dos optimizer Résolu

Question

Bonjour,
Il y a le virus dos optimizer sur mon pc, que faire ?

carlosNY · Answer

All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
No active process named Dos Optimizer.pif was found!
========== SERVICES/DRIVERS ==========

Service\Driver ASKUpgrade deleted successfully.
========== FILES ==========
File/Folder C:\Documents and Settings\ESS\Menu Démarrer\Programmes\Démarrage\Dos Optimizer.pif not found.
C:\Program Files\Ask & Record Toolbar\Uninstall moved successfully.
C:\Program Files\Ask & Record Toolbar moved successfully.
C:\Program Files\AskBardis\bar\Settings moved successfully.
C:\Program Files\AskBardis\bar\History moved successfully.
C:\Program Files\AskBardis\bar\Cache moved successfully.
C:\Program Files\AskBardis\bar\bin moved successfully.
C:\Program Files\AskBardis\bar moved successfully.
C:\Program Files\AskBardis moved successfully.
File/Folder C:\Program Files\AVG not found.
File/Folder C:\Program Files\LiveTV not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Ask and Record FLV Service deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59385f95-c52f-4a84-b674-4a4206b17218}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59385f95-c52f-4a84-b674-4a4206b17218}\ deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: ESS
->Temp folder emptied: 36278112 bytes
->Temporary Internet Files folder emptied: 338924801 bytes
->Java cache emptied: 30912836 bytes
->FireFox cache emptied: 36248576 bytes
->Google Chrome cache emptied: 7184193 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 7516749 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
 
%systemdrive% .tmp files removed: 734003136 bytes
C:\WINDOWS\msdownld.tmp folder deleted successfully.
%systemroot% .tmp files removed: 2114937 bytes
%systemroot%\System32 .tmp files removed: 8882688 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 1146,44 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 09032009_185624

Files moved on Reboot...

Registry entries deleted on Reboot...















   -----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual  CPU  E2160  @ 1.80GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : ESS ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:37 Go (Free:6 Go)
   D:\ (CD or DVD)
   E:\ (USB) - FAT32 - Total:1908 Mo (Free:0 Go)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 03/09/2009|19:11 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  Extensions

   (ESS) - {7762a897-2a75-4e3f-a3a7-55bd098b9879} => toolbartv
   (ESS) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} => hotspot_shield
   (ESS) - {E9A1DEE0-C623-4439-8932-001E7D17607D} => ajtoolbar


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Search Page"="https://www.google.com/?gws_rd=ssl"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 17/07/2009|21:50 - Option : [2]
   2 - "C:\ToolBar SD\TB_2.txt" - 03/09/2009|19:14 - Option : [2]

   -----------\  Fin du rapport a 19:14:28,89

Utilisateur anonyme · Answer

• Telecharge malwarebytes 

• Tu l´instale, le programme va se mettre automatiquement a jour. 

• Une fois a jour, le programme va se lancer.

• Click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression". 

• Click maintenant sur l´onglet recherche et coche la case : "executer un examen rapide". 

• Puis click sur "rechercher". 

• Laisse le scanner le pc... 

• Si des elements on ete trouvés > click sur supprimer la selection. 

• Si il t´es demandé de redemarrer > click sur "yes". 

• A la fin un rapport va s´ouvrir, sauvegarde le de maniere a le retrouver en vu de le poster sur le forum. 

• Copie et colle le rapport stp.

carlosNY · Answer

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2551
Windows 5.1.2600 Service Pack 2

03/09/2009 19:29:59
mbam-log-2009-09-03 (19-29-59).txt

Type de recherche: Examen rapide
Eléments examinés: 89603
Temps écoulé: 8 minute(s), 56 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FrameWorkService (Trojan.Delf) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FrameWorkService (Trojan.Delf) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 (Security.Hijack) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\ESS\Application Data\lsass.exe (Trojan.Delf) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\smss.exe (Trojan.Delf) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Sexy Girls.scr (Trojan.Delf) -> Quarantined and deleted successfully.

Utilisateur anonyme · Answer

Salut ,

Désolé du retard , réuvre malewarebytes vas sur quarantaine et supprime tout 

refais un scan RSIT et post log.txt

carlosNY · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by ESS at 2009-09-05 02:37:05
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 6 GB (17%) free of 38 GB
Total RAM: 1015 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:37:15, on 05/09/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\Documents and Settings\ESS\Menu Démarrer\Programmes\Démarrage\Dos Optimizer.pif
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\ESS\Bureau\disque\logicielle\désinfection -virus provenant de flach disque-\RSIT.exe
C:\Program Files	rend micro\ESS.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 67.69.254.242:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files\Hotspot_Shield	bHot1.dll
R3 - URLSearchHook: (no name) - {59385f95-c52f-4a84-b674-4a4206b17218} - (no file)
R3 - URLSearchHook: toolbartv Toolbar - {7762a897-2a75-4e3f-a3a7-55bd098b9879} - C:\Program Files	oolbartv	btoo0.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: toolbartv Toolbar - {7762a897-2a75-4e3f-a3a7-55bd098b9879} - C:\Program Files	oolbartv	btoo0.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files\Hotspot_Shield	bHot1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll
O3 - Toolbar: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files\Hotspot_Shield	bHot1.dll
O3 - Toolbar: (no name) - {59385f95-c52f-4a84-b674-4a4206b17218} - (no file)
O3 - Toolbar: toolbartv Toolbar - {7762a897-2a75-4e3f-a3a7-55bd098b9879} - C:\Program Files	oolbartv	btoo0.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Dos Optimizer.pif = ?
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator\Ghost (file missing)
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator\Ghost (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: prxernsp.dll
O10 - Unknown file in Winsock LSP: prxerdrv.dll
O10 - Unknown file in Winsock LSP: prxerdrv.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15107/CTPID.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\..\{D64A6D53-4B27-4AF5-AA10-4B69889C9792}: NameServer = 213.150.176.196,196.203.251.8
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE

Utilisateur anonyme · Answer

RE,

désinstal ta version de UsbFix et utilise la nouvelle mises a jours :

• Télécharge et install UsbFix 

->> http://pagesperso-orange.fr/NosTools/cariboost_files/UsbFix.exe

 (!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir

• Double clic sur le raccourci UsbFix présent sur ton bureau .

• Choisis l'option 1 ( Recherche )

• Laisse travailler l'outil.

• Ensuite post le rapport UsbFix.txt qui apparaitra.

• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
          Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
          Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 


• Tuto : http://pagesperso-orange.fr/NosTools/usbfix.html

carlosNY · Answer

############################## | UsbFix V6.025 |

User : ESS (Administrateurs) # AYMEN
Update on 04/09/2009 by Chiquitine29, C_XX & Chimay8
Start at: 02:50:36 | 05/09/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

Intel(R) Pentium(R) Dual  CPU  E2160  @ 1.80GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 37,26 Go (6,31 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque amovible # 1,86 Go (726,04 Mo free) [2 GO] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\Documents and Settings\ESS\Menu Démarrer\Programmes\Démarrage\Dos Optimizer.pif
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |

Présent ! C:\WINDOWS\inf\smss.exe  
Présent ! C:\WINDOWS\system32\Sexy Girls.scr  
Présent ! C:\DOCUME~1\ESS\APPLIC~1\smss.exe  
Présent ! C:\DOCUME~1\ESS\APPLIC~1\svchost.exe  
Présent ! E:\wlan.exe  

################## | Suspect ! ... | https://www.virustotal.com/gui/ |


################## | Registre # Clés Run infectieuses |

Présent ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "FrameWorkService"  
Présent ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "FrameWorkService"  
Présent ! HKU\S-1-5-21-448539723-573735546-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "FrameWorkService"  

################## | Registre # Mountpoints2 |


################## | ! Fin du rapport # UsbFix V6.025 ! |

Utilisateur anonyme · Answer

(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir

• Double clic sur le raccourci UsbFix présent sur ton bureau

• choisis l'option 2 ( Suppression )

• Ton bureau disparaitra et le pc redémarrera .

• Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.

• Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 



###########

ensuite :


Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 




-> Double clique sur combofix.exe. 
-> Tape sur la touche 1 (Yes) pour démarrer le scan. 
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt 

Avant d'utiliser ComboFix : 

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours. 

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil. 

Une fois fait, sur ton bureau double-clic sur Combofix.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. 

