Une fenetre norton antiv. apparait sans arret
Fermé
MYOSOS
-
29 août 2008 à 21:20
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 - 3 sept. 2008 à 15:56
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 - 3 sept. 2008 à 15:56
A voir également:
- Fenetre de norton
- Norton gratuit - Télécharger - Antivirus & Antimalwares
- Norton power eraser - Télécharger - Divers Utilitaires
- Raccourci agrandir fenetre - Guide
- Fenetre privée - Guide
- Norton utilities gratuit - Télécharger - Optimisation
4 réponses
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
29 août 2008 à 21:23
29 août 2008 à 21:23
salut
passe ceci :
Télécharge combofix.exe (par sUBs) sur ton Bureau.
-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
@+
passe ceci :
Télécharge combofix.exe (par sUBs) sur ton Bureau.
-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
@+
voilà j'ai fait l'analyse! mon pc a redémarré mais la fenetre norton est toujours là! je vous copie colle le rapport!que dois-je faire après çà svp?
ComboFix 08-08-29.02 - BIETZER NATHALIE 2008-08-29 22:50:03.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.386 [GMT 2:00]
Endroit: C:\Documents and Settings\BIETZER NATHALIE\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\License Agreement.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Uninstall.lnk
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\bin.clearspring.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\static.youku.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\static.youku.com\v1.0.0314\v\swf\qplayer.swf\qplayer.sol
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@ads.pointroll[1].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[1].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[2].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[3].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[5].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[6].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@edt02[1].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@edt02[2].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@serving-sys[2].txt
C:\Documents and Settings\BIETZER NATHALIE\Menu Démarrer\Programmes\Spyware-Secure
C:\WINDOWS\system32\a.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV
-------\Service_TDSSserv
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-28 to 2008-08-29 ))))))))))))))))))))))))))))))))))))
.
2008-08-29 16:30 . 2008-08-29 16:30 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-29 16:30 . 2008-08-29 16:30 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\Application Data\Malwarebytes
2008-08-29 16:30 . 2008-08-29 16:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-29 16:30 . 2008-08-17 15:05 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-29 16:30 . 2008-08-17 15:05 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-24 20:07 . 2008-08-24 20:07 <REP> d-------- C:\Program Files\Veoh Networks
2008-08-24 17:00 . 2008-08-24 17:00 <REP> d-------- C:\Program Files\DivX
2008-08-19 21:10 . 2008-08-29 21:21 <REP> d-------- C:\Program Files\mIRC
2008-08-19 21:10 . 2008-08-29 22:21 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\Application Data\mIRC
2008-08-18 13:39 . 2008-08-18 13:39 <REP> d-------- C:\Program Files\Sun
2008-08-18 13:39 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-18 13:36 . 2008-08-18 13:36 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-08-18 01:07 . 2008-08-18 01:07 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-08-18 00:50 . 2008-08-18 00:52 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\.SunDownloadManager
2008-08-18 00:17 . 2008-06-23 18:28 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-08-18 00:17 . 2007-04-17 11:32 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-08-18 00:17 . 2007-03-08 07:10 1,048,576 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-08-18 00:17 . 2008-06-23 18:28 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-08-18 00:17 . 2008-06-23 18:28 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-08-18 00:17 . 2008-06-23 18:28 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-08-18 00:17 . 2008-06-23 18:28 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll
2008-08-18 00:17 . 2008-06-23 18:28 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-08-18 00:17 . 2008-06-23 11:20 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-16 21:25 . 2008-08-29 12:43 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-16 21:25 . 2008-08-16 21:25 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-16 20:04 . 2008-05-01 16:31 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-07 19:13 . 2008-08-07 19:13 <REP> d-------- C:\Program Files\ViaMichelin
2008-08-07 19:12 . 2006-04-10 18:05 104,576 --a------ C:\WINDOWS\system32\drivers\wceusbsh.sys
2008-08-07 19:12 . 2006-04-10 18:05 104,576 --a------ C:\WINDOWS\system32\dllcache\wceusbsh.sys
2008-08-07 19:10 . 2005-10-21 03:47 30,592 --------- C:\WINDOWS\system32\drivers\rndismpx.sys
2008-08-07 19:10 . 2005-10-21 03:47 12,800 --------- C:\WINDOWS\system32\drivers\usb8023x.sys
2008-08-07 19:09 . 2008-08-24 20:07 <REP> d-------- C:\WINDOWS\Downloaded Installations
2008-08-07 19:09 . 2008-08-07 19:24 <REP> d-------- C:\Program Files\Microsoft ActiveSync
2008-07-29 18:48 . 2008-07-29 18:48 <REP> d-------- C:\Program Files\XnView
2008-07-29 18:48 . 2008-08-29 15:44 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\Application Data\XnView
