Hijacker.gen

Bonjour, voici le rapport .
Bonne lecture.

======= RAPPORT D'AD-REMOVER 2.0.0.0,D | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 19/05/10 à 19:20
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 16:06:27 le 26/05/2010 | Mode normal | Option: SCAN
Exécuté de: C:\Ad-Remover\ADR.exe
SE: Microsoft® Windows Vista(TM) Édition Familiale Premium (Service Pack 1 - X86)
Nom du PC: PC-DE-PONINE (Hewlett-Packard HP Pavilion dv6 Notebook PC)
Utilisateur actuel: ponine
.
============== ÉLÉMENT(S) TROUVÉ(S) ==============
.
.
C:\Program Files\Everest Poker
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everest Poker
C:\Users\Public\Desktop\Everest Poker.lnk
.
HKCU\Software\Grand Virtual
HKLM\Software\Classes\Interface\{115CCBAE-27B0-47C3-BA42-BAB708424393}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker
.
.
============== SCAN ADDITIONNEL ==============
.
* Mozilla FireFox Version 3.6.3 (fr) *
.
C:\Users\ponine\..\29e1t2q7.default\prefs.js - browser.download.dir: C:\\Users\\ponine\\Desktop
C:\Users\ponine\..\29e1t2q7.default\prefs.js - browser.download.lastDir: C:\\Users\\ponine\\Desktop
C:\Users\ponine\..\29e1t2q7.default\prefs.js - browser.search.defaultenginename: Fast Browser Search
C:\Users\ponine\..\29e1t2q7.default\prefs.js - browser.search.defaulturl: hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
C:\Users\ponine\..\29e1t2q7.default\prefs.js - browser.search.selectedEngine: Fast Browser Search
C:\Users\ponine\..\29e1t2q7.default\prefs.js - browser.startup.homepage: hxxp://www.google.fr/
C:\Users\ponine\..\29e1t2q7.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.2.3
.
TROUVÉ: C:\Users\ponine\..\29e1t2q7.default\prefs.js - user_pref("browser.search.defaultenginename", "Fast Browser Search");
TROUVÉ: C:\Users\ponine\..\29e1t2q7.default\prefs.js - user_pref("browser.search.defaulturl", "hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=");
TROUVÉ: C:\Users\ponine\..\29e1t2q7.default\prefs.js - user_pref("browser.search.order.1", "Fast Browser Search");
TROUVÉ: C:\Users\ponine\..\29e1t2q7.default\prefs.js - user_pref("browser.search.selectedEngine", "Fast Browser Search");
.
* Internet Explorer Version 7.0.6001.18000 *
.
[HKCU\Software\Microsoft\Internet Explorer\Main]
.
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Show_ToolBar: yes
Start Page: hxxp://www.bouyguestelecom.fr
.
[HKLM\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Delete_Temp_Files_On_Exit: yes
Local Page: %SystemRoot%\system32\blank.htm
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=91&bd=Pavilion&pf=cnnb
.
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
.
========================================
.
C:\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Ad-Remover\Backup: 1 Fichier(s)
.
C:\Ad-Report-SCAN[1].txt - 3299 Octet(s)
.
Fin à: 16:11:48, 26/05/2010
.
============== E.O.F - SCAN[1] ==============

Bonjour dédétraqué,
Quand y en a plus, Y en a encore apparemment !! Il semblerait qu'il y en ait encore quelques uns, je te laisse regarder. Bonne lecture et merci encore.

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=7.00.6000.16386 (vista_rtm.061101-2205)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=b79b390ad582ec45a6254b608d84cf46
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-05-24 01:32:32
# local_time=2010-05-24 03:32:32 (+0100, Paris, Madrid (heure d'été))
# country="France"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 23480005 23480005 0 0
# compatibility_mode=5892 16776573 100 100 0 112237691 0 0
# compatibility_mode=8192 67108863 100 0 227 227 0 0
# scanned=20125
# found=0
# cleaned=0
# scan_time=2989
# version=7
# iexplore.exe=7.00.6000.16386 (vista_rtm.061101-2205)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=b79b390ad582ec45a6254b608d84cf46
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-05-25 01:02:02
# local_time=2010-05-25 03:02:02 (+0100, Paris, Madrid (heure d'été))
# country="France"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 23483131 23483131 0 0
# compatibility_mode=5892 16776573 100 100 0 112240817 0 0
# compatibility_mode=8192 67108863 100 0 3353 3353 0 0
# scanned=177558
# found=3
# cleaned=3
# scan_time=41233
C:\Program Files\Everest Poker\cstart-tmp.exe a variant of Win32/Casino application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Program Files\Everest Poker\cstart.exe a variant of Win32/Casino application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Program Files\Everest Poker\Everest Poker.exe a variant of Win32/Casino application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4131

Windows 6.0.6001 Service Pack 1 (Safe Mode)
Internet Explorer 7.0.6001.18000

23/05/2010 01:51:09
mbam-log-2010-05-23 (01-51-09).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 287013
Temps écoulé: 1 heure(s), 50 minute(s), 14 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\Users\ponine\AppData\Roaming\860A525DC28C053192EB34BFBBE5DA33\gotnewupdate000.exe.vir (Malware.Packer.Gen) -> Quarantined and deleted successfully.

