Charge dedié 500mo
Résolu/Fermé
alban46
Messages postés
71
Date d'inscription
vendredi 11 janvier 2008
Statut
Membre
Dernière intervention
4 octobre 2008
-
29 juil. 2008 à 16:25
IronVI Messages postés 72 Date d'inscription lundi 28 juillet 2008 Statut Membre Dernière intervention 7 août 2008 - 30 juil. 2008 à 17:43
IronVI Messages postés 72 Date d'inscription lundi 28 juillet 2008 Statut Membre Dernière intervention 7 août 2008 - 30 juil. 2008 à 17:43
A voir également:
- Charge dedié 500mo
- La poste est prête à prendre en charge votre envoi. dès qu'il nous sera confié, vous pourrez suivre son trajet ici. ✓ - Forum Mobile
- Mode non pris en charge ✓ - Forum Format et connectique vidéo
- Ma 3ds ne charge plus - Forum DS
- Mon iptv ne charge plus ✓ - Forum TV & Vidéo
- Iphone ne charge plus mais détecte le chargeur ✓ - Forum iPhone
9 réponses
IronVI
Messages postés
72
Date d'inscription
lundi 28 juillet 2008
Statut
Membre
Dernière intervention
7 août 2008
7
29 juil. 2008 à 16:28
29 juil. 2008 à 16:28
salut
on va vérifier la présence de virus
télécharge http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe
double clique ==> do a system scan and save log
un rapport s'ouvre
copier coller dans la réponse
on va vérifier la présence de virus
télécharge http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe
double clique ==> do a system scan and save log
un rapport s'ouvre
copier coller dans la réponse
alban46
Messages postés
71
Date d'inscription
vendredi 11 janvier 2008
Statut
Membre
Dernière intervention
4 octobre 2008
15
29 juil. 2008 à 16:44
29 juil. 2008 à 16:44
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:43:49, on 29/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft LifeChat\LifeChat.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\program files\steam\steam.exe
C:\Program Files\Pack Securite\Common\FSM32.EXE
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\alban\Bureau\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL (file missing)
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [LifeChat] "C:\Program Files\Microsoft LifeChat\LifeChat.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [VoipBuster] "C:\program files\voipbuster.com\voipbuster\voipbuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [WindowsLivePhone] "C:\PROGRA~1\WI1F86~1\MESSEN~1\DEVICE~1\msgrdvmn.exe" /AutoRun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\armelle\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversFWBInitialSetup1.0.0.15.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O24 - Desktop Component 0: (no name) - http://www.nrj.fr/onair/webcam/webcam.jpg?uniq1168711660406
Scan saved at 16:43:49, on 29/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft LifeChat\LifeChat.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\program files\steam\steam.exe
C:\Program Files\Pack Securite\Common\FSM32.EXE
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\alban\Bureau\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL (file missing)
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [LifeChat] "C:\Program Files\Microsoft LifeChat\LifeChat.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [VoipBuster] "C:\program files\voipbuster.com\voipbuster\voipbuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [WindowsLivePhone] "C:\PROGRA~1\WI1F86~1\MESSEN~1\DEVICE~1\msgrdvmn.exe" /AutoRun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\armelle\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversFWBInitialSetup1.0.0.15.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O24 - Desktop Component 0: (no name) - http://www.nrj.fr/onair/webcam/webcam.jpg?uniq1168711660406
IronVI
Messages postés
72
Date d'inscription
lundi 28 juillet 2008
Statut
Membre
Dernière intervention
7 août 2008
7
29 juil. 2008 à 16:58
29 juil. 2008 à 16:58
y'a effectivement quelques saletés
relance hijackthis,
fait " Do a System Scan Only "
coche ces lignes
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/
clique sur fix checked ==> oui
+++++++++
https://www.besttechie.com/resources/malwarebytes/
=> double-clic sur mbam-setup pour lancer l'installation
=> Installer simplement sans rien modifier
=> Quand le programme lancé ==> onglet Mise à jour cliquer sur => Recherche de mise à jour
Onglet Recherche => cocher Exécuter un examen complet
=> Clic Rechercher
=> Eventuellement décocher les disque à ne pas analyser
=> Clic Lancer l'examen
=> En fin de scan , si infection trouvée
==> Clic Afficher résultat
=> Fermer vos applications en cours
=> Vérifier si tout est coché et clic Supprimer la sélection
=> un rapport s'ouvre le copier et le coller dans la réponse
--
Bachi Bouzouks ! Tchouk Tchouk Nougat ! Que le grand cric me croque !
relance hijackthis,
fait " Do a System Scan Only "
coche ces lignes
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/
clique sur fix checked ==> oui
+++++++++
https://www.besttechie.com/resources/malwarebytes/
=> double-clic sur mbam-setup pour lancer l'installation
=> Installer simplement sans rien modifier
=> Quand le programme lancé ==> onglet Mise à jour cliquer sur => Recherche de mise à jour
Onglet Recherche => cocher Exécuter un examen complet
=> Clic Rechercher
=> Eventuellement décocher les disque à ne pas analyser
=> Clic Lancer l'examen
=> En fin de scan , si infection trouvée
==> Clic Afficher résultat
=> Fermer vos applications en cours
=> Vérifier si tout est coché et clic Supprimer la sélection
=> un rapport s'ouvre le copier et le coller dans la réponse
--
Bachi Bouzouks ! Tchouk Tchouk Nougat ! Que le grand cric me croque !