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 20:24 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-08-29 11:53 --------- d-----w C:\Program Files\Navilog1
2008-08-28 22:06 --------- d-----w C:\Program Files\Norton Internet Security
2008-08-24 18:08 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-18 11:39 --------- d-----w C:\Program Files\Java
2008-07-19 14:06 --------- d-----w C:\Documents and Settings\BIETZER NATHALIE\Application Data\Search Settings
2008-07-19 13:45 --------- d-----w C:\Program Files\Search Settings
2008-07-19 13:45 --------- d-----w C:\Program Files\Dealio
2008-07-19 13:45 --------- d-----w C:\Documents and Settings\BIETZER NATHALIE\Application Data\Dealio
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="C:\APPS\SMP\SmpSys.exe" [2005-11-17 10:51 975360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-06 13:39 68856]
"EPSON Stylus DX4400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE" [2007-03-01 08:01 180736]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15:00 15360]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-13 18:06 3660848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 15:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 15:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 15:00 455168]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 15:01 67584]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-28 16:13 766041]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 19:51 53248]
"DetectorApp"="C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 07:15 102400]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2005-09-17 00:27 52848]
"IS CfgWiz"="C:\Program Files\Norton Internet Security\cfgwiz.exe" [2005-09-29 22:33 120464]
"SSC_UserPrompt"="C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-10 12:57 218240]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-12-01 10:33 158720]
"EULA"="C:\APPS\PB_TB\EULALauncher.exe" [2006-09-29 14:14 18944]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-12-01 10:18 26112]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 02:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 02:13 774168]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-24 12:13 266497]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"au"="C:\Program Files\Dealio\DealioAU.exe" [2008-05-26 19:50 595296]
"SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2008-06-12 16:57 991584]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 16:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 15:00 15360]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AOL 9.0\\waol.exe"=
"C:\\APPS\\skype\\phone\\Skype.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
S3 2ac0dfe5-ab9e-482a-be9c-f0a5caba5bfb;2ac0dfe5-ab9e-482a-be9c-f0a5caba5bfb;D:\Player\cds300.dll []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
*Newly Created Service* - COMHOST
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
2008-08-29 C:\WINDOWS\Tasks\Master CD_DVD Creator.job
- C:\Apps\SMP\MCDCHECK.EXE [2005-11-08 16:26]
2007-01-11 C:\WINDOWS\Tasks\Rappel d'enregistrement 3.job
- C:\WINDOWS\system32\OOBE\oobebaln.exe [2004-08-10 15:00]
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\BIETZER NATHALIE\Application Data\Mozilla\Firefox\Profiles\46h1abij.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://fr.search.yahoo.com/search?ei=UTF-8&fr=ytff-divx&p=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.orange.fr
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 23:00:14
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\system32\ATL.DLL
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LQCVFX\COCIManager.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Messenger\msmsgs.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-29 23:11:01 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-29 21:10:33
Pre-Run: 30,224,347,136 octets libres
Post-Run: 33,590,427,648 octets libres
234 --- E O F --- 2008-08-29 10:15:54
ComboFix 08-08-29.02 - BIETZER NATHALIE 2008-08-29 22:50:03.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.386 [GMT 2:00]
Endroit: C:\Documents and Settings\BIETZER NATHALIE\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\License Agreement.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Uninstall.lnk
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\bin.clearspring.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\static.youku.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\static.youku.com\v1.0.0314\v\swf\qplayer.swf\qplayer.sol
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@ads.pointroll[1].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[1].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[2].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[3].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[5].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[6].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@edt02[1].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@edt02[2].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@serving-sys[2].txt
C:\Documents and Settings\BIETZER NATHALIE\Menu Démarrer\Programmes\Spyware-Secure
C:\WINDOWS\system32\a.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV
-------\Service_TDSSserv
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-28 to 2008-08-29 ))))))))))))))))))))))))))))))))))))
.
