Pubs intempestives
Résolu
Bonjour,
je suis infesté de pubs sur le net et parfois mon pc se bloque, j'ai fais un hijacthis voici le rapport si quelqu'un pouvait m'aider car j'ai essayé de comprendre seul mais c'est pas facile !
merci beaucoup
a+
je suis infesté de pubs sur le net et parfois mon pc se bloque, j'ai fais un hijacthis voici le rapport si quelqu'un pouvait m'aider car j'ai essayé de comprendre seul mais c'est pas facile !
merci beaucoup
a+
Configuration: Windows XP Internet Explorer 6.0
15 réponses
Résumé de la discussion
Une infestation publicitaire et des blocages du navigateur apparaissent sur Windows XP avec Internet Explorer 6, et un rapport HijackThis est utilisé pour diagnostiquer les éléments détectés. Plusieurs intervenants proposent des solutions et des ressources en ligne, notamment des tutoriels sur HijackThis, des méthodes de désinfection et des liens vers des guides de sécurité. Les conseils incluent souvent démarrer en mode sans échec, exécuter des scans avec des outils comme ComboFix et partager les rapports pour obtenir une aide coordonnée. En dernier lieu, des ressources supplémentaires proposent des mesures préventives et des méthodes d’analyse plus avancées pour éviter les récidives et limiter les symptômes.
-
ModérateurSalut
pas mal de lecture pour commencer :
http://www.commentcamarche.net/faq/sujet 2436 securite hijackthis et logiciels de desinfection
++ -
Modérateurfaudra que tu m'explique comment tu fais pour savoir ce qui est infecté et ce qu'il faut faire
c possible ça ?
oui, tout à fait, si tu veux devenir un initié, fais moi signe ;-)
@+
-
-
Modérateur@amnohymnecommence pas t'inscrire sur le forum, ça sera plus simple :-)
ensuite, dis moi un peu ce que tu attends, que veux tu apprendre, pour toi ou pour la suite pouvoir aider ? etc ...
++
-
@green daydéjà inscris
je voudrais savoir déchiffrer les rapports divers, savoir lesquels faire, et ce pour moi et pour les autres car je dépanne des gens en informatique en attendant d'ouvrir ma boite un jour....(peut-être !)
en attendant bonne nuit
a+
amno -
-
-
ModérateurTrès bien tout est ok ! ;-)
@+ -
ModérateurSalut
c'est pas il, c'est elle ;-))
télécharge OTMoveIt (de Old_Timer) sur ton Bureau :
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
C:\Windows\system32\ssqnnlj.dll
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre Results.
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.
si c'est le cas accepte par Yes.
ensuite :
Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :
O20 - Winlogon Notify: ssqnnlj - ssqnnlj.dll (file missing)
et poste un nouveau hijack
++-
oups !
pardon
voila
File/Folder C:\Windows\system32\ssqnnlj.dll not found.
OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03272008_202154
et l'autre
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:25, on 2008-03-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
-
-
ModérateurSalut
Télécharge SDFix sur ton bureau
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
Redémarre ton ordinateur en mode sans échec
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.cmd pour lancer le script.
Appuie sur Y pour commencer le processus de nettoyage.
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !
++-
salut a toi
oh ! grand vizir !
voici le rapport numero 1, le 2 arrive de suite....
[b]SDFix: Version 1.162 [/b]
Run by Fred on 2008-03-27 at 17:47
Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\Fred\Bureau\sdfix\SDFix
[b]Checking Services [/b]:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
[b]Checking Files [/b]:
No Trojan Files Found
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-27 18:23:54
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000000
"hdf12"=hex:f9,4e,cc,36,84,6f,94,ab,5e,07,ed,ae,e0,b0,33,d6,a0,42,9d,d9,c9,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\"
"h0"=dword:00000001
"khjeh"=hex:ff,15,86,30,85,01,8d,5b,16,e5,6b,58,54,51,c1,b5,75,c9,68,10,01,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,09,85,4e,5b,06,e4,54,1a,e9,65,88,8a,37,8f,f2,59,3f,..
"khjeh"=hex:f9,0b,6f,e2,e4,02,6b,11,35,4e,dc,ee,b5,b1,29,8d,99,94,b8,5a,6a,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a7,89,5e,17,76,b2,1f,54,bd,3f,9b,a2,93,50,6d,09,96,82,36,53,45,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000000
"hdf12"=hex:f9,4e,cc,36,84,6f,94,ab,5e,07,ed,ae,e0,b0,33,d6,a0,42,9d,d9,c9,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\"
"h0"=dword:00000001
"khjeh"=hex:ff,15,86,30,85,01,8d,5b,16,e5,6b,58,54,51,c1,b5,75,c9,68,10,01,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,09,85,4e,5b,06,e4,54,1a,e9,65,88,8a,37,8f,f2,59,3f,..
"khjeh"=hex:f9,0b,6f,e2,e4,02,6b,11,35,4e,dc,ee,b5,b1,29,8d,99,94,b8,5a,6a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a7,89,5e,17,76,b2,1f,54,bd,3f,9b,a2,93,50,6d,09,96,82,36,53,45,..