alban46
Messages postés
71
Date d'inscription
vendredi 11 janvier 2008
Statut
Membre
Dernière intervention
4 octobre 2008
15
29 juil. 2008 à 19:04
29 juil. 2008 à 19:04
Malwarebytes' Anti-Malware 1.23
Version de la base de données: 1007
Windows 5.1.2600 Service Pack 2
18:51:30 29/07/2008
mbam-log-7-29-2008 (18-51-30).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 177872
Temps écoulé: 1 hour(s), 29 minute(s), 31 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 2
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootStera (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
C:\Program Files\Hotbar (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2006 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Documents and Settings\alban\Local Settings\Temp\dat6A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.
je bug encore
Version de la base de données: 1007
Windows 5.1.2600 Service Pack 2
18:51:30 29/07/2008
mbam-log-7-29-2008 (18-51-30).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 177872
Temps écoulé: 1 hour(s), 29 minute(s), 31 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 2
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootStera (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
C:\Program Files\Hotbar (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2006 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Documents and Settings\alban\Local Settings\Temp\dat6A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.
je bug encore
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
teyz
Messages postés
181
Date d'inscription
mardi 21 août 2007
Statut
Membre
Dernière intervention
25 août 2010
8
29 juil. 2008 à 19:08
29 juil. 2008 à 19:08
pense à redémarré aprés chaque étape.
alban46
Messages postés
71
Date d'inscription
vendredi 11 janvier 2008
Statut
Membre
Dernière intervention
4 octobre 2008
15
29 juil. 2008 à 19:20
29 juil. 2008 à 19:20
C'est fait t'inquiéte
IronVI
Messages postés
72
Date d'inscription
lundi 28 juillet 2008
Statut
Membre
Dernière intervention
7 août 2008
7
30 juil. 2008 à 00:24
30 juil. 2008 à 00:24
lut, décidement , rogue rode partout en ce moment .
après on est pas sûr que ce soit un virus !
Télécharger et enregistrer sur le bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
=Double-clic sur Combofix
= Presser 1 si demandé
= Attendre la fermeture de l’outil ( 5 -10 mn ou plus si infection importante)
=Copier/coller le rapport dans la réponse
Un rapport dans C:\Combofix.txt à mettre dans la réponse
Réactiver l'antivirus
============
supprimer ensuite
combofix
QooBox qui est à C:\
ensuite refait un hijackthis
après on est pas sûr que ce soit un virus !
Télécharger et enregistrer sur le bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
=Double-clic sur Combofix
= Presser 1 si demandé
= Attendre la fermeture de l’outil ( 5 -10 mn ou plus si infection importante)
=Copier/coller le rapport dans la réponse
Un rapport dans C:\Combofix.txt à mettre dans la réponse
Réactiver l'antivirus
============
supprimer ensuite
combofix
QooBox qui est à C:\
ensuite refait un hijackthis
alban46
Messages postés
71
Date d'inscription
vendredi 11 janvier 2008
Statut
Membre
Dernière intervention
4 octobre 2008
15
30 juil. 2008 à 13:42
30 juil. 2008 à 13:42
ComboFix 08-07-29.1 - alban 2008-07-30 13:12:25.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.406 [GMT 2:00]
Endroit: C:\Documents and Settings\alban\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
* Resident AV is active
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WA6P
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\stera.log
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_FOPN
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-28 to 2008-07-30 ))))))))))))))))))))))))))))))))))))
.
2008-07-29 17:20 . 2008-07-29 17:20 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-29 17:20 . 2008-07-29 17:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-29 17:20 . 2008-07-29 17:20 <REP> d-------- C:\Documents and Settings\alban\Application Data\Malwarebytes
2008-07-29 17:20 . 2008-07-23 20:09 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-07-29 17:20 . 2008-07-23 20:09 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-16 20:20 . 2004-08-04 00:45 32,128 --a------ C:\WINDOWS\system32\drivers\wceusbsh.sys
2008-07-16 20:20 . 2004-08-04 00:45 32,128 --a------ C:\WINDOWS\system32\dllcache\wceusbsh.sys
2008-07-16 13:00 . 2008-07-16 13:01 <REP> d-------- C:\Program Files\Microsoft LifeChat
2008-07-14 10:39 . 2008-07-14 10:39 <REP> d-------- C:\Documents and Settings\alban\Application Data\ICQ Toolbar
2008-07-12 19:28 . 2008-07-12 19:38 51,072 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-07-12 19:28 . 2008-07-12 19:38 30,016 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-07-12 19:23 . 2008-07-12 19:25 86,674,776 --a------ C:\Program Files\pack_securite.exe
