Supprimer antispyware 2009
Résolu
Bonjour,
j'ai un virus antispyware 2009 sur mon ordi portable j'ai vista
j'ai fait un scan en mode sans echec avec malwarebites dont voic le rapport
j'ai relancé l'ordi mais il est toujours là
Malwarebytes' Anti-Malware 1.29
Version de la base de données: 1298
Windows 6.0.6001 Service Pack 1
21/10/2008 00:09:16
mbam-log-2008-10-21 (00-08-58).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 121055
Temps écoulé: 17 minute(s), 32 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 6
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qgtfvojuihsncln (Trojan.Shutdowner) -> No action taken.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Malware.Trace) -> No action taken.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Users\delphine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4K78U3FU\setup_100783_6777_[1].exe (Trojan.FakeAlert) -> No action taken.
C:\Users\delphine\AppData\Local\Temp\cbXRjHXn.dll (Trojan.Vundo) -> No action taken.
C:\Users\delphine\AppData\Local\Temp\ljJaXoMe.dll (Trojan.Vundo) -> No action taken.
C:\Users\delphine\AppData\Local\Temp\tmp0001a7a3 (Trojan.Vundo) -> No action taken.
C:\Users\delphine\AppData\Local\Temp\tuvTljHw.dll (Trojan.Vundo) -> No action taken.
C:\Windows\System32\qgtfvojuihsncln.exe (Trojan.Shutdowner) -> No action taken.
je ne sais plus quoi faire merci de m'aider
j'ai un virus antispyware 2009 sur mon ordi portable j'ai vista
j'ai fait un scan en mode sans echec avec malwarebites dont voic le rapport
j'ai relancé l'ordi mais il est toujours là
Malwarebytes' Anti-Malware 1.29
Version de la base de données: 1298
Windows 6.0.6001 Service Pack 1
21/10/2008 00:09:16
mbam-log-2008-10-21 (00-08-58).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 121055
Temps écoulé: 17 minute(s), 32 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 6
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qgtfvojuihsncln (Trojan.Shutdowner) -> No action taken.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Malware.Trace) -> No action taken.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Users\delphine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4K78U3FU\setup_100783_6777_[1].exe (Trojan.FakeAlert) -> No action taken.
C:\Users\delphine\AppData\Local\Temp\cbXRjHXn.dll (Trojan.Vundo) -> No action taken.
C:\Users\delphine\AppData\Local\Temp\ljJaXoMe.dll (Trojan.Vundo) -> No action taken.
C:\Users\delphine\AppData\Local\Temp\tmp0001a7a3 (Trojan.Vundo) -> No action taken.
C:\Users\delphine\AppData\Local\Temp\tuvTljHw.dll (Trojan.Vundo) -> No action taken.
C:\Windows\System32\qgtfvojuihsncln.exe (Trojan.Shutdowner) -> No action taken.
je ne sais plus quoi faire merci de m'aider
Configuration: Windows Vista Internet Explorer 7.0
65 réponses
Résumé de la discussion
Un logiciel considéré comme spyware, antispyware 2009, est détecté sur un portable Windows Vista, et Malwarebytes signale éléments malveillants tels que Trojan.Shutdowner, Trojan.Agent et Trojan.Vundo dans le registre et fichiers temporaires. La meilleure réponse préconise d'exécuter ComboFix en mode sans connexion et en langue française, puis de redémarrer si nécessaire et de partager le rapport affiché pour poursuivre le nettoyage. Le processus recommande de déconnecter le réseau, fermer les applications, puis laisser ComboFix effectuer le scan et générer un fichier de log, après quoi réactiver la protection en temps réel. En pratique, ComboFix peut nécessiter un redémarrage et produit un rapport utile; d'autres outils peuvent être requis si des éléments persistent après le nettoyage et nécessitent une analyse ultérieure.
