Win32:Adware-gen [Adw]
Bonjour,
je suis infecté par le virus Win32:Adware-gen [Adw]
apres la lecture d'autres sujet similaire, je ne voie toujours pas comment résoudre ce probleme....
j'ai pu contater qu'il fallais faire un scan avec HijackThis que j'ai fait (Cf rapport ci dessous) et je voudrais savoir comment faire pour supprimer ce maudit virus! merci d'avance
Logfile of HijackThis v1.99.1
Scan saved at 18:00:10, on 16/12/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16764)
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\ATK0100\HControl.exe
C:\Windows\System32\mobsync.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ATK0100\ATKOSD.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\explorer.exe
C:\Program Files\BitComet\BitComet.exe
C:\Users\Xx......mAx......xX\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\Windows\system32\iifefEwU.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {CEA3DF87-6823-4835-A37D-74D276EB2BEA} - C:\Windows\system32\pmnoMdab.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [HControl] C:\Windows\ATK0100\HControl.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [b014d537] rundll32.exe "C:\Windows\system32\kkvynkgy.dll",b
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\iifefEwU.dll,#1
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
je suis infecté par le virus Win32:Adware-gen [Adw]
apres la lecture d'autres sujet similaire, je ne voie toujours pas comment résoudre ce probleme....
j'ai pu contater qu'il fallais faire un scan avec HijackThis que j'ai fait (Cf rapport ci dessous) et je voudrais savoir comment faire pour supprimer ce maudit virus! merci d'avance
Logfile of HijackThis v1.99.1
Scan saved at 18:00:10, on 16/12/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16764)
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\ATK0100\HControl.exe
C:\Windows\System32\mobsync.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ATK0100\ATKOSD.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\explorer.exe
C:\Program Files\BitComet\BitComet.exe
C:\Users\Xx......mAx......xX\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\Windows\system32\iifefEwU.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {CEA3DF87-6823-4835-A37D-74D276EB2BEA} - C:\Windows\system32\pmnoMdab.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [HControl] C:\Windows\ATK0100\HControl.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [b014d537] rundll32.exe "C:\Windows\system32\kkvynkgy.dll",b
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\iifefEwU.dll,#1
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
Configuration: Windows Vista Internet Explorer 7.0
35 réponses
Résumé de la discussion
Win32:Adware-gen [Adw] est au cœur d'un fil où un utilisateur cherche comment supprimer ce malware après un diagnostic HijackThis et des modifications de pages et paramètres réseau. Des réponses indiquent ComboFix comme procédure clé, avec création d'un point de restauration et suppression de fichiers et entrées suspects dans des dossiers système et le registre. Le rapport détaille des éléments problématiques tels que des BHO, des extensions de navigateur et des programmes qui se lancent au démarrage, justifiant une suppression guidée. Pour aller plus loin, des traces de sites potentiellement infectés et des fichiers système créés récemment soulignent la nécessité d'analyser le log et d’adopter une approche sécurisée.
-
bon voila j'ai fais le test combofix... kevin05 lache l'affaire, vous disputez pas pr rien, ca fera pas avancer les choses: j'suis sur que t'es plein de ne volonté mais je vais écouter boulepate62.....
ComboFix 08-12-15.08 - Xx......mAx......xX 2008-12-16 20:25:59.1 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6000.0.1252.1.1036.18.1919.1070 [GMT 1:00]
Lancé depuis: c:\downloads\ComboFix.exe
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\progra~2\Microsoft\Network\Downloader\qmgr0.dat
c:\progra~2\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\awtqqpOE.dll
c:\windows\system32\badMonmp.ini
c:\windows\system32\badMonmp.ini2
c:\windows\system32\byXPGYSI.dll
c:\windows\system32\CLUDLkkj.ini
c:\windows\system32\CLUDLkkj.ini2
c:\windows\system32\fcccbaAT.dll
c:\windows\system32\fccccDtq.dll
c:\windows\system32\ffflgmjl.ini
c:\windows\system32\geBrsSJa.dll
c:\windows\system32\geBuUlKE.dll
c:\windows\system32\hgGwUkJD.dll
c:\windows\system32\jkkLDULC.dll
c:\windows\system32\mlJDvUkH.dll
c:\windows\system32\pmnmmJaX.dll
c:\windows\system32\pmnmnKDS.dll
c:\windows\system32\pmnnKETk.dll
c:\windows\system32\pmnoMdab.dll
c:\windows\system32\qngqodig.ini
c:\windows\system32\qoMdEVnN.dll
c:\windows\system32\qoMgddAR.dll
c:\windows\system32\rqRHyaYS.dll
c:\windows\system32\rqRLcYPJ.dll
c:\windows\system32\ssqNDuUM.dll
c:\windows\system32\ssqPgGWQ.dll
c:\windows\system32\tuvUMeFx.dll
c:\windows\system32\wvUkKdec.dll
c:\windows\system32\xxyxWOhF.dll
c:\windows\system32\ygknyvkk.ini
----- BITS: Il y a peut-être des sites infectés -----
hxxp://childhe.com
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-16 au 2008-12-16 ))))))))))))))))))))))))))))))))))))
.