2008-07-12 00:47 . 2008-07-12 00:47 4,898,144 --a------ C:\Program Files\LimeWireWin.exe
2008-07-11 14:46 . 2008-07-11 14:46 2,018,112 --a------ C:\Program Files\battlefield2-nocd-1_0-ENG.zip
2008-07-11 14:43 . 2008-07-11 14:43 1,270,342 --a------ C:\Program Files\winrar_winrar_3.71_francais_9632.exe
2008-07-11 01:18 . 2008-07-11 13:55 <REP> d-------- C:\Program Files\Anti-Blaxx
2008-07-11 00:27 . 2008-07-11 00:27 <REP> d-------- C:\Documents and Settings\alban\Support
2008-07-11 00:27 . 2008-07-11 00:27 <REP> d-------- C:\Documents and Settings\alban\RELOADED
2008-07-11 00:27 . 2008-07-11 00:27 <REP> d-------- C:\Documents and Settings\alban\Redist
2008-07-11 00:27 . 2008-07-11 00:27 <REP> d-------- C:\Documents and Settings\alban\nvidia_driver
2008-07-11 00:27 . 2008-07-11 00:27 <REP> d-------- C:\Documents and Settings\alban\directx
2008-07-11 00:27 . 2008-07-11 00:27 <REP> d-------- C:\Documents and Settings\alban\autorun
2008-07-11 00:26 . 2008-07-11 00:26 <REP> d-------- C:\Documents and Settings\alban\BFMC
2008-07-11 00:26 . 2004-10-22 07:16 118,736 --a------ C:\Documents and Settings\alban\setup.exe
2008-07-11 00:26 . 2005-05-23 02:22 10,023 --a------ C:\Documents and Settings\alban\layout.bin
2008-07-11 00:23 . 2005-05-23 02:22 1,187,840 --a------ C:\Documents and Settings\alban\Autorun.exe
2008-07-10 23:58 . 2008-07-10 23:59 <REP> d-------- C:\Program Files\DAEMON Tools Toolbar
2008-07-10 23:58 . 2008-07-10 23:59 <REP> d-------- C:\Program Files\DAEMON Tools Lite
2008-07-10 23:53 . 2008-07-10 23:53 <REP> d-------- C:\Documents and Settings\alban\Application Data\DAEMON Tools
2008-07-10 23:53 . 2008-07-10 23:53 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-07-10 23:52 . 2008-07-10 23:52 4,982,216 --a------ C:\Program Files\daemon4124-lite.exe
2008-07-10 14:02 . 2008-07-10 14:02 <REP> d-------- C:\Program Files\uTorrent
2008-07-10 14:02 . 2008-07-12 01:44 <REP> d-------- C:\Documents and Settings\alban\Application Data\uTorrent
2008-07-10 13:27 . 2008-07-15 16:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-07-10 13:27 . 2008-07-10 13:27 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-07 03:24 . 2008-07-11 19:45 137,840 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-07 03:23 . 2008-07-12 19:56 111,928 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-07-07 03:22 . 2008-07-07 03:22 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-07-07 02:16 . 2008-07-07 02:28 572,848,791 --a------ C:\Program Files\battlefield_2_demo_jouable_1_anglais_14661.exe
2008-07-06 01:48 . 2008-07-06 01:48 <REP> d-------- C:\Program Files\Lavalys
2008-07-06 01:48 . 2008-07-06 01:48 8,315,488 --a------ C:\Program Files\everestultimate450.exe
2008-07-06 01:20 . 2008-07-06 01:20 1,234,119 --a------ C:\Program Files\wrar38b2.exe
2008-07-05 19:53 . 2008-07-05 19:53 <REP> d-------- C:\Program Files\Alwil Software
2008-07-05 19:52 . 2008-07-12 19:11 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-05 19:51 . 2008-07-05 19:51 9,722,720 --a------ C:\Program Files\spybotsd152.exe
2008-07-05 19:50 . 2008-07-05 19:52 24,354,672 --a------ C:\Program Files\setupfre.exe
2008-07-05 19:45 . 2008-07-05 19:45 <REP> d-------- C:\Program Files\AIDA32 - Personal System Information
2008-07-05 19:44 . 2008-07-05 19:44 3,300,289 --a------ C:\Program Files\AIDA_32_3.93_Personnal_Edition.exe
2008-07-05 02:24 . 2008-07-05 02:24 <REP> d-------- C:\Documents and Settings\alban\Application Data\Windows Live Writer
2008-07-05 01:36 . 2008-07-05 01:36 64,372 --a------ C:\WINDOWS\BricoPackUninst.cmd
2008-07-05 01:35 . 2008-07-05 01:35 2,359,350 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
2008-07-05 01:31 . 2008-07-05 01:36 6,114 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-07-05 01:30 . 2008-07-05 01:30 <REP> d-------- C:\WINDOWS\BricoPacks
2008-07-01 14:47 . 2008-07-01 15:14 <REP> d-------- C:\Documents and Settings\alban\Application Data\Desperate Housewives
2008-06-11 06:52 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 06:52 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-09 18:07 . 2008-07-30 13:27 <REP> d-------- C:\Program Files\Steam
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-29 20:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-29 15:15 --------- d-----w C:\Documents and Settings\alban\Application Data\teamspeak2
2008-07-29 14:31 --------- d-----w C:\Documents and Settings\alban\Application Data\FileZilla
2008-07-27 19:33 --------- d-----w C:\Documents and Settings\alban\Application Data\Skype
2008-07-18 18:02 --------- d-----w C:\Documents and Settings\alban\Application Data\HLSW
2008-07-15 14:44 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-12 17:43 --------- d-----w C:\Program Files\Pack Securite
