SVP trojans trouvés
Fermé
managercherif
-
12 nov. 2008 à 06:56
sherred Messages postés 8346 Date d'inscription samedi 26 janvier 2008 Statut Membre Dernière intervention 25 mars 2024 - 12 nov. 2008 à 09:22
sherred Messages postés 8346 Date d'inscription samedi 26 janvier 2008 Statut Membre Dernière intervention 25 mars 2024 - 12 nov. 2008 à 09:22
A voir également:
- SVP trojans trouvés
- Anti trojans - Télécharger - Antivirus & Antimalwares
- Comment supprimé les trojans aaa,bbb,ccc ... - Forum Virus
- Recherche des trojans/virus sur mon MAC, gros problème - Forum MacOS
- Filtres non trouvés pas de flux ??? - Forum Windows
- Trojan ou virus je ne ses pas aider moi svp - Forum Virus
1 réponse
sherred
Messages postés
8346
Date d'inscription
samedi 26 janvier 2008
Statut
Membre
Dernière intervention
25 mars 2024
350
12 nov. 2008 à 07:05
12 nov. 2008 à 07:05
télechargez ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html
Lancez HijackThis en double cliquant sur son icône puis cliquez sur le bouton do a system scan and save a logfile
Le rapport est retranscrit aussitôt apres le scan dans une fenêtre de type Bloc-notes
il vous suffit de realiser un copier/coller et de le poster dans le forum
Lancez HijackThis en double cliquant sur son icône puis cliquez sur le bouton do a system scan and save a logfile
Le rapport est retranscrit aussitôt apres le scan dans une fenêtre de type Bloc-notes
il vous suffit de realiser un copier/coller et de le poster dans le forum
12 nov. 2008 à 07:09
voici le rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:08:59, on 12/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\VM303_STI.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\SimpleCenter\bin\win\sclauncher.exe
C:\Program Files\Atheros\ACU.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe
C:\Program Files\DAP Premium\DAP.EXE
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\WINDOWS\system32\lxcycoms.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [PC Booster] C:\Program Files\inKline Global\PC Booster\pcbooster.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LXCYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [sclauncher] C:\Program Files\SimpleCenter\bin\win\sclauncher.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DownloadAccelerator] "C:\Program Files\DAP Premium\DAP.EXE" /STARTUP
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP Premium\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP Premium\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP Premium\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) -
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Service de configuration Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: lxcy_device - - C:\WINDOWS\system32\lxcycoms.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe (file missing)
O23 - Service: McAfee McShield (McShield) - Unknown owner - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe (file missing)
O23 - Service: McAfee Task Manager (McTaskManager) - Unknown owner - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
12 nov. 2008 à 07:32
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Déconnecte toi d'internet ferme les fenêtres de tous les programmes en cours.et provisoirement
arrete les anti virus et autres protection pendand l'analyse
coupe egalement Spybot
Pendant la durée de l'analyse ne te sert pas de ton pc
clique combofix.exe.
touche 1 (Yes) pour démarrer le scan.
une fois fini un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
Le rapport se trouve également ici : C:\Combofix.txt
une fois l'analyse terminé ,remet toute tes protections antivirus et antispywares
12 nov. 2008 à 07:52
ComboFix 08-11-11.01 - Administrateur 2008-11-12 7:41:27.4 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.916 [GMT 1:00]
Lancé depuis: c:\documents and settings\Administrateur\Mes documents\My Completed Downloads\ComboFix.exe
* Un nouveau point de restauration a été créé
[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-12 au 2008-11-12 ))))))))))))))))))))))))))))))))))))
.