2008-12-16 20:20 . 2008-12-16 20:21 <REP> d-------- C:\ToolBar SD
2008-12-15 21:42 . 51,792 c:\windows\System32\drivers\SET24FE.tmp
2008-12-15 21:42 . 2008-11-26 18:17 51,792 --a------ c:\windows\System32\drivers\aswMonFlt.sys
2008-12-15 17:56 . 2008-12-15 17:56 <REP> d----c--- c:\windows\System32\DRVSTORE
2008-12-15 17:56 . 2008-04-17 13:12 107,368 --a------ c:\windows\System32\GEARAspi.dll
2008-12-15 17:56 . 2008-04-17 13:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys
2008-12-15 17:55 . 2008-12-15 17:56 <REP> d-------- c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-15 17:55 . 2008-12-15 17:56 <REP> d-------- c:\program files\iTunes
2008-12-15 17:55 . 2008-12-15 17:55 <REP> d-------- c:\program files\iPod
2008-12-15 17:55 . 2008-12-15 17:55 <REP> d-------- c:\program files\Bonjour
2008-12-15 17:55 . 2008-12-15 17:56 <REP> d-------- c:\progra~2\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-15 17:53 . 2008-12-15 17:55 <REP> d-------- c:\users\All Users\Apple Computer
2008-12-15 17:53 . 2008-12-15 17:54 <REP> d-------- c:\program files\QuickTime
2008-12-15 17:53 . 2008-12-15 17:55 <REP> d-------- c:\progra~2\Apple Computer
2008-12-15 17:52 . 2008-12-15 17:52 <REP> d-------- c:\program files\Apple Software Update
2008-12-15 17:50 . 2008-12-15 17:55 <REP> d-------- c:\program files\Common Files\Apple
2008-12-14 13:05 . 2008-12-15 19:00 1,025 --a------ C:\noi.MSNFix
2008-12-13 20:48 . 2008-12-13 01:16 52,786 --a------ c:\windows\fxstaller.MSNFix
2008-12-12 03:03 . 2008-10-22 00:31 2,048 --a------ c:\windows\System32\tzres.dll
2008-12-11 03:08 . 2008-11-01 00:38 4,247,552 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
2008-12-11 03:08 . 2008-11-01 04:33 1,687,040 --a------ c:\windows\System32\gameux.dll
2008-12-11 03:08 . 2008-10-21 06:16 297,472 --a------ c:\windows\System32\gdi32.dll
2008-12-11 03:08 . 2008-11-01 04:33 28,672 --a------ c:\windows\System32\Apphlpdm.dll
2008-12-11 03:07 . 2008-10-29 07:20 2,923,520 --a------ c:\windows\explorer.exe
2008-12-11 03:06 . 2008-06-23 02:52 2,855,424 --a------ c:\windows\System32\mf.dll
2008-12-11 03:06 . 2008-06-23 02:52 996,352 --a------ c:\windows\System32\WMNetMgr.dll
2008-12-11 03:06 . 2008-06-23 02:52 98,816 --a------ c:\windows\System32\mfps.dll
2008-12-11 03:06 . 2008-06-23 02:52 94,720 --a------ c:\windows\System32\logagent.exe
2008-12-11 03:06 . 2008-06-23 02:52 52,736 --a------ c:\windows\System32\rrinstaller.exe
2008-12-11 03:06 . 2008-06-23 02:52 24,576 --a------ c:\windows\System32\mfpmp.exe
2008-12-11 03:06 . 2008-06-22 23:34 2,048 --a------ c:\windows\System32\mferror.dll
2008-12-07 15:06 . 2008-12-07 15:06 <REP> d-------- c:\users\XXMAX~1.XX\AppData\Roaming\gtopala
2008-11-26 16:57 . 2008-10-21 06:16 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-26 16:57 . 2008-08-28 04:24 712,192 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-26 16:57 . 2008-08-28 04:24 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 16:57 . 2008-08-28 04:24 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 16:57 . 2008-10-22 04:43 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-26 16:57 . 2008-10-22 04:43 160,768 --a------ c:\windows\System32\PortableDeviceTypes.dll
2008-11-26 16:57 . 2008-10-22 04:43 95,232 --a------ c:\windows\System32\PortableDeviceClassExtension.dll
2008-11-23 17:21 . 2008-11-23 17:21 268 --ah----- C:\sqmdata07.sqm
2008-11-23 17:21 . 2008-11-23 17:21 244 --ah----- C:\sqmnoopt07.sqm
2008-11-22 15:53 . 2008-11-22 15:53 <REP> d-------- c:\program files\Common Files\Adobe AIR
2008-11-17 18:15 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
2008-11-17 18:15 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
2008-11-17 18:15 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe
2008-11-17 18:15 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll
2008-11-17 18:14 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll
2008-11-17 18:14 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
2008-11-17 18:14 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll
2008-11-17 18:14 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll
2008-11-17 18:14 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-16 19:04 59,033 ----a-w c:\users\XXMAX~1.XX\AppData\Roaming\nvModes.dat
2008-12-15 19:41 --------- d-----w c:\program files\Google
2008-12-15 18:02 --------- d-----w c:\users\XXMAX~1.XX\AppData\Roaming\LimeWire
2008-12-15 17:30 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-15 17:30 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-15 17:27 --------- d-----w c:\program files\PDF Editeur 2
2008-12-15 17:24 --------- d-----w c:\program files\Microsoft Works
2008-12-15 17:18 --------- d-----w c:\users\XXMAX~1.XX\AppData\Roaming\Corel
2008-12-15 17:17 --------- d-----w c:\program files\Corel
2008-12-14 22:12 5,322 ----a-w c:\users\XXMAX~1.XX\AppData\Roaming\wklnhst.dat
2008-12-12 02:14 174 --sha-w c:\program files\desktop.ini
2008-12-12 02:12 --------- d-----w c:\program files\Windows Mail
2008-12-12 02:06 --------- d-----w c:\progra~2\Microsoft Help
2008-12-03 18:08 88 --sh--r c:\users\All Users\5886914F93.sys
2008-12-03 18:08 88 --sh--r c:\progra~2\5886914F93.sys
2008-12-03 18:08 2,828 --sha-w c:\users\All Users\KGyGaAvL.sys
2008-12-03 18:08 2,828 --sha-w c:\progra~2\KGyGaAvL.sys
2008-11-11 15:28 43,520 ----a-w c:\windows\System32\CmdLineExt03.dll
2008-11-11 15:25 --------- d-----w c:\program files\KONAMI
2008-11-10 19:10 --------- d-----w c:\program files\MSBuild
2008-11-10 19:05 --------- d-----w c:\program files\Microsoft.NET
2008-11-10 18:59 --------- d-----w c:\program files\Microsoft Visual Studio 8
2008-11-09 10:57 --------- d-----w c:\program files\DAEMON Tools Toolbar
2008-11-09 10:57 --------- d-----w c:\program files\DAEMON Tools Lite
2008-11-09 10:52 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-11-09 10:51 --------- d-----w c:\users\XXMAX~1.XX\AppData\Roaming\DAEMON Tools
2008-11-08 22:05 --------- d-----w c:\program files\Songbeat
2008-11-01 03:33 537,600 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:33 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:33 449,536 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:33 2,144,256 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:33 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-10-31 23:23 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
2008-10-21 20:34 --------- d-----w c:\program files\eMule
2008-10-21 20:34 --------- d-----w c:\progra~2\eMule
2008-10-16 04:40 826,368 ----a-w c:\windows\System32\wininet.dll
2008-10-16 04:40 56,320 ----a-w c:\windows\System32\iesetup.dll
2008-10-16 04:40 26,624 ----a-w c:\windows\System32\ieUnatt.exe