2008-07-12 17:37 --------- d-----w C:\Documents and Settings\alban\Application Data\Shareaza
2008-07-12 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\F-Secure
2008-07-12 17:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\fssg
2008-07-11 22:48 --------- d-----w C:\Program Files\LimeWire
2008-07-11 17:12 --------- d-----w C:\Program Files\EA GAMES
2008-07-11 12:42 1,271,557 ----a-w C:\Program Files\wrar371fr.exe
2008-07-10 11:59 19,858 ----a-w C:\Program Files\Battlefield 2.iso [mininova].torrent
2008-07-06 00:51 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-07-05 23:17 674 ----a-w C:\Program Files\WinRar v3.71+Crack [mininova].torrent
2008-07-04 23:36 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-07-04 23:36 219,648 ----a-w C:\WINDOWS\system32\dllcache\uxtheme.dll
2008-07-04 15:06 --------- d-----w C:\Program Files\FileZilla FTP Client
2008-07-01 12:42 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-06-24 10:29 --------- d-----w C:\Program Files\DivX
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-19 18:58 --------- d-----w C:\Documents and Settings\alban\Application Data\FaxCtr
2008-06-15 18:31 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-05-22 22:20 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-05-21 12:52 161,038,167 ----a-w C:\Program Files\DofusInstaller_v1_23_0.exe
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-23 20:16 3,864,576 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-22 07:41 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:41 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-21 19:51 290,816 ------w C:\WINDOWS\Setup1.exe
2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-02-21 18:13 4,477,356 ----a-w C:\Program Files\hlsw_1_2_1_setup(2).exe
2008-02-18 17:58 5,862,994 ----a-w C:\Program Files\ts2_client_rc2_2032.exe
2008-01-16 17:38 1,495,603 -c--a-w C:\Program Files\MDL_1.3.0322.exe
2008-01-13 14:15 642,796 ----a-w C:\Program Files\XviD-1.1.3-28062007.exe
2007-12-20 19:22 25,839,688 ----a-w C:\Program Files\wmp11-windowsxp-x86-FR-FR.exe
.
------- Sigcheck -------
2005-01-27 19:12 662016 66a10b98f18fd804236ab2d90301de04 C:\WINDOWS\$hf_mig$\KB867282\SP2QFE\wininet.dll
2005-05-02 22:58 663040 0996b57cc2abcb271872296e98a18db2 C:\WINDOWS\$hf_mig$\KB883939\SP2QFE\wininet.dll
2005-03-10 09:48 662016 06ad0b0f43286cd50af283762eb56763 C:\WINDOWS\$hf_mig$\KB890923\SP2QFE\wininet.dll
2005-07-03 04:10 663552 39846b1ac2b99349272ee6e075c3b8af C:\WINDOWS\$hf_mig$\KB896727\SP2QFE\wininet.dll
2007-08-20 11:49 825344 2dd1b0f579c80562edcb8848ff7ea9f6 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
2007-10-11 01:22 825344 871ae10d6ae8877e9636ae5017953d52 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
2007-12-07 03:42 825344 f4fd487241d3ac291046a22cebd2cf71 C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
2008-03-01 14:34 827392 5a0093f59b505c008ed0cee615563c72 C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
2008-04-23 09:19 827392 78d3d2b0be6ad3e6d82ccb115cf74310 C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
2004-08-05 07:00 660480 58fe94ef42e074f4cad8bf02e70e6478 C:\WINDOWS\$NtUninstallKB867282$\wininet.dll
2005-01-27 19:14 660992 b16b02f3c804f057dab099cc15ed0206 C:\WINDOWS\$NtUninstallKB883939$\wininet.dll
2005-05-02 22:57 662016 ffe3e6fb8d52955a2de4c6cc765b02bc C:\WINDOWS\$NtUninstallKB896727$\wininet.dll
2005-07-03 04:16 662528 e994e704303f07f331b03ee9ed6d9e2d C:\WINDOWS\$NtUninstallKB925454$\wininet.dll
2006-10-23 17:34 668672 efa0c2870cba1747809a13e09f35bf82 C:\WINDOWS\$NtUninstallKB928090$\wininet.dll
2007-01-04 16:02 669184 114342601ac7ea73b0d2a0ed8505b8b9 C:\WINDOWS\$NtUninstallKB931768$\wininet.dll
2007-02-19 17:23 669696 1bde6d5dba35797eca8db8fcb80fc015 C:\WINDOWS\$NtUninstallKB933566$\wininet.dll
2007-04-18 14:44 669696 a3bf56a786b277e881fd9137f55f0b4b C:\WINDOWS\$NtUninstallKB937143$\wininet.dll
2007-06-26 16:36 669696 19058fbdc72f7bae085369c6d0a7d074 C:\WINDOWS\$NtUninstallKB939653$\wininet.dll
2007-08-22 14:57 669696 4f6a45b54d26708e2c2bf2c43d83edea C:\WINDOWS\ie7\wininet.dll
2007-08-13 19:54 818688 a4a0fc92358f39538a6494c42ef99fe9 C:\WINDOWS\ie7updates\KB939653-IE7\wininet.dll
2007-08-20 11:59 824832 f6dfceed3a7aa4c9eeb966d3f1adc70a C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
2007-10-11 01:49 824832 bc5119c53bdd48dabc628d448a3bdccb C:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll
2007-12-07 04:08 824832 4fc90bece54fac81b0090b94e27bfb6b C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll
2008-03-01 14:58 826368 8e027981ddffa690d456fe18b37415a0 C:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll
2007-08-20 11:59 824832 f6dfceed3a7aa4c9eeb966d3f1adc70a C:\WINDOWS\SoftwareDistribution\Download\36e241a7c6880a9ebdbe78b98d36306d\SP2GDR\wininet.dll