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

carlosNY · Answer

############################## | UsbFix V6.025 |

User : ESS (Administrateurs) # AYMEN
Update on 04/09/2009 by Chiquitine29, C_XX & Chimay8
Start at: 03:02:25 | 05/09/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

Intel(R) Pentium(R) Dual  CPU  E2160  @ 1.80GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 37,26 Go (6,27 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque amovible # 1,86 Go (726,04 Mo free) [2 GO] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe

################## | Fichiers # Dossiers infectieux |

Supprimé ! C:\WINDOWS\inf\smss.exe 
Supprimé ! C:\WINDOWS\system32\Sexy Girls.scr 
Supprimé ! C:\DOCUME~1\ESS\APPLIC~1\smss.exe 
Supprimé ! C:\DOCUME~1\ESS\APPLIC~1\svchost.exe 
Supprimé ! E:\wlan.exe 

################## | Autres |


################## | Suspect ! ... | https://www.virustotal.com/gui/ |


################## | Registre # Clés Run infectieuses |

Supprimé ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "FrameWorkService"  
Supprimé ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "FrameWorkService"  

################## | Registre # Mountpoints2 |


################## | Listing des fichiers présent |

[10/10/2008 01:29|--a------|1024] C:\.rnd 
[12/07/2009 16:23|---hs----|212] C:\boot.ini 
[15/10/2001 00:41|-rahs----|4952] C:\Bootfont.bin 
[25/08/2008 15:43|--a------|0] C:\CONFIG.SYS 
[16/03/2009 23:41|--a------|120] C:\drmHeader.bin 
[22/08/2009 07:39|--a------|184] C:\drwtsn32.log 
[23/09/2008 02:56|--a------|117] C:\finfos.txt 
[27/03/2001 00:00|--a------|53248] C:\gendel32.exe 
[18/11/2008 04:44|--a------|164] C:\install.dat 
[25/08/2008 15:43|-rahs----|0] C:\IO.SYS 
[04/04/2009 02:58|--a------|125] C:\ioSpecial.ini 
[09/11/2008 18:28|--a------|1453] C:\MDL 2.0 Debug.txt 
[23/09/2008 02:56|--a------|447] C:\mpeg.txt 
[25/08/2008 15:43|-rahs----|0] C:\MSDOS.SYS 
[04/08/2004 04:38|-rahs----|47564] C:\NTDETECT.COM 
[04/08/2004 04:59|-rahs----|251712] C:
tldr 
[?|?|?] C:\pagefile.sys 
[12/11/2008 03:09|--ah-----|1073741824] C:\pfsvoddata.bbv 
[25/08/2008 16:56|--a------|573] C:\RHDSetup.log 
[12/07/2009 16:15|--a------|167] C:\Setup.log 
[07/10/2008 13:39|--ah-----|268] C:\sqmdata00.sqm 
[22/10/2008 03:43|--ah-----|268] C:\sqmdata01.sqm 
[23/10/2008 00:26|--ah-----|268] C:\sqmdata02.sqm 
[06/11/2008 17:15|--ah-----|268] C:\sqmdata03.sqm 
[18/02/2009 18:52|--ah-----|268] C:\sqmdata04.sqm 
[07/10/2008 13:39|--ah-----|244] C:\sqmnoopt00.sqm 
[22/10/2008 03:43|--ah-----|244] C:\sqmnoopt01.sqm 
[23/10/2008 00:26|--ah-----|244] C:\sqmnoopt02.sqm 
[06/11/2008 17:15|--ah-----|244] C:\sqmnoopt03.sqm 
[18/02/2009 18:52|--ah-----|172] C:\sqmnoopt04.sqm 
[12/11/2008 04:24|--a------|57] C:\StvTimeCode.txt 
[03/09/2009 19:14|--a------|1852] C:\TB.txt 
[05/09/2009 03:07|--a------|3753] C:\UsbFix.txt 
[12/07/2009 16:12|--a------|175] C:\WiFiSetup.log 
[17/02/2008 12:43|--a------|377344] E:\ESS_Fichiers.exe 

################## | Upload | 

Veuillez envoyer le fichier : C:\DOCUME~1\ESS\Bureau\UsbFix_Upload_Me_AYMEN.zip : https://www.androidworld.fr/ 
Merci pour votre contribution .  

################## | ! Fin du rapport # UsbFix V6.025 ! |

carlosNY · Answer

ComboFix 09-09-03.02 - ESS 05/09/2009  3:19.1.2 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.1015.660 [GMT 2:00]
Running from: c:\documents and settings\ESS\Bureau\disque\logicielle\désinfection -virus provenant de flach disque-\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\ESS\Favoris\Free MP3 Search.url
c:\documents and settings\ESS\Favoris\Free Porn.url
c:\windows\Installer\22e3ae.msi
c:\windows\UA000082.DLL
c:\windows\UA000106.DLL

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES
-------\Legacy_SYSDRV32
-------\Service_Boonty Games


(((((((((((((((((((((((((   Files Created from 2009-08-05 to 2009-09-05  )))))))))))))))))))))))))))))))
.

2009-09-05 01:30 . 2008-02-17 10:43	377344	----a-w-	c:\windows\system32\Sexy Girls.scr
2009-09-03 16:56 . 2009-09-03 16:56	--------	d-----w-	C:\_OTM
2009-09-02 04:21 . 2009-09-02 04:21	--------	d-sh--w-	c:\documents and settings\ESS\IECompatCache
2009-09-02 04:17 . 2009-09-02 04:17	--------	d-sh--w-	c:\documents and settings\ESS\PrivacIE
2009-09-02 04:16 . 2009-09-02 04:16	--------	d-sh--w-	c:\documents and settings\NetworkService\IETldCache
2009-09-02 04:13 . 2009-09-02 04:13	--------	d-sh--w-	c:\documents and settings\ESS\IETldCache
2009-09-02 04:08 . 2009-09-02 22:28	--------	d-----w-	c:\windows\ie8updates
2009-09-02 04:00 . 2007-08-13 17:45	78336	----a-w-	c:\windows\system32\ieencode.dll
2009-09-02 03:59 . 2007-08-13 17:45	78336	----a-w-	c:\windows\system32\dllcache\ieencode.dll
2009-08-31 16:41 . 2009-08-31 16:41	--------	d-----w-	c:\documents and settings\ESS\Application Data\Todae
2009-08-31 13:58 . 2009-08-07 08:48	100352	-c----w-	c:\windows\system32\dllcache\iecompat.dll
2009-08-31 13:56 . 2009-07-03 16:57	246272	-c----w-	c:\windows\system32\dllcache\ieproxy.dll
2009-08-31 13:56 . 2009-07-03 16:57	12800	-c----w-	c:\windows\system32\dllcache\xpshims.dll
2009-08-26 17:28 . 2009-09-02 04:01	--------	d-----w-	c:\documents and settings\All Users\Bureau
2009-08-24 02:28 . 2009-08-24 02:28	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\Visicron
2009-08-24 01:27 . 2009-08-24 01:28	--------	d-----w-	c:\program files\Fichiers communs\DivX Shared
2009-08-24 00:53 . 2009-08-24 00:53	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\TVU Networks
2009-08-24 00:53 . 2009-08-24 00:53	--------	d-----w-	c:\documents and settings\All Users\Application Data\TVU Networks
2009-08-24 00:52 . 2009-08-24 00:52	--------	d-----w-	c:\documents and settings\ESS\LocalLow
2009-08-24 00:52 . 2009-08-25 16:09	--------	d-----w-	c:\program files\SopCast
2009-08-24 00:07 . 2009-08-24 00:07	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data	oolbartv
2009-08-24 00:07 . 2009-08-24 00:34	--------	d-----w-	c:\program files	oolbartv
2009-08-22 22:57 . 2009-08-22 22:57	--------	d-----w-	C:\Hotspot Shield
2009-08-22 05:23 . 2009-08-22 05:23	--------	d-----w-	c:\program files\RadioXpi
2009-08-22 04:07 . 2009-08-22 04:07	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\LiveTV_
2009-08-22 04:06 . 2009-08-22 04:07	--------	d-----w-	c:\program files\LiveTV_
2009-08-19 22:24 . 2009-08-19 22:44	--------	d-----w-	c:\program files\Patch MsnCreative
2009-08-16 14:54 . 2009-08-16 14:54	--------	d-----w-	c:\program files\MediaSPace
2009-08-16 14:53 . 2009-08-16 14:53	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\Downloaded Installations
2009-08-14 22:46 . 2009-08-14 22:46	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\Identities
2009-08-12 03:17 . 2009-08-12 03:17	--------	d-----w-	c:\program files\LimeWire

