Analyse et avis
Résolu
Bonjour,
pourriez vous me dire ce que ce rapport exprime et si y a danger?merci d avance
SDFix: Version 1.112
Run by Administrateur on 29/10/2007 at 16:37
Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\ADMINI~1\Bureau\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...
Normal Mode:
Checking Files:
Trojan Files Found:
C:\Windows\system32\1.tmp - Deleted
C:\Windows\system32\1.tmp - Deleted
Removing Temp Files...
ADS Check:
C:\Windows
No streams found.
C:\Windows\system32
No streams found.
C:\Windows\system32\svchost.exe
No streams found.
C:\Windows\system32\ntoskrnl.exe
No streams found.
Final Check:
Remaining Services:
------------------
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\WINDOWS\\system32\\lxcrcoms.exe"="C:\\WINDOWS\\system32\\lxcrcoms.exe:*:Enabled:Lexmark Communications System"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
Remaining Files:
---------------
File Backups: - C:\DOCUME~1\ADMINI~1\Bureau\SDFix\backups\backups.zip
Files with Hidden Attributes:
Thu 5 Jun 2003 24,576 A..H. --- "C:\Program Files\RamBoost XP\StopRam.exe"
Mon 9 Apr 2007 5 A.SH. --- "C:\WINDOWS\system32\dedd9_g.dll"
Tue 23 Oct 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Finished!
Configuration: Windows XP
Firefox 2.0.0.8
pourriez vous me dire ce que ce rapport exprime et si y a danger?merci d avance
SDFix: Version 1.112
Run by Administrateur on 29/10/2007 at 16:37
Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\ADMINI~1\Bureau\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...
Normal Mode:
Checking Files:
Trojan Files Found:
C:\Windows\system32\1.tmp - Deleted
C:\Windows\system32\1.tmp - Deleted
Removing Temp Files...
ADS Check:
C:\Windows
No streams found.
C:\Windows\system32
No streams found.
C:\Windows\system32\svchost.exe
No streams found.
C:\Windows\system32\ntoskrnl.exe
No streams found.
Final Check:
Remaining Services:
------------------
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\WINDOWS\\system32\\lxcrcoms.exe"="C:\\WINDOWS\\system32\\lxcrcoms.exe:*:Enabled:Lexmark Communications System"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
Remaining Files:
---------------
File Backups: - C:\DOCUME~1\ADMINI~1\Bureau\SDFix\backups\backups.zip
Files with Hidden Attributes:
Thu 5 Jun 2003 24,576 A..H. --- "C:\Program Files\RamBoost XP\StopRam.exe"
Mon 9 Apr 2007 5 A.SH. --- "C:\WINDOWS\system32\dedd9_g.dll"
Tue 23 Oct 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Finished!
Configuration: Windows XP
Firefox 2.0.0.8
Configuration: Windows XP Firefox 2.0.0.8
99 réponses
Résumé de la discussion
Rapport de détection et de nettoyage d’infection sur Windows XP, incluant SDFix et ComboFix, et la question du niveau de danger associé à ces éléments. Plusieurs éléments indiquent la suppression de fichiers trojans et la restauration des valeurs du registre et du fichier hosts, avec des listes de programmes autorisés et des sauvegardes système. Des réponses recommandent l’usage d’outils complémentaires tels que ComboFix, ATF Cleaner et NoLop et recommandent un redémarrage en mode sans échec pour approfondir l’analyse. Des observations évoquent des modifications détectées dans des clés de démarrage et des éléments suspects dans la liste des applications autorisées, suggérant une vérification plus poussée mais sans conclure à une résolution définitive.
-
bonjour. et bein voila..ne pas confondre vitesse et precipitation...a suivre...
-
Contributeur sécuritéSalut leon ! Loll!
Je voulais te faire un signe 'up' pour te faire remarquer que c'est gentil de ta part de nous remercier !
Et je crois que je suis un peu fatigué, j'ai cliqué sur le mauvais bouton ! Loll!
La prochaine fois je saurai.
J'ai joué au Lucky luke avec ma souris. Le contraire de ce que je prêche .
J'ai pas pris le temps de lire !