-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:54:27, on 04.02.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20935)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINDOWS\system32\CTsvcCDA.exe
D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
d:\program files\mcafee.com\agent\mcdetect.exe
d:\PROGRA~1\mcafee.com\vso\mcshield.exe
d:\PROGRA~1\mcafee.com\agent\mctskshd.exe
d:\PROGRA~1\mcafee.com\vso\OasClnt.exe
D:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Program Files\Microsoft LifeCam\MSCamS32.exe
D:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
d:\program files\mcafee.com\vso\mcvsshld.exe
D:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
d:\program files\mcafee.com\agent\mcagent.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\MsPMSPSv.exe
D:\WINDOWS\system32\SearchIndexer.exe
D:\WINDOWS\system32\CTHELPER.EXE
D:\PROGRA~1\Bluewin\QUICKH~1\SMARTB~1\MotiveSB.exe
D:\WINDOWS\vVX6000.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Microsoft IntelliType Pro\type32.exe
D:\Program Files\Microsoft IntelliPoint\point32.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Creative\SBAudigy\TaskBar\CTLTray.exe
D:\Program Files\Creative\SBAudigy\TaskBar\CTLTask.exe
C:\Program Files\Voipwise\Voipwise.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe
d:\progra~1\mcafee.com\vso\mcvsftsn.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Windows Desktop Search\WindowsSearch.exe
D:\Program Files\Bluewin\Quick Help\bin\mpbtn.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe
D:\WINDOWS\system32\SearchProtocolHost.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Ultimate Edition
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - D:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKLM\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKLM\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
O4 - HKLM\..\Run: [Vistadrv] C:\Windows\system32\Vistadrive\vsdrv.exe
O4 - HKLM\..\Run: [Styler] C:\Program Files\styler\Styler.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [Motive SmartBridge] D:\PROGRA~1\Bluewin\QUICKH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [VX6000] D:\WINDOWS\vVX6000.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] D:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "D:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] D:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [LifeCam] "D:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QT Lite\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RecoverFromReboot] D:\WINDOWS\Temp\RecoverFromReboot.exe
O4 - HKLM\..\Run: [type32] "D:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "D:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "D:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] D:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] d:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [OASClnt] D:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE D:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TaskTray] "D:\Program Files\Creative\SBAudigy\TaskBar\CTLTray.exe"
O4 - HKCU\..\Run: [TaskBar] "D:\Program Files\Creative\SBAudigy\TaskBar\CTLTask.exe"
O4 - HKCU\..\Run: [Voipwise] "C:\Program Files\Voipwise\Voipwise.exe" -nosplash -minimized
O4 - HKCU\..\Run: [LightScribe Control Panel] D:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Cognac] D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\27.tmp.exe
O4 - HKCU\..\Run: [MS AntiSpyware 2009] "D:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe" /autorun
O4 - HKUS\S-1-5-19\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
O4 - Global Startup: Quick Help.lnk = D:\Program Files\Bluewin\Quick Help\bin\matcli.exe
O4 - Global Startup: Windows Search.lnk = D:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - d:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - d:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - d:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - D:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - D:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
-
Modérateurmemey ---> Pour la deuxième fois, arrête de t'incruster sur le sujet des autres, fais TON propre sujet :
http://www.commentcamarche.net/forum/forum 7#ecrire -
Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1325
Windows 5.1.2600 Service Pack 2
31/10/2008 14:32:04
mbam-log-2008-10-31 (14-32-04).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 66815
Temps écoulé: 1 hour(s), 12 minute(s), 46 second(s)
Processus mémoire infecté(s): 7
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 33
Valeur(s) du Registre infectée(s): 7
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 12
Fichier(s) infecté(s): 46
Processus mémoire infecté(s):
C:\Documents and Settings\memey\Application Data\Gool\Gool.exe (Trojan.Downloader) -> Unloaded process successfully.
C:\Documents and Settings\memey\Application Data\Microsoft\Windows\vbcfrx.exe (Trojan.Vundo) -> Unloaded process successfully.
C:\Program Files\GetPack\GetPack23.exe (Trojan.Agent) -> Unloaded process successfully.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe (Trojan.Agent) -> Unloaded process successfully.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe (Trojan.Agent) -> Unloaded process successfully.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Documents and Settings\memey\Application Data\SpeedRunner\SpeedRunner.exe (Adware.SurfAccuracy) -> Unloaded process successfully.
Module(s) mémoire infecté(s):
C:\Program Files\Webtools\webtools.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Mjcore\Mjcore.dll (Trojan.BHO) -> Delete on reboot.
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3dd59d19-54db-7854-883f-2ac00226d6bb} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3dd59d19-54db-7854-883f-2ac00226d6bb} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_myjavacore.mjcore (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e0f01490-dcf3-4357-95aa-169a8c2b2190} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{17e44256-51e0-4d46-a0c8-44e80ab4ba5b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d88e1558-7c2d-407a-953a-c044f5607cea} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d88e1558-7c2d-407a-953a-c044f5607cea} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_myjavacore.mjcore.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oincs.oinanalytics (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6b221e01-f517-4959-8c41-81948e7f2f17} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6b221e01-f517-4959-8c41-81948e7f2f17} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oincs.oinanalytics.1 (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{80ef304a-b1c4-425c-8535-95ab6f1eefb8} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{f7fa36a4-3177-4b57-b9c1-e9c5b2e0d3a9} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\oinanalytics (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\icheck (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\OINAnalytics.DLL (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\BHO_MyJavaCore.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\testCPV6.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo (Adware.PurityScan) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe (Security.Hijack) -> Delete on reboot.
Valeur(s) du Registre infectée(s):
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gool (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfkg6wip (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\facegame (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\getpack23 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\speedrunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brastk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brastk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: (C:\WINDOWS\pchealth\Global.exe) Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\Program Files\Outerinfo (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\components (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Webtools (Trojan.Agent) -> Delete on reboot.
C:\Program Files\OINAnalytics (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\GetPack (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\iCheck (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E} (Trojan.Agent) -> Delete on reboot.
C:\Program Files\Mjcore (Trojan.BHO) -> Delete on reboot.
C:\Documents and Settings\memey\Application Data\Facegame (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\memey\Application Data\speedrunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\Documents and Settings\memey\Application Data\Gool (Trojan.Agent) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\WINDOWS\system32\xfolebc.dll (Trojan.BHO.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\memey\Application Data\Gool\Gool.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\Webtools\webtools.dll (Trojan.BHO) -> Delete on reboot.