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-05 00:47 . 2008-12-17 23:59	--------	d-----w-	c:\documents and settings\ESS\Application Data\Skype
2009-09-05 00:46 . 2008-08-28 23:31	--------	d--h--w-	c:\documents and settings\ESS\Application Data\skypePM
2009-09-05 00:37 . 2009-07-17 11:01	--------	d-----w-	c:\program files	rend micro
2009-09-03 17:45 . 2001-10-14 22:44	76384	----a-w-	c:\windows\system32\perfc00C.dat
2009-09-03 17:45 . 2001-10-14 22:44	471246	----a-w-	c:\windows\system32\perfh00C.dat
2009-09-03 10:18 . 2008-10-03 23:02	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-09-02 22:34 . 2008-08-26 00:30	--------	d-----w-	c:\program files\Yahoo!
2009-08-25 16:09 . 2008-11-13 00:57	--------	d-----w-	c:\documents and settings\ESS\Application Data\Paltalk
2009-08-25 16:07 . 2008-08-25 15:17	--------	d-----w-	c:\program files\Creative
2009-08-24 01:32 . 2008-08-25 15:25	--------	d-----w-	c:\program files\DivX
2009-08-22 23:00 . 2009-06-17 23:47	--------	d-----w-	c:\program files\Hotspot Shield
2009-08-16 02:16 . 2009-06-23 00:11	--------	d-----w-	c:\program files\Proxifier
2009-08-16 01:49 . 2008-08-28 11:57	--------	d-----w-	c:\program files\Google
2009-08-12 04:36 . 2009-04-26 23:35	--------	d-----w-	c:\documents and settings\ESS\Application Data\LimeWire
2009-08-10 17:00 . 2009-06-02 19:32	--------	d-----w-	c:\program files\SpacialAudio
2009-08-06 22:59 . 2009-07-17 21:40	55656	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-08-03 11:36 . 2008-10-03 23:02	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 11:36 . 2008-10-03 23:02	19096	-c--a-w-	c:\windows\system32\drivers\mbam.sys
2009-08-02 22:24 . 2009-06-17 23:48	--------	d-----w-	c:\program files\Hotspot_Shield
2009-07-23 01:27 . 2009-05-25 14:18	--------	d-----w-	c:\documents and settings\ESS\Application Data\Winamp
2009-07-22 21:07 . 2009-05-25 14:18	--------	d-----w-	c:\program files\Winamp
2009-07-22 19:13 . 2009-07-21 23:22	28592	----a-w-	c:\windows\system32\drivers	ap0901.sys
2009-07-22 10:38 . 2009-07-22 10:38	--------	d-sh--w-	c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-07-17 21:40 . 2009-07-17 21:40	--------	d-----w-	c:\program files\Avira
2009-07-17 21:40 . 2009-07-17 21:40	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-07-14 00:15 . 2009-07-14 00:15	823296	----a-w-	c:\windows\system32\divx_xx0c.dll
2009-07-14 00:15 . 2009-07-14 00:15	823296	----a-w-	c:\windows\system32\divx_xx07.dll
2009-07-14 00:15 . 2009-07-14 00:15	815104	----a-w-	c:\windows\system32\divx_xx0a.dll
2009-07-14 00:15 . 2009-07-14 00:15	811008	----a-w-	c:\windows\system32\divx_xx16.dll
2009-07-14 00:15 . 2009-07-14 00:15	802816	----a-w-	c:\windows\system32\divx_xx11.dll
2009-07-14 00:15 . 2009-07-14 00:15	685056	----a-w-	c:\windows\system32\DivX.dll
2009-07-12 14:33 . 2009-07-12 14:33	--------	d-----w-	c:\program files\SAGEM WiFi manager
2009-07-12 14:25 . 2008-08-25 14:06	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-07-12 14:15 . 2009-04-29 21:53	--------	d-----w-	c:\program files\SAGEM
2009-07-12 14:15 . 2009-07-12 14:15	--------	d-----w-	c:\documents and settings\ESS\Application Data\InstallShield
2009-07-04 14:40 . 2009-07-04 14:40	0	-c--a-w-	c:\windows\system32\cd.dat
2009-07-02 02:34 . 2009-06-01 18:13	33840	----a-w-	c:\windows\system32\drivers\hssdrv.sys
2009-06-27 23:20 . 2009-06-27 23:20	165069	----a-w-	c:\windows\IceOp Uninstaller.exe
2009-06-20 18:28 . 2009-06-20 18:28	85504	----a-w-	c:\windows\system32\ff_vfw.dll
2009-06-14 15:21 . 2009-06-14 15:21	60273	----a-w-	c:\windows\system32\pthreadGC2.dll
2009-06-14 15:21 . 2009-06-14 15:21	256512	----a-w-	c:\windows\system32\ff_kernelDeint.dll
2009-06-14 15:21 . 2009-06-14 15:21	237056	----a-w-	c:\windows\system32\TomsMoComp_ff.dll
2009-07-14 00:16 . 2009-07-14 00:16	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
.

------- Sigcheck -------

[-] 2008-11-12 00:19	359040	EBEAB4C47642CD68D7FD23187EECA1B0	c:\windows\system32\backup	cpip.sys
[7] 2004-08-04 03:14	359040	9F4B36614A0FC234525BA224957DE55C	c:\windows\system32\dllcache	cpip.sys
[-] 2004-08-04 03:14	359040	3BB4B08619C111C7BE8BDA07AA0DE6A2	c:\windows\system32\drivers	cpip.sys
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield	bHot1.dll" [2009-08-02 2215960]
"{7762a897-2a75-4e3f-a3a7-55bd098b9879}"= "c:\program files	oolbartv	btoo0.dll" [2009-07-15 2224152]

[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

[HKEY_CLASSES_ROOT\clsid\{7762a897-2a75-4e3f-a3a7-55bd098b9879}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7762a897-2a75-4e3f-a3a7-55bd098b9879}]
2009-07-15 08:09	2224152	----a-w-	c:\program files	oolbartv	btoo0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
2009-08-02 22:25	2215960	----a-w-	c:\program files\Hotspot_Shield	bHot1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-08-22 22:56	218160	----a-w-	c:\program files\Hotspot Shield\hssie\HssIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield	bHot1.dll" [2009-08-02 2215960]
"{7762a897-2a75-4e3f-a3a7-55bd098b9879}"= "c:\program files	oolbartv	btoo0.dll" [2009-07-15 2224152]

[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

[HKEY_CLASSES_ROOT\clsid\{7762a897-2a75-4e3f-a3a7-55bd098b9879}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "c:\program files\Hotspot_Shield	bHot1.dll" [2009-08-02 2215960]
"{7762A897-2A75-4E3F-A3A7-55BD098B9879}"= "c:\program files	oolbartv	btoo0.dll" [2009-07-15 2224152]

[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

[HKEY_CLASSES_ROOT\clsid\{7762a897-2a75-4e3f-a3a7-55bd098b9879}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-06 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OBealsched.exe" [2009-01-26 185872]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-12-12 413696]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-08-16 122368]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\ESS\Menu D‚marrer\Programmes\D‚marrage\
DosÿOptimizer.pif [2008-2-17 377344]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisallowRun"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"2"= mmc.exe
"5"= regedt32.exe
"1"= cmd.exe
"3"= rstrui.exe
"4"= regedit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LMIinit]
2008-10-02 17:45	87352	----a-w-	c:\windows\system32\LMIinit.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^PalTalk.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^ESS^Menu Démarrer^Programmes^Démarrage^MaxTV.lnk]
path=c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\MaxTV.lnk
backup=c:\windows\pss\MaxTV.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^ESS^Menu Démarrer^Programmes^Démarrage^OneNote 2007 - Capture d'écran et lancement.lnk]
path=c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\OneNote 2007 - Capture d'écran et lancement.lnk
backup=c:\windows\pss\OneNote 2007 - Capture d'écran et lancement.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"UleadBurningHelper"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"Keenfinder Service"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"IDriverT"=3 (0x3)
"HssTrayService"=3 (0x3)
"HssSrv"=2 (0x2)
"HotspotShieldService"=2 (0x2)
"gusvc"=3 (0x3)
"FirebirdServerDefaultInstance"=3 (0x3)
"FirebirdGuardianDefaultInstance"=2 (0x2)
"Capture Device Service"=2 (0x2)
"Boonty Games"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Microsoft Office\Office12\GROOVE.EXE"=
"c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"=
"c:\Program Files\LimeWire\LimeWire.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Messenger\livecall.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [25/08/2008 16:48 13696]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [17/07/2009 23:40 108289]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [06/08/2009 20:58 331824]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [10/10/2008 01:29 47640]
R2 ZDCNDIS5;ZDCNDIS5 NDIS5.1 Protocol Driver;c:\windows\system32\ZDCndis5.sys [12/07/2009 16:02 20736]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\hssdrv.sys [01/06/2009 20:13 33840]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [14/01/2008 12:06 21632]
R3 tap0901;TAP-Win32 Adapter V9;c:\windows\system32\drivers	ap0901.sys [22/07/2009 01:22 28592]
R3 V0330VID;WebCam Vista;c:\windows\system32\drivers\V0330Vid.sys [11/05/2009 21:36 173632]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [11/08/2009 01:19 57640]
S3 mcdevice;mcdevice;c:\windows\system32\drivers\mcdevice.sys [11/12/2008 00:19 323584]
S3 ntkvpn;Loki VPN Driver Service;c:\windows\system32\DRIVERS
tkvpn.sys --> c:\windows\system32\DRIVERS
tkvpn.sys [?]
S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanBZXP.sys [12/07/2009 16:33 402432]
S3 tapavpn;Steganos Anonym VPN Adapter;c:\windows\system32\drivers	apavpn.sys [19/10/2007 10:50 24320]
S4 Keenfinder Service;Keenfinder Service;"c:\program files\Keenfinder\keenfinder.exe" "c:\program files\Keenfinder\keenfinder.dll" Service --> c:\program files\Keenfinder\keenfinder.exe [?]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
.
Contents of the 'Scheduled Tasks' folder

2009-09-05 c:\windows\Tasks\User_Feed_Synchronization-{1F8414C6-A53E-45C0-B260-CAD037F0532C}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 17:36]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{59385f95-c52f-4a84-b674-4a4206b17218} - (no file)
Toolbar-{59385f95-c52f-4a84-b674-4a4206b17218} - (no file)
WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)
WebBrowser-{59385F95-C52F-4A84-B674-4A4206B17218} - (no file)
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
HKCU-Run-FrameWorkService - (no file)
HKLM-Run-FrameWorkService - (no file)
SafeBoot-SVCWINSPOOL