2008-08-29 16:30 . 2008-08-29 16:30 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-29 16:30 . 2008-08-29 16:30 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\Application Data\Malwarebytes
2008-08-29 16:30 . 2008-08-29 16:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-29 16:30 . 2008-08-17 15:05 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-29 16:30 . 2008-08-17 15:05 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-24 20:07 . 2008-08-24 20:07 <REP> d-------- C:\Program Files\Veoh Networks
2008-08-24 17:00 . 2008-08-24 17:00 <REP> d-------- C:\Program Files\DivX
2008-08-19 21:10 . 2008-08-29 21:21 <REP> d-------- C:\Program Files\mIRC
2008-08-19 21:10 . 2008-08-29 22:21 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\Application Data\mIRC
2008-08-18 13:39 . 2008-08-18 13:39 <REP> d-------- C:\Program Files\Sun
2008-08-18 13:39 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-18 13:36 . 2008-08-18 13:36 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-08-18 01:07 . 2008-08-18 01:07 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-08-18 00:50 . 2008-08-18 00:52 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\.SunDownloadManager
2008-08-18 00:17 . 2008-06-23 18:28 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-08-18 00:17 . 2007-04-17 11:32 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-08-18 00:17 . 2007-03-08 07:10 1,048,576 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-08-18 00:17 . 2008-06-23 18:28 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-08-18 00:17 . 2008-06-23 18:28 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-08-18 00:17 . 2008-06-23 18:28 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-08-18 00:17 . 2008-06-23 18:28 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll
2008-08-18 00:17 . 2008-06-23 18:28 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-08-18 00:17 . 2008-06-23 11:20 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-16 21:25 . 2008-08-29 12:43 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-16 21:25 . 2008-08-16 21:25 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-16 20:04 . 2008-05-01 16:31 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-07 19:13 . 2008-08-07 19:13 <REP> d-------- C:\Program Files\ViaMichelin
2008-08-07 19:12 . 2006-04-10 18:05 104,576 --a------ C:\WINDOWS\system32\drivers\wceusbsh.sys
2008-08-07 19:12 . 2006-04-10 18:05 104,576 --a------ C:\WINDOWS\system32\dllcache\wceusbsh.sys
2008-08-07 19:10 . 2005-10-21 03:47 30,592 --------- C:\WINDOWS\system32\drivers\rndismpx.sys
2008-08-07 19:10 . 2005-10-21 03:47 12,800 --------- C:\WINDOWS\system32\drivers\usb8023x.sys
2008-08-07 19:09 . 2008-08-24 20:07 <REP> d-------- C:\WINDOWS\Downloaded Installations
2008-08-07 19:09 . 2008-08-07 19:24 <REP> d-------- C:\Program Files\Microsoft ActiveSync
2008-07-29 18:48 . 2008-07-29 18:48 <REP> d-------- C:\Program Files\XnView
2008-07-29 18:48 . 2008-08-29 15:44 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\Application Data\XnView
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 20:24 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-08-29 11:53 --------- d-----w C:\Program Files\Navilog1
2008-08-28 22:06 --------- d-----w C:\Program Files\Norton Internet Security
2008-08-24 18:08 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-18 11:39 --------- d-----w C:\Program Files\Java
2008-07-19 14:06 --------- d-----w C:\Documents and Settings\BIETZER NATHALIE\Application Data\Search Settings
2008-07-19 13:45 --------- d-----w C:\Program Files\Search Settings
2008-07-19 13:45 --------- d-----w C:\Program Files\Dealio
2008-07-19 13:45 --------- d-----w C:\Documents and Settings\BIETZER NATHALIE\Application Data\Dealio
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="C:\APPS\SMP\SmpSys.exe" [2005-11-17 10:51 975360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-06 13:39 68856]
"EPSON Stylus DX4400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE" [2007-03-01 08:01 180736]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15:00 15360]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-13 18:06 3660848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 15:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 15:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 15:00 455168]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 15:01 67584]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-28 16:13 766041]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 19:51 53248]