C:\Documents and Settings\memey\Application Data\Microsoft\Windows\vbcfrx.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\memey\Application Data\Facegame\Facegame.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Mjcore\Mjcore.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\OINAnalytics\OINAnalytics2.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\memey\Application Data\Facegame\Facegame.exe7a0 (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\memey\Local Settings\Temporary Internet Files\Content.IE5\H20UBIU3\148[1].net (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\memey\Local Settings\Temporary Internet Files\Content.IE5\H20UBIU3\155[1].net (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\memey\Local Settings\Temporary Internet Files\Content.IE5\O1234567\157[1].net (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\memey\Local Settings\Temporary Internet Files\Content.IE5\TRMZLM8X\156[1].net (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Program Files\iCheck\iCheck.exe (Adware.ISM) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\components\srff.dll (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{98494775-999E-4B5E-9833-3169EFE5F283}\RP18\A0010717.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{98494775-999E-4B5E-9833-3169EFE5F283}\RP18\A0010851.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\karna.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\karna.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\__41.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\__42.tmp (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\__56.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\Terms.rtf (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\chrome.manifest (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\install.rdf (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\components\FF.dll (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\OINAnalytics\Uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\GetPack\dictame.gz (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\GetPack\GetPack23.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\GetPack\trgtame.gz (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\iCheck\Uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\memey\Application Data\Facegame\Facegame.exek1 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\memey\Application Data\speedrunner\config.cfg (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\Documents and Settings\memey\Application Data\speedrunner\SpeedRunner.exe (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\Documents and Settings\memey\Application Data\speedrunner\SRUninstall.exe (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\beep.sys (Fake.Beep.Sys) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dllcache\beep.sys (Fake.Beep.Sys) -> Quarantined and deleted successfully.
C:\WINDOWS\brastk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\brastk.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\Program Files\Fichiers communs\Yazzle3090OinAdmin.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
C:\Program Files\Fichiers communs\Yazzle3090OinUninstaller.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\__1C.tmp (Trojan.Agent) -> Quarantined and deleted successfully. -
si tu cherches un tuto sur un programme va ici.
http://www.malekal.com/tutorial
les questions il faut mieu se les poser maintenant qu une fois la merde dans l ordi.
1)antivirus :antivir ou avg 8 antivirus
2)pare-feu gratuits:regle un seul pare feu sur un ordi.telecharge un des suivants ensuite deconnecte toi.
puis desactive le pare feu windows(aller dans le centre de securite puis pare feu windows et la desactive le)
puis installe celui de ton choix.
je te conseille un des 2(en anglais mais simple avec le tuto qui est donne)
Comodo pro Firewall
http://www.commentcamarche.net/telecharger/telecharger 34055041 comodo firewall pro
Tuto pour la 3.0
https://infomars.fr/forum/index.php?showtopic=1225
ou
OnlineArmor :
téléchargement:https://www.commentcamarche.net/telecharger/ 34055356 online armor personal firewall
tutoriels:https://forum.pcastuces.com/sujet.asp?f=25&s=35606
:http://www.malekal.com/tutorial_Online_Armor.ph
il y en a d autres mais d apres les test de matousec en gratuit il n y en a pas bcp d autre.
http://www.matousec.com/index.html
3)ensuite désinstal java car pas a jours et telecharge et instal cette version :
https://www.java.com/fr/download/manual.jsp
ensuite si c est la version gratuite désinstal adobe reader car pas a jours et telecharge et instal cette version :
https://get2.adobe.com/reader/otherversions/
4)passe a mozilla 3 au lieu d internet explorer car c est bien plus sur.
http://www.commentcamarche.net/telecharger/telecharger 111 firefox -
alors si je comprends bien je dois mettre à jour java et adobe puis installer mozilla
quel pare feu installer ?
dois je virer mcafee?
si oui du coup quel antivirus ?
desolépour ces questions mais je suis novice -
Modérateur"pas de vrai pare feu"
---> La plupart des gens ne savent pas s'en servir. Soit ils acceptent tout parce que ça les saoule, soit ils bloquent Internet sans faire exprès car le fichier à qui ils ont bloqué la connexion a un nom bizarre.
McAfee n'est pas super en effet mais tu lui proposerais quoi ? -
pas de vrai pare feu, mc afee c est un peu entre avast et norton tout de meme mais bon.
adobe et java pas a jour.
changement: d internet explorer passer a mozilla ou autres.
ce serait tout de meme bien mieux et pas du tout superflu. -
ModérateurPour moi, non.
Des questions ? -
j'ai suivi toute la procedure indiquée y compris le point de restau
y a t il autre chose? -
ModérateurPour finir :
---> Réactive l'UAC.
---> Désinstalle HijackThis.
---> Supprime ComboFix et les dossiers ComboFix et Qoobox situés dans C:\
---> Supprime OTMoveIt3, SmitFraudFix et le dossier _OTMoveIt situé dans C:\
---> Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
https://www.ccleaner.com/ccleaner/download
---> Lance-le. Va dans "Options" puis "Avancé", tu décoches la case "Effacer uniquement les fichiers etc...". Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage. Puis tu vas dans "Registre", tu fais "Chercher des erreurs". Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.
---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger :
http://www.commentcamarche.net/faq/sujet 13214 desactiver reactiver la restauration systeme de vista
---> Je te conseille de créer un point de restauration que tu pourras utiliser plus tard si tu as un problème :
https://forums.cnetfrance.fr -
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:00:38, on 21/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Windows\System32\p2phost.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Dell Support Center\gs_agent\dsc.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6080828
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
-
Modérateur---> Poste un nouveau rapport HijackThis.