.
------- Supplementary Scan -------
.
mWindow Title = 
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 67.69.254.242:80
uInternet Settings,ProxyOverride = local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
IE: {{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - c:\program files\Ghost Navigator\Ghost
LSP: PrxerDrv.dll
TCP: {D64A6D53-4B27-4AF5-AA10-4B69889C9792} = 213.150.176.196,196.203.251.8
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\documents and settings\ESS\Application Data\Mozilla\Firefox\Profiles\3jzhgi8b.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=2&q=
FF - prefs.js: network.proxy.ftp - 127.0.0.1
FF - prefs.js: network.proxy.ftp_port - 80
FF - prefs.js: network.proxy.gopher - 127.0.0.1
FF - prefs.js: network.proxy.gopher_port - 80
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.socks - 127.0.0.1
FF - prefs.js: network.proxy.socks_port - 80
FF - prefs.js: network.proxy.ssl - 127.0.0.1
FF - prefs.js: network.proxy.ssl_port - 80
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\ESS\Application Data\Mozilla\Firefox\Profiles\3jzhgi8b.default\extensions\{7762a897-2a75-4e3f-a3a7-55bd098b9879}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\ESS\Application Data\Mozilla\Firefox\Profiles\3jzhgi8b.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\FFExternalAlert.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pFoxitReaderPlugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-05 03:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  


c:\windows\system32\Sexy Girls.scr 377344 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-448539723-573735546-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{219C3740-370D-5039-65CB-DBB14A0E7DC1}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iajokdkadiachhbhbh"=hex:69,61,6d,65,68,6d,67,6d,6a,6b,70,61,63,65,6e,6e,61,6b,
   00,00
"hahoafcmmhigabmp"=hex:6a,61,63,66,64,68,62,61,64,6f,69,65,70,6a,6a,64,6b,67,
   6d,6f,00,fe
"ianochijpclkfnkgol"=hex:63,61,6e,65,67,6a,00,7c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1336)
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'explorer.exe'(2360)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\program files\Google\Quick Search Box\bin\1.2.1137.3514\qsb.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\LMIRfsClientNP.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\windows\system32\wscntfy.exe
c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\Dos Optimizer.pif
.
**************************************************************************
.
Completion time: 2009-09-05  3:40 - machine was rebooted
ComboFix-quarantined-files.txt  2009-09-05 01:40

Pre-Run: 7 073 599 488 octets libres
Post-Run: 7 004 258 304 octets libres

324

Utilisateur anonyme · Answer

télécharge ce fichier sur le bureau : 

>> http://sd-1.archive-host.com/membres/up/127028005715545653/CFScript.zip

Dézippe le 

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ceci : 

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide. 

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal! 

Ne touche à rien tant que le scan n'est pas terminé. 

Après redémarrage, poste le contenu du rapport Combofix.txt

carlosNY · Answer

ComboFix 09-09-03.02 - ESS 05/09/2009  4:10.2.2 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.1015.635 [GMT 2:00]
Running from: c:\documents and settings\ESS\Bureau\disque\logicielle\désinfection -virus provenant de flach disque-\ComboFix.exe
Command switches used :: c:\documents and settings\ESS\Bureau\disque\logicielle\désinfection -virus provenant de flach disque-\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\Dos Optimizer.pif"
"c:\windows\system32\Sexy Girls.scr"
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\_OTM
c:\_otm\MovedFiles\09032009_185624.log
c:\_otm\MovedFiles\09032009_185624.res
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\AARAudio.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\AARConv.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\AARSettings.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\AARVideos.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\AskInstallChecker.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\askSBarSetup.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\audgopher.dll
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\audhook.dll
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\ffmpeg.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\FLVPlayer.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\FLVSrvc.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\lame_enc.dll
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbaregister.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\sdl.dll
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\Uninstall\IRIMG1.JPG
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\Uninstall\IRIMG2.JPG
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\Uninstall\uninstall.dat
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\Uninstall\uninstall.xml
c:\_otm\MovedFiles\09032009_185624\Program Files\Ask & Record Toolbar\VistaAudioLib.dll
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\bin\askBar.dll
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\bin\askPopStp.dll
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\bin\AskSplash.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\bin\AskTBApp.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\bin\ASKUpgrade.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\bin\psvince.dll
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Cache\000EBBD9
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Cache\000EC03E.bin
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Cache\000EC2BF.bin
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Cache\000EC753.bin
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Cache\000EC937.bin
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Cache\000ECC25.bin
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Cache\000ECEA6.bin
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Cache\000ED3D6.bin
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Cache\files.ini
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\History\search
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Settings\AskLogo.ico
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Settings\config.dat
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Settings\config.dat.bak
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Settings\prevcfg.htm
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\bar\Settings\prevCfg2.htm
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\unins00.exe
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\unins000.dat
c:\_otm\MovedFiles\09032009_185624\Program Files\AskBardis\unins000.exe
c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}\{B3F4072D-1B2C-4B5E-B016-E93C4BEA5AEB}.msi
c:\documents and settings\ESS\Application Data\smss.exe
c:\windows\Inf\smss.exe
c:\windows\system32\Sexy Girls.scr

.
(((((((((((((((((((((((((   Files Created from 2009-08-05 to 2009-09-05  )))))))))))))))))))))))))))))))
.

2009-09-02 04:21 . 2009-09-02 04:21	--------	d-sh--w-	c:\documents and settings\ESS\IECompatCache
2009-09-02 04:17 . 2009-09-02 04:17	--------	d-sh--w-	c:\documents and settings\ESS\PrivacIE
2009-09-02 04:16 . 2009-09-02 04:16	--------	d-sh--w-	c:\documents and settings\NetworkService\IETldCache
2009-09-02 04:13 . 2009-09-02 04:13	--------	d-sh--w-	c:\documents and settings\ESS\IETldCache
2009-09-02 04:08 . 2009-09-02 22:28	--------	d-----w-	c:\windows\ie8updates
2009-09-02 04:00 . 2007-08-13 17:45	78336	----a-w-	c:\windows\system32\ieencode.dll
2009-09-02 03:59 . 2007-08-13 17:45	78336	----a-w-	c:\windows\system32\dllcache\ieencode.dll
2009-08-31 16:41 . 2009-08-31 16:41	--------	d-----w-	c:\documents and settings\ESS\Application Data\Todae
2009-08-31 13:58 . 2009-08-07 08:48	100352	-c----w-	c:\windows\system32\dllcache\iecompat.dll
2009-08-31 13:56 . 2009-07-03 16:57	246272	-c----w-	c:\windows\system32\dllcache\ieproxy.dll
2009-08-31 13:56 . 2009-07-03 16:57	12800	-c----w-	c:\windows\system32\dllcache\xpshims.dll
2009-08-26 17:28 . 2009-09-02 04:01	--------	d-----w-	c:\documents and settings\All Users\Bureau
2009-08-24 02:28 . 2009-08-24 02:28	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\Visicron
2009-08-24 01:27 . 2009-08-24 01:28	--------	d-----w-	c:\program files\Fichiers communs\DivX Shared
2009-08-24 00:53 . 2009-08-24 00:53	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\TVU Networks
2009-08-24 00:53 . 2009-08-24 00:53	--------	d-----w-	c:\documents and settings\All Users\Application Data\TVU Networks
2009-08-24 00:52 . 2009-08-24 00:52	--------	d-----w-	c:\documents and settings\ESS\LocalLow
2009-08-24 00:52 . 2009-08-25 16:09	--------	d-----w-	c:\program files\SopCast
2009-08-24 00:07 . 2009-08-24 00:07	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data	oolbartv
2009-08-24 00:07 . 2009-08-24 00:34	--------	d-----w-	c:\program files	oolbartv
2009-08-22 22:57 . 2009-08-22 22:57	--------	d-----w-	C:\Hotspot Shield
2009-08-22 05:23 . 2009-08-22 05:23	--------	d-----w-	c:\program files\RadioXpi
2009-08-22 04:07 . 2009-08-22 04:07	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\LiveTV_
2009-08-22 04:06 . 2009-08-22 04:07	--------	d-----w-	c:\program files\LiveTV_
2009-08-19 22:24 . 2009-08-19 22:44	--------	d-----w-	c:\program files\Patch MsnCreative
2009-08-16 14:54 . 2009-08-16 14:54	--------	d-----w-	c:\program files\MediaSPace
2009-08-16 14:53 . 2009-08-16 14:53	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\Downloaded Installations
2009-08-14 22:46 . 2009-08-14 22:46	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\Identities
2009-08-12 03:17 . 2009-08-12 03:17	--------	d-----w-	c:\program files\LimeWire