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000091
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\\Program Files\\installations\\jeux\\halo2\\halo.exe"="C:\\Program Files\\installations\\jeux\\halo2\\halo.exe:*:Enabled:Halo"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\\Program Files\\installations\\logiciels\\emule\\emule.exe"="C:\\Program Files\\installations\\logiciels\\emule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"
"C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe"="C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe:*:Enabled:DiRT Executable"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
[b]Remaining Files [/b]:
File Backups: - C:\DOCUME~1\Fred\Bureau\sdfix\SDFix\backups\backups.zip
[b]Files with Hidden Attributes [/b]:
Mon 17 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cc102203f99c8c6ebf1523556f8411b6\BIT3.tmp"
Mon 17 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT2.tmp"
[b]Finished![/b]
le voilà ! !!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:48, on 2008-03-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll
O20 - Winlogon Notify: ssqnnlj - ssqnnlj.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
-
-
ModérateurLol, en fait c'est combo qui a fait tout le boulot !
fais ce qui est indiqué ici stp :
http://www.commentcamarche.net/faq/sujet 3174 virus methode preliminaire de desinfection version fr
@demain-
-
salut
voila le avg
-----------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------
+ Créé à: 00:27 2008-03-27
+ Résultat de l'analyse:
C:\Documents and Settings\Rudy\Cookies\rudy@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@advertising[1].txt -> TrackingCookie.Advertising : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@atdmt[1].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@estat[1].txt -> TrackingCookie.Estat : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@ehg-telecomitalia.hitbox[2].txt -> TrackingCookie.Hitbox : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@hitbox[2].txt -> TrackingCookie.Hitbox : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@ie.search.msn[1].txt -> TrackingCookie.Msn : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@serving-sys[1].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@statcounter[1].txt -> TrackingCookie.Statcounter : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
Fin du rapport -
re re salut voila le rapport bitdef en ligne
BitDefender Online Scanner
Rapport d'analyse généré à: Thu, Mar 27, 2008 - 00:48:18
Voie d'analyse: A:\;C:\;D:\;F:\;Z:\;
Statistiques
Temps
00:16:01
Fichiers
67538
Directoires
5464
Secteurs de boot
3
Archives
835
Paquets programmes
6666
Résultats
Virus identifiés
10
Fichiers infectés
21
Fichiers suspects
0
Avertissements
0
Désinfectés
0
Fichiers effacés
21
Info sur les moteurs
Définition virus
941186
Version des moteurs
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
Analyse des plugins
14
Archive des plugins
38
Unpack des plugins
7
E-mail plugins
6
Système plugins
1
Paramètres d'analyse
Première action
Désinfecté
Seconde Action
Supprimé
Heuristique
Oui
Acceptez les avertissements
Oui
Extensions analysées
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;
Excludez les extensions
Analyse d'emails
Oui
Analyse des Archives
Oui
Analyser paquets programmes
Oui
Analyse des fichiers
Oui
Analyse de boot
Oui
Fichier analysé
Statut
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP51\A0006883.dll
Infecté par: Trojan.Vundo.EDN
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP51\A0006883.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP51\A0006883.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007235.dll
Infecté par: Trojan.Vundo.EEL
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007235.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007235.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007337.dll
Infecté par: Trojan.Vundo.EEL
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007337.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007337.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007338.dll
Infecté par: Trojan.Vundo.EDK
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007338.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007338.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007394.dll
Infecté par: Trojan.Vundo.EDQ
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007394.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007394.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007395.dll
Infecté par: Trojan.Vundo.EDV
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007395.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007395.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007399.dll
Infecté par: Trojan.Vundo.EDV
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007399.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007399.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007584.dll
Infecté par: Trojan.Vundo.EDV
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007584.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007584.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009893.dll
Infecté par: Trojan.Vundo.EDT
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009893.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009893.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009894.dll
Infecté par: Trojan.Vundo.EDU
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009894.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009894.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009895.dll
Infecté par: Trojan.Vundo.EEH
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009895.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009895.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009896.dll
Infecté par: Trojan.Vundo.EDM
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009896.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009896.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009897.dll
Infecté par: Trojan.Vundo.EDM
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009897.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009897.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009899.dll
Infecté par: Trojan.Vundo.EDM
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009899.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009899.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009903.dll
Infecté par: Trojan.Vundo.EDU
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009903.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009903.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009904.dll
Infecté par: Trojan.Vundo.EDK
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009904.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009904.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009905.dll
Infecté par: Trojan.Vundo.EDU
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009905.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009905.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009906.dll
Infecté par: Trojan.Vundo.EDT
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009906.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009906.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009907.dll
Infecté par: Trojan.Vundo.GH
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009907.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009908.dll
Infecté par: Trojan.Vundo.EEH
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009908.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009908.dll
Supprimé
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009909.dll
Infecté par: Trojan.Vundo.EDT
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009909.dll
Echec de la désinfection
C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009909.dll
Supprimé
merci pour la reponse
amno
-
-
ça a l'air de marcher !!!
bon si j'ais bien compris :
un coup de combofix, un navilog, et un vundo et le tour est joué ?
je doute que ce soit aussi simple ... non ? -
Modérateurok ! :)
-
Modérateurbien, as tu encore des pubs ??
++-
-
et enfin voila le hijackthis le plus récent
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:06, on 2008-03-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll
O20 - Winlogon Notify: ssqnnlj - ssqnnlj.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
-
-
Modérateurok,
# Télécharger Vundofix.exe (par Atribune) sur votre Bureau : http://www.atribune.org/ccount/click.php?id=4
* Double-cliquer sur VundoFix.exe afin de le lancer.
* Cliquer sur le bouton Scan for Vundo.
* Lorsque le scan est complété, cliquer sur le bouton Fix Vundo.
* Une invite de commande demandera si l’on souhaite supprimer les fichiers, cliquer sur YES
* Après avoir cliqué "YES", le Bureau disparaîtra un moment lors de la suppression des fichiers. * Une nouvelle invite de commande annoncera que le PC devra s'éteindre ("shutdown"). Cliquer sur OK , puis laisser le redémarrer.
* Le contenu du rapport est situé dans C:\vundofix.txt, poste le stp
++ -
re salut
et voila le travail !