Bonjour dédétraqué,
je viens de te poster le résultat du scan, j'ai supprimé le fichier infecté, je n'ai plus de problèmes depuis un moment donc je pense et j'espère que ça a fonctionné.
Merci pour tout
Brisssou

Bonjour

Pour OTL.txt
http://www.cijoint.fr/cjlink.php?file=cj201005/cij17tQ6BE.txt

Pour Extra.txt
http://www.cijoint.fr/cjlink.php?file=cj201005/cijDa3yUAM.txt

Bonsoir dédétraqué,

J'ai eu beau réessayer en mode sans échec le problème subsiste, toujours cet écran bleu.
Une idée de ce que je pourrais faire???

Merci d'avance.

Bonne nuit

J'ai un petit problème quand je lance le programme joybftv3.exe, Après quelques secondes d'analyse, un écran bleu apparait puis au redémarrage, un message d'erreur de Windows me dit ça :

Signature du problème :
Nom d'événement de problème: BlueScreen
Version du système: 6.0.6001.2.1.0.768.3
Identificateur de paramètres régionaux: 1036

Informations supplémentaires sur le problème :
BCCode: 50
BCP1: D1000008
BCP2: 00000000
BCP3: B033F53E
BCP4: 00000000
OS Version: 6_0_6001
Service Pack: 1_0
Product: 768_1

Fichiers aidant à décrire le problème :
C:\Windows\Minidump\Mini052010-02.dmp
C:\Users\ponine\AppData\Local\temp\WER-37206-0.sysdata.xml
C:\Users\ponine\AppData\Local\temp\WER4E4E.tmp.version.txt

Lire notre déclaration de confidentialité :
http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x040c

ComboFix 10-05-17.05 - ponine 19/05/2010 14:44:46.1.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3069.1852 [GMT 2:00]
Lancé depuis: c:\users\ponine\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\ponine\AppData\Roaming\860A525DC28C053192EB34BFBBE5DA33
c:\users\ponine\AppData\Roaming\860A525DC28C053192EB34BFBBE5DA33\enemies-names.txt
c:\users\ponine\AppData\Roaming\860A525DC28C053192EB34BFBBE5DA33\gotnewupdate000.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-19 au 2010-05-19 ))))))))))))))))))))))))))))))))))))
.