@+ Jal -
grace a g!rly et jalobservateur mon probleme est resolu
et les conseils judicieux quand aux logiciels de securite de jalobservateur sont tres efficaces et ne ralentissentpas du tout mon pc contrairement ace qu on pouurait croire de prime abord
encore merci a vous deux eta tous ceux qui affrent leur temps et leur savoir benevolement -
bonsoir.j ai une imprimante lexmark .j ai defragmente en mode sans echec. c est pas pareil?j ai passe ccleaner plusieurs fois avec les reglages que tu m as donne. je trouve que mon pc demarre plus vite. et dis moi pour les parametres de l assistance a distance ce que je dois faire. et pour les logiciels que tu m as dis d installer. merci d avance
-
Contributeur sécuritéOk leon.
Donc il y a des traces de'' oodefrag'' seulement.
Surement une mauvaise désinstallation.
Recherches et supprime les restes et Ccleaner.
Puis
Refais Reg Seeker en sans echec Mode automatique.
Celle -ci devrait être dans la liste verte.
Et tu ne m"as pas donné suite à ma question sur msn ... Tu as une imprimante Lexmark?
ce soir tu devras défragmenter avec JKDefrag en mode Ecran de veille.
Mais donnes-moi avant tes impressions sur la machine stp" -
et voila ce que trouve antivir.
AntiVir PersonalEdition Classic
Report file date: samedi 3 novembre 2007 19:32
Scanning for 913479 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: Administrateur
Computer name: UCE552
Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 12:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 11:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 14:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 11:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:15
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 13:26:55
ANTIVIR2.VDF : 7.0.0.140 940544 Bytes 26/10/2007 11:10:21
ANTIVIR3.VDF : 7.0.0.165 129536 Bytes 02/11/2007 13:59:23
AVEWIN32.DLL : 7.6.0.30 3056128 Bytes 27/10/2007 11:10:21
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 06:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 07:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 06:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 11:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 06:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 11:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 11:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 08:37:21
Configuration settings for the scan:
Jobname..........................: Rootkit search
Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\rootkit.avp
Logging..........................: high
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Scan memory......................: off
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high
Expanded search settings.........: 0x00300922
Start of the scan: samedi 3 novembre 2007 19:32
Starting search for hidden objects.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\System\oodefrag08.00.00.01workstation
[NOTE] The registry entry is invisible.
'441320' objects were checked, '1' hidden objects were found.
End of the scan: samedi 3 novembre 2007 19:42
Used time: 10:54 min
The scan has been done completely.
0 Scanning directories
0 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
0 Files cannot be scanned
0 Files not concerned
0 Archives were scanned
0 Warnings
0 Notes
441320 Objects were scanned with rootkit scan
1 Hidden objects were found -
bonjour et bonsoir.. voila le rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:17:38, on 03/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Windows\System32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\lxcrcoms.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\ctfmon.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: lxcr_device - - C:\Windows\system32\lxcrcoms.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
-
Contributeur sécuritéAllo leon !
Re postes un nouveau log HT stp. ;-) -
bonjour..on en est ou deja?
-
ComboFix 07-11-02.3 - Administrateur 2007-11-03 3:05:08.4 - NTFSx86
Running from: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
* Created a new restore point
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\1.tmp
.
((((((((((((((((((((((((((((( Fichiers créés 2007-10-03 to 2007-11-03 ))))))))))))))))))))))))))))))))))))
.
2007-10-31 22:22 106 --a--c--- C:\delete.bat
2007-10-31 20:43 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-30 19:58 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-10-30 11:19 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys
2007-10-29 15:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
2007-10-29 11:24 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Grisoft
2007-10-29 11:23 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-10-28 22:03 53 --a------ C:\WINDOWS\DelToolbox.bat
2007-10-28 13:14 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\TuneUp Software