2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-18 04:35 3,505,208 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 04:35 3,470,904 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 02:03 2,027,520 ----a-w c:\windows\System32\win32k.sys
2008-01-29 20:38 67,840 ----a-w c:\users\XXMAX~1.XX\AppData\Roaming\GDIPFONTCACHEV1.DAT
2008-07-30 13:02 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-07-30 13:02 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-07-30 13:02 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-12-15 217088]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2006-12-10 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-10 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-10 81920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 c:\windows\RtHDVCpl.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\pmnoMdab
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-06-27 18:03 152872 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-08-08 13:11 490952 c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-07-04 12:09 171448 c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
--a------ 2007-05-31 08:21 648072 c:\windows\WindowsMobile\wmdc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{EAF24220-0648-49F1-B22A-BDB42D5FA48F}"= Disabled:UDP:c:\program files\Magentic\bin\MgImp.exe:Magentic
"{47395BA4-7149-4322-B34F-461667949A4D}"= Disabled:TCP:c:\program files\Magentic\bin\MgImp.exe:Magentic
"{46C4F2D3-1DAB-4638-A430-9B3C502597CC}"= Disabled:UDP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{E253A437-483F-40B6-AC0A-9CDEA528B6ED}"= Disabled:TCP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{EC828024-2095-48FF-8146-EB83AD66C584}"= Disabled:UDP:c:\program files\Magentic\bin\MgApp.exe:Magentic
"{E835FF41-B059-4790-A3D6-291B8A159830}"= Disabled:TCP:c:\program files\Magentic\bin\MgApp.exe:Magentic
"TCP Query User{8B27D9B6-F97F-4CBB-AE5A-434212197D3E}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{278FBE5E-DAC2-4CD6-8706-1A67B85228E4}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{0172AF2D-A2EF-4914-8734-39DFC8AE2EF5}c:\\valve lan\\hl.exe"= UDP:c:\valve lan\hl.exe:Half-Life Launcher
"UDP Query User{C3E170CB-CCE0-4206-BF38-79789644BA7A}c:\\valve lan\\hl.exe"= TCP:c:\valve lan\hl.exe:Half-Life Launcher
"{6C7BE8F3-4E99-487B-99B5-EF640BCC909E}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{A270CE00-EF5C-41B9-9F20-ADC0AF0857AC}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{F7DFD37E-8BCF-4D9B-A05F-0A0EF7B8068B}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"{E6DFF8CE-A8F9-4C51-9135-2C31C49000A5}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{B85079B7-728C-4571-A2FC-FCF6F6586798}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{97DFB7C7-91FA-46D3-BF35-59AA4D76BD98}"= UDP:24259:BitComet 24259 TCP
"{AE8AE518-B26A-49CB-8407-153786CEB97E}"= TCP:24259:BitComet 24259 UDP
"{F92A58BD-C1B2-4119-B0FA-B466C2493136}"= UDP:24259:BitComet 24259 TCP
"{C6A51DEA-CD9A-444E-BFFD-E69676BFDAD5}"= TCP:24259:BitComet 24259 UDP
"TCP Query User{5482295B-FFB9-40D1-B1E3-34ACE820CA6D}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{EE188824-9567-49BF-9BBA-D58D6A088BA1}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{C280CDD2-CDE8-4D1C-8BA7-F6AE70023157}"= UDP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"{05BBF25A-7313-46A9-9259-734098AC1D0F}"= TCP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"{9CBF060D-F410-45E3-898F-F036499AA6CA}"= UDP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"{457B4BF5-C6E7-4247-BC06-CE82A605D846}"= TCP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"TCP Query User{594168E9-BB65-420D-8978-74C4688129E2}c:\\program files\\jeyo\\jmc_windowsmobile\\jmc_wm.exe"= UDP:c:\program files\jeyo\jmc_windowsmobile\jmc_wm.exe:Jeyo Mobile Companion
"UDP Query User{2F60D74D-55F0-454E-8C82-D4FCBDFEC99E}c:\\program files\\jeyo\\jmc_windowsmobile\\jmc_wm.exe"= TCP:c:\program files\jeyo\jmc_windowsmobile\jmc_wm.exe:Jeyo Mobile Companion
"{81D44A1C-DB04-4591-883B-01A82A6A2161}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{8770B3FB-217C-4CB7-8136-712AF8C3E682}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{86B98EAD-7ABD-47A5-8DD5-D5C5EF1CA623}c:\\program files\\videolan\\vlc\\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{E1B2A5FD-E3F0-40CA-A745-472431412CA7}c:\\program files\\videolan\\vlc\\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"{61BAD372-73EF-468B-B595-5F21CE80FF32}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{8090290D-ED7E-4281-8AD5-CC9FD4DB4E3B}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C339FF6D-B1BD-4E3B-B643-4F9797799AFD}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{86D267D4-A4E3-48CC-823A-FFEB61696E9A}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{DFFAB77E-336B-4AED-80A3-074C85C042A4}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-15 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-15 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-12-15 51792]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2007-08-24 24576]
R3 StkCMini;Syntek AVStream USB2.0 VGA WebCam;c:\windows\system32\Drivers\StkCMini.sys [2007-08-24 1132544]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\system32\drivers\royal.sys [2007-08-20 240128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\wdsync.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{29c22a4e-a353-11dd-945b-806e6f6e6963}]
\shell\AutoRun\command - E:\WDSetup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e750105-3d19-11dd-b9d0-001bfc2481db}]
\shell\AutoRun\command - F:\wdsync.exe
.
- - - - ORPHELINS SUPPRIMES - - - -
BHO-{362DF5FC-0DCC-42B5-A82E-EFF6AA706828} - c:\windows\system32\pmnoMdab.dll
HKCU-Run-fsm - (no file)
HKLM-Run-b014d537 - c:\windows\system32\kkvynkgy.dll
MSConfigStartUp-Corel File Shell Monitor - c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
MSConfigStartUp-Corel Photo Downloader - c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
MSConfigStartUp-Magentic - c:\progra~1\Magentic\bin\Magentic.exe
MSConfigStartUp-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
MSConfigStartUp-VoipDiscount - c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-16 20:31:47
Windows 6.0.6000 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\System32\conime.exe
c:\windows\System32\rundll32.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\windows\ATK0100\ATKOSD.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Heure de fin: 2008-12-16 20:40:40 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-16 19:40:30
Avant-CF: 25 295 728 640 octets libres
Après-CF: 25,016,012,800 octets libres
282 --- E O F --- 2008-12-12 02:06:58-
Bien, du ménages a été fait mais ce n'est pas terminé.