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-05 02:07 . 2008-12-17 23:59	--------	d-----w-	c:\documents and settings\ESS\Application Data\Skype
2009-09-05 02:05 . 2008-10-10 23:33	--------	d-----w-	c:\documents and settings\All Users\Application Data\WinZip
2009-09-05 00:46 . 2008-08-28 23:31	--------	d--h--w-	c:\documents and settings\ESS\Application Data\skypePM
2009-09-05 00:37 . 2009-07-17 11:01	--------	d-----w-	c:\program files	rend micro
2009-09-03 17:45 . 2001-10-14 22:44	76384	----a-w-	c:\windows\system32\perfc00C.dat
2009-09-03 17:45 . 2001-10-14 22:44	471246	----a-w-	c:\windows\system32\perfh00C.dat
2009-09-03 10:18 . 2008-10-03 23:02	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-09-02 22:34 . 2008-08-26 00:30	--------	d-----w-	c:\program files\Yahoo!
2009-08-25 16:09 . 2008-11-13 00:57	--------	d-----w-	c:\documents and settings\ESS\Application Data\Paltalk
2009-08-25 16:07 . 2008-08-25 15:17	--------	d-----w-	c:\program files\Creative
2009-08-24 01:32 . 2008-08-25 15:25	--------	d-----w-	c:\program files\DivX
2009-08-22 23:00 . 2009-06-17 23:47	--------	d-----w-	c:\program files\Hotspot Shield
2009-08-16 02:16 . 2009-06-23 00:11	--------	d-----w-	c:\program files\Proxifier
2009-08-16 01:49 . 2008-08-28 11:57	--------	d-----w-	c:\program files\Google
2009-08-12 04:36 . 2009-04-26 23:35	--------	d-----w-	c:\documents and settings\ESS\Application Data\LimeWire
2009-08-10 17:00 . 2009-06-02 19:32	--------	d-----w-	c:\program files\SpacialAudio
2009-08-06 22:59 . 2009-07-17 21:40	55656	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-08-03 11:36 . 2008-10-03 23:02	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 11:36 . 2008-10-03 23:02	19096	-c--a-w-	c:\windows\system32\drivers\mbam.sys
2009-08-02 22:24 . 2009-06-17 23:48	--------	d-----w-	c:\program files\Hotspot_Shield
2009-07-23 01:27 . 2009-05-25 14:18	--------	d-----w-	c:\documents and settings\ESS\Application Data\Winamp
2009-07-22 21:07 . 2009-05-25 14:18	--------	d-----w-	c:\program files\Winamp
2009-07-22 19:13 . 2009-07-21 23:22	28592	----a-w-	c:\windows\system32\drivers	ap0901.sys
2009-07-17 21:40 . 2009-07-17 21:40	--------	d-----w-	c:\program files\Avira
2009-07-17 21:40 . 2009-07-17 21:40	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-07-14 00:15 . 2009-07-14 00:15	823296	----a-w-	c:\windows\system32\divx_xx0c.dll
2009-07-14 00:15 . 2009-07-14 00:15	823296	----a-w-	c:\windows\system32\divx_xx07.dll
2009-07-14 00:15 . 2009-07-14 00:15	815104	----a-w-	c:\windows\system32\divx_xx0a.dll
2009-07-14 00:15 . 2009-07-14 00:15	811008	----a-w-	c:\windows\system32\divx_xx16.dll
2009-07-14 00:15 . 2009-07-14 00:15	802816	----a-w-	c:\windows\system32\divx_xx11.dll
2009-07-14 00:15 . 2009-07-14 00:15	685056	----a-w-	c:\windows\system32\DivX.dll
2009-07-12 14:33 . 2009-07-12 14:33	--------	d-----w-	c:\program files\SAGEM WiFi manager
2009-07-12 14:25 . 2008-08-25 14:06	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-07-12 14:15 . 2009-04-29 21:53	--------	d-----w-	c:\program files\SAGEM
2009-07-12 14:15 . 2009-07-12 14:15	--------	d-----w-	c:\documents and settings\ESS\Application Data\InstallShield
2009-07-04 14:40 . 2009-07-04 14:40	0	-c--a-w-	c:\windows\system32\cd.dat
2009-07-02 02:34 . 2009-06-01 18:13	33840	----a-w-	c:\windows\system32\drivers\hssdrv.sys
2009-06-27 23:20 . 2009-06-27 23:20	165069	----a-w-	c:\windows\IceOp Uninstaller.exe
2009-06-20 18:28 . 2009-06-20 18:28	85504	----a-w-	c:\windows\system32\ff_vfw.dll
2009-06-14 15:21 . 2009-06-14 15:21	60273	----a-w-	c:\windows\system32\pthreadGC2.dll
2009-06-14 15:21 . 2009-06-14 15:21	256512	----a-w-	c:\windows\system32\ff_kernelDeint.dll
2009-06-14 15:21 . 2009-06-14 15:21	237056	----a-w-	c:\windows\system32\TomsMoComp_ff.dll
2009-07-14 00:16 . 2009-07-14 00:16	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
.

------- Sigcheck -------

[-] 2008-11-12 00:19	359040	EBEAB4C47642CD68D7FD23187EECA1B0	c:\windows\system32\backup	cpip.sys
[7] 2004-08-04 03:14	359040	9F4B36614A0FC234525BA224957DE55C	c:\windows\system32\dllcache	cpip.sys
[-] 2004-08-04 03:14	359040	3BB4B08619C111C7BE8BDA07AA0DE6A2	c:\windows\system32\drivers	cpip.sys
.
(((((((((((((((((((((((((((((   SnapShot@2009-09-05_01.29.32   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-05 02:05 . 2009-09-05 02:05	29184              c:\windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}\IconCD95F6617.exe
- 2009-06-23 23:05 . 2009-06-23 23:05	29184              c:\windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}\IconCD95F6617.exe
+ 2009-09-05 02:05 . 2009-09-05 02:05	632320              c:\windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}\IconCD95F66110.exe
- 2009-06-23 23:05 . 2009-06-23 23:05	632320              c:\windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}\IconCD95F66110.exe
+ 2009-09-05 02:05 . 2009-09-05 02:05	1461248              c:\windows\Installer\225d0a.msi
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-08-22 22:56	218160	----a-w-	c:\program files\Hotspot Shield\hssie\HssIE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-06 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OBealsched.exe" [2009-01-26 185872]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-12-12 413696]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-08-16 122368]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\ESS\Menu D‚marrer\Programmes\D‚marrage\
DosÿOptimizer.pif [2008-2-17 377344]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"2"= mmc.exe
"5"= regedt32.exe
"1"= cmd.exe
"3"= rstrui.exe
"4"= regedit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LMIinit]
2008-10-02 17:45	87352	----a-w-	c:\windows\system32\LMIinit.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^PalTalk.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^ESS^Menu Démarrer^Programmes^Démarrage^MaxTV.lnk]
path=c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\MaxTV.lnk
backup=c:\windows\pss\MaxTV.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^ESS^Menu Démarrer^Programmes^Démarrage^OneNote 2007 - Capture d'écran et lancement.lnk]
path=c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\OneNote 2007 - Capture d'écran et lancement.lnk
backup=c:\windows\pss\OneNote 2007 - Capture d'écran et lancement.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"UleadBurningHelper"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"Keenfinder Service"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"IDriverT"=3 (0x3)
"HssTrayService"=3 (0x3)
"HssSrv"=2 (0x2)
"HotspotShieldService"=2 (0x2)
"gusvc"=3 (0x3)
"FirebirdServerDefaultInstance"=3 (0x3)
"FirebirdGuardianDefaultInstance"=2 (0x2)
"Capture Device Service"=2 (0x2)
"Boonty Games"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Microsoft Office\Office12\GROOVE.EXE"=
"c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"=
"c:\Program Files\LimeWire\LimeWire.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Messenger\livecall.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [25/08/2008 16:48 13696]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [17/07/2009 23:40 108289]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [06/08/2009 20:58 331824]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [10/10/2008 01:29 47640]
R2 ZDCNDIS5;ZDCNDIS5 NDIS5.1 Protocol Driver;c:\windows\system32\ZDCndis5.sys [12/07/2009 16:02 20736]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\hssdrv.sys [01/06/2009 20:13 33840]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [14/01/2008 12:06 21632]
R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanBZXP.sys [12/07/2009 16:33 402432]
R3 tap0901;TAP-Win32 Adapter V9;c:\windows\system32\drivers	ap0901.sys [22/07/2009 01:22 28592]
R3 V0330VID;WebCam Vista;c:\windows\system32\drivers\V0330Vid.sys [11/05/2009 21:36 173632]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [11/08/2009 01:19 57640]
S3 mcdevice;mcdevice;c:\windows\system32\drivers\mcdevice.sys [11/12/2008 00:19 323584]
S3 ntkvpn;Loki VPN Driver Service;c:\windows\system32\DRIVERS
tkvpn.sys --> c:\windows\system32\DRIVERS
tkvpn.sys [?]
S3 tapavpn;Steganos Anonym VPN Adapter;c:\windows\system32\drivers	apavpn.sys [19/10/2007 10:50 24320]
S4 Keenfinder Service;Keenfinder Service;"c:\program files\Keenfinder\keenfinder.exe" "c:\program files\Keenfinder\keenfinder.dll" Service --> c:\program files\Keenfinder\keenfinder.exe [?]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
.
Contents of the 'Scheduled Tasks' folder