Search Navipromo version 3.5.1 commencé le 2008-03-26 à 22:36:00.86
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Fred"
Mise à jour le 23.03.2008 à 22h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180
Système de fichiers : NTFS
Executé en mode normal
*** Recherche Programmes installés ***
*** Recherche dossiers dans C:\WINDOWS ***
*** Recherche dossiers dans C:\Program Files ***
*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\APPLIC~1 ***
*** Recherche dossiers dans "C:\Documents and Settings\Fred\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\Fred\locals~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\Fred\menudm~1\progra~1" ***
*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Aucun Fichier trouvé
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans C:\WINDOWS\system32 *
* Recherche dans "C:\Documents and Settings\Fred\locals~1\applic~1" *
* Recherche dans "C:\docume~1\Administrateur\locals~1\applic~1" *
* Recherche dans "C:\docume~1\Rudy\locals~1\applic~1" *
*** Recherche fichiers ***
*** Recherche clés spécifiques dans le Registre ***
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans C:\WINDOWS\system32 :
* Dans "C:\Documents and Settings\Fred\locals~1\applic~1" :
* Dans "C:\docume~1\Administrateur\locals~1\applic~1" :
* Dans "C:\docume~1\Rudy\locals~1\applic~1" :
3)Recherche Certificats :
Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche fichiers connus :
*** Analyse terminée le 2008-03-26 à 22:39:07.03 ***
merci encore -
Modérateurok ! ;-)
* Faire un clic droit sur ce lien : http://perso.orange.fr/il.mafioso/Navifix/Navilog1.zip
* Enregistrez la cible (du lien) sous... et enregistrez-le sur le bureau.
* Faire un clic droit sur navilog1.zip et choisir "tout extraire"
* Double-cliquez sur navilog1.exe
* Arriver au menu principal, choisir l'option 1 et valider.
* Patientez jusqu'au message : Analyse Termine le ...
* Le rapport sera en outre sauvegardé à la racine du disque (fixnavi.txt)
==> poste le stp
++ -
ModérateurSalut
Télécharger ComboFix (par sUBs) sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
* Démarrer en mode sans echec
* Double cliquer combofix.exe.
* Appuyer sur la touche Y (Yes) pour démarrer le scan
* Le rapport sera crée dans: C:\Combofix.txt, poste le stp
++-
bonsoir à toi ..... et merci de cette rapidité!!!!
voilà le rapport demandé !
ComboFix 08-03-25.4 - Administrateur 2008-03-26 21:57:46.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1759 [GMT 1:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BM83fc7a4a.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\aycdd.ini
C:\WINDOWS\system32\aycdd.ini2
C:\WINDOWS\system32\ayinmvub.dll
C:\WINDOWS\system32\clvqwebm.dll
C:\WINDOWS\system32\cmdhbrmw.dll
C:\WINDOWS\system32\ctynarno.dll
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\gwlscydg.dll
C:\WINDOWS\system32\hjnftftv.dll
C:\WINDOWS\system32\ilnduqwy.dll
C:\WINDOWS\system32\itjmtrpv.dll
C:\WINDOWS\system32\iuywtocj.dll
C:\WINDOWS\system32\jcotwyui.ini
C:\WINDOWS\system32\jgdvkeyn.ini
C:\WINDOWS\system32\napmatln.dll
C:\WINDOWS\system32\nurbvkvx.dll
C:\WINDOWS\system32\nyekvdgj.dll
C:\WINDOWS\system32\ovtbajmm.dll
C:\WINDOWS\system32\rrqss.ini2
C:\WINDOWS\system32\sjdvxjdl.dll
C:\WINDOWS\system32\ssqnnlj.dll
C:\WINDOWS\system32\ussugpnn.dll
C:\WINDOWS\system32\vifdxooq.dll
C:\WINDOWS\system32\ygxadnfi.dll
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
.
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-03-26 21:56 . 2008-02-05 23:07 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-03-26 21:56 . 2008-02-05 22:49 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-03-26 21:56 . 2008-03-26 21:59 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-03-25 20:05 . 2008-03-25 20:05 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Media Player Classic
2008-03-20 23:55 . 2008-03-20 23:55 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-20 23:51 . 2008-03-26 21:04 1,426 --a------ C:\rollback.ini
2008-03-20 23:43 . 2008-03-20 23:43 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-20 23:20 . 2008-03-20 23:20 <REP> d-------- C:\Documents and Settings\Fred\Application Data\MailFrontier
2008-03-20 23:17 . 2008-03-26 22:01 3,483,680 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-20 23:17 . 2008-03-26 21:52 53,828 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-20 23:13 . 2008-03-21 07:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-20 23:11 . 2008-03-26 20:53 <REP> d-------- C:\WINDOWS\Internet Logs
2008-03-20 00:01 . 2008-03-20 19:01 1,501,269 ---hs---- C:\WINDOWS\system32\nbqidoup.ini
2008-03-19 20:27 . 2008-03-19 23:55 1,501,020 ---hs---- C:\WINDOWS\system32\bhsayfaq.ini
2008-03-19 19:52 . 2008-03-19 20:19 1,500,720 ---hs---- C:\WINDOWS\system32\jthinvat.ini
2008-03-18 16:51 . 2008-03-19 19:47 2,031,076 ---hs---- C:\WINDOWS\system32\nhnigetp.ini
2008-03-17 21:58 . 2008-03-18 16:50 1,358,947 ---hs---- C:\WINDOWS\system32\wkvfreyp.ini
2008-03-17 21:04 . 2008-03-17 21:04 <REP> d-------- C:\Program Files\MSXML 4.0
2008-03-17 18:10 . 2008-03-17 18:22 1,355,220 ---hs---- C:\WINDOWS\system32\xcgxlnyn.ini
2008-03-17 12:44 . 2008-03-17 18:05 654 ---hs---- C:\WINDOWS\system32\govivmke.ini
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\Fred\Application Data\SUPERAntiSpyware.com
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-17 07:48 . 2008-03-17 07:48 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-03-17 07:28 . 2008-03-17 18:32 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-03-17 07:23 . 2007-07-09 14:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-16 20:15 . 2008-03-19 23:57 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-03-16 20:15 . 2007-02-09 12:10 574,464 -----c--- C:\WINDOWS\system32\dllcache\ntfs.sys
2008-03-16 20:15 . 2006-08-14 11:34 332,928 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-03-16 20:15 . 2006-06-26 18:41 148,480 -----c--- C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-03-16 20:15 . 2006-05-19 14:23 112,128 -----c--- C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
2008-03-16 20:15 . 2006-05-19 14:23 95,744 -----c--- C:\WINDOWS\system32\dllcache\iphlpapi.dll
2008-03-16 20:14 . 2008-03-17 07:47 534 ---hs---- C:\WINDOWS\system32\kvetpuje.ini
2008-03-16 11:27 . 2008-03-16 12:08 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Image Zone Express
2008-03-15 12:38 . 2008-03-16 20:14 1,366,983 ---hs---- C:\WINDOWS\system32\lvhhpnyu.ini
2008-03-14 12:43 . 2008-03-14 23:32 1,350,975 ---hs---- C:\WINDOWS\system32\nestoxvd.ini
2008-03-13 00:03 . 2008-03-13 00:03 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-13 00:03 . 2008-03-13 00:03 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-10 23:44 . 2008-03-10 23:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SimCity Societies