-
as tu un conseil pour la protection de l'ordi ?
-
tout est bon et j'ai redemarrer l'ordi en réactivant l'antivirus et tout est redevenu normal
pas de traces d'antispyware
10000 mercis sincèrement -
Modérateur"que dois je installer pour ne pas me refaire envahir par ces malware et éviter de te donner du boulot"
---> Tu me poseras des questions à la fin si tu veux.
Essaie de changer de fond d'écran. -
oui oui je crois que c'est ok sauf que mon écran d'accueil est noir
que dois je installer pour ne pas me refaire envahir par ces malware et éviter de te donner du boulot -
ModérateurNormalement, j'ai viré ton rogue. Confirme-le moi.
-
ComboFix 08-10-19.04 - delphine 2008-10-21 19:15:18.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1936 [GMT 2:00]
Lancé depuis: C:\Users\delphine\Downloads\ComboFix.exe
Commutateurs utilisés :: C:\Users\delphine\Desktop\CFScript.txt
* Un nouveau point de restauration a été créé
FILE ::
C:\Windows\System32\404Fix.exe
C:\Windows\System32\AntiXPVSTFix.exe
C:\Windows\System32\dumphive.exe
C:\Windows\System32\IEDFix.C.exe
C:\Windows\System32\IEDFix.exe
C:\Windows\System32\o4Patch.exe
C:\Windows\System32\Process.exe
C:\Windows\System32\SrchSTS.exe
C:\Windows\System32\tmp.reg
C:\Windows\System32\VACFix.exe
C:\Windows\System32\VCCLSID.exe
C:\Windows\System32\WS2Fix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\_OTMoveIt
C:\_OTMoveIt\MovedFiles\10212008_031022.log
C:\_OTMoveIt\MovedFiles\10212008_031022.res
C:\_OTMoveIt\MovedFiles\10212008_031022\Users\delphine\AppData\Local\Temp\~DF9C97.tmp
C:\_OTMoveIt\MovedFiles\10212008_031022\Windows\temp\sqlite_G7hNAo3fHyDZaNI
C:\_OTMoveIt\MovedFiles\10212008_031022\Windows\temp\sqlite_QNR16dsmcVG92zG
C:\ProgramData\Solt Lake Software
C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\LOG\20081020215602792.log
C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\LOG\20081020233011367.log
C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\LOG\20081021001255915.log
C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\LOG\20081021024410540.log
C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\LOG\20081021031309875.log
C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\LOG\20081021095137078.log
C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\LOG\20081021100049875.log
C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\LOG\20081021103713804.log
C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\LOG\20081021171558194.log
C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\LOG\20081021171921739.log
C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\LOG\20081021173214415.log
C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\proas2009.exe
C:\Users\All Users\Solt Lake Software\Pro Antispyware 2009\LOG\20081020215602792.log
C:\Users\All Users\Solt Lake Software\Pro Antispyware 2009\LOG\20081020233011367.log
C:\Users\All Users\Solt Lake Software\Pro Antispyware 2009\LOG\20081021001255915.log
C:\Users\All Users\Solt Lake Software\Pro Antispyware 2009\LOG\20081021024410540.log
C:\Users\All Users\Solt Lake Software\Pro Antispyware 2009\LOG\20081021031309875.log
C:\Users\All Users\Solt Lake Software\Pro Antispyware 2009\LOG\20081021095137078.log
C:\Users\All Users\Solt Lake Software\Pro Antispyware 2009\LOG\20081021100049875.log
C:\Users\All Users\Solt Lake Software\Pro Antispyware 2009\LOG\20081021103713804.log
C:\Users\All Users\Solt Lake Software\Pro Antispyware 2009\LOG\20081021171558194.log
C:\Users\All Users\Solt Lake Software\Pro Antispyware 2009\LOG\20081021171921739.log
C:\Users\All Users\Solt Lake Software\Pro Antispyware 2009\LOG\20081021173214415.log
C:\Users\All Users\Solt Lake Software\Pro Antispyware 2009\proas2009.exe
C:\Windows\System32\404Fix.exe
C:\Windows\System32\AntiXPVSTFix.exe
C:\Windows\System32\dumphive.exe
C:\Windows\System32\IEDFix.C.exe
C:\Windows\System32\o4Patch.exe
C:\Windows\System32\SrchSTS.exe
C:\Windows\System32\tmp.reg
C:\Windows\System32\VACFix.exe
C:\Windows\System32\VCCLSID.exe
C:\Windows\System32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-21 au 2008-10-21 ))))))))))))))))))))))))))))))))))))
.