2009-09-05 c:\windows\Tasks\User_Feed_Synchronization-{1F8414C6-A53E-45C0-B260-CAD037F0532C}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 17:36]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{c95a4e8e-816d-4655-8c79-d736da1adb6d} - (no file)
URLSearchHooks-{7762a897-2a75-4e3f-a3a7-55bd098b9879} - (no file)
BHO-{7762a897-2a75-4e3f-a3a7-55bd098b9879} - (no file)
BHO-{c95a4e8e-816d-4655-8c79-d736da1adb6d} - (no file)
Toolbar-{c95a4e8e-816d-4655-8c79-d736da1adb6d} - (no file)
Toolbar-{7762a897-2a75-4e3f-a3a7-55bd098b9879} - (no file)
WebBrowser-{C95A4E8E-816D-4655-8C79-D736DA1ADB6D} - (no file)
WebBrowser-{7762A897-2A75-4E3F-A3A7-55BD098B9879} - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mWindow Title = 
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 67.69.254.242:80
uInternet Settings,ProxyOverride = local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
IE: {{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - c:\program files\Ghost Navigator\Ghost
LSP: PrxerDrv.dll
TCP: {D64A6D53-4B27-4AF5-AA10-4B69889C9792} = 213.150.176.196,196.203.251.8
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\documents and settings\ESS\Application Data\Mozilla\Firefox\Profiles\3jzhgi8b.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=2&q=
FF - prefs.js: network.proxy.ftp - 127.0.0.1
FF - prefs.js: network.proxy.ftp_port - 80
FF - prefs.js: network.proxy.gopher - 127.0.0.1
FF - prefs.js: network.proxy.gopher_port - 80
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.socks - 127.0.0.1
FF - prefs.js: network.proxy.socks_port - 80
FF - prefs.js: network.proxy.ssl - 127.0.0.1
FF - prefs.js: network.proxy.ssl_port - 80
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\ESS\Application Data\Mozilla\Firefox\Profiles\3jzhgi8b.default\extensions\{7762a897-2a75-4e3f-a3a7-55bd098b9879}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\ESS\Application Data\Mozilla\Firefox\Profiles\3jzhgi8b.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\FFExternalAlert.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pFoxitReaderPlugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-05 04:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-448539723-573735546-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{219C3740-370D-5039-65CB-DBB14A0E7DC1}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iajokdkadiachhbhbh"=hex:69,61,6d,65,68,6d,67,6d,6a,6b,70,61,63,65,6e,6e,61,6b,
   00,00
"hahoafcmmhigabmp"=hex:6a,61,63,66,64,68,62,61,64,6f,69,65,70,6a,6a,64,6b,67,
   6d,6f,00,fe
"ianochijpclkfnkgol"=hex:63,61,6e,65,67,6a,00,7c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1336)
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Completion time: 2009-09-05  4:24
ComboFix-quarantined-files.txt  2009-09-05 02:24
ComboFix2.txt  2009-09-05 01:40

Pre-Run: 6 890 070 016 octets libres
Post-Run: 6 849 998 848 octets libres

337

Utilisateur anonyme · Answer

l infection se relance car un fichier ne veut pas partir 

on va devoir recommencer la manipe précédente mas avec ce fichier : 

http://sd-1.archive-host.com/membres/up/127028005715545653/CFScript.zip

carlosNY · Answer

ComboFix 09-09-04.01 - ESS 05/09/2009  6:21.3.2 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.1015.560 [GMT 2:00]
Running from: c:\documents and settings\ESS\Bureau\disque\logicielle\désinfection -virus provenant de flach disque-\ComboFix.exe
Command switches used :: c:\documents and settings\ESS\Bureau\disque\logicielle\désinfection -virus provenant de flach disque-\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\documents and settings\ESS\Application Data\smss.exe"
"c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\Dos Optimizer.pif"
"c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\DosÿOptimizer.pif"
"c:\windows\Inf\smss.exe"
"c:\windows\system32\Sexy Girls.scr"
.

(((((((((((((((((((((((((   Files Created from 2009-08-05 to 2009-09-05  )))))))))))))))))))))))))))))))
.

2009-09-05 03:02 . 2009-09-05 03:02	--------	d-----w-	c:\program files\AskBardis
2009-09-02 04:21 . 2009-09-02 04:21	--------	d-sh--w-	c:\documents and settings\ESS\IECompatCache
2009-09-02 04:17 . 2009-09-02 04:17	--------	d-sh--w-	c:\documents and settings\ESS\PrivacIE
2009-09-02 04:16 . 2009-09-02 04:16	--------	d-sh--w-	c:\documents and settings\NetworkService\IETldCache
2009-09-02 04:13 . 2009-09-02 04:13	--------	d-sh--w-	c:\documents and settings\ESS\IETldCache
2009-09-02 04:08 . 2009-09-02 22:28	--------	d-----w-	c:\windows\ie8updates
2009-09-02 04:00 . 2007-08-13 17:45	78336	----a-w-	c:\windows\system32\ieencode.dll
2009-09-02 03:59 . 2007-08-13 17:45	78336	----a-w-	c:\windows\system32\dllcache\ieencode.dll
2009-08-31 16:41 . 2009-08-31 16:41	--------	d-----w-	c:\documents and settings\ESS\Application Data\Todae
2009-08-31 13:58 . 2009-08-07 08:48	100352	-c----w-	c:\windows\system32\dllcache\iecompat.dll
2009-08-31 13:56 . 2009-07-03 16:57	246272	-c----w-	c:\windows\system32\dllcache\ieproxy.dll
2009-08-31 13:56 . 2009-07-03 16:57	12800	-c----w-	c:\windows\system32\dllcache\xpshims.dll
2009-08-26 17:28 . 2009-09-02 04:01	--------	d-----w-	c:\documents and settings\All Users\Bureau
2009-08-24 02:28 . 2009-08-24 02:28	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\Visicron
2009-08-24 01:27 . 2009-08-24 01:28	--------	d-----w-	c:\program files\Fichiers communs\DivX Shared
2009-08-24 00:53 . 2009-08-24 00:53	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\TVU Networks
2009-08-24 00:53 . 2009-08-24 00:53	--------	d-----w-	c:\documents and settings\All Users\Application Data\TVU Networks
2009-08-24 00:52 . 2009-08-24 00:52	--------	d-----w-	c:\documents and settings\ESS\LocalLow
2009-08-24 00:52 . 2009-08-25 16:09	--------	d-----w-	c:\program files\SopCast
2009-08-24 00:07 . 2009-08-24 00:07	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data	oolbartv
2009-08-24 00:07 . 2009-08-24 00:34	--------	d-----w-	c:\program files	oolbartv
2009-08-22 22:57 . 2009-08-22 22:57	--------	d-----w-	C:\Hotspot Shield
2009-08-22 05:23 . 2009-08-22 05:23	--------	d-----w-	c:\program files\RadioXpi
2009-08-22 04:07 . 2009-08-22 04:07	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\LiveTV_
2009-08-22 04:06 . 2009-08-22 04:07	--------	d-----w-	c:\program files\LiveTV_
2009-08-19 22:24 . 2009-08-19 22:44	--------	d-----w-	c:\program files\Patch MsnCreative
2009-08-16 14:54 . 2009-08-16 14:54	--------	d-----w-	c:\program files\MediaSPace
2009-08-16 14:53 . 2009-08-16 14:53	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\Downloaded Installations
2009-08-14 22:46 . 2009-08-14 22:46	--------	d-----w-	c:\documents and settings\ESS\Local Settings\Application Data\Identities
2009-08-12 03:17 . 2009-08-12 03:17	--------	d-----w-	c:\program files\LimeWire