Clic sur "démarrer", au dessus dans la barre de recherche tape : notepad
Le bloc-notes devrait s'ouvrir si ce n'est pas le cas ; clic sur "démarrer" -> tous les programmes -> accessoires, bloc-notes.
Dans celui-ci copie et colle les lignes suivantes.
Folder::
c:\program files\DAEMON Tools Toolbar
C:\ToolBar SD
C:\noi.MSNFix
c:\windows\fxstaller.MSNFix
En haut du fichier, clic sur Fichier, Enregistrer sous et sélectionne Bureau.
Donne lui comme nom : CFScript
Désactive ton antivirus. Fais un glisser de ce fichier sur Combofix, c'est-à-dire tu fais un clic sur le fichier préalablement créé puis tu maintiens le clic enfoncé et tu le déplaces sur Combofix, comme ceci
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif (clik pour voir l'image)
Une fenêtre devrait apparaître, tape 1 pour continuer. Ne touche à rien et laisse le faire, à la fin du scan un rapport devrait s'ouvrir copie et colle son contenu ici.
Ensuite, rends toi sur Virustotal
https://www.virustotal.com/gui/
A côté de choisir, copie et colle la ligne ci-dessous
c:\users\All Users\5886914F93.sys
Click sur Envoyer et colle le rapport ici une fois l'analyse terminée.
Puis :
Clic sur "open the misc tools section"
Clic sur "open uninstall manager"
Clic sur "Save list" dans la fenêtre qui va s'ouvrir fais un copié du contenu de ce fichier et colle le ici stp
-
-
oki ben jte remercie énormement; ca m'aura éviter un formatage et t ce qui s'en suit!
je feré cela demain dc si tu pouvé passer jeter un oeil demain sur le rapport paske la jvé allé me coucher: demain j'ai 7h30 d'examun (debut du bac blanc du semestre...:s)
en tt cas un grand merci et a demain je pense (ou apres demain en fonction de mes révisions :p) -
:P
Laisse le scan se terminer et fais ceci :
Fais ce qui est indiqué sur ce lien et colle le rapport ici. Tu l'as déjà fait tout à l'heure, masi ta version était obsolète et n'était pas renommée donc à refaire et je pense qu'après ça ce sera terminé.
-
ki tkt jsuis en train dle faire....
;) pas mal le jeu dmot "ca mange pas dpain" venant d'un boulanger ;)
donc la c'est bon c'est terminé? -
Oui, mais bon, n'hésite pas à passer le logiciel indiqué ci-dessus ça ne mange pas d'pain et permettra de vérifir un peu plus.
-
je n'ai aucun de ces 2 fichiers =) ca veu que c'est bon?
-
Encore infecté ? JE pense que oui, l'infection, enfin celle que tu as eu laisse pas mal de fichiers derrière.
Clic sur "démarrer" au dessus dans la barre de recherche tape la ligne ci-dessous lance la recherche et supprime si tu trouves :
iifefEwU
Recommence avec :
kkvynkgy
Après, télécharge, installe, mets à jour Malwarebytes anti-malwares. Fais un scan complet de ton ordinateur et colle le rapport ici une fois qu'il a terminé (enfin si tu arrives à copier le rapport, le cas échéant envoie le ici http://dl.free.fr/
;-)
-
nn mais le truc c'est que le document ki apparet est vide....
ps: et ce que mon ordi est encore infecté? -
-
j'arrive pas a faire le copier collé :$
-
Ah bah je sais pas si mon métier et mes études de boulanger vont t'aider à te trouver une voie pour plus tard lol, mais bon avec un BAC S (enfin tu l'as pas encore :P) tu as le choix ! Y'a pas une conseillére dans ton bahut ? Tu sais une femme qui t'aide à te guider et raconte n'importe quoi ? lol Choisis bien, mais ne te trompe pas ;-)
Pour le rapport c'est ok, voici la suite :
Ouvre HijackThis
Clic sur "open the misc tools section"
Clic sur "open uninstall manager"
Clic sur "Save list" dans la fenêtre qui va s'ouvrir fais un copié du contenu de ce fichier et colle le ici
-
que dois-je faire maintenant?
-
voila le rapport de virus total:
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.12.17.0 2008.12.16 -
AntiVir 7.9.0.45 2008.12.16 -
Authentium 5.1.0.4 2008.12.16 -
Avast 4.8.1281.0 2008.12.16 -
AVG 8.0.0.199 2008.12.16 -
BitDefender 7.2 2008.12.16 -
CAT-QuickHeal 10.00 2008.12.16 -
ClamAV 0.94.1 2008.12.16 -
Comodo 764 2008.12.16 -
DrWeb 4.44.0.09170 2008.12.16 -
eSafe 7.0.17.0 2008.12.16 -
eTrust-Vet 31.6.6263 2008.12.16 -
Ewido 4.0 2008.12.16 -
F-Prot 4.4.4.56 2008.12.16 -
F-Secure 8.0.14332.0 2008.12.16 -
Fortinet 3.117.0.0 2008.12.16 -
GData 19 2008.12.16 -
Ikarus T3.1.1.45.0 2008.12.16 -
K7AntiVirus 7.10.555 2008.12.16 -
Kaspersky 7.0.0.125 2008.12.16 -
McAfee 5466 2008.12.16 -
McAfee+Artemis 5466 2008.12.16 -
Microsoft 1.4205 2008.12.16 -
NOD32 3696 2008.12.16 -
Norman 5.80.02 2008.12.16 -
Panda 9.0.0.4 2008.12.16 -
PCTools 4.4.2.0 2008.12.16 -
Prevx1 V2 2008.12.16 -
Rising 21.08.12.00 2008.12.16 -
SecureWeb-Gateway 6.7.6 2008.12.16 -
Sophos 4.36.0 2008.12.16 -
Sunbelt 3.2.1801.2 2008.12.11 -
Symantec 10 2008.12.16 -
TheHacker 6.3.1.4.189 2008.12.16 -
TrendMicro 8.700.0.1004 2008.12.16 -
VBA32 3.12.8.10 2008.12.16 -
ViRobot 2008.12.16.1521 2008.12.16 -
VirusBuster 4.5.11.0 2008.12.16 -
Information additionnelle
File size: 88 bytes
MD5...: 75905dbeeb687fc22c5a283e085351bb
SHA1..: 30a7b8cf62cead0aeaf89308327ac63065bfba06
SHA256: 173754b7ae398b5cd72e18b4a8e9260e694b685007ea5450473fbe436c2dcbde
SHA512: 1748abd97c0f65b6509ed51f5781f6bd654fe84233c5d44cbc595f64423d95a5
d195872702d96fab9b9d2eee9f1b2267137714b7b79f880ee919ef594c4b82a5
ssdeep: 3:hl/gEB/1nXYn:Mao
PEiD..: -
TrID..: File type identification
MS Flight Simulator Aircraft Performance Info (100.0%)
PEInfo: - -
je suis en terminale S et ne sais absolumlent pas quoi faire plus tard (ce qui est problematique), quelle formation as tu? ca pourrai peu etre m'aider parce que je trouve que ce que tu fais est tres interressant! :$
-
ben la je suis entrain de faire la suite.... ca ne devrais pas tarder je pense....