"DetectorApp"="C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 07:15 102400]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2005-09-17 00:27 52848]
"IS CfgWiz"="C:\Program Files\Norton Internet Security\cfgwiz.exe" [2005-09-29 22:33 120464]
"SSC_UserPrompt"="C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-10 12:57 218240]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-12-01 10:33 158720]
"EULA"="C:\APPS\PB_TB\EULALauncher.exe" [2006-09-29 14:14 18944]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-12-01 10:18 26112]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 02:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 02:13 774168]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-24 12:13 266497]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"au"="C:\Program Files\Dealio\DealioAU.exe" [2008-05-26 19:50 595296]
"SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2008-06-12 16:57 991584]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 16:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 15:00 15360]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AOL 9.0\\waol.exe"=
"C:\\APPS\\skype\\phone\\Skype.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
S3 2ac0dfe5-ab9e-482a-be9c-f0a5caba5bfb;2ac0dfe5-ab9e-482a-be9c-f0a5caba5bfb;D:\Player\cds300.dll []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
*Newly Created Service* - COMHOST
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
2008-08-29 C:\WINDOWS\Tasks\Master CD_DVD Creator.job
- C:\Apps\SMP\MCDCHECK.EXE [2005-11-08 16:26]
2007-01-11 C:\WINDOWS\Tasks\Rappel d'enregistrement 3.job
- C:\WINDOWS\system32\OOBE\oobebaln.exe [2004-08-10 15:00]
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\BIETZER NATHALIE\Application Data\Mozilla\Firefox\Profiles\46h1abij.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://fr.search.yahoo.com/search?ei=UTF-8&fr=ytff-divx&p=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.orange.fr
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 23:00:14
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\system32\ATL.DLL
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LQCVFX\COCIManager.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Messenger\msmsgs.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-29 23:11:01 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-29 21:10:33
Pre-Run: 30,224,347,136 octets libres
Post-Run: 33,590,427,648 octets libres
234 --- E O F --- 2008-08-29 10:15:54
voilà j'ai fait l'analyse! mon pc a redémarré mais la fenetre norton est toujours là! je vous copie colle le rapport!que dois-je faire après çà svp?
ComboFix 08-08-29.02 - BIETZER NATHALIE 2008-08-29 22:50:03.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.386 [GMT 2:00]
Endroit: C:\Documents and Settings\BIETZER NATHALIE\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\License Agreement.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Uninstall.lnk
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\bin.clearspring.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\static.youku.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\static.youku.com\v1.0.0314\v\swf\qplayer.swf\qplayer.sol
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@ads.pointroll[1].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[1].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[2].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[3].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[5].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[6].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@edt02[1].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@edt02[2].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@serving-sys[2].txt
C:\Documents and Settings\BIETZER NATHALIE\Menu Démarrer\Programmes\Spyware-Secure
C:\WINDOWS\system32\a.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV
-------\Service_TDSSserv
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-28 to 2008-08-29 ))))))))))))))))))))))))))))))))))))
.