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-05 03:07 . 2008-12-17 23:59	--------	d-----w-	c:\documents and settings\ESS\Application Data\Skype
2009-09-05 02:05 . 2008-10-10 23:33	--------	d-----w-	c:\documents and settings\All Users\Application Data\WinZip
2009-09-05 00:46 . 2008-08-28 23:31	--------	d--h--w-	c:\documents and settings\ESS\Application Data\skypePM
2009-09-05 00:37 . 2009-07-17 11:01	--------	d-----w-	c:\program files	rend micro
2009-09-03 17:45 . 2001-10-14 22:44	76384	----a-w-	c:\windows\system32\perfc00C.dat
2009-09-03 17:45 . 2001-10-14 22:44	471246	----a-w-	c:\windows\system32\perfh00C.dat
2009-09-03 10:18 . 2008-10-03 23:02	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-09-02 22:34 . 2008-08-26 00:30	--------	d-----w-	c:\program files\Yahoo!
2009-08-25 16:09 . 2008-11-13 00:57	--------	d-----w-	c:\documents and settings\ESS\Application Data\Paltalk
2009-08-25 16:07 . 2008-08-25 15:17	--------	d-----w-	c:\program files\Creative
2009-08-24 01:32 . 2008-08-25 15:25	--------	d-----w-	c:\program files\DivX
2009-08-22 23:00 . 2009-06-17 23:47	--------	d-----w-	c:\program files\Hotspot Shield
2009-08-16 02:16 . 2009-06-23 00:11	--------	d-----w-	c:\program files\Proxifier
2009-08-16 01:49 . 2008-08-28 11:57	--------	d-----w-	c:\program files\Google
2009-08-12 04:36 . 2009-04-26 23:35	--------	d-----w-	c:\documents and settings\ESS\Application Data\LimeWire
2009-08-10 17:00 . 2009-06-02 19:32	--------	d-----w-	c:\program files\SpacialAudio
2009-08-06 22:59 . 2009-07-17 21:40	55656	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-08-03 11:36 . 2008-10-03 23:02	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 11:36 . 2008-10-03 23:02	19096	-c--a-w-	c:\windows\system32\drivers\mbam.sys
2009-08-02 22:24 . 2009-06-17 23:48	--------	d-----w-	c:\program files\Hotspot_Shield
2009-07-23 01:27 . 2009-05-25 14:18	--------	d-----w-	c:\documents and settings\ESS\Application Data\Winamp
2009-07-22 21:07 . 2009-05-25 14:18	--------	d-----w-	c:\program files\Winamp
2009-07-22 19:13 . 2009-07-21 23:22	28592	----a-w-	c:\windows\system32\drivers	ap0901.sys
2009-07-17 21:40 . 2009-07-17 21:40	--------	d-----w-	c:\program files\Avira
2009-07-17 21:40 . 2009-07-17 21:40	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-07-14 00:15 . 2009-07-14 00:15	823296	----a-w-	c:\windows\system32\divx_xx0c.dll
2009-07-14 00:15 . 2009-07-14 00:15	823296	----a-w-	c:\windows\system32\divx_xx07.dll
2009-07-14 00:15 . 2009-07-14 00:15	815104	----a-w-	c:\windows\system32\divx_xx0a.dll
2009-07-14 00:15 . 2009-07-14 00:15	811008	----a-w-	c:\windows\system32\divx_xx16.dll
2009-07-14 00:15 . 2009-07-14 00:15	802816	----a-w-	c:\windows\system32\divx_xx11.dll
2009-07-14 00:15 . 2009-07-14 00:15	685056	----a-w-	c:\windows\system32\DivX.dll
2009-07-12 14:33 . 2009-07-12 14:33	--------	d-----w-	c:\program files\SAGEM WiFi manager
2009-07-12 14:25 . 2008-08-25 14:06	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-07-12 14:15 . 2009-04-29 21:53	--------	d-----w-	c:\program files\SAGEM
2009-07-12 14:15 . 2009-07-12 14:15	--------	d-----w-	c:\documents and settings\ESS\Application Data\InstallShield
2009-07-04 14:40 . 2009-07-04 14:40	0	-c--a-w-	c:\windows\system32\cd.dat
2009-07-02 02:34 . 2009-06-01 18:13	33840	----a-w-	c:\windows\system32\drivers\hssdrv.sys
2009-06-27 23:20 . 2009-06-27 23:20	165069	----a-w-	c:\windows\IceOp Uninstaller.exe
2009-06-20 18:28 . 2009-06-20 18:28	85504	----a-w-	c:\windows\system32\ff_vfw.dll
2009-06-14 15:21 . 2009-06-14 15:21	60273	----a-w-	c:\windows\system32\pthreadGC2.dll
2009-06-14 15:21 . 2009-06-14 15:21	256512	----a-w-	c:\windows\system32\ff_kernelDeint.dll
2009-06-14 15:21 . 2009-06-14 15:21	237056	----a-w-	c:\windows\system32\TomsMoComp_ff.dll
2009-07-14 00:16 . 2009-07-14 00:16	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
.

------- Sigcheck -------

[-] 2008-11-12 00:19	359040	EBEAB4C47642CD68D7FD23187EECA1B0	c:\windows\system32\backup	cpip.sys
[7] 2004-08-04 03:14	359040	9F4B36614A0FC234525BA224957DE55C	c:\windows\system32\dllcache	cpip.sys
[-] 2004-08-04 03:14	359040	3BB4B08619C111C7BE8BDA07AA0DE6A2	c:\windows\system32\drivers	cpip.sys
.
(((((((((((((((((((((((((((((   SnapShot@2009-09-05_01.29.32   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-05 01:38 . 2008-10-16 13:09	51224              c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-09-05 01:38 . 2004-08-04 04:55	13824              c:\windows\system32\dllcache\cache\wscntfy.exe
+ 2009-09-05 01:38 . 2004-08-04 04:54	82944              c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-09-05 01:38 . 2004-08-04 04:55	25088              c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-09-05 01:38 . 2004-08-04 04:55	14336              c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-09-05 01:38 . 2004-08-04 04:54	71680              c:\windows\system32\dllcache\cache\ssdpsrv.dll
+ 2009-09-05 01:38 . 2004-08-04 04:55	57856              c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-09-05 01:38 . 2004-08-04 04:54	59904              c:\windows\system32\dllcache\cacheegsvc.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	89088              c:\windows\system32\dllcache\cacheasauto.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	17408              c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-09-05 01:38 . 2006-10-18 19:47	27136              c:\windows\system32\dllcache\cache\mspmsnsv.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	33792              c:\windows\system32\dllcache\cache\msgsvc.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	13312              c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-09-05 01:38 . 2004-08-04 04:54	22016              c:\windows\system32\dllcache\cache\lpk.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	18944              c:\windows\system32\dllcache\cache\linkinfo.dll
+ 2009-09-05 01:38 . 2004-08-04 04:45	25216              c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-09-05 01:38 . 2004-08-04 03:00	29056              c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-09-05 01:38 . 2004-08-04 04:54	55808              c:\windows\system32\dllcache\cache\eventlog.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	15360              c:\windows\system32\dllcache\cache\ctfmon.exe
+ 2009-09-05 01:38 . 2004-08-04 04:54	60416              c:\windows\system32\dllcache\cache\cryptsvc.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	77312              c:\windows\system32\dllcache\cache\browser.dll
+ 2009-09-05 01:38 . 2004-08-04 03:05	14336              c:\windows\system32\dllcache\cache\asyncmac.sys
+ 2009-09-05 01:38 . 2001-10-14 22:41	12032              c:\windows\system32\dllcache\cache\acpiec.sys
+ 2009-09-05 02:05 . 2009-09-05 02:05	29184              c:\windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}\IconCD95F6617.exe
- 2009-06-23 23:05 . 2009-06-23 23:05	29184              c:\windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}\IconCD95F6617.exe
+ 2009-09-05 01:38 . 2004-08-04 04:54	5120              c:\windows\system32\dllcache\cache\sfc.dll
+ 2009-09-05 01:38 . 2001-10-14 22:44	2944              c:\windows\system32\dllcache\cache
ull.sys
+ 2009-09-05 01:38 . 2001-10-14 22:41	4224              c:\windows\system32\dllcache\cache\beep.sys
+ 2009-09-05 01:38 . 2004-08-04 04:54	129536              c:\windows\system32\dllcache\cache\xmlprov.dll
+ 2009-09-05 01:38 . 2004-08-04 04:55	506368              c:\windows\system32\dllcache\cache\winlogon.exe
+ 2009-09-05 01:38 . 2008-08-26 08:11	826368              c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	578048              c:\windows\system32\dllcache\cache\user32.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	185344              c:\windows\system32\dllcache\cache\upnphost.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	297984              c:\windows\system32\dllcache\cache	ermsrv.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	246272              c:\windows\system32\dllcache\cache	apisrv.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	171008              c:\windows\system32\dllcache\cache\srsvc.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	135168              c:\windows\system32\dllcache\cache\shsvcs.dll
+ 2009-09-05 01:38 . 2004-08-04 04:55	108544              c:\windows\system32\dllcache\cache\services.exe
+ 2009-09-05 01:38 . 2004-08-04 04:54	193024              c:\windows\system32\dllcache\cache\schedsvc.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	186368              c:\windows\system32\dllcache\cache\scecli.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	395776              c:\windows\system32\dllcache\cachepcss.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	382464              c:\windows\system32\dllcache\cache\qmgr.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	438272              c:\windows\system32\dllcache\cache
tmssvc.dll
+ 2009-09-05 01:38 . 2004-08-04 03:15	574592              c:\windows\system32\dllcache\cache
tfs.sys
+ 2009-09-05 01:38 . 2004-08-04 04:54	198144              c:\windows\system32\dllcache\cache
etman.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	407040              c:\windows\system32\dllcache\cache
etlogon.dll
+ 2009-09-05 01:38 . 2004-08-04 03:14	182912              c:\windows\system32\dllcache\cache
dis.sys
+ 2009-09-05 01:38 . 2004-08-04 04:54	247808              c:\windows\system32\dllcache\cache\mswsock.dll
+ 2009-09-05 01:38 . 2001-10-14 22:43	924432              c:\windows\system32\dllcache\cache\mfc40u.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	110080              c:\windows\system32\dllcache\cache\imm32.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	243200              c:\windows\system32\dllcache\cache\es.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	851968              c:\windows\system32\dllcache\cache\comres.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	611328              c:\windows\system32\dllcache\cache\comctl32.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	176640              c:\windows\system32\dllcache\cache\appmgmts.dll
+ 2009-09-05 01:38 . 2004-08-03 20:39	142464              c:\windows\system32\dllcache\cache\aec.sys
- 2009-06-23 23:05 . 2009-06-23 23:05	632320              c:\windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}\IconCD95F66110.exe
+ 2009-09-05 02:05 . 2009-09-05 02:05	632320              c:\windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}\IconCD95F66110.exe
+ 2009-09-05 01:38 . 2004-08-04 04:54	1548288              c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-09-05 01:38 . 2004-08-04 04:48	2150400              c:\windows\system32\dllcache\cache
toskrnl.exe
+ 2009-09-05 01:38 . 2004-08-04 05:05	2017280              c:\windows\system32\dllcache\cache
tkrnlpa.exe
+ 2009-09-05 01:38 . 2008-08-27 13:41	3593216              c:\windows\system32\dllcache\cache\mshtml.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	1048576              c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-09-05 01:38 . 2004-08-04 04:54	1036288              c:\windows\system32\dllcache\cache\explorer.exe
+ 2009-09-05 02:05 . 2009-09-05 02:05	1461248              c:\windows\Installer\225d0a.msi
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-08-22 22:56	218160	----a-w-	c:\program files\Hotspot Shield\hssie\HssIE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-06 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OBealsched.exe" [2009-01-26 185872]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-12-12 413696]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-08-16 122368]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\ESS\Menu D‚marrer\Programmes\D‚marrage\
DosÿOptimizer.pif [2008-2-17 377344]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"2"= mmc.exe
"5"= regedt32.exe
"1"= cmd.exe
"3"= rstrui.exe
"4"= regedit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LMIinit]
2008-10-02 17:45	87352	----a-w-	c:\windows\system32\LMIinit.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^PalTalk.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^ESS^Menu Démarrer^Programmes^Démarrage^MaxTV.lnk]
path=c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\MaxTV.lnk
backup=c:\windows\pss\MaxTV.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^ESS^Menu Démarrer^Programmes^Démarrage^OneNote 2007 - Capture d'écran et lancement.lnk]
path=c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\OneNote 2007 - Capture d'écran et lancement.lnk
backup=c:\windows\pss\OneNote 2007 - Capture d'écran et lancement.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"UleadBurningHelper"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"Keenfinder Service"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"IDriverT"=3 (0x3)
"HssTrayService"=3 (0x3)
"HssSrv"=2 (0x2)
"HotspotShieldService"=2 (0x2)
"gusvc"=3 (0x3)
"FirebirdServerDefaultInstance"=3 (0x3)
"FirebirdGuardianDefaultInstance"=2 (0x2)
"Capture Device Service"=2 (0x2)
"Boonty Games"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Microsoft Office\Office12\GROOVE.EXE"=
"c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"=
"c:\Program Files\LimeWire\LimeWire.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Messenger\livecall.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [25/08/2008 16:48 13696]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [17/07/2009 23:40 108289]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [06/08/2009 20:58 331824]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [10/10/2008 01:29 47640]
R2 ZDCNDIS5;ZDCNDIS5 NDIS5.1 Protocol Driver;c:\windows\system32\ZDCndis5.sys [12/07/2009 16:02 20736]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\hssdrv.sys [01/06/2009 20:13 33840]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [14/01/2008 12:06 21632]
R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanBZXP.sys [12/07/2009 16:33 402432]
R3 tap0901;TAP-Win32 Adapter V9;c:\windows\system32\drivers	ap0901.sys [22/07/2009 01:22 28592]
R3 V0330VID;WebCam Vista;c:\windows\system32\drivers\V0330Vid.sys [11/05/2009 21:36 173632]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [11/08/2009 01:19 57640]
S3 mcdevice;mcdevice;c:\windows\system32\drivers\mcdevice.sys [11/12/2008 00:19 323584]
S3 ntkvpn;Loki VPN Driver Service;c:\windows\system32\DRIVERS
tkvpn.sys --> c:\windows\system32\DRIVERS
tkvpn.sys [?]
S3 tapavpn;Steganos Anonym VPN Adapter;c:\windows\system32\drivers	apavpn.sys [19/10/2007 10:50 24320]
S4 Keenfinder Service;Keenfinder Service;"c:\program files\Keenfinder\keenfinder.exe" "c:\program files\Keenfinder\keenfinder.dll" Service --> c:\program files\Keenfinder\keenfinder.exe [?]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
.
Contents of the 'Scheduled Tasks' folder