2008-10-21 17:35 . 2008-10-21 18:30 <REP> d-------- C:\Program Files\a-squared Free
2008-10-21 13:05 . 2008-10-21 13:05 <REP> d-------- C:\Program Files\CCleaner
2008-10-21 00:32 . 2008-10-21 00:32 <REP> d-------- C:\Program Files\Trend Micro
2008-10-20 23:45 . 2008-10-20 23:45 <REP> d-------- C:\Users\delphine\AppData\Roaming\Malwarebytes
2008-10-20 23:45 . 2008-10-20 23:45 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-10-20 23:45 . 2008-10-20 23:45 <REP> d-------- C:\ProgramData\Malwarebytes
2008-10-20 23:45 . 2008-10-20 23:45 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-20 23:45 . 2008-10-16 20:25 38,496 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-10-20 23:45 . 2008-10-16 20:25 15,504 --a------ C:\Windows\System32\drivers\mbam.sys
2008-10-20 23:03 . 2008-10-21 09:58 <REP> d-------- C:\Users\delphine\AppData\Roaming\SUPERAntiSpyware.com
2008-10-20 23:03 . 2008-10-20 23:03 <REP> d-------- C:\Users\All Users\SUPERAntiSpyware.com
2008-10-20 23:03 . 2008-10-20 23:03 <REP> d-------- C:\ProgramData\SUPERAntiSpyware.com
2008-10-20 23:03 . 2008-10-21 09:58 <REP> d-------- C:\Program Files\SUPERAntiSpyware
2008-10-20 22:51 . 2008-10-20 22:51 <REP> d-------- C:\Program Files\Enigma Software Group
2008-10-20 22:26 . 2008-10-21 00:09 <REP> d-------- C:\Users\delphine\doc delph
2008-10-20 21:59 . 2008-10-20 21:59 <REP> d-------- C:\Users\delphine\AppData\Roaming\Nero
2008-10-20 21:58 . 2008-10-20 21:58 <REP> d-------- C:\Program Files\Nero Express 9
2008-10-20 12:29 . 2008-10-20 12:29 <REP> d-------- C:\Program Files\DAEMON Tools Lite
2008-10-20 12:25 . 2008-10-20 12:25 <REP> d-------- C:\Users\delphine\AppData\Roaming\DAEMON Tools
2008-10-20 12:25 . 2008-10-20 12:25 717,296 --a------ C:\Windows\System32\drivers\sptd.sys
2008-10-20 12:24 . 2008-10-20 12:24 97,008 --a------ C:\Program Files\daemon4301-lite.exe
2008-10-20 12:22 . 2008-10-20 12:22 376 --a------ C:\Windows\ODBC.INI
2008-10-20 11:45 . 2008-10-20 11:45 <REP> d-------- C:\Users\delphine\AppData\Roaming\zweitgeist
2008-10-20 10:39 . 2008-10-20 10:39 <REP> d-------- C:\Program Files\Common Files\Adobe
2008-10-20 10:37 . 2008-10-20 10:37 27,620 --a------ C:\Users\delphine\AppData\Roaming\nvModes.dat
2008-10-20 09:44 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-10-20 09:44 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
2008-10-20 09:44 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
2008-10-20 09:42 . 2008-08-05 11:49 428,544 --a------ C:\Windows\System32\EncDec.dll
2008-10-20 09:42 . 2008-08-05 11:49 293,376 --a------ C:\Windows\System32\psisdecd.dll
2008-10-20 09:42 . 2008-08-05 11:48 217,088 --a------ C:\Windows\System32\psisrndr.ax
2008-10-20 09:42 . 2008-08-05 11:48 177,664 --a------ C:\Windows\System32\mpg2splt.ax
2008-10-20 09:42 . 2008-08-05 11:48 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-10-19 23:38 . 2008-10-21 18:50 <REP> d-------- C:\Program Files\Webteh
2008-10-19 23:19 . 2008-10-19 23:19 <REP> d-------- C:\Users\delphine\AppData\Roaming\DivX
2008-10-19 23:13 . 2008-10-19 23:13 <REP> d-------- C:\Program Files\DivX
2008-10-19 23:13 . 2008-10-19 23:13 <REP> d-------- C:\Program Files\Common Files\PX Storage Engine
2008-10-19 16:00 . 2008-10-19 16:00 <REP> d-------- C:\Users\delphine\AppData\Roaming\Media Player Classic
2008-10-19 13:27 . 2008-10-20 23:26 <REP> d-------- C:\Users\delphine\AppData\Roaming\uTorrent
2008-10-19 13:27 . 2008-10-19 13:27 <REP> d-------- C:\Program Files\uTorrent
2008-10-19 13:19 . 2008-10-19 13:19 <REP> d-------- C:\Users\delphine\AppData\Roaming\vlc
2008-10-19 13:19 . 2008-10-19 13:19 <REP> d-------- C:\Program Files\VideoLAN
2008-10-19 13:18 . 2008-10-19 13:18 14,566,424 --a------ C:\Program Files\vlc-0.9.4-win32.exe
2008-10-19 13:12 . 2008-10-20 09:41 <REP> d-------- C:\Users\delphine\AppData\Roaming\skypePM
2008-10-19 13:12 . 2008-10-19 13:12 56 --ah----- C:\Users\All Users\ezsidmv.dat
2008-10-19 13:12 . 2008-10-19 13:12 56 --ah----- C:\ProgramData\ezsidmv.dat
2008-10-19 13:10 . 2008-10-20 11:37 <REP> d-------- C:\Users\delphine\AppData\Roaming\Skype
2008-10-19 13:09 . 2008-10-19 13:09 <REP> d-------- C:\Users\All Users\Skype
2008-10-19 13:09 . 2008-10-19 13:09 <REP> d-------- C:\ProgramData\Skype
2008-10-19 13:09 . 2008-10-19 13:09 <REP> d-------- C:\Program Files\Skype
2008-10-19 13:09 . 2008-10-19 13:09 <REP> d-------- C:\Program Files\Common Files\Skype
2008-10-19 13:03 . 2008-10-19 13:03 <REP> d-------- C:\Users\delphine\AppData\Roaming\CyberLink
2008-10-18 10:04 . 2008-10-18 10:04 <REP> d-------- C:\Users\delphine\AppData\Roaming\Template
2008-10-18 10:03 . 2008-10-20 11:52 240 --a------ C:\Users\delphine\AppData\Roaming\wklnhst.dat
2008-10-17 22:44 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-10-17 21:46 . 2008-10-17 21:46 <REP> d-------- C:\Windows\PCHEALTH
2008-10-17 21:41 . 2008-10-17 21:41 <REP> d-------- C:\Users\All Users\WLInstaller
2008-10-17 21:41 . 2008-10-17 21:41 <REP> d-------- C:\ProgramData\WLInstaller