2008-03-10 23:40 . 2008-03-10 23:40 <REP> dr-h----- C:\Documents and Settings\Fred\Application Data\SecuROM
2008-03-10 23:40 . 2008-03-10 23:40 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-03-06 00:19 . 2008-03-06 00:19 319 --a------ C:\WINDOWS\game.ini
2008-03-06 00:14 . 2008-03-06 00:14 <REP> d-------- C:\Program Files\Activision
2008-03-05 23:36 . 2008-03-05 23:36 <REP> d--hs---- C:\WINDOWS\ftpcache
2008-02-26 07:41 . 2007-02-03 19:30 1,507,232 -ra------ C:\WINDOWS\system32\drivers\lvpopflt.sys
2008-02-26 07:41 . 2008-03-26 22:00 0 --a------ C:\WINDOWS\system32\drivers\lvuvc.hs
2008-02-26 07:40 . 2007-02-03 19:32 1,939,360 -ra------ C:\WINDOWS\system32\drivers\lvuvc.sys
2008-02-26 07:40 . 2007-02-03 19:32 527,136 -ra------ C:\WINDOWS\system32\LVUI2RC.dll
2008-02-26 07:40 . 2003-02-21 13:42 348,160 -ra------ C:\WINDOWS\system\msvcr71.dll
2008-02-26 07:40 . 2007-02-03 19:29 264,992 -ra------ C:\WINDOWS\system32\lvcodec2.dll
2008-02-26 07:40 . 2007-02-03 19:32 215,840 -ra------ C:\WINDOWS\system32\LVUI2.dll
2008-02-26 07:40 . 2007-02-03 19:29 129,824 -ra------ C:\WINDOWS\system32\lvci1051.dll
2008-02-26 07:40 . 2007-02-03 17:59 50,127 -ra------ C:\WINDOWS\system32\lvcoinst.ini
2008-02-26 07:40 . 2007-02-03 19:32 41,504 -ra------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-02-26 07:40 . 2007-02-03 19:32 22,560 -ra------ C:\WINDOWS\system32\drivers\lvuvcflt.sys
2008-02-26 07:40 . 2007-02-03 18:01 13,398 -ra------ C:\WINDOWS\system32\Repository.reg
2008-02-26 07:30 . 2008-02-26 07:30 127,034 -r------- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-02-26 07:28 . 2008-02-26 07:30 <REP> d-------- C:\Program Files\Logitech
2008-02-26 07:28 . 2008-02-26 07:40 <REP> d-------- C:\Program Files\Fichiers communs\LogiShrd
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 23:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 11:20 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-03-01 15:34 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-29 19:24 --------- d-----w C:\Documents and Settings\Rudy\Application Data\HPAppData
2008-02-15 19:24 --------- d-----w C:\Documents and Settings\Fred\Application Data\HP
2008-02-13 00:19 --------- d-----w C:\Program Files\Ubi Soft
2008-02-12 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\Ahead
2008-02-12 23:33 --------- d-----w C:\Program Files\Nero
2008-02-12 23:33 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-02-11 19:40 --------- d-----w C:\Documents and Settings\Rudy\Application Data\Grisoft
2008-02-09 21:56 --------- d-----w C:\Documents and Settings\Fred\Application Data\CyberLink
2008-02-08 19:19 --------- d-----w C:\Program Files\QuickTime
2008-02-07 19:18 --------- d-----w C:\Program Files\HP
2008-02-06 23:42 --------- d-----w C:\Documents and Settings\Fred\Application Data\Snapfish
2008-02-06 21:31 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-06 21:31 --------- d-----w C:\Program Files\installations
2008-02-06 21:05 --------- d-----w C:\Documents and Settings\Fred\Application Data\eu
2008-02-06 21:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-02-06 00:14 --------- d-----w C:\Program Files\MSN Messenger
2008-02-05 23:55 --------- d-----w C:\Program Files\CyberLink
2008-02-05 23:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-05 23:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-02-05 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-05 23:52 --------- d-----w C:\Program Files\Microsoft Works
2008-02-05 23:47 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools
2008-02-05 23:40 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 23:37 --------- d-----w C:\Program Files\DaemonTools_WhenUSave_Installer
2008-02-05 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools Pro
2008-02-05 23:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-05 23:14 --------- d-----w C:\Program Files\Roxio
2008-02-05 23:14 --------- d-----w C:\Program Files\Fichiers communs\SureThing Shared
2008-02-05 23:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\WEBREG
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\Fred\Application Data\HPAppData
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\HPSSUPPLY
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-02-05 23:05 --------- d-----w C:\Program Files\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-02-05 22:45 --------- d-----w C:\Program Files\Realtek
2008-02-05 22:10 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-05 22:08 --------- d-----w C:\Program Files\Services en ligne
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"SUPERAntiSpyware"="C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 07:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 06:19 7626752]
"nwiz"="nwiz.exe" [2006-07-12 06:19 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-12 06:19 86016]
"avast!"="C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 01:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 01:13 774168]
"devenv"="C:\WINDOWS\system\smvss.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe" [2007-12-13 19:27 919016]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\installations\logiciels\superantispyware\SASSEH.DLL [2006-12-20 12:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnnlj]
ssqnnlj.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\installations\logiciels\adobe acrobat\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 16:09 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-15 11:02 482760 C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-03-11 21:34 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\installations\\jeux\\halo2\\halo.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\installations\\logiciels\\emule\\emule.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe"=
R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\WINDOWS\system32\drivers\pe3ah4nc.sys [2007-05-18 20:53]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\WINDOWS\system32\drivers\ps6ah4nc.sys [2007-05-18 20:52]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\WINDOWS\system32\pr2ah4nc.exe svc []
S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2003-04-01 10:23]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-14 13:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\Documents
"2008-03-14 19:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\Documents
"2008-03-14 07:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\Documents
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 22:01:16
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-26 22:04:01 - machine was rebooted [Fred]
ComboFix-quarantined-files.txt 2008-03-26 21:03:55
.