je te remercie deja beaucoup pour ton efficassité, c'est super sympa de prendre de ton temps pour m'aider... -
Très bien pour ça c'est ok.
En attente de la suite :-)
-
la deuxieme analyse de combo fix m'a donné cela...
ComboFix 08-12-15.08 - Xx......mAx......xX 2008-12-16 21:06:40.1 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6000.0.1252.1.1036.18.1919.1164 [GMT 1:00]
Lancé depuis: c:\users\Xx......mAx......xX\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Xx......mAx......xX\Desktop\CFScript.txt
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\noi.msnfix\
c:\program files\DAEMON Tools Toolbar
c:\program files\DAEMON Tools Toolbar\_DTLite.xml
c:\program files\DAEMON Tools Toolbar\DTToolbar.dll
c:\program files\DAEMON Tools Toolbar\FirefoxDTT\chrome.manifest
c:\program files\DAEMON Tools Toolbar\FirefoxDTT\chrome\dttoolbar.jar
c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.xpt
c:\program files\DAEMON Tools Toolbar\FirefoxDTT\install.rdf
c:\program files\DAEMON Tools Toolbar\Resources\about.ico
c:\program files\DAEMON Tools Toolbar\Resources\AboutWindow.ico
c:\program files\DAEMON Tools Toolbar\Resources\as.ico
c:\program files\DAEMON Tools Toolbar\Resources\as.png
c:\program files\DAEMON Tools Toolbar\Resources\astro.ico
c:\program files\DAEMON Tools Toolbar\Resources\b1.bmp
c:\program files\DAEMON Tools Toolbar\Resources\b1.png
c:\program files\DAEMON Tools Toolbar\Resources\BurnImage.ico
c:\program files\DAEMON Tools Toolbar\Resources\buy.ico
c:\program files\DAEMON Tools Toolbar\Resources\cond000.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond001.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond003.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond004.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond005.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond006.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond007.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond008.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond009.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond010.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond011.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond019.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond020.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond021.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond022.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond023.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond024.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond025.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond026.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond037.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond038.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond039.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond040.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond041.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond046.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond048.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond050.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond051.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond052.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond053.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond054.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond055.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond056.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond057.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond058.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond059.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond060.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond061.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond062.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond063.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond064.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond065.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond066.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond067.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond068.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond069.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond075.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond076.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond077.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond078.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond079.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond080.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond084.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond085.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond086.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond087.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond088.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond089.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond090.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond091.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond092.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond093.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond094.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond095.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond108.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond109.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond110.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond111.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond112.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond113.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond120.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond121.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond122.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond126.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond127.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond128.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond129.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond130.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond131.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond132.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond133.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond134.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond135.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond136.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond137.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond138.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond140.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond141.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond142.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond143.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond148.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond149.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond152.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond154.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond155.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond156.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond157.gif
c:\program files\DAEMON Tools Toolbar\Resources\Config.ico
c:\program files\DAEMON Tools Toolbar\Resources\d.ico
c:\program files\DAEMON Tools Toolbar\Resources\d2.ico
c:\program files\DAEMON Tools Toolbar\Resources\daemon.ico
c:\program files\DAEMON Tools Toolbar\Resources\ds.ico
c:\program files\DAEMON Tools Toolbar\Resources\dsearch.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt.ico
c:\program files\DAEMON Tools Toolbar\Resources\DTPro.ico
c:\program files\DAEMON Tools Toolbar\Resources\Dwnl.ico