2008-10-17 21:41 . 2008-10-17 21:47 <REP> d-------- C:\Program Files\Windows Live
2008-10-17 21:41 . 2008-10-17 21:46 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-10-17 21:21 . 2008-10-17 21:21 <REP> d-------- C:\Program Files\Combined Community Codec Pack
2008-10-17 21:21 . 2008-10-17 21:21 6,833,525 --a------ C:\Program Files\combined-community-codec-pack_combined_community_codec_pack_2008-09-21_anglais_26882.exe
2008-10-17 14:23 . 2008-09-18 07:09 3,601,464 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-10-17 14:23 . 2008-09-18 07:09 3,549,240 --a------ C:\Windows\System32\ntoskrnl.exe
2008-10-17 14:23 . 2008-05-08 23:59 430,080 --a------ C:\Windows\System32\vbscript.dll
2008-10-17 14:23 . 2008-05-08 23:59 180,224 --a------ C:\Windows\System32\scrobj.dll
2008-10-17 14:23 . 2008-05-08 23:59 172,032 --a------ C:\Windows\System32\scrrun.dll
2008-10-17 14:23 . 2008-05-08 23:59 155,648 --a------ C:\Windows\System32\wscript.exe
2008-10-17 14:23 . 2008-05-08 23:58 135,168 --a------ C:\Windows\System32\wshom.ocx
2008-10-17 14:23 . 2008-05-08 23:58 135,168 --a------ C:\Windows\System32\cscript.exe
2008-10-17 14:23 . 2008-05-08 23:59 90,112 --a------ C:\Windows\System32\wshext.dll
2008-10-16 21:00 . 2008-10-16 21:00 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-10-15 20:23 . 2008-10-15 20:23 <REP> d-------- C:\Users\delphine\AppData\Roaming\PeerNetworking
2008-10-15 18:59 . 2008-10-15 18:59 <REP> dr------- C:\Users\delphine\Searches
2008-10-15 18:59 . 2008-10-18 09:58 <REP> dr------- C:\Users\delphine\Contacts
2008-10-15 18:59 . 2008-10-15 18:59 720,896 --a------ C:\Windows\IMAPIShellExt.dll
2008-10-15 18:59 . 2008-10-15 18:59 81,920 --a------ C:\Windows\BurnImage.exe
2008-10-15 18:58 . 2008-10-20 11:38 <REP> dr------- C:\Users\delphine\Videos
2008-10-15 18:58 . 2008-10-16 23:08 <REP> dr------- C:\Users\delphine\Pictures
2008-10-15 18:58 . 2008-10-18 10:08 <REP> dr------- C:\Users\delphine\Music
2008-10-15 18:58 . 2008-10-21 17:34 <REP> dr------- C:\Users\delphine\Downloads
2008-10-15 18:58 . 2008-10-21 19:09 <REP> dr------- C:\Users\delphine\Documents
2008-10-15 18:58 . 2006-11-02 14:37 <REP> d-------- C:\Users\delphine\AppData\Roaming\Media Center Programs
2008-10-15 18:58 . 2008-10-15 18:58 <REP> d-------- C:\Users\delphine\AppData\Roaming\Dell
2008-10-15 18:58 . 2008-10-15 18:58 <REP> d--h----- C:\Users\delphine\AppData
2008-10-15 18:58 . 2008-10-20 22:26 <REP> d-------- C:\Users\delphine
2008-10-15 18:55 . 2008-10-15 18:55 <REP> dr------- C:\Windows\System32\config\systemprofile\Contacts
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-20 21:28 --------- d-----w C:\Program Files\McAfee
2008-10-20 10:17 70,123,020 ----a-w C:\Program Files\Nero Express 9.rar
2008-10-19 11:04 --------- d-----w C:\ProgramData\CyberLink
2008-10-18 07:42 --------- d-----w C:\Program Files\Windows Mail
2008-10-17 12:21 --------- d-----w C:\Program Files\Google
2008-10-15 18:47 --------- d-----w C:\ProgramData\Dell
2008-10-15 16:55 --------- d-sh--w C:\ProgramData\Modèles
2008-10-15 16:55 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-10-15 16:55 --------- d-sh--w C:\ProgramData\Favoris
2008-10-15 16:55 --------- d-sh--w C:\ProgramData\Documents
2008-10-15 16:55 --------- d-sh--w C:\ProgramData\Bureau
2008-10-15 16:55 --------- d-sh--w C:\ProgramData\Application Data
2008-10-15 16:55 --------- d-sh--w C:\Program Files\Fichiers communs
2008-10-02 03:49 827,392 ----a-w C:\Windows\System32\wininet.dll
2008-09-18 02:16 2,032,640 ----a-w C:\Windows\System32\win32k.sys
2008-09-16 00:14 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-09-16 00:14 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-09-16 00:12 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-09-16 00:12 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-09-16 00:12 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-09-16 00:12 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-09-16 00:12 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-09-16 00:12 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-09-16 00:12 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-09-16 00:12 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-09-16 00:12 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-09-16 00:12 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-09-16 00:11 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2008-09-16 00:11 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2008-09-16 00:11 815,104 ----a-w C:\Windows\System32\divx_xx0a.dll
2008-09-16 00:11 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2008-09-16 00:11 683,520 ----a-w C:\Windows\System32\DivX.dll
2008-09-16 00:11 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-09-16 00:11 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-08-28 23:31 --------- d-----w C:\Program Files\DellTPad
2008-08-28 23:30 8,704 ----a-w C:\Windows\System32\hccoin.dll
2008-08-28 23:30 73,216 ----a-w C:\Windows\system32\drivers\usbccgp.sys