2008-03-17 20:11:14 --- E O F ---
merci merci merci ! -
bonsoir à toi ..... et merci de cette rapidité!!!!
voilà le rapport demandé !
ComboFix 08-03-25.4 - Administrateur 2008-03-26 21:57:46.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1759 [GMT 1:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BM83fc7a4a.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\aycdd.ini
C:\WINDOWS\system32\aycdd.ini2
C:\WINDOWS\system32\ayinmvub.dll
C:\WINDOWS\system32\clvqwebm.dll
C:\WINDOWS\system32\cmdhbrmw.dll
C:\WINDOWS\system32\ctynarno.dll
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\gwlscydg.dll
C:\WINDOWS\system32\hjnftftv.dll
C:\WINDOWS\system32\ilnduqwy.dll
C:\WINDOWS\system32\itjmtrpv.dll
C:\WINDOWS\system32\iuywtocj.dll
C:\WINDOWS\system32\jcotwyui.ini
C:\WINDOWS\system32\jgdvkeyn.ini
C:\WINDOWS\system32\napmatln.dll
C:\WINDOWS\system32\nurbvkvx.dll
C:\WINDOWS\system32\nyekvdgj.dll
C:\WINDOWS\system32\ovtbajmm.dll
C:\WINDOWS\system32\rrqss.ini2
C:\WINDOWS\system32\sjdvxjdl.dll
C:\WINDOWS\system32\ssqnnlj.dll
C:\WINDOWS\system32\ussugpnn.dll
C:\WINDOWS\system32\vifdxooq.dll
C:\WINDOWS\system32\ygxadnfi.dll
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
.
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-03-26 21:56 . 2008-02-05 23:07 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-03-26 21:56 . 2008-02-05 22:49 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-03-26 21:56 . 2008-03-26 21:59 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-03-25 20:05 . 2008-03-25 20:05 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Media Player Classic
2008-03-20 23:55 . 2008-03-20 23:55 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-20 23:51 . 2008-03-26 21:04 1,426 --a------ C:\rollback.ini
2008-03-20 23:43 . 2008-03-20 23:43 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-20 23:20 . 2008-03-20 23:20 <REP> d-------- C:\Documents and Settings\Fred\Application Data\MailFrontier
2008-03-20 23:17 . 2008-03-26 22:01 3,483,680 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-20 23:17 . 2008-03-26 21:52 53,828 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-20 23:13 . 2008-03-21 07:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-20 23:11 . 2008-03-26 20:53 <REP> d-------- C:\WINDOWS\Internet Logs
2008-03-20 00:01 . 2008-03-20 19:01 1,501,269 ---hs---- C:\WINDOWS\system32\nbqidoup.ini
2008-03-19 20:27 . 2008-03-19 23:55 1,501,020 ---hs---- C:\WINDOWS\system32\bhsayfaq.ini
2008-03-19 19:52 . 2008-03-19 20:19 1,500,720 ---hs---- C:\WINDOWS\system32\jthinvat.ini
2008-03-18 16:51 . 2008-03-19 19:47 2,031,076 ---hs---- C:\WINDOWS\system32\nhnigetp.ini
2008-03-17 21:58 . 2008-03-18 16:50 1,358,947 ---hs---- C:\WINDOWS\system32\wkvfreyp.ini
2008-03-17 21:04 . 2008-03-17 21:04 <REP> d-------- C:\Program Files\MSXML 4.0
2008-03-17 18:10 . 2008-03-17 18:22 1,355,220 ---hs---- C:\WINDOWS\system32\xcgxlnyn.ini
2008-03-17 12:44 . 2008-03-17 18:05 654 ---hs---- C:\WINDOWS\system32\govivmke.ini
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\Fred\Application Data\SUPERAntiSpyware.com
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-17 07:48 . 2008-03-17 07:48 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-03-17 07:28 . 2008-03-17 18:32 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-03-17 07:23 . 2007-07-09 14:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-16 20:15 . 2008-03-19 23:57 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-03-16 20:15 . 2007-02-09 12:10 574,464 -----c--- C:\WINDOWS\system32\dllcache\ntfs.sys
2008-03-16 20:15 . 2006-08-14 11:34 332,928 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-03-16 20:15 . 2006-06-26 18:41 148,480 -----c--- C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-03-16 20:15 . 2006-05-19 14:23 112,128 -----c--- C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
2008-03-16 20:15 . 2006-05-19 14:23 95,744 -----c--- C:\WINDOWS\system32\dllcache\iphlpapi.dll
2008-03-16 20:14 . 2008-03-17 07:47 534 ---hs---- C:\WINDOWS\system32\kvetpuje.ini
2008-03-16 11:27 . 2008-03-16 12:08 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Image Zone Express
2008-03-15 12:38 . 2008-03-16 20:14 1,366,983 ---hs---- C:\WINDOWS\system32\lvhhpnyu.ini
2008-03-14 12:43 . 2008-03-14 23:32 1,350,975 ---hs---- C:\WINDOWS\system32\nestoxvd.ini
2008-03-13 00:03 . 2008-03-13 00:03 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-13 00:03 . 2008-03-13 00:03 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-10 23:44 . 2008-03-10 23:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SimCity Societies
2008-03-10 23:40 . 2008-03-10 23:40 <REP> dr-h----- C:\Documents and Settings\Fred\Application Data\SecuROM
2008-03-10 23:40 . 2008-03-10 23:40 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-03-06 00:19 . 2008-03-06 00:19 319 --a------ C:\WINDOWS\game.ini
2008-03-06 00:14 . 2008-03-06 00:14 <REP> d-------- C:\Program Files\Activision
2008-03-05 23:36 . 2008-03-05 23:36 <REP> d--hs---- C:\WINDOWS\ftpcache
2008-02-26 07:41 . 2007-02-03 19:30 1,507,232 -ra------ C:\WINDOWS\system32\drivers\lvpopflt.sys
2008-02-26 07:41 . 2008-03-26 22:00 0 --a------ C:\WINDOWS\system32\drivers\lvuvc.hs
2008-02-26 07:40 . 2007-02-03 19:32 1,939,360 -ra------ C:\WINDOWS\system32\drivers\lvuvc.sys
2008-02-26 07:40 . 2007-02-03 19:32 527,136 -ra------ C:\WINDOWS\system32\LVUI2RC.dll
2008-02-26 07:40 . 2003-02-21 13:42 348,160 -ra------ C:\WINDOWS\system\msvcr71.dll
2008-02-26 07:40 . 2007-02-03 19:29 264,992 -ra------ C:\WINDOWS\system32\lvcodec2.dll
2008-02-26 07:40 . 2007-02-03 19:32 215,840 -ra------ C:\WINDOWS\system32\LVUI2.dll