2007-10-25 22:52 <REP> d-------- C:\Program Files\PyGrenouille
2007-10-22 22:18 <REP> d----c--- C:\MILEC
2007-10-22 14:27 <REP> d-------- C:\Program Files\RamBoost XP
2007-10-20 10:35 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-19 11:08 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\HouseCall 6.6
2007-10-18 09:10 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-10-14 12:01 <REP> d-------- C:\Program Files\Avira
2007-10-14 12:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-10-08 09:27 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-07 21:21 0 --a------ C:\WINDOWS\system32\SBRC.dat
2007-10-07 21:21 0 --a------ C:\WINDOWS\system32\SBFC.dat
2007-10-07 20:39 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sunbelt Software
2007-10-07 16:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-10-07 16:21 <REP> d-------- C:\Program Files\SUPERAntiSpyware
2007-10-07 16:21 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com
2007-10-04 14:10 <REP> d-------- C:\Program Files\IObit
2007-10-04 13:45 <REP> d-------- C:\Program Files\RogueRemover FREE
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-01 23:41 831 ----a-w C:\Windows\system32\drivers\fwdrv.err
2007-11-01 10:23 --------- d-----w C:\Program Files\JkDefrag
2007-11-01 09:35 --------- d-----w C:\Program Files\lx_cats
2007-10-31 22:19 --------- d-----w C:\Program Files\Hijackthis Version Française
2007-10-30 11:55 --------- d-----w C:\Program Files\MSN Messenger
2007-10-29 16:55 --------- d-----w C:\Program Files\Navilog1
2007-10-29 14:55 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Uniblue
2007-10-28 21:06 --------- d-----w C:\Program Files\SpywareBlaster
2007-10-28 21:03 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-28 12:53 --------- d-----w C:\Program Files\DupFile Shareware
2007-10-21 17:52 --------- d-----w C:\Program Files\a-squared Free
2007-10-21 17:46 --------- d-----w C:\Program Files\Lavasoft
2007-10-16 10:48 --------- d-----w C:\Program Files\CFWebAdvancedU
2007-10-15 09:19 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\CamfrogWEB
2007-10-14 20:14 --------- d-----w C:\Program Files\DivX
2007-10-14 11:15 --------- d-----w C:\Program Files\Alwil Software
2007-10-14 11:09 --------- d-----w C:\Program Files\AxBx
2007-10-07 18:36 --------- d-----w C:\Program Files\Sunbelt Software
2007-10-03 21:49 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\ma-config.com
2007-10-01 21:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Prevx
2007-10-01 20:56 --------- d-----w C:\Program Files\EsetOnlineScanner
2007-10-01 12:29 --------- d-----w C:\Program Files\Webutility
2007-09-30 12:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-29 23:42 --------- d-----w C:\Program Files\MSECache
2007-09-29 20:32 --------- d-----w C:\Program Files\ToniArts
2007-09-28 14:17 --------- d-----w C:\Program Files\Crawler
2007-09-22 18:36 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Jetico Personal Firewall
2007-09-21 21:21 --------- d-----w C:\Program Files\Lavalys
2007-09-21 20:32 1,412,023 ----a-w C:\Windows\system32\drivers\v3engine.sys
2007-09-16 21:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2007-09-16 21:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-09-16 19:06 --------- d-----w C:\Program Files\Conference
2007-09-11 07:54 --------- d-----w C:\Program Files\Microsoft SQL Server
2007-09-10 15:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-09-10 15:20 --------- d-----w C:\Program Files\Microsoft.NET
2007-09-10 15:15 --------- d-----w C:\Program Files\Microsoft Small Business
2007-09-10 15:05 --------- d-----w C:\Program Files\Zylom Games
2007-09-09 10:10 86,094 -c--a-w C:\Windows\BPMNT.dll
2007-09-09 10:10 71,749 -c--a-w C:\Windows\hcextoutput.dll
2007-09-09 10:10 267,845 -c--a-w C:\Windows\tsc.exe
2007-09-09 10:10 1,163,344 -c--a-w C:\Windows\vsapi32.dll
2007-09-09 10:08 69,689 -c--a-w C:\Windows\UNZIP.DLL
2007-09-09 10:08 507,904 -c--a-w C:\Windows\TMUPDATE.DLL
2007-09-09 10:08 286,720 -c--a-w C:\Windows\PATCH.EXE
2007-09-06 10:03 23,152 ----a-w C:\Windows\system32\drivers\aswRdr.sys
2007-08-20 15:39 512 -c--a-w C:\ScanSectorLog.dat
2007-05-12 14:34 14 ----a-w C:\Documents and Settings\Administrateur\getfile.dat
2006-01-12 10:27 72,344 -c--a-w C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT
2005-12-25 21:42 278,528 -c--a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2005-12-25 17:59 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2007-04-09 09:40:46 5 --sha-w C:\Windows\system32\dedd9_g.dll
2007-07-01 20:43:38 16,384 --sha-w C:\Windows\system32\config\systemprofile\Cookies\index.dat
2007-07-01 20:43:38 16,384 --sha-w C:\Windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
2007-07-01 20:43:38 32,768 --sha-w C:\Windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-14 12:07]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 18:19]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 15:46]