2008-08-28 23:30 5,888 ----a-w C:\Windows\system32\drivers\usbd.sys
2008-08-28 23:30 39,424 ----a-w C:\Windows\system32\drivers\usbehci.sys
2008-08-28 23:30 26,112 ----a-w C:\Windows\System32\hidserv.dll
2008-08-28 23:30 23,552 ----a-w C:\Windows\system32\drivers\usbuhci.sys
2008-08-28 23:30 226,304 ----a-w C:\Windows\system32\drivers\usbport.sys
2008-08-28 23:30 22,016 ----a-w C:\Windows\System32\hid.dll
2008-08-28 23:30 194,560 ----a-w C:\Windows\system32\drivers\usbhub.sys
2008-08-28 23:30 15,872 ----a-w C:\Windows\System32\hcrstco.dll
2008-08-28 23:28 295,936 ----a-w C:\Windows\System32\gdi32.dll
2008-08-28 23:26 28,728 ------w C:\Windows\system32\drivers\msahci.sys
2008-08-28 23:26 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-08-28 23:26 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-08-28 23:22 5,236 ----a-w C:\Windows\system32\drivers\1028_Dell_INS_I1720.mrk
2008-08-28 15:36 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_Apfiltr_01005.Wdf
2008-08-28 15:36 --------- d-----w C:\Program Files\Sigmatel
2008-08-28 15:36 --------- d-----w C:\Program Files\CONEXANT
2008-08-28 14:10 --------- d-----w C:\Program Files\Dell
2008-08-28 14:05 --------- d-----w C:\ProgramData\McAfee
2008-08-28 14:05 --------- d-----w C:\Program Files\Citrix
2008-08-28 14:04 --------- d-----w C:\Program Files\McAfee.com
2008-08-28 14:04 --------- d-----w C:\Program Files\Common Files\McAfee
2008-08-28 14:03 --------- d-----w C:\Program Files\Microsoft Works
2008-08-28 14:01 --------- d-----w C:\Program Files\CyberLink
2008-08-28 14:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-28 14:00 --------- d-----w C:\ProgramData\SupportSoft
2008-08-28 14:00 --------- d-----w C:\Program Files\Dell Support Center
2008-08-28 14:00 --------- d-----w C:\Program Files\Common Files\supportsoft
2008-08-28 13:58 --------- d-----w C:\Program Files\Cisco
2008-08-28 13:57 --------- d-----w C:\Program Files\Creative
2008-08-28 13:56 --------- d-----w C:\Program Files\Creative Live! Cam
2008-08-28 13:56 --------- d-----w C:\Program Files\Common Files\Reallusion
2008-08-28 13:56 --------- d-----w C:\Program Files\Common Files\Creative
2008-08-28 13:55 --------- d-----w C:\Program Files\NetWaiting
2008-08-28 13:55 --------- d-----w C:\Program Files\Digital Line Detect
2008-08-28 13:55 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-28 13:55 --------- d-----w C:\Program Files\Broadcom
2008-08-28 13:54 --------- d-----w C:\Program Files\Modem Diagnostic Tool
2008-08-28 13:49 --------- d-----w C:\Program Files\Java
2008-08-28 13:48 --------- d-----w C:\Program Files\Common Files\Java
2008-08-27 01:06 288,768 ----a-w C:\Windows\system32\drivers\srv.sys
2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:32 28,160 ----a-w C:\Windows\System32\Apphlpdm.dll
2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-07-31 01:13 4,240,384 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\Users\delphine\AppData\Roaming\zweitgeist ----
2008-10-20 11:45 374 --a------ C:\Users\delphine\AppData\Roaming\zweitgeist\Install.log
2008-10-20 11:45 24 --a------ C:\Users\delphine\AppData\Roaming\zweitgeist\Hash.txt
---- Directory of C:\Users\delphine\doc delph ----
2008-10-21 00:09 1830 --a------ C:\Users\delphine\doc delph\mbam-log-2008-10-21 (00-08-58).txt
((((((((((((((((((((((((((((( snapshot_2008-10-21_11.11.37.25 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-10-21 08:38:16 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-10-21 17:21:26 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-10-21 17:21:26 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-10-21 08:37:40 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-10-21 17:21:26 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-10-21 17:21:26 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-10-21 08:36:56 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-10-21 17:21:32 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-10-21 08:36:56 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-10-21 17:21:32 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-10-21 08:36:56 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-10-21 17:21:32 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-10-21 08:42:06 101,250 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-10-21 15:39:10 101,250 ----a-w C:\Windows\System32\perfc009.dat
- 2008-10-21 08:42:07 123,556 ----a-w C:\Windows\System32\perfc00C.dat
+ 2008-10-21 15:39:10 123,556 ----a-w C:\Windows\System32\perfc00C.dat
- 2008-10-21 08:42:07 587,178 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-10-21 15:39:10 587,178 ----a-w C:\Windows\System32\perfh009.dat
- 2008-10-21 08:42:07 669,566 ----a-w C:\Windows\System32\perfh00C.dat
+ 2008-10-21 15:39:10 669,566 ----a-w C:\Windows\System32\perfh00C.dat
- 2008-10-21 08:38:36 3,778 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1595350923-1692993811-4134033364-1000_UserData.bin