2008-02-26 07:40 . 2007-02-03 19:29 129,824 -ra------ C:\WINDOWS\system32\lvci1051.dll
2008-02-26 07:40 . 2007-02-03 17:59 50,127 -ra------ C:\WINDOWS\system32\lvcoinst.ini
2008-02-26 07:40 . 2007-02-03 19:32 41,504 -ra------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-02-26 07:40 . 2007-02-03 19:32 22,560 -ra------ C:\WINDOWS\system32\drivers\lvuvcflt.sys
2008-02-26 07:40 . 2007-02-03 18:01 13,398 -ra------ C:\WINDOWS\system32\Repository.reg
2008-02-26 07:30 . 2008-02-26 07:30 127,034 -r------- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-02-26 07:28 . 2008-02-26 07:30 <REP> d-------- C:\Program Files\Logitech
2008-02-26 07:28 . 2008-02-26 07:40 <REP> d-------- C:\Program Files\Fichiers communs\LogiShrd
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 23:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 11:20 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-03-01 15:34 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-29 19:24 --------- d-----w C:\Documents and Settings\Rudy\Application Data\HPAppData
2008-02-15 19:24 --------- d-----w C:\Documents and Settings\Fred\Application Data\HP
2008-02-13 00:19 --------- d-----w C:\Program Files\Ubi Soft
2008-02-12 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\Ahead
2008-02-12 23:33 --------- d-----w C:\Program Files\Nero
2008-02-12 23:33 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-02-11 19:40 --------- d-----w C:\Documents and Settings\Rudy\Application Data\Grisoft
2008-02-09 21:56 --------- d-----w C:\Documents and Settings\Fred\Application Data\CyberLink
2008-02-08 19:19 --------- d-----w C:\Program Files\QuickTime
2008-02-07 19:18 --------- d-----w C:\Program Files\HP
2008-02-06 23:42 --------- d-----w C:\Documents and Settings\Fred\Application Data\Snapfish
2008-02-06 21:31 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-06 21:31 --------- d-----w C:\Program Files\installations
2008-02-06 21:05 --------- d-----w C:\Documents and Settings\Fred\Application Data\eu
2008-02-06 21:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-02-06 00:14 --------- d-----w C:\Program Files\MSN Messenger
2008-02-05 23:55 --------- d-----w C:\Program Files\CyberLink
2008-02-05 23:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-05 23:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-02-05 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-05 23:52 --------- d-----w C:\Program Files\Microsoft Works
2008-02-05 23:47 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools
2008-02-05 23:40 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 23:37 --------- d-----w C:\Program Files\DaemonTools_WhenUSave_Installer
2008-02-05 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools Pro
2008-02-05 23:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-05 23:14 --------- d-----w C:\Program Files\Roxio
2008-02-05 23:14 --------- d-----w C:\Program Files\Fichiers communs\SureThing Shared
2008-02-05 23:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\WEBREG
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\Fred\Application Data\HPAppData
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\HPSSUPPLY
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-02-05 23:05 --------- d-----w C:\Program Files\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-02-05 22:45 --------- d-----w C:\Program Files\Realtek
2008-02-05 22:10 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-05 22:08 --------- d-----w C:\Program Files\Services en ligne
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"SUPERAntiSpyware"="C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 07:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 06:19 7626752]
"nwiz"="nwiz.exe" [2006-07-12 06:19 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-12 06:19 86016]
"avast!"="C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 01:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 01:13 774168]
"devenv"="C:\WINDOWS\system\smvss.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe" [2007-12-13 19:27 919016]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\installations\logiciels\superantispyware\SASSEH.DLL [2006-12-20 12:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnnlj]
ssqnnlj.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\installations\logiciels\adobe acrobat\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 16:09 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-15 11:02 482760 C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-03-11 21:34 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\installations\\jeux\\halo2\\halo.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\installations\\logiciels\\emule\\emule.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe"=
R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\WINDOWS\system32\drivers\pe3ah4nc.sys [2007-05-18 20:53]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\WINDOWS\system32\drivers\ps6ah4nc.sys [2007-05-18 20:52]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\WINDOWS\system32\pr2ah4nc.exe svc []
S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2003-04-01 10:23]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-14 13:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\Documents
"2008-03-14 19:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\Documents
"2008-03-14 07:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\Documents
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 22:01:16
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-26 22:04:01 - machine was rebooted [Fred]
ComboFix-quarantined-files.txt 2008-03-26 21:03:55
.