c:\program files\DAEMON Tools Toolbar\Resources\emulation.ico
c:\program files\DAEMON Tools Toolbar\Resources\features.ico
c:\program files\DAEMON Tools Toolbar\Resources\gd.ico
c:\program files\DAEMON Tools Toolbar\Resources\genre.xml
c:\program files\DAEMON Tools Toolbar\Resources\globe.ico
c:\program files\DAEMON Tools Toolbar\Resources\GrabImage.ico
c:\program files\DAEMON Tools Toolbar\Resources\hb.bmp
c:\program files\DAEMON Tools Toolbar\Resources\hb.ico
c:\program files\DAEMON Tools Toolbar\Resources\help.ico
c:\program files\DAEMON Tools Toolbar\Resources\ip.ico
c:\program files\DAEMON Tools Toolbar\Resources\lang.xml
c:\program files\DAEMON Tools Toolbar\Resources\lingvo.ico
c:\program files\DAEMON Tools Toolbar\Resources\m.ico
c:\program files\DAEMON Tools Toolbar\Resources\mail.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mail_disable.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mail_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mail_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mail_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc_disable.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\MenuRadioConfig.ico
c:\program files\DAEMON Tools Toolbar\Resources\MenuRadioStation.ico
c:\program files\DAEMON Tools Toolbar\Resources\MenuTr.ico
c:\program files\DAEMON Tools Toolbar\Resources\next.bmp
c:\program files\DAEMON Tools Toolbar\Resources\next_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\next_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\next_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\none.bmp
c:\program files\DAEMON Tools Toolbar\Resources\none_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\noW.gif
c:\program files\DAEMON Tools Toolbar\Resources\op.ico
c:\program files\DAEMON Tools Toolbar\Resources\play.bmp
c:\program files\DAEMON Tools Toolbar\Resources\play.ico
c:\program files\DAEMON Tools Toolbar\Resources\play_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\play_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\play_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\pragma.ico
c:\program files\DAEMON Tools Toolbar\Resources\prev.bmp
c:\program files\DAEMON Tools Toolbar\Resources\prev_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\prev_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\prev_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\prod.ico
c:\program files\DAEMON Tools Toolbar\Resources\Radio.ico
c:\program files\DAEMON Tools Toolbar\Resources\RadioBg.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioBgMask.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDisp.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDisp_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown.ico
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioError.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioError_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioSmallDisp.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioSmallDisp_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioWait.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioWait_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\refresh.bmp
c:\program files\DAEMON Tools Toolbar\Resources\refresh_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\refresh_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\refresh_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Rss.ico
c:\program files\DAEMON Tools Toolbar\Resources\Rss1.ico
c:\program files\DAEMON Tools Toolbar\Resources\rssClose.ico
c:\program files\DAEMON Tools Toolbar\Resources\rssL.bmp
c:\program files\DAEMON Tools Toolbar\Resources\rssOpen.ico
c:\program files\DAEMON Tools Toolbar\Resources\size.bmp
c:\program files\DAEMON Tools Toolbar\Resources\size_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\skins.ico
c:\program files\DAEMON Tools Toolbar\Resources\spt.ico
c:\program files\DAEMON Tools Toolbar\Resources\stop.bmp
c:\program files\DAEMON Tools Toolbar\Resources\stop.ico
c:\program files\DAEMON Tools Toolbar\Resources\stop_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\stop_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\stop_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\SupportRequest.ico
c:\program files\DAEMON Tools Toolbar\Resources\time.ico
c:\program files\DAEMON Tools Toolbar\Resources\TitleIcon.ico
c:\program files\DAEMON Tools Toolbar\Resources\toolbar.xml
c:\program files\DAEMON Tools Toolbar\Resources\trans.ico
c:\program files\DAEMON Tools Toolbar\Resources\Trash.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Trash_disable.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Trash_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Trash_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Trash_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\u.ico
c:\program files\DAEMON Tools Toolbar\Resources\vol.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol.ico
c:\program files\DAEMON Tools Toolbar\Resources\vol_back.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_dott.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_dott_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wb.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtClose.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtClose_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtClose_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtClose_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtText.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtText_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtText_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtText_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Weather_m42.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Weather_m43.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wi.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi0.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi1.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi10.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi11.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi12.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi13.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi2.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi3.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi4.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi5.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi6.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi7.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi8.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi9.ico
c:\program files\DAEMON Tools Toolbar\uninst.exe
C:\ToolBar SD
c:\toolbar sd\AutrInf.cmd
c:\toolbar sd\Back.cmd
c:\toolbar sd\Changelog ToolBar.txt
c:\toolbar sd\Crack.txt
c:\toolbar sd\DemP.cmd
c:\toolbar sd\DirectFix.cmd
c:\toolbar sd\Discl_en.vbs
c:\toolbar sd\Discl_fr.vbs
c:\toolbar sd\Discl_sp.vbs
c:\toolbar sd\Doss.tbsd
c:\toolbar sd\DossKill.txt
c:\toolbar sd\Fich.cmd
c:\toolbar sd\FichKill.txt
c:\toolbar sd\FixExt.cmd
c:\toolbar sd\iNv.exe
c:\toolbar sd\Kill.cmd
c:\toolbar sd\Langues.cmd
c:\toolbar sd\Orph.egd
c:\toolbar sd\OsV.exe
c:\toolbar sd\paths.bat
c:\toolbar sd\pv.exe
c:\toolbar sd\Rech.cmd
c:\toolbar sd\RegP2.txt
c:\toolbar sd\RegP3.txt
c:\toolbar sd\RegP4.txt
c:\toolbar sd\RegP5.txt
c:\toolbar sd\RegPCU.txt
c:\toolbar sd\RegPLM.txt
c:\toolbar sd\RegTBSD.reg
c:\toolbar sd\Rkeys.txt
c:\toolbar sd\RKit.lsd
c:\toolbar sd\RoGUeS.lsd
c:\toolbar sd\RunTool.txt
c:\toolbar sd\sed.exe
c:\toolbar sd\setpath.exe
c:\toolbar sd\TB_1.txt
c:\toolbar sd\ToolBarSD.cmd
c:\toolbar sd\ToolBarSD.ico
c:\toolbar sd\Uninstal.exe
c:\toolbar sd\VUN.txt
c:\windows\fxstaller.MSNFix\
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-16 au 2008-12-16 ))))))))))))))))))))))))))))))))))))
.