+ 2008-10-21 15:33:59 4,352 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1595350923-1692993811-4134033364-1000_UserData.bin
- 2008-10-21 08:38:36 67,720 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-10-21 15:33:58 68,266 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-10-21 08:38:35 37,636 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-10-21 15:33:57 38,400 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-10-21 09:02:06 207,124 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2008-10-21 14:46:18 209,524 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2008-10-21 08:15:11 207,622 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2008-10-21 16:56:08 210,902 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin
.
-- Instantané actualisé --
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CollaborationHost"="C:\Windows\system32\p2phost.exe" [2008-01-21 192000]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2008-03-11 202544]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-28 68856]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter"="C:\Dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"Apoint"="C:\Program Files\DellTPad\Apoint.exe" [2007-09-24 159744]
"OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [2007-12-03 36864]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-06-25 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-06-25 8433664]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-06-25 81920]
"NVHotkey"="C:\Windows\system32\nvHotkey.dll" [2007-06-25 67584]
"Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2008-05-16 3444736]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-28 29744]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
C:\Users\delphine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - C:\Program Files\Dell\DellDock\DellDock.exe [2008-05-13 1058088]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-08-28 50688]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-28 16:05 10536 C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{C5CC3EB9-96E8-4DD2-8EF8-E611BF7C55C2}"= C:\Program Files\Dell\MediaDirect\MediaDirect.exe:Dell MediaDirect
"{558ABC44-8A8D-4CD5-A037-E5682B9CCAD7}"= C:\Program Files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program
"{E019647E-E993-45C9-ADF7-E7249D2226D2}"= C:\Program Files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{CA0EC34A-36DC-4945-8D9D-36B678656747}"= C:\Program Files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{BF5C1C7F-593A-4C35-BF0A-D264CAF98E5C}"= Profile=Private|Profile=Public|C:\Program Files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{868F8139-383F-4228-9B1F-78E5438A3E62}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{8A2FDE48-C05B-4FA6-A923-B15EAB949EAE}"= C:\Program Files\Skype\Phone\Skype.exe:Skype
"{0DAF4E77-6888-453B-867F-6B0028780214}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{2001F324-6000-49A0-B244-BD0AADE598FA}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R2 AESTFilters;Andrea ST Filters Service;C:\Windows\system32\aestsrv.exe [2008-01-02 73728]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
R3 OEM02Dev;Creative Camera OEM002 Driver;C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-12-03 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-12-03 7424]
S3 GoToAssist;GoToAssist;C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe Start=service [ ]
S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
.
Contenu du dossier 'Tâches planifiées'
2008-08-28 C:\Windows\Tasks\McDefragTask.job
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
2008-08-28 C:\Windows\Tasks\McQcTask.job
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-Pro Antispyware 2009 - C:\ProgramData\Solt Lake Software\Pro Antispyware 2009\proas2009.exe
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-21 19:21:38
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\wlanext.exe
C:\Windows\System32\BCMWLTRY.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\hidfind.exe
C:\Program Files\DellTPad\ApntEx.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\McAfee\MSK\msksrver.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Windows\System32\stacsv.exe
C:\Windows\System32\drivers\XAudio.exe
C:\Program Files\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\McAfee\VirusScan\mcsysmon.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\System32\dllhost.exe
.
**************************************************************************
.
Heure de fin: 2008-10-21 19:25:14 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-10-21 17:25:08
ComboFix2.txt 2008-10-21 09:12:55
ComboFix3.txt 2008-10-21 08:30:45
Avant-CF: 98 325 110 784 octets libres
Après-CF: 97,910,439,936 octets libres
403 --- E O F --- 2008-10-20 07:49:14 -
ModérateurQuand tu cliques sur le logo Vista, tu as une barre Rechercher. Tape Exécuter et presse Entrée.
-
merci d'être là de nouveau
j'ai un soucis très bête : il est où executer avec vista
- 1
- 2
- 3
- 4
Suivant