2007-08-20 11:49 825344 2dd1b0f579c80562edcb8848ff7ea9f6 C:\WINDOWS\SoftwareDistribution\Download\36e241a7c6880a9ebdbe78b98d36306d\SP2QFE\wininet.dll
2008-04-23 06:16 817152 d1524e4adae7db718e4d60889293d6d3 C:\WINDOWS\system32\wininet.dll
2008-04-23 06:16 817152 d1524e4adae7db718e4d60889293d6d3 C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\explorer.exe
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-05 07:00 1036288 4c33e5b9a6197b6ed215f6cfba0a2daa C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 07:00 15360]
"WOOKIT"="C:\Program Files\Wanadoo\Shell.exe" [2004-08-23 15:50 122880]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"Steam"="c:\program files\steam\steam.exe" [2008-06-09 18:09 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-21 16:28 282624]
"F-Secure Manager"="C:\Program Files\Pack Securite\Common\FSM32.EXE" [2007-04-26 19:12 183208]
"F-Secure TNB"="C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" [2007-04-26 19:10 740208]
"LifeChat"="C:\Program Files\Microsoft LifeChat\LifeChat.exe" [2007-01-26 14:31 259440]
"PD0620 STISvc"="P0620Pin.dll" [2005-05-10 19:03 36864 C:\WINDOWS\system32\P0620Pin.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 07:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe"=
"C:\\Program Files\\neuf Talk\\neuf Talk.exe"=
"C:\\Program Files\\MessengerDiscovery\\MessengerDiscovery Live.exe"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\Steam\\SteamApps\\alban46000\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\HLSW\\hlsw.exe"=
"C:\\Program Files\\S2SaTstrat\\stratplanner.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Steam\\SteamApps\\speedgamer378248\\counter-strike\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\louskyz\\condition zero\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\louskyz\\counter-strike\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\speedgamer378248\\half-life\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\speedgamer378248\\team fortress classic\\hl.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\javaw.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-07-12 19:38]
R0 m5287;m5287;C:\WINDOWS\system32\drivers\m5287.sys [2005-02-05 09:00]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Pack Securite\HIPS\fshs.sys [2008-07-12 19:37]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Pack Securite\Anti-Virus\minifilter\fsgk.sys [2007-04-26 19:07]
S3 AIDA32Driver;AIDA32Driver;C:\Program Files\AIDA32 - Personal System Information\aida32.sys [2004-02-23 04:07]
S3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 13:29]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Pack Securite\Anti-Virus\Win2K\FSfilter.sys [2007-04-26 19:08]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Pack Securite\Anti-Virus\Win2K\FSrec.sys [2007-04-26 19:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{326ba752-a107-11dc-8bcd-0011675d3790}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-VoipBuster - C:\program files\voipbuster.com\voipbuster\voipbuster.exe
HKCU-Run-WindowsLivePhone - C:\PROGRA~1\WI1F86~1\MESSEN~1\DEVICE~1\msgrdvmn.exe
HKLM-Run-EoEngine - (no file)
HKLM-Run-EoWeather - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://start.icq.com/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 -: { - C:\Program Files\Messenger\msmsgs.exe
O9 -: {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\armelle\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 -: {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com
O16 -: {029FDBA6-3547-11D7-AA4C-0050BF051A00} - hxxp://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
C:\WINDOWS\Downloaded Program Files\Rawflow.ocx
O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_2_0_4_12.cab
C:\WINDOWS\Downloaded Program Files\hardwaredetection.inf
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-30 13:26:14
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\WINDOWS\system32\PAStiSvc.exe
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Pack Securite\FWES\program\fsdfwd.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-30 13:39:58 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-30 11:39:45
Pre-Run: 3,470,376,960 octets libres
Post-Run: 8,856,854,528 octets libres
293
quelle étape je doit faire avec hijackthis ?????
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.406 [GMT 2:00]
Endroit: C:\Documents and Settings\alban\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
* Resident AV is active
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WA6P
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\stera.log
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_FOPN
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-28 to 2008-07-30 ))))))))))))))))))))))))))))))))))))
.