2010-05-12 10:43 . 2010-01-29 16:21 738304 ----a-w- c:\windows\system32\inetcomm.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-19 12:38 . 2009-02-26 15:48 672322 ----a-w- c:\windows\system32\perfh00C.dat
2010-05-19 12:38 . 2009-02-26 15:48 124434 ----a-w- c:\windows\system32\perfc00C.dat
2010-05-19 11:55 . 2009-09-01 16:42 -------- d-----w- c:\users\ponine\AppData\Roaming\Skype
2010-05-19 11:54 . 2009-08-25 18:36 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-05-19 10:24 . 2009-09-01 16:45 -------- d-----w- c:\users\ponine\AppData\Roaming\skypePM
2010-05-17 22:07 . 2010-01-25 16:14 -------- d-----w- c:\program files\Everest Poker
2010-05-17 16:18 . 2009-08-25 15:13 7512 ----a-w- c:\users\ponine\AppData\Local\d3d9caps.dat
2010-05-16 12:24 . 2009-09-16 13:26 -------- d-----w- c:\users\ponine\AppData\Roaming\OpenOffice.org2
2010-05-14 01:18 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-05-14 01:02 . 2009-02-26 09:05 -------- d-----w- c:\programdata\Microsoft Help
2010-05-06 08:36 . 2009-10-10 14:21 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-04-02 11:20 . 2010-04-02 11:16 -------- d-----w- c:\programdata\DivX
2010-04-02 11:20 . 2010-04-02 11:20 56766 ----a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-04-02 11:20 . 2010-01-26 13:25 -------- d-----w- c:\program files\DivX
2010-04-02 11:20 . 2010-04-02 11:20 56978 ----a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-04-02 11:19 . 2010-04-02 11:19 53600 ----a-w- c:\programdata\DivX\Update\Uninstaller.exe
2010-04-02 11:19 . 2010-04-02 11:19 57409 ----a-w- c:\programdata\DivX\ControlPanel\Uninstaller.exe
2010-04-02 11:19 . 2010-04-02 11:19 52963 ----a-w- c:\programdata\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-04-02 11:19 . 2010-04-02 11:19 54073 ----a-w- c:\programdata\DivX\Qt4.5\Uninstaller.exe
2010-04-02 11:19 . 2010-04-02 11:19 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-04-02 11:16 . 2010-04-02 11:20 754984 ----a-w- c:\programdata\DivX\Setup\Resource.dll
2010-04-02 11:16 . 2010-04-02 11:20 986904 ----a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-03-31 11:12 . 2010-02-08 10:32 50354 ----a-w- c:\users\ponine\AppData\Roaming\Facebook\uninstall.exe
2010-03-31 11:12 . 2010-02-08 10:32 -------- d-----w- c:\users\ponine\AppData\Roaming\Facebook
2010-03-12 02:24 . 2009-02-26 09:22 588472 ----a-w- c:\windows\system32\ezsvc7x.dll
2010-03-09 16:28 . 2010-03-30 20:55 833024 ----a-w- c:\windows\system32\wininet.dll
2010-03-09 16:25 . 2010-03-30 20:55 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-09 14:01 . 2010-03-30 20:55 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2010-03-06 05:30 . 2010-03-06 05:30 5582848 ----a-w- c:\users\ponine\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
2010-03-05 02:21 . 2009-08-30 08:36 109488 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-03-04 18:54 . 2010-04-14 21:09 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-02-23 11:32 . 2010-04-14 21:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-23 11:32 . 2010-04-14 21:10 78848 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-02-23 11:32 . 2010-04-14 21:10 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-20 23:39 . 2010-03-12 02:02 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-02-20 23:37 . 2010-03-12 02:02 31232 ----a-w- c:\windows\system32\httpapi.dll
2010-02-20 21:18 . 2010-03-12 02:02 411136 ----a-w- c:\windows\system32\drivers\http.sys
2010-02-18 17:36 . 2010-04-14 21:10 3600776 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-18 17:36 . 2010-04-14 21:10 3548560 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-18 14:49 . 2010-04-14 21:09 898952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-02-18 14:11 . 2010-04-14 21:09 190464 ----a-w- c:\windows\system32\iphlpsvc.dll
2009-02-26 16:10 . 2009-02-26 15:51 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-07-16 25604904]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-12-04 1410344]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-01-08 450663]
"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-11-28 1148200]
"TSMAgent"="c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-12-25 1316136]
"CLMLServer for HP TouchSmart"="c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-12-25 189736]
"TVAgent"="c:\program files\Hewlett-Packard\Media\TV\TVAgent.exe" [2009-05-08 206120]
"UCam_Menu"="c:\program files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2008-11-14 218408]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2008-11-18 914224]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-11-26 210216]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-10-10 206128]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-10-30 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-12-08 432432]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"BboxUpdate"="c:\program files\BboxUpdate\eStantAutoRunV.exe" [2008-04-14 6144]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 1135912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [x]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-11-19 222512]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-12-05 109408]
S2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/05/22 04:12];c:\program files\Hewlett-Packard\Media\DVD\000.fcl [2008-11-28 16:04 87536]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_c92065b9\aestsrv.exe [2009-01-13 77824]
S2 eStantLaunchService;BboxUpdate;c:\program files\BboxUpdate\eSRunService.exe [2008-04-29 20480]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-03-18 19456]
S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-12-17 365952]
S2 TVCapSvc;TV Background Capture Service (TVBCS);c:\program files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [2008-11-26 296320]
S2 TVSched;TV Task Scheduler (TVTS);c:\program files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [2008-11-26 116096]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-09-04 54784]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2008-05-28 22072]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 08:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.bouyguestelecom.fr
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=91&bd=Pavilion&pf=cnnb
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: everestpoker.com\account
FF - ProfilePath - c:\users\ponine\AppData\Roaming\Mozilla\Firefox\Profiles\29e1t2q7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: network.proxy.http - PROXY.esc-pau.fr
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\ponine\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\users\ponine\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-19 14:54
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files\Hewlett-Packard\Media\DVD\000.fcl"
.
Heure de fin: 2010-05-19 14:59:07
ComboFix-quarantined-files.txt 2010-05-19 12:59

Avant-CF: 273 219 055 616 octets libres
Après-CF: 273 157 513 216 octets libres

- - End Of File - - F8DF5C35A5CFFA87CB82CC9BE110E6E3