2008-03-17 20:11:14 --- E O F ---
merci merci merci ! -
bonsoir à toi ..... et merci de cette rapidité!!!!
voilà le rapport demandé !
ComboFix 08-03-25.4 - Administrateur 2008-03-26 21:57:46.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1759 [GMT 1:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BM83fc7a4a.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\aycdd.ini
C:\WINDOWS\system32\aycdd.ini2
C:\WINDOWS\system32\ayinmvub.dll
C:\WINDOWS\system32\clvqwebm.dll
C:\WINDOWS\system32\cmdhbrmw.dll
C:\WINDOWS\system32\ctynarno.dll
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\gwlscydg.dll
C:\WINDOWS\system32\hjnftftv.dll
C:\WINDOWS\system32\ilnduqwy.dll
C:\WINDOWS\system32\itjmtrpv.dll
C:\WINDOWS\system32\iuywtocj.dll
C:\WINDOWS\system32\jcotwyui.ini
C:\WINDOWS\system32\jgdvkeyn.ini
C:\WINDOWS\system32\napmatln.dll
C:\WINDOWS\system32\nurbvkvx.dll
C:\WINDOWS\system32\nyekvdgj.dll
C:\WINDOWS\system32\ovtbajmm.dll
C:\WINDOWS\system32\rrqss.ini2
C:\WINDOWS\system32\sjdvxjdl.dll
C:\WINDOWS\system32\ssqnnlj.dll
C:\WINDOWS\system32\ussugpnn.dll
C:\WINDOWS\system32\vifdxooq.dll
C:\WINDOWS\system32\ygxadnfi.dll
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
.
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-03-26 21:56 . 2008-02-05 23:07 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-03-26 21:56 . 2008-02-05 22:49 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-03-26 21:56 . 2008-03-26 21:59 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-03-25 20:05 . 2008-03-25 20:05 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Media Player Classic
2008-03-20 23:55 . 2008-03-20 23:55 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-20 23:51 . 2008-03-26 21:04 1,426 --a------ C:\rollback.ini
2008-03-20 23:43 . 2008-03-20 23:43 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-20 23:20 . 2008-03-20 23:20 <REP> d-------- C:\Documents and Settings\Fred\Application Data\MailFrontier
2008-03-20 23:17 . 2008-03-26 22:01 3,483,680 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-20 23:17 . 2008-03-26 21:52 53,828 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-20 23:13 . 2008-03-21 07:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-20 23:11 . 2008-03-26 20:53 <REP> d-------- C:\WINDOWS\Internet Logs
2008-03-20 00:01 . 2008-03-20 19:01 1,501,269 ---hs---- C:\WINDOWS\system32\nbqidoup.ini
2008-03-19 20:27 . 2008-03-19 23:55 1,501,020 ---hs---- C:\WINDOWS\system32\bhsayfaq.ini
2008-03-19 19:52 . 2008-03-19 20:19 1,500,720 ---hs---- C:\WINDOWS\system32\jthinvat.ini
2008-03-18 16:51 . 2008-03-19 19:47 2,031,076 ---hs---- C:\WINDOWS\system32\nhnigetp.ini
2008-03-17 21:58 . 2008-03-18 16:50 1,358,947 ---hs---- C:\WINDOWS\system32\wkvfreyp.ini
2008-03-17 21:04 . 2008-03-17 21:04 <REP> d-------- C:\Program Files\MSXML 4.0
2008-03-17 18:10 . 2008-03-17 18:22 1,355,220 ---hs---- C:\WINDOWS\system32\xcgxlnyn.ini
2008-03-17 12:44 . 2008-03-17 18:05 654 ---hs---- C:\WINDOWS\system32\govivmke.ini
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\Fred\Application Data\SUPERAntiSpyware.com
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-17 07:48 . 2008-03-17 07:48 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-03-17 07:28 . 2008-03-17 18:32 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-03-17 07:23 . 2007-07-09 14:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-16 20:15 . 2008-03-19 23:57 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-03-16 20:15 . 2007-02-09 12:10 574,464 -----c--- C:\WINDOWS\system32\dllcache\ntfs.sys
2008-03-16 20:15 . 2006-08-14 11:34 332,928 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-03-16 20:15 . 2006-06-26 18:41 148,480 -----c--- C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-03-16 20:15 . 2006-05-19 14:23 112,128 -----c--- C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
2008-03-16 20:15 . 2006-05-19 14:23 95,744 -----c--- C:\WINDOWS\system32\dllcache\iphlpapi.dll
2008-03-16 20:14 . 2008-03-17 07:47 534 ---hs---- C:\WINDOWS\system32\kvetpuje.ini
2008-03-16 11:27 . 2008-03-16 12:08 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Image Zone Express
2008-03-15 12:38 . 2008-03-16 20:14 1,366,983 ---hs---- C:\WINDOWS\system32\lvhhpnyu.ini
2008-03-14 12:43 . 2008-03-14 23:32 1,350,975 ---hs---- C:\WINDOWS\system32\nestoxvd.ini
2008-03-13 00:03 . 2008-03-13 00:03 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-13 00:03 . 2008-03-13 00:03 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-10 23:44 . 2008-03-10 23:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SimCity Societies
2008-03-10 23:40 . 2008-03-10 23:40 <REP> dr-h----- C:\Documents and Settings\Fred\Application Data\SecuROM
2008-03-10 23:40 . 2008-03-10 23:40 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-03-06 00:19 . 2008-03-06 00:19 319 --a------ C:\WINDOWS\game.ini
2008-03-06 00:14 . 2008-03-06 00:14 <REP> d-------- C:\Program Files\Activision
2008-03-05 23:36 . 2008-03-05 23:36 <REP> d--hs---- C:\WINDOWS\ftpcache
2008-02-26 07:41 . 2007-02-03 19:30 1,507,232 -ra------ C:\WINDOWS\system32\drivers\lvpopflt.sys
2008-02-26 07:41 . 2008-03-26 22:00 0 --a------ C:\WINDOWS\system32\drivers\lvuvc.hs
2008-02-26 07:40 . 2007-02-03 19:32 1,939,360 -ra------ C:\WINDOWS\system32\drivers\lvuvc.sys
2008-02-26 07:40 . 2007-02-03 19:32 527,136 -ra------ C:\WINDOWS\system32\LVUI2RC.dll
2008-02-26 07:40 . 2003-02-21 13:42 348,160 -ra------ C:\WINDOWS\system\msvcr71.dll
2008-02-26 07:40 . 2007-02-03 19:29 264,992 -ra------ C:\WINDOWS\system32\lvcodec2.dll
2008-02-26 07:40 . 2007-02-03 19:32 215,840 -ra------ C:\WINDOWS\system32\LVUI2.dll
2008-02-26 07:40 . 2007-02-03 19:29 129,824 -ra------ C:\WINDOWS\system32\lvci1051.dll
2008-02-26 07:40 . 2007-02-03 17:59 50,127 -ra------ C:\WINDOWS\system32\lvcoinst.ini
2008-02-26 07:40 . 2007-02-03 19:32 41,504 -ra------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-02-26 07:40 . 2007-02-03 19:32 22,560 -ra------ C:\WINDOWS\system32\drivers\lvuvcflt.sys