2009-09-05 c:\windows\Tasks\User_Feed_Synchronization-{1F8414C6-A53E-45C0-B260-CAD037F0532C}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 17:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mWindow Title = 
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 67.69.254.242:80
uInternet Settings,ProxyOverride = local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
IE: {{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - c:\program files\Ghost Navigator\Ghost
LSP: PrxerDrv.dll
TCP: {D64A6D53-4B27-4AF5-AA10-4B69889C9792} = 213.150.176.196,196.203.251.8
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\documents and settings\ESS\Application Data\Mozilla\Firefox\Profiles\3jzhgi8b.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=2&q=
FF - prefs.js: network.proxy.ftp - 127.0.0.1
FF - prefs.js: network.proxy.ftp_port - 80
FF - prefs.js: network.proxy.gopher - 127.0.0.1
FF - prefs.js: network.proxy.gopher_port - 80
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.socks - 127.0.0.1
FF - prefs.js: network.proxy.socks_port - 80
FF - prefs.js: network.proxy.ssl - 127.0.0.1
FF - prefs.js: network.proxy.ssl_port - 80
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\ESS\Application Data\Mozilla\Firefox\Profiles\3jzhgi8b.default\extensions\{7762a897-2a75-4e3f-a3a7-55bd098b9879}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\ESS\Application Data\Mozilla\Firefox\Profiles\3jzhgi8b.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\FFExternalAlert.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pFoxitReaderPlugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-05 06:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-448539723-573735546-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{219C3740-370D-5039-65CB-DBB14A0E7DC1}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iajokdkadiachhbhbh"=hex:69,61,6d,65,68,6d,67,6d,6a,6b,70,61,63,65,6e,6e,61,6b,
   00,00
"hahoafcmmhigabmp"=hex:6a,61,63,66,64,68,62,61,64,6f,69,65,70,6a,6a,64,6b,67,
   6d,6f,00,fe
"ianochijpclkfnkgol"=hex:63,61,6e,65,67,6a,00,7c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1336)
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'explorer.exe'(444)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\program files\Google\Quick Search Box\bin\1.2.1137.3514\qsb.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Completion time: 2009-09-05  6:32
ComboFix-quarantined-files.txt  2009-09-05 04:31
ComboFix2.txt  2009-09-05 02:25
ComboFix3.txt  2009-09-05 01:40

Pre-Run: 6 827 737 088 octets libres
Post-Run: 6 842 855 424 octets libres

351

Utilisateur anonyme · Answer

c est bizarre les outils ne supprime pas ce fichier ..


&#9654; Télécharge OTM de OldTimer sur ton Bureau. 

• Double-clique sur OTM.exe afin de le lancer. 

• Copie (Ctrl+C) le texte suivant ci-dessous : 



:processes 
explorer.exe 

:files 
c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\Dos Optimizer.pif
c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\DosÿOptimizer.pif
:commands 
[emptytemp] 



• Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

• Clique maintenant sur le bouton MoveIt! puis ferme OTM. 

&#9654; Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
&#9654; Accepte en cliquant sur YES. 

• Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

carlosNY · Answer

All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
========== FILES ==========
File/Folder c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\Dos Optimizer.pif not found.
File/Folder c:\documents and settings\ESS\Menu Démarrer\Programmes\Démarrage\DosÿOptimizer.pif not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: ESS
->Temp folder emptied: 36368923 bytes
->Temporary Internet Files folder emptied: 61151218 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 7254622 bytes
->Google Chrome cache emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 354 bytes
RecycleBin emptied: 1092 bytes
 
Total Files Cleaned = 99,99 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 09052009_135637

Files moved on Reboot...

Registry entries deleted on Reboot...

Utilisateur anonyme · Answer

Télécharge HijackThis (outils de diagnostic) ici : 

->  Fais un clic droit sur un des liens et choisi enregistrer la cible sous .... le bureau

->  http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe 
->  http://static.commentcamarche.net/www.commentcamarche.net/download/fichiers/HJTInstall.exe

-> Fais un double-clic sur HJTInstall.exe afin de lancer l'installation 

-> Clique sur Install ensuite sur I Accept 

-> Clique sur Do a scan system and save log file 

-> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse

carlosNY · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:09:30, on 05/09/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\Documents and Settings\ESS\Menu Démarrer\Programmes\Démarrage\Dos Optimizer.pif
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 67.69.254.242:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Dos Optimizer.pif = ?
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator\Ghost (file missing)
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator\Ghost (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: prxernsp.dll
O10 - Unknown file in Winsock LSP: prxerdrv.dll
O10 - Unknown file in Winsock LSP: prxerdrv.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15107/CTPID.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\..\{D64A6D53-4B27-4AF5-AA10-4B69889C9792}: NameServer = 213.150.176.196,196.203.251.8
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE

Utilisateur anonyme · Answer

réouvre hijackthis , choisi "do a system scan only"

dans le liste coches ces lignes :

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
O4 - Startup: Dos Optimizer.pif = ? 

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe 
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe 

O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator\Ghost (file missing) 
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator\Ghost (file missing) 


O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/ 
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab 
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab 
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab 
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab 
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab 
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab 
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab 
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/default.aspx 
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab 
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab 
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab 
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab 
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab 
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15107/CTPID.cab 
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab 
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100 


tu les coches et tu clic sur fix checked 


ensuite refais un scan Rsit et post log.txt stp

carlosNY · Answer

chiquitine29, çava comme ça?

Dos optimizer

28 réponses

Discussions similaires

Newsletters