2008-12-15 21:42 . 2008-11-26 18:17 51,792 --a------ c:\windows\System32\drivers\aswMonFlt.sys
2008-12-15 17:56 . 2008-12-15 17:56 <REP> d----c--- c:\windows\System32\DRVSTORE
2008-12-15 17:56 . 2008-04-17 13:12 107,368 --a------ c:\windows\System32\GEARAspi.dll
2008-12-15 17:56 . 2008-04-17 13:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys
2008-12-15 17:55 . 2008-12-15 17:56 <REP> d-------- c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-15 17:55 . 2008-12-15 17:56 <REP> d-------- c:\program files\iTunes
2008-12-15 17:55 . 2008-12-15 17:55 <REP> d-------- c:\program files\iPod
2008-12-15 17:55 . 2008-12-15 17:55 <REP> d-------- c:\program files\Bonjour
2008-12-15 17:55 . 2008-12-15 17:56 <REP> d-------- c:\progra~2\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-15 17:53 . 2008-12-15 17:55 <REP> d-------- c:\users\All Users\Apple Computer
2008-12-15 17:53 . 2008-12-15 17:54 <REP> d-------- c:\program files\QuickTime
2008-12-15 17:53 . 2008-12-15 17:55 <REP> d-------- c:\progra~2\Apple Computer
2008-12-15 17:52 . 2008-12-15 17:52 <REP> d-------- c:\program files\Apple Software Update
2008-12-15 17:50 . 2008-12-15 17:55 <REP> d-------- c:\program files\Common Files\Apple
2008-12-14 13:05 . 2008-12-15 19:00 1,025 --a------ C:\noi.MSNFix
2008-12-13 20:48 . 2008-12-13 01:16 52,786 --a------ c:\windows\fxstaller.MSNFix
2008-12-12 03:03 . 2008-10-22 00:31 2,048 --a------ c:\windows\System32\tzres.dll
2008-12-11 03:08 . 2008-11-01 00:38 4,247,552 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
2008-12-11 03:08 . 2008-11-01 04:33 1,687,040 --a------ c:\windows\System32\gameux.dll
2008-12-11 03:08 . 2008-10-21 06:16 297,472 --a------ c:\windows\System32\gdi32.dll
2008-12-11 03:08 . 2008-11-01 04:33 28,672 --a------ c:\windows\System32\Apphlpdm.dll
2008-12-11 03:07 . 2008-10-29 07:20 2,923,520 --a------ c:\windows\explorer.exe
2008-12-11 03:06 . 2008-06-23 02:52 2,855,424 --a------ c:\windows\System32\mf.dll
2008-12-11 03:06 . 2008-06-23 02:52 996,352 --a------ c:\windows\System32\WMNetMgr.dll
2008-12-11 03:06 . 2008-06-23 02:52 98,816 --a------ c:\windows\System32\mfps.dll
2008-12-11 03:06 . 2008-06-23 02:52 94,720 --a------ c:\windows\System32\logagent.exe
2008-12-11 03:06 . 2008-06-23 02:52 52,736 --a------ c:\windows\System32\rrinstaller.exe
2008-12-11 03:06 . 2008-06-23 02:52 24,576 --a------ c:\windows\System32\mfpmp.exe
2008-12-11 03:06 . 2008-06-22 23:34 2,048 --a------ c:\windows\System32\mferror.dll
2008-11-26 16:57 . 2008-10-21 06:16 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-26 16:57 . 2008-08-28 04:24 712,192 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-26 16:57 . 2008-08-28 04:24 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 16:57 . 2008-08-28 04:24 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 16:57 . 2008-10-22 04:43 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-26 16:57 . 2008-10-22 04:43 160,768 --a------ c:\windows\System32\PortableDeviceTypes.dll
2008-11-26 16:57 . 2008-10-22 04:43 95,232 --a------ c:\windows\System32\PortableDeviceClassExtension.dll
2008-11-23 17:21 . 2008-11-23 17:21 268 --ah----- C:\sqmdata07.sqm
2008-11-23 17:21 . 2008-11-23 17:21 244 --ah----- C:\sqmnoopt07.sqm
2008-11-22 15:53 . 2008-11-22 15:53 <REP> d-------- c:\program files\Common Files\Adobe AIR
2008-11-17 18:15 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
2008-11-17 18:15 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
2008-11-17 18:15 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe
2008-11-17 18:15 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll
2008-11-17 18:14 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll
2008-11-17 18:14 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
2008-11-17 18:14 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll
2008-11-17 18:14 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll
2008-11-17 18:14 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-15 19:41 --------- d-----w c:\program files\Google
2008-12-15 17:30 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-15 17:30 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-15 17:27 --------- d-----w c:\program files\PDF Editeur 2
2008-12-15 17:24 --------- d-----w c:\program files\Microsoft Works
2008-12-15 17:17 --------- d-----w c:\program files\Corel
2008-12-12 02:14 174 --sha-w c:\program files\desktop.ini
2008-12-12 02:12 --------- d-----w c:\program files\Windows Mail
2008-12-12 02:06 --------- d-----w c:\progra~2\Microsoft Help
2008-12-03 18:08 88 --sh--r c:\users\All Users\5886914F93.sys
2008-12-03 18:08 88 --sh--r c:\progra~2\5886914F93.sys
2008-12-03 18:08 2,828 --sha-w c:\users\All Users\KGyGaAvL.sys
2008-12-03 18:08 2,828 --sha-w c:\progra~2\KGyGaAvL.sys
2008-11-11 15:25 --------- d-----w c:\program files\KONAMI
2008-11-10 19:10 --------- d-----w c:\program files\MSBuild
2008-11-10 19:05 --------- d-----w c:\program files\Microsoft.NET
2008-11-10 18:59 --------- d-----w c:\program files\Microsoft Visual Studio 8
2008-11-09 10:57 --------- d-----w c:\program files\DAEMON Tools Lite
2008-11-09 10:52 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-11-08 22:05 --------- d-----w c:\program files\Songbeat
2008-11-01 03:33 537,600 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:33 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:33 449,536 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:33 2,144,256 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:33 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-10-31 23:23 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
2008-10-21 20:34 --------- d-----w c:\program files\eMule
2008-10-21 20:34 --------- d-----w c:\progra~2\eMule
2008-07-30 13:02 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-07-30 13:02 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-07-30 13:02 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((( snapshot@2008-12-16_20.34.56.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-16 19:31:42 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-12-16 20:11:30 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-12-16 20:11:30 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-12-16 19:31:41 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-12-16 20:11:30 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-12-16 20:11:30 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-12-16 18:03:54 107,614 ----a-w c:\windows\System32\perfc009.dat
+ 2008-12-16 19:37:25 107,614 ----a-w c:\windows\System32\perfc009.dat
- 2008-12-16 18:03:55 122,020 ----a-w c:\windows\System32\perfc00C.dat
+ 2008-12-16 19:37:25 122,020 ----a-w c:\windows\System32\perfc00C.dat
- 2008-12-16 18:03:55 618,470 ----a-w c:\windows\System32\perfh009.dat
+ 2008-12-16 19:37:25 618,470 ----a-w c:\windows\System32\perfh009.dat
- 2008-12-16 18:03:55 700,222 ----a-w c:\windows\System32\perfh00C.dat
+ 2008-12-16 19:37:25 700,222 ----a-w c:\windows\System32\perfh00C.dat
- 2008-12-16 17:59:04 9,654 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-808816023-62131175-2614681958-1000_UserData.bin