2008-02-26 07:40 . 2007-02-03 18:01 13,398 -ra------ C:\WINDOWS\system32\Repository.reg
2008-02-26 07:30 . 2008-02-26 07:30 127,034 -r------- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-02-26 07:28 . 2008-02-26 07:30 <REP> d-------- C:\Program Files\Logitech
2008-02-26 07:28 . 2008-02-26 07:40 <REP> d-------- C:\Program Files\Fichiers communs\LogiShrd
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 23:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 11:20 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-03-01 15:34 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-29 19:24 --------- d-----w C:\Documents and Settings\Rudy\Application Data\HPAppData
2008-02-15 19:24 --------- d-----w C:\Documents and Settings\Fred\Application Data\HP
2008-02-13 00:19 --------- d-----w C:\Program Files\Ubi Soft
2008-02-12 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\Ahead
2008-02-12 23:33 --------- d-----w C:\Program Files\Nero
2008-02-12 23:33 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-02-11 19:40 --------- d-----w C:\Documents and Settings\Rudy\Application Data\Grisoft
2008-02-09 21:56 --------- d-----w C:\Documents and Settings\Fred\Application Data\CyberLink
2008-02-08 19:19 --------- d-----w C:\Program Files\QuickTime
2008-02-07 19:18 --------- d-----w C:\Program Files\HP
2008-02-06 23:42 --------- d-----w C:\Documents and Settings\Fred\Application Data\Snapfish
2008-02-06 21:31 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-06 21:31 --------- d-----w C:\Program Files\installations
2008-02-06 21:05 --------- d-----w C:\Documents and Settings\Fred\Application Data\eu
2008-02-06 21:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-02-06 00:14 --------- d-----w C:\Program Files\MSN Messenger
2008-02-05 23:55 --------- d-----w C:\Program Files\CyberLink
2008-02-05 23:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-05 23:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-02-05 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-05 23:52 --------- d-----w C:\Program Files\Microsoft Works
2008-02-05 23:47 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools
2008-02-05 23:40 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 23:37 --------- d-----w C:\Program Files\DaemonTools_WhenUSave_Installer
2008-02-05 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools Pro
2008-02-05 23:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-05 23:14 --------- d-----w C:\Program Files\Roxio
2008-02-05 23:14 --------- d-----w C:\Program Files\Fichiers communs\SureThing Shared
2008-02-05 23:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\WEBREG
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\Fred\Application Data\HPAppData
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\HPSSUPPLY
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-02-05 23:05 --------- d-----w C:\Program Files\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-02-05 22:45 --------- d-----w C:\Program Files\Realtek
2008-02-05 22:10 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-05 22:08 --------- d-----w C:\Program Files\Services en ligne
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"SUPERAntiSpyware"="C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 07:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 06:19 7626752]
"nwiz"="nwiz.exe" [2006-07-12 06:19 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-12 06:19 86016]
"avast!"="C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 01:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 01:13 774168]
"devenv"="C:\WINDOWS\system\smvss.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe" [2007-12-13 19:27 919016]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\installations\logiciels\superantispyware\SASSEH.DLL [2006-12-20 12:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnnlj]
ssqnnlj.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\installations\logiciels\adobe acrobat\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 16:09 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-15 11:02 482760 C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-03-11 21:34 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\installations\\jeux\\halo2\\halo.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\installations\\logiciels\\emule\\emule.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe"=
R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\WINDOWS\system32\drivers\pe3ah4nc.sys [2007-05-18 20:53]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\WINDOWS\system32\drivers\ps6ah4nc.sys [2007-05-18 20:52]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\WINDOWS\system32\pr2ah4nc.exe svc []
S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2003-04-01 10:23]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-14 13:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\Documents
"2008-03-14 19:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\Documents
"2008-03-14 07:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\Documents
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 22:01:16
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-26 22:04:01 - machine was rebooted [Fred]
ComboFix-quarantined-files.txt 2008-03-26 21:03:55
.
2008-03-17 20:11:14 --- E O F ---
merci merci merci !
-
-
bonjour
y aurait-il quelqu'un pour m'aider svp ? -
rebonjour,
désolé voici le rapport !
Logfile of HijackThis v1.99.1
Scan saved at 21:08:29, on 17/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\SoftwareDistribution\Download\8a85dfd65efe3ce79ca8bcef055ca8bd\update\update.exe
Z:\Mes documents\telechargements\utilitaires\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [devenv] C:\WINDOWS\system\smvss.exe /w
O4 - HKLM\..\Run: [80cf49d6] rundll32.exe "C:\WINDOWS\system32\nyekvdgj.dll",b
O4 - HKLM\..\Run: [BM83fc7a4a] Rundll32.exe "C:\WINDOWS\system32\ilnduqwy.dll",s
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
merci !