"ctfmon.exe"="C:\Windows\system32\ctfmon.exe" [2004-08-20 00:09]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DelRecentsDocuments"=0 (0x0)
"DelRun"=0 (0x0)
"DelFindFiles"=0 (0x0)
"DelFindComputer"=0 (0x0)
"NoSecCPL"=0 (0x0)
"NoPwdPage"=0 (0x0)
"NoProfilePage"=0 (0x0)
"NoDevMgrPage"=0 (0x0)
"NoConfigPage"=0 (0x0)
"NoFileSysPage"=0 (0x0)
"NoVirtMemPage"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"=1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"=0 (0x0)
"NoOpenDriveCD"=0 (0x0)
"NoDirCopy"=0 (0x0)
"NoDirDel"=0 (0x0)
"NoDirMove"=0 (0x0)
"NoDirRen"=0 (0x0)
"NoPrinterTabs"=0 (0x0)
"NoDeletePrinter"=0 (0x0)
"NoAddPrinter"=0 (0x0)
"NoInstrumentation"=1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fjotho]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\Windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"LXCRCATS"=rundll32 C:\Windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
R1 fwdrv;Firewall Driver;C:\Windows\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\Windows\system32\drivers\khips.sys
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
R3 ALiIRDA;Pilote de périphérique infrarouge ALi;C:\Windows\system32\DRIVERS\alifir.sys
R3 Stmatm;ATM/ADSL miniport;C:\Windows\system32\DRIVERS\stmatm.sys
R3 usbscan;Pilote de scanneur USB;C:\Windows\system32\DRIVERS\usbscan.sys
S3 AlcrFilt;Alcor Micro Corp;\??\C:\Windows\System32\Drivers\AlcrFilt.sys
S3 DarkSpy;DarkSpy;\??\C:\Windows\system32\DarkSpyKernel.sys
S3 DCamUSBPremier;USB Video Camera;C:\Windows\system32\Drivers\mpixvid.sys
S3 MEMSWEEP2;MEMSWEEP2;\??\C:\Windows\system32\5.tmp
S3 netrcacm;RCA USB Digital Cable Modem Driver;C:\Windows\system32\DRIVERS\netrcacm.sys
S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;C:\Windows\system32\DRIVERS\sis163u.sys
S3 TaurusUsb;ADSL Modem USB Service;C:\Windows\system32\DRIVERS\torususb.sys
S3 USBSTOR;Pilote de stockage de masse USB;C:\Windows\system32\DRIVERS\USBSTOR.SYS
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-11-02 16:15:05 C:\Windows\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-10-29 14:54:59 C:\Windows\Tasks\Uniblue SpyEraser Nag.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
"2007-10-29 14:54:57 C:\Windows\Tasks\Uniblue SpyEraser.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-03 03:16:17
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-03 3:21:20
C:\ComboFix2.txt ... 2007-10-31 21:04
.
--- E O F --- -
Contributeur sécuritéDonc, on peut voir ici, des nouvelles lignes qui étaient cachées auparavant.
En faisant une suppression ciblée, on voit apparaitre la ligne 010 qui était aussi absente avant.
et ces deux-ci : O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\System32\shdocvw.dll
Alors, ceci explique l'impossibilité de supprimer les anciennes lignes de Java qui ont en fait été exploitées par un individu mal intentionné.
En conséquences, ceci : C:\Windows\System32\shdocvw.dll ne se laissera pas si facilement supprimer non plus .
On poursuit.
Donc en conséquences seulement supprimable et réussi avec OT MoveIt
C:\Windows\System32\shdocvw.dll NOT unregistered.
C:\Windows\System32\shdocvw.dll moved successfully.
-------------------------------------------------------------- -
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:12:56, on 03/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\lxcrcoms.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\System32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: lxcr_device - - C:\Windows\system32\lxcrcoms.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
-
voila le dernier rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:07:19, on 03/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\lxcrcoms.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\System32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: lxcr_device - - C:\Windows\system32\lxcrcoms.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
-
et j ai toujours ce truc qui veux pas partir..
J2SE runtime environnement5.0 update 6
les autres java sont partis -
Contributeur sécuritéOk leon !
Voilà le masque tombé
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
Regardes la nouvelle ligne qui vient d,apparaitre...
Compares ton autre log plus haut.
je te reviens pour la suite sur msn -
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:30:26, on 03/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\lxcrcoms.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\System32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: lxcr_device - - C:\Windows\system32\lxcrcoms.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
-
Contributeur sécuritéJe t,attend sur Msn avec des lignes à fixer
-
et comment je verifie maintenant?
-
t inquiete ca va..
la peur n evite pas le danger -
Contributeur sécuritéMoi oui mais pas lui !
il est craintif .
Un chat échaudé craint l'eau froide ;-)
- 1
- 2
- 3
- 4
- 5
Suivant