2008-08-29 16:30 . 2008-08-29 16:30 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-29 16:30 . 2008-08-29 16:30 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\Application Data\Malwarebytes
2008-08-29 16:30 . 2008-08-29 16:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-29 16:30 . 2008-08-17 15:05 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-29 16:30 . 2008-08-17 15:05 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-24 20:07 . 2008-08-24 20:07 <REP> d-------- C:\Program Files\Veoh Networks
2008-08-24 17:00 . 2008-08-24 17:00 <REP> d-------- C:\Program Files\DivX
2008-08-19 21:10 . 2008-08-29 21:21 <REP> d-------- C:\Program Files\mIRC
2008-08-19 21:10 . 2008-08-29 22:21 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\Application Data\mIRC
2008-08-18 13:39 . 2008-08-18 13:39 <REP> d-------- C:\Program Files\Sun
2008-08-18 13:39 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-18 13:36 . 2008-08-18 13:36 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-08-18 01:07 . 2008-08-18 01:07 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-08-18 00:50 . 2008-08-18 00:52 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\.SunDownloadManager
2008-08-18 00:17 . 2008-06-23 18:28 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-08-18 00:17 . 2007-04-17 11:32 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-08-18 00:17 . 2007-03-08 07:10 1,048,576 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-08-18 00:17 . 2008-06-23 18:28 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-08-18 00:17 . 2008-06-23 18:28 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-08-18 00:17 . 2008-06-23 18:28 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-08-18 00:17 . 2008-06-23 18:28 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll
2008-08-18 00:17 . 2008-06-23 18:28 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-08-18 00:17 . 2008-06-23 11:20 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-16 21:25 . 2008-08-29 12:43 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-16 21:25 . 2008-08-16 21:25 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-16 20:04 . 2008-05-01 16:31 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-07 19:13 . 2008-08-07 19:13 <REP> d-------- C:\Program Files\ViaMichelin
2008-08-07 19:12 . 2006-04-10 18:05 104,576 --a------ C:\WINDOWS\system32\drivers\wceusbsh.sys
2008-08-07 19:12 . 2006-04-10 18:05 104,576 --a------ C:\WINDOWS\system32\dllcache\wceusbsh.sys
2008-08-07 19:10 . 2005-10-21 03:47 30,592 --------- C:\WINDOWS\system32\drivers\rndismpx.sys
2008-08-07 19:10 . 2005-10-21 03:47 12,800 --------- C:\WINDOWS\system32\drivers\usb8023x.sys
2008-08-07 19:09 . 2008-08-24 20:07 <REP> d-------- C:\WINDOWS\Downloaded Installations
2008-08-07 19:09 . 2008-08-07 19:24 <REP> d-------- C:\Program Files\Microsoft ActiveSync
2008-07-29 18:48 . 2008-07-29 18:48 <REP> d-------- C:\Program Files\XnView
2008-07-29 18:48 . 2008-08-29 15:44 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\Application Data\XnView
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 20:24 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-08-29 11:53 --------- d-----w C:\Program Files\Navilog1
2008-08-28 22:06 --------- d-----w C:\Program Files\Norton Internet Security
2008-08-24 18:08 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-18 11:39 --------- d-----w C:\Program Files\Java
2008-07-19 14:06 --------- d-----w C:\Documents and Settings\BIETZER NATHALIE\Application Data\Search Settings
2008-07-19 13:45 --------- d-----w C:\Program Files\Search Settings
2008-07-19 13:45 --------- d-----w C:\Program Files\Dealio
2008-07-19 13:45 --------- d-----w C:\Documents and Settings\BIETZER NATHALIE\Application Data\Dealio
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="C:\APPS\SMP\SmpSys.exe" [2005-11-17 10:51 975360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-06 13:39 68856]
"EPSON Stylus DX4400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE" [2007-03-01 08:01 180736]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15:00 15360]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-13 18:06 3660848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 15:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 15:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 15:00 455168]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 15:01 67584]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-28 16:13 766041]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 19:51 53248]
"DetectorApp"="C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 07:15 102400]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2005-09-17 00:27 52848]
"IS CfgWiz"="C:\Program Files\Norton Internet Security\cfgwiz.exe" [2005-09-29 22:33 120464]
"SSC_UserPrompt"="C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-10 12:57 218240]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-12-01 10:33 158720]
"EULA"="C:\APPS\PB_TB\EULALauncher.exe" [2006-09-29 14:14 18944]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-12-01 10:18 26112]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 02:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 02:13 774168]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-24 12:13 266497]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"au"="C:\Program Files\Dealio\DealioAU.exe" [2008-05-26 19:50 595296]
"SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2008-06-12 16:57 991584]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 16:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 15:00 15360]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AOL 9.0\\waol.exe"=
"C:\\APPS\\skype\\phone\\Skype.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
S3 2ac0dfe5-ab9e-482a-be9c-f0a5caba5bfb;2ac0dfe5-ab9e-482a-be9c-f0a5caba5bfb;D:\Player\cds300.dll []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
*Newly Created Service* - COMHOST
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
2008-08-29 C:\WINDOWS\Tasks\Master CD_DVD Creator.job
- C:\Apps\SMP\MCDCHECK.EXE [2005-11-08 16:26]
2007-01-11 C:\WINDOWS\Tasks\Rappel d'enregistrement 3.job
- C:\WINDOWS\system32\OOBE\oobebaln.exe [2004-08-10 15:00]
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\BIETZER NATHALIE\Application Data\Mozilla\Firefox\Profiles\46h1abij.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://fr.search.yahoo.com/search?ei=UTF-8&fr=ytff-divx&p=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.orange.fr
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 23:00:14
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\system32\ATL.DLL
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LQCVFX\COCIManager.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Messenger\msmsgs.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-29 23:11:01 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-29 21:10:33
Pre-Run: 30,224,347,136 octets libres
Post-Run: 33,590,427,648 octets libres
234 --- E O F --- 2008-08-29 10:15:54
ComboFix 08-08-29.02 - BIETZER NATHALIE 2008-08-29 22:50:03.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.386 [GMT 2:00]
Endroit: C:\Documents and Settings\BIETZER NATHALIE\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\License Agreement.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Uninstall.lnk
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\bin.clearspring.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\static.youku.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\#SharedObjects\C88JH8GQ\static.youku.com\v1.0.0314\v\swf\qplayer.swf\qplayer.sol
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
C:\Documents and Settings\BIETZER NATHALIE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@ads.pointroll[1].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[1].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[2].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[3].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[5].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@bluestreak[6].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@edt02[1].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@edt02[2].txt
C:\Documents and Settings\BIETZER NATHALIE\Cookies\bietzer nathalie@serving-sys[2].txt
C:\Documents and Settings\BIETZER NATHALIE\Menu Démarrer\Programmes\Spyware-Secure
C:\WINDOWS\system32\a.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV
-------\Service_TDSSserv
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-28 to 2008-08-29 ))))))))))))))))))))))))))))))))))))
.
2008-08-29 16:30 . 2008-08-29 16:30 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-29 16:30 . 2008-08-29 16:30 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\Application Data\Malwarebytes
2008-08-29 16:30 . 2008-08-29 16:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-29 16:30 . 2008-08-17 15:05 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-29 16:30 . 2008-08-17 15:05 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-24 20:07 . 2008-08-24 20:07 <REP> d-------- C:\Program Files\Veoh Networks
2008-08-24 17:00 . 2008-08-24 17:00 <REP> d-------- C:\Program Files\DivX
2008-08-19 21:10 . 2008-08-29 21:21 <REP> d-------- C:\Program Files\mIRC
2008-08-19 21:10 . 2008-08-29 22:21 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\Application Data\mIRC
2008-08-18 13:39 . 2008-08-18 13:39 <REP> d-------- C:\Program Files\Sun
2008-08-18 13:39 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-18 13:36 . 2008-08-18 13:36 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-08-18 01:07 . 2008-08-18 01:07 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-08-18 00:50 . 2008-08-18 00:52 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\.SunDownloadManager
2008-08-18 00:17 . 2008-06-23 18:28 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-08-18 00:17 . 2007-04-17 11:32 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-08-18 00:17 . 2007-03-08 07:10 1,048,576 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-08-18 00:17 . 2008-06-23 18:28 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-08-18 00:17 . 2008-06-23 18:28 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-08-18 00:17 . 2008-06-23 18:28 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-08-18 00:17 . 2008-06-23 18:28 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll
2008-08-18 00:17 . 2008-06-23 18:28 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-08-18 00:17 . 2008-06-23 11:20 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-16 21:25 . 2008-08-29 12:43 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-16 21:25 . 2008-08-16 21:25 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-16 20:04 . 2008-05-01 16:31 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-07 19:13 . 2008-08-07 19:13 <REP> d-------- C:\Program Files\ViaMichelin
2008-08-07 19:12 . 2006-04-10 18:05 104,576 --a------ C:\WINDOWS\system32\drivers\wceusbsh.sys
2008-08-07 19:12 . 2006-04-10 18:05 104,576 --a------ C:\WINDOWS\system32\dllcache\wceusbsh.sys
2008-08-07 19:10 . 2005-10-21 03:47 30,592 --------- C:\WINDOWS\system32\drivers\rndismpx.sys
2008-08-07 19:10 . 2005-10-21 03:47 12,800 --------- C:\WINDOWS\system32\drivers\usb8023x.sys
2008-08-07 19:09 . 2008-08-24 20:07 <REP> d-------- C:\WINDOWS\Downloaded Installations
2008-08-07 19:09 . 2008-08-07 19:24 <REP> d-------- C:\Program Files\Microsoft ActiveSync
2008-07-29 18:48 . 2008-07-29 18:48 <REP> d-------- C:\Program Files\XnView
2008-07-29 18:48 . 2008-08-29 15:44 <REP> d-------- C:\Documents and Settings\BIETZER NATHALIE\Application Data\XnView
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 20:24 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-08-29 11:53 --------- d-----w C:\Program Files\Navilog1
2008-08-28 22:06 --------- d-----w C:\Program Files\Norton Internet Security
2008-08-24 18:08 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-18 11:39 --------- d-----w C:\Program Files\Java
2008-07-19 14:06 --------- d-----w C:\Documents and Settings\BIETZER NATHALIE\Application Data\Search Settings
2008-07-19 13:45 --------- d-----w C:\Program Files\Search Settings
2008-07-19 13:45 --------- d-----w C:\Program Files\Dealio
2008-07-19 13:45 --------- d-----w C:\Documents and Settings\BIETZER NATHALIE\Application Data\Dealio
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="C:\APPS\SMP\SmpSys.exe" [2005-11-17 10:51 975360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-06 13:39 68856]
"EPSON Stylus DX4400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE" [2007-03-01 08:01 180736]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15:00 15360]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-13 18:06 3660848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 15:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 15:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 15:00 455168]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 15:01 67584]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-28 16:13 766041]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 19:51 53248]
"DetectorApp"="C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 07:15 102400]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2005-09-17 00:27 52848]
"IS CfgWiz"="C:\Program Files\Norton Internet Security\cfgwiz.exe" [2005-09-29 22:33 120464]
"SSC_UserPrompt"="C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-10 12:57 218240]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-12-01 10:33 158720]
"EULA"="C:\APPS\PB_TB\EULALauncher.exe" [2006-09-29 14:14 18944]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-12-01 10:18 26112]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 02:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 02:13 774168]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-24 12:13 266497]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"au"="C:\Program Files\Dealio\DealioAU.exe" [2008-05-26 19:50 595296]
"SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2008-06-12 16:57 991584]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 16:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 15:00 15360]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AOL 9.0\\waol.exe"=
"C:\\APPS\\skype\\phone\\Skype.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
S3 2ac0dfe5-ab9e-482a-be9c-f0a5caba5bfb;2ac0dfe5-ab9e-482a-be9c-f0a5caba5bfb;D:\Player\cds300.dll []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
*Newly Created Service* - COMHOST
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
2008-08-29 C:\WINDOWS\Tasks\Master CD_DVD Creator.job
- C:\Apps\SMP\MCDCHECK.EXE [2005-11-08 16:26]
2007-01-11 C:\WINDOWS\Tasks\Rappel d'enregistrement 3.job
- C:\WINDOWS\system32\OOBE\oobebaln.exe [2004-08-10 15:00]
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\BIETZER NATHALIE\Application Data\Mozilla\Firefox\Profiles\46h1abij.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://fr.search.yahoo.com/search?ei=UTF-8&fr=ytff-divx&p=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.orange.fr
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 23:00:14
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\system32\ATL.DLL
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LQCVFX\COCIManager.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Messenger\msmsgs.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-29 23:11:01 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-29 21:10:33
Pre-Run: 30,224,347,136 octets libres
Post-Run: 33,590,427,648 octets libres
234 --- E O F --- 2008-08-29 10:15:54
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
3 sept. 2008 à 15:56
3 sept. 2008 à 15:56
Salut Mycosos,
excuse pour le retard,
post un nouveau rapport hijack this stp
@+
excuse pour le retard,
post un nouveau rapport hijack this stp
@+