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://unattendshare.free.fr/index2.html
uInternet Settings,ProxyOverride = *.local
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.fr
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\extensions\doudehou@gmail.com\components\statusbarEx.dll
FF - component: c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\programme\Mozilla Plugins\npitunes.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-31 18:50
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2e,74,05,1d,17,af,47,49,b9,a1,75,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2e,74,05,1d,17,af,47,49,b9,a1,75,\
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AU"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.avi"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.CDA"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ThunderbirdEML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.M3U"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MP3"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]
@Denied: (2) (Administrator)
"Progid"="AcroExch.Document"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AU"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.URL"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10o\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10o"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10p\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10p"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10pf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10pf"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAV"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMA"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMD"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMS"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMV"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMZ"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WPL"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WVX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.xmp"
.
Heure de fin: 2009-05-31 18:52
ComboFix-quarantined-files.txt 2009-05-31 16:52
Avant-CF: 7 200 116 736 octets libres
Après-CF: 8 989 401 088 octets libres
538 -
Modérateur/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\
--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Clique droit sur ComboFix.exe (le .exe n'est pas forcément visible) et choisis Exécuter en tant qu'administrateur.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix -
Aie
soucis: le scan bugge au bout d une vingtaine de minute (j avais essayé en scan rapide, mais bug aussi) -
ModérateurOk, tu me posteras le rapport.
-
Non, je n avais fait que le scan RSIT
le scan de malware est en cours
- 1
- 2
Suivant