2008-07-29 17:20 . 2008-07-29 17:20 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-29 17:20 . 2008-07-29 17:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-29 17:20 . 2008-07-29 17:20 <REP> d-------- C:\Documents and Settings\alban\Application Data\Malwarebytes
2008-07-29 17:20 . 2008-07-23 20:09 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-07-29 17:20 . 2008-07-23 20:09 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-16 20:20 . 2004-08-04 00:45 32,128 --a------ C:\WINDOWS\system32\drivers\wceusbsh.sys
2008-07-16 20:20 . 2004-08-04 00:45 32,128 --a------ C:\WINDOWS\system32\dllcache\wceusbsh.sys
2008-07-16 13:00 . 2008-07-16 13:01 <REP> d-------- C:\Program Files\Microsoft LifeChat
2008-07-14 10:39 . 2008-07-14 10:39 <REP> d-------- C:\Documents and Settings\alban\Application Data\ICQ Toolbar
2008-07-12 19:28 . 2008-07-12 19:38 51,072 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-07-12 19:28 . 2008-07-12 19:38 30,016 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-07-12 19:23 . 2008-07-12 19:25 86,674,776 --a------ C:\Program Files\pack_securite.exe
2008-07-12 00:47 . 2008-07-12 00:47 4,898,144 --a------ C:\Program Files\LimeWireWin.exe
2008-07-11 14:46 . 2008-07-11 14:46 2,018,112 --a------ C:\Program Files\battlefield2-nocd-1_0-ENG.zip
2008-07-11 14:43 . 2008-07-11 14:43 1,270,342 --a------ C:\Program Files\winrar_winrar_3.71_francais_9632.exe
2008-07-11 01:18 . 2008-07-11 13:55 <REP> d-------- C:\Program Files\Anti-Blaxx
2008-07-11 00:27 . 2008-07-11 00:27 <REP> d-------- C:\Documents and Settings\alban\Support
2008-07-11 00:27 . 2008-07-11 00:27 <REP> d-------- C:\Documents and Settings\alban\RELOADED
2008-07-11 00:27 . 2008-07-11 00:27 <REP> d-------- C:\Documents and Settings\alban\Redist
2008-07-11 00:27 . 2008-07-11 00:27 <REP> d-------- C:\Documents and Settings\alban\nvidia_driver
2008-07-11 00:27 . 2008-07-11 00:27 <REP> d-------- C:\Documents and Settings\alban\directx
2008-07-11 00:27 . 2008-07-11 00:27 <REP> d-------- C:\Documents and Settings\alban\autorun
2008-07-11 00:26 . 2008-07-11 00:26 <REP> d-------- C:\Documents and Settings\alban\BFMC
2008-07-11 00:26 . 2004-10-22 07:16 118,736 --a------ C:\Documents and Settings\alban\setup.exe
2008-07-11 00:26 . 2005-05-23 02:22 10,023 --a------ C:\Documents and Settings\alban\layout.bin
2008-07-11 00:23 . 2005-05-23 02:22 1,187,840 --a------ C:\Documents and Settings\alban\Autorun.exe
2008-07-10 23:58 . 2008-07-10 23:59 <REP> d-------- C:\Program Files\DAEMON Tools Toolbar
2008-07-10 23:58 . 2008-07-10 23:59 <REP> d-------- C:\Program Files\DAEMON Tools Lite
2008-07-10 23:53 . 2008-07-10 23:53 <REP> d-------- C:\Documents and Settings\alban\Application Data\DAEMON Tools
2008-07-10 23:53 . 2008-07-10 23:53 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-07-10 23:52 . 2008-07-10 23:52 4,982,216 --a------ C:\Program Files\daemon4124-lite.exe
2008-07-10 14:02 . 2008-07-10 14:02 <REP> d-------- C:\Program Files\uTorrent
2008-07-10 14:02 . 2008-07-12 01:44 <REP> d-------- C:\Documents and Settings\alban\Application Data\uTorrent
2008-07-10 13:27 . 2008-07-15 16:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-07-10 13:27 . 2008-07-10 13:27 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-07 03:24 . 2008-07-11 19:45 137,840 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-07 03:23 . 2008-07-12 19:56 111,928 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-07-07 03:22 . 2008-07-07 03:22 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-07-07 02:16 . 2008-07-07 02:28 572,848,791 --a------ C:\Program Files\battlefield_2_demo_jouable_1_anglais_14661.exe
2008-07-06 01:48 . 2008-07-06 01:48 <REP> d-------- C:\Program Files\Lavalys
2008-07-06 01:48 . 2008-07-06 01:48 8,315,488 --a------ C:\Program Files\everestultimate450.exe
2008-07-06 01:20 . 2008-07-06 01:20 1,234,119 --a------ C:\Program Files\wrar38b2.exe
2008-07-05 19:53 . 2008-07-05 19:53 <REP> d-------- C:\Program Files\Alwil Software
2008-07-05 19:52 . 2008-07-12 19:11 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-05 19:51 . 2008-07-05 19:51 9,722,720 --a------ C:\Program Files\spybotsd152.exe
2008-07-05 19:50 . 2008-07-05 19:52 24,354,672 --a------ C:\Program Files\setupfre.exe
2008-07-05 19:45 . 2008-07-05 19:45 <REP> d-------- C:\Program Files\AIDA32 - Personal System Information
2008-07-05 19:44 . 2008-07-05 19:44 3,300,289 --a------ C:\Program Files\AIDA_32_3.93_Personnal_Edition.exe
2008-07-05 02:24 . 2008-07-05 02:24 <REP> d-------- C:\Documents and Settings\alban\Application Data\Windows Live Writer
2008-07-05 01:36 . 2008-07-05 01:36 64,372 --a------ C:\WINDOWS\BricoPackUninst.cmd
2008-07-05 01:35 . 2008-07-05 01:35 2,359,350 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
2008-07-05 01:31 . 2008-07-05 01:36 6,114 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-07-05 01:30 . 2008-07-05 01:30 <REP> d-------- C:\WINDOWS\BricoPacks
2008-07-01 14:47 . 2008-07-01 15:14 <REP> d-------- C:\Documents and Settings\alban\Application Data\Desperate Housewives