+ 2008-12-16 19:33:13 9,924 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-808816023-62131175-2614681958-1000_UserData.bin
- 2008-12-16 17:59:04 49,232 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-12-16 19:33:13 49,448 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-12-16 18:04:15 40,194 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-12-16 19:33:07 40,410 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-12-15 217088]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2006-12-10 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-10 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-10 81920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 c:\windows\RtHDVCpl.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-06-27 18:03 152872 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-08-08 13:11 490952 c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-07-04 12:09 171448 c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
--a------ 2007-05-31 08:21 648072 c:\windows\WindowsMobile\wmdc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{EAF24220-0648-49F1-B22A-BDB42D5FA48F}"= Disabled:UDP:c:\program files\Magentic\bin\MgImp.exe:Magentic
"{47395BA4-7149-4322-B34F-461667949A4D}"= Disabled:TCP:c:\program files\Magentic\bin\MgImp.exe:Magentic
"{46C4F2D3-1DAB-4638-A430-9B3C502597CC}"= Disabled:UDP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{E253A437-483F-40B6-AC0A-9CDEA528B6ED}"= Disabled:TCP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{EC828024-2095-48FF-8146-EB83AD66C584}"= Disabled:UDP:c:\program files\Magentic\bin\MgApp.exe:Magentic
"{E835FF41-B059-4790-A3D6-291B8A159830}"= Disabled:TCP:c:\program files\Magentic\bin\MgApp.exe:Magentic
"TCP Query User{8B27D9B6-F97F-4CBB-AE5A-434212197D3E}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{278FBE5E-DAC2-4CD6-8706-1A67B85228E4}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{0172AF2D-A2EF-4914-8734-39DFC8AE2EF5}c:\\valve lan\\hl.exe"= UDP:c:\valve lan\hl.exe:Half-Life Launcher
"UDP Query User{C3E170CB-CCE0-4206-BF38-79789644BA7A}c:\\valve lan\\hl.exe"= TCP:c:\valve lan\hl.exe:Half-Life Launcher
"{6C7BE8F3-4E99-487B-99B5-EF640BCC909E}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{A270CE00-EF5C-41B9-9F20-ADC0AF0857AC}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{F7DFD37E-8BCF-4D9B-A05F-0A0EF7B8068B}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"{E6DFF8CE-A8F9-4C51-9135-2C31C49000A5}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{B85079B7-728C-4571-A2FC-FCF6F6586798}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{97DFB7C7-91FA-46D3-BF35-59AA4D76BD98}"= UDP:24259:BitComet 24259 TCP
"{AE8AE518-B26A-49CB-8407-153786CEB97E}"= TCP:24259:BitComet 24259 UDP
"{F92A58BD-C1B2-4119-B0FA-B466C2493136}"= UDP:24259:BitComet 24259 TCP
"{C6A51DEA-CD9A-444E-BFFD-E69676BFDAD5}"= TCP:24259:BitComet 24259 UDP
"TCP Query User{5482295B-FFB9-40D1-B1E3-34ACE820CA6D}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{EE188824-9567-49BF-9BBA-D58D6A088BA1}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{C280CDD2-CDE8-4D1C-8BA7-F6AE70023157}"= UDP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"{05BBF25A-7313-46A9-9259-734098AC1D0F}"= TCP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"{9CBF060D-F410-45E3-898F-F036499AA6CA}"= UDP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"{457B4BF5-C6E7-4247-BC06-CE82A605D846}"= TCP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"TCP Query User{594168E9-BB65-420D-8978-74C4688129E2}c:\\program files\\jeyo\\jmc_windowsmobile\\jmc_wm.exe"= UDP:c:\program files\jeyo\jmc_windowsmobile\jmc_wm.exe:Jeyo Mobile Companion
"UDP Query User{2F60D74D-55F0-454E-8C82-D4FCBDFEC99E}c:\\program files\\jeyo\\jmc_windowsmobile\\jmc_wm.exe"= TCP:c:\program files\jeyo\jmc_windowsmobile\jmc_wm.exe:Jeyo Mobile Companion
"{81D44A1C-DB04-4591-883B-01A82A6A2161}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{8770B3FB-217C-4CB7-8136-712AF8C3E682}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{86B98EAD-7ABD-47A5-8DD5-D5C5EF1CA623}c:\\program files\\videolan\\vlc\\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{E1B2A5FD-E3F0-40CA-A745-472431412CA7}c:\\program files\\videolan\\vlc\\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"{61BAD372-73EF-468B-B595-5F21CE80FF32}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{8090290D-ED7E-4281-8AD5-CC9FD4DB4E3B}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C339FF6D-B1BD-4E3B-B643-4F9797799AFD}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{86D267D4-A4E3-48CC-823A-FFEB61696E9A}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{DFFAB77E-336B-4AED-80A3-074C85C042A4}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-15 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-15 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-12-15 51792]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2007-08-24 24576]
R3 StkCMini;Syntek AVStream USB2.0 VGA WebCam;c:\windows\system32\Drivers\StkCMini.sys [2007-08-24 1132544]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\system32\drivers\royal.sys [2007-08-20 240128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\wdsync.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{29c22a4e-a353-11dd-945b-806e6f6e6963}]
\shell\AutoRun\command - E:\WDSetup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e750105-3d19-11dd-b9d0-001bfc2481db}]
\shell\AutoRun\command - F:\wdsync.exe
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-16 21:11:32
Windows 6.0.6000 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\System32\conime.exe
c:\windows\System32\rundll32.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\ATK0100\ATKOSD.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\System32\dllhost.exe
.
**************************************************************************
.
Heure de fin: 2008-12-16 21:19:50 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-16 20:19:46
ComboFix2.txt 2008-12-16 19:40:41
Avant-CF: 24 958 726 144 octets libres
Après-CF: 24,588,500,992 octets libres
539 --- E O F --- 2008-12-12 02:06:58 -
Contributeur sécuritéje sais pas je suis entrain d'apprendre et tu men as appris un peut plus :))))
-
Oui, mais me concernant ça fait un moment que j'ai testé sur des cobayes vu l'infection là (Vundo), il n'y a pas de risques, même une "astuce" a été écrite la-dessus .. et même si toi, tu croirais qu'il y aurait un risque pourquoi l'utiliserais-tu ? C'est que t'aimes jouer avec le risque ? ;-)
Il y a quelques temps de ça, il ne fallait pas dévoiller Combofix aux yeux de tout le monde, maintenant tu regardes ici dans les astuces ou sur n'importe quel forum les gens l'utilisent d'eyx-même pour régler leur problème et qu'il y a un risque ou pas, très peu doivent s'en soucier.
Les temps changent.
-
Contributeur sécuritéOui t'as pas tord ^^
car c'est en faisant des erreurs que l'on apprend à ce qu'il parait ?
Ouais mais la c'est la pc de quelqu'un qui et en jeu ;)
- 1
- 2
Suivant