2008-06-11 06:52 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 06:52 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-09 18:07 . 2008-07-30 13:27 <REP> d-------- C:\Program Files\Steam
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-29 20:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-29 15:15 --------- d-----w C:\Documents and Settings\alban\Application Data\teamspeak2
2008-07-29 14:31 --------- d-----w C:\Documents and Settings\alban\Application Data\FileZilla
2008-07-27 19:33 --------- d-----w C:\Documents and Settings\alban\Application Data\Skype
2008-07-18 18:02 --------- d-----w C:\Documents and Settings\alban\Application Data\HLSW
2008-07-15 14:44 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-12 17:43 --------- d-----w C:\Program Files\Pack Securite
2008-07-12 17:37 --------- d-----w C:\Documents and Settings\alban\Application Data\Shareaza
2008-07-12 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\F-Secure
2008-07-12 17:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\fssg
2008-07-11 22:48 --------- d-----w C:\Program Files\LimeWire
2008-07-11 17:12 --------- d-----w C:\Program Files\EA GAMES
2008-07-11 12:42 1,271,557 ----a-w C:\Program Files\wrar371fr.exe
2008-07-10 11:59 19,858 ----a-w C:\Program Files\Battlefield 2.iso [mininova].torrent
2008-07-06 00:51 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-07-05 23:17 674 ----a-w C:\Program Files\WinRar v3.71+Crack [mininova].torrent
2008-07-04 23:36 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-07-04 23:36 219,648 ----a-w C:\WINDOWS\system32\dllcache\uxtheme.dll
2008-07-04 15:06 --------- d-----w C:\Program Files\FileZilla FTP Client
2008-07-01 12:42 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-06-24 10:29 --------- d-----w C:\Program Files\DivX
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-19 18:58 --------- d-----w C:\Documents and Settings\alban\Application Data\FaxCtr
2008-06-15 18:31 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-05-22 22:20 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-05-21 12:52 161,038,167 ----a-w C:\Program Files\DofusInstaller_v1_23_0.exe
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-23 20:16 3,864,576 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-22 07:41 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:41 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-21 19:51 290,816 ------w C:\WINDOWS\Setup1.exe
2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-02-21 18:13 4,477,356 ----a-w C:\Program Files\hlsw_1_2_1_setup(2).exe
2008-02-18 17:58 5,862,994 ----a-w C:\Program Files\ts2_client_rc2_2032.exe
2008-01-16 17:38 1,495,603 -c--a-w C:\Program Files\MDL_1.3.0322.exe
2008-01-13 14:15 642,796 ----a-w C:\Program Files\XviD-1.1.3-28062007.exe
2007-12-20 19:22 25,839,688 ----a-w C:\Program Files\wmp11-windowsxp-x86-FR-FR.exe
.
------- Sigcheck -------
2005-01-27 19:12 662016 66a10b98f18fd804236ab2d90301de04 C:\WINDOWS\$hf_mig$\KB867282\SP2QFE\wininet.dll
2005-05-02 22:58 663040 0996b57cc2abcb271872296e98a18db2 C:\WINDOWS\$hf_mig$\KB883939\SP2QFE\wininet.dll
2005-03-10 09:48 662016 06ad0b0f43286cd50af283762eb56763 C:\WINDOWS\$hf_mig$\KB890923\SP2QFE\wininet.dll
2005-07-03 04:10 663552 39846b1ac2b99349272ee6e075c3b8af C:\WINDOWS\$hf_mig$\KB896727\SP2QFE\wininet.dll
2007-08-20 11:49 825344 2dd1b0f579c80562edcb8848ff7ea9f6 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
2007-10-11 01:22 825344 871ae10d6ae8877e9636ae5017953d52 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
2007-12-07 03:42 825344 f4fd487241d3ac291046a22cebd2cf71 C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
2008-03-01 14:34 827392 5a0093f59b505c008ed0cee615563c72 C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
2008-04-23 09:19 827392 78d3d2b0be6ad3e6d82ccb115cf74310 C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
2004-08-05 07:00 660480 58fe94ef42e074f4cad8bf02e70e6478 C:\WINDOWS\$NtUninstallKB867282$\wininet.dll
2005-01-27 19:14 660992 b16b02f3c804f057dab099cc15ed0206 C:\WINDOWS\$NtUninstallKB883939$\wininet.dll
2005-05-02 22:57 662016 ffe3e6fb8d52955a2de4c6cc765b02bc C:\WINDOWS\$NtUninstallKB896727$\wininet.dll
2005-07-03 04:16 662528 e994e704303f07f331b03ee9ed6d9e2d C:\WINDOWS\$NtUninstallKB925454$\wininet.dll
2006-10-23 17:34 668672 efa0c2870cba1747809a13e09f35bf82 C:\WINDOWS\$NtUninstallKB928090$\wininet.dll
2007-01-04 16:02 669184 114342601ac7ea73b0d2a0ed8505b8b9 C:\WINDOWS\$NtUninstallKB931768$\wininet.dll
2007-02-19 17:23 669696 1bde6d5dba35797eca8db8fcb80fc015 C:\WINDOWS\$NtUninstallKB933566$\wininet.dll
2007-04-18 14:44 669696 a3bf56a786b277e881fd9137f55f0b4b C:\WINDOWS\$NtUninstallKB937143$\wininet.dll
2007-06-26 16:36 669696 19058fbdc72f7bae085369c6d0a7d074 C:\WINDOWS\$NtUninstallKB939653$\wininet.dll
2007-08-22 14:57 669696 4f6a45b54d26708e2c2bf2c43d83edea C:\WINDOWS\ie7\wininet.dll
2007-08-13 19:54 818688 a4a0fc92358f39538a6494c42ef99fe9 C:\WINDOWS\ie7updates\KB939653-IE7\wininet.dll
2007-08-20 11:59 824832 f6dfceed3a7aa4c9eeb966d3f1adc70a C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
2007-10-11 01:49 824832 bc5119c53bdd48dabc628d448a3bdccb C:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll
2007-12-07 04:08 824832 4fc90bece54fac81b0090b94e27bfb6b C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll
2008-03-01 14:58 826368 8e027981ddffa690d456fe18b37415a0 C:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll
2007-08-20 11:59 824832 f6dfceed3a7aa4c9eeb966d3f1adc70a C:\WINDOWS\SoftwareDistribution\Download\36e241a7c6880a9ebdbe78b98d36306d\SP2GDR\wininet.dll
2007-08-20 11:49 825344 2dd1b0f579c80562edcb8848ff7ea9f6 C:\WINDOWS\SoftwareDistribution\Download\36e241a7c6880a9ebdbe78b98d36306d\SP2QFE\wininet.dll
2008-04-23 06:16 817152 d1524e4adae7db718e4d60889293d6d3 C:\WINDOWS\system32\wininet.dll
2008-04-23 06:16 817152 d1524e4adae7db718e4d60889293d6d3 C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\explorer.exe
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-05 07:00 1036288 4c33e5b9a6197b6ed215f6cfba0a2daa C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 07:00 15360]
"WOOKIT"="C:\Program Files\Wanadoo\Shell.exe" [2004-08-23 15:50 122880]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"Steam"="c:\program files\steam\steam.exe" [2008-06-09 18:09 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-21 16:28 282624]
"F-Secure Manager"="C:\Program Files\Pack Securite\Common\FSM32.EXE" [2007-04-26 19:12 183208]
"F-Secure TNB"="C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" [2007-04-26 19:10 740208]
"LifeChat"="C:\Program Files\Microsoft LifeChat\LifeChat.exe" [2007-01-26 14:31 259440]
"PD0620 STISvc"="P0620Pin.dll" [2005-05-10 19:03 36864 C:\WINDOWS\system32\P0620Pin.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 07:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe"=
"C:\\Program Files\\neuf Talk\\neuf Talk.exe"=
"C:\\Program Files\\MessengerDiscovery\\MessengerDiscovery Live.exe"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\Steam\\SteamApps\\alban46000\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\HLSW\\hlsw.exe"=
"C:\\Program Files\\S2SaTstrat\\stratplanner.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Steam\\SteamApps\\speedgamer378248\\counter-strike\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\louskyz\\condition zero\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\louskyz\\counter-strike\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\speedgamer378248\\half-life\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\speedgamer378248\\team fortress classic\\hl.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\javaw.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-07-12 19:38]
R0 m5287;m5287;C:\WINDOWS\system32\drivers\m5287.sys [2005-02-05 09:00]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Pack Securite\HIPS\fshs.sys [2008-07-12 19:37]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Pack Securite\Anti-Virus\minifilter\fsgk.sys [2007-04-26 19:07]
S3 AIDA32Driver;AIDA32Driver;C:\Program Files\AIDA32 - Personal System Information\aida32.sys [2004-02-23 04:07]
S3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 13:29]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Pack Securite\Anti-Virus\Win2K\FSfilter.sys [2007-04-26 19:08]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Pack Securite\Anti-Virus\Win2K\FSrec.sys [2007-04-26 19:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{326ba752-a107-11dc-8bcd-0011675d3790}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-VoipBuster - C:\program files\voipbuster.com\voipbuster\voipbuster.exe
HKCU-Run-WindowsLivePhone - C:\PROGRA~1\WI1F86~1\MESSEN~1\DEVICE~1\msgrdvmn.exe
HKLM-Run-EoEngine - (no file)
HKLM-Run-EoWeather - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://start.icq.com/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 -: { - C:\Program Files\Messenger\msmsgs.exe
O9 -: {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\armelle\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 -: {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com
O16 -: {029FDBA6-3547-11D7-AA4C-0050BF051A00} - hxxp://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
C:\WINDOWS\Downloaded Program Files\Rawflow.ocx
O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_2_0_4_12.cab
C:\WINDOWS\Downloaded Program Files\hardwaredetection.inf
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-30 13:26:14
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\WINDOWS\system32\PAStiSvc.exe
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Pack Securite\FWES\program\fsdfwd.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-30 13:39:58 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-30 11:39:45
Pre-Run: 3,470,376,960 octets libres
Post-Run: 8,856,854,528 octets libres
293
quelle étape je doit faire avec hijackthis ?????
IronVI
Messages postés
72
Date d'inscription
lundi 28 juillet 2008
Statut
Membre
Dernière intervention
7 août 2008
7
30 juil. 2008 à 17:43
30 juil. 2008 à 17:43
rien de spécial, refait un log hijackthis