2008-11-11 17:46 . 2008-11-11 17:46 <REP> d-------- c:\program files\MP3 Player Utilities
2008-11-11 17:45 . 2004-05-14 07:21 6,850 -ra------ c:\windows\Disktool.INI
2008-11-11 17:45 . 2004-09-29 08:53 6,057 -ra------ c:\windows\fwupgrade.ini
2008-11-11 17:45 . 2004-05-12 03:28 3,677 -ra------ c:\windows\PlaySnd.INI
2008-11-06 11:20 . 2008-11-06 11:20 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-11-05 10:37 . 2008-11-05 10:53 <REP> d-------- c:\windows\BDOSCAN8
2008-11-05 07:21 . 2008-11-05 07:21 <REP> d-------- c:\documents and settings\Administrateur\Application Data\Malwarebytes
2008-11-05 07:20 . 2008-11-05 07:22 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-05 07:20 . 2008-11-05 07:20 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-05 07:20 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-05 07:20 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-10-30 14:03 . 2008-10-30 14:03 <REP> d-------- c:\documents and settings\Administrateur\Application Data\Leadertech
2008-10-29 06:30 . 2008-10-29 06:30 <REP> d-------- c:\program files\VSO
2008-10-29 06:30 . 2008-10-30 14:36 <REP> d-------- c:\documents and settings\Administrateur\Application Data\Vso
2008-10-28 11:53 . 2008-10-28 11:53 <REP> d-------- c:\documents and settings\Administrateur\Application Data\AdobeUM
2008-10-28 06:37 . 2008-10-28 06:37 <REP> d-------- c:\program files\Micro Application
2008-10-25 12:38 . 2008-10-25 12:38 <REP> d-------- c:\documents and settings\All Users\Application Data\Micro Application
2008-10-23 07:20 . 2008-10-23 07:20 <REP> d-------- c:\program files\PDFCreator Toolbar
2008-10-23 07:20 . 2008-10-23 07:21 <REP> d-------- c:\program files\PDFCreator
2008-10-23 07:20 . 2008-10-23 07:20 253,139 --a------ c:\windows\PDFCreator_Toolbar_Uninstaller_5250.exe
2008-10-23 07:20 . 1998-07-13 01:08 141,312 --a------ c:\windows\system32\MSCMCFR.DLL
2008-10-23 07:20 . 2001-10-28 16:42 116,224 --a------ c:\windows\system32\pdfcmnnt.dll
2008-10-23 07:20 . 1998-07-06 00:00 23,552 --a------ c:\windows\system32\MSMPIDE.DLL
2008-10-23 07:01 . 2008-10-23 07:01 <REP> d-------- c:\program files\Free PDF to Word Doc Converter
2008-10-23 06:34 . 2008-10-30 14:03 <REP> dr------- C:\UDC Output Files
2008-10-16 09:02 . 2008-10-16 13:46 <REP> d-------- c:\program files\NOS
2008-10-16 09:02 . 2008-10-16 13:46 <REP> d-------- c:\documents and settings\All Users\Application Data\NOS
2008-10-14 11:24 . 2008-10-14 11:24 50 --a------ c:\windows\MegaManager.INI
2008-10-14 11:20 . 2008-10-14 11:20 <REP> d-------- c:\documents and settings\All Users\Application Data\Megaupload
2008-10-14 11:20 . 2008-10-14 11:20 <REP> d-------- c:\documents and settings\All Users\Application Data\EmailNotifier
2008-10-14 11:20 . 2008-10-14 11:20 <REP> d-------- c:\documents and settings\Administrateur\Application Data\EmailNotifier
2008-10-14 10:07 . 2006-08-01 14:02 49,152 --a------ c:\windows\system32\ChCfg.exe
2008-10-14 10:07 . 2007-11-14 14:18 553 --a------ c:\windows\USetup.iss
2008-10-14 10:05 . 2008-03-05 17:07 520,192 --a------ c:\windows\RtlExUpd.dll
2008-10-14 10:05 . 2008-10-14 10:05 315,392 --a------ c:\windows\HideWin.exe
2008-10-14 09:50 . 2008-10-14 10:53 <REP> d-------- C:\Driver Download
2008-10-14 09:44 . 2008-10-14 09:44 <REP> d-------- c:\program files\Driver-Soft
2008-10-13 22:36 . 2008-10-13 22:36 17,801 --a------ c:\windows\system32\drivers\AegisP.sys
2008-10-13 22:35 . 2008-10-13 22:35 <REP> d-------- c:\program files\NETGEAR
2008-10-13 13:08 . 2006-07-14 14:13 360,533 --a------ c:\windows\system32\acs.exe
2008-10-13 13:07 . 2008-10-13 13:07 <REP> d-------- c:\program files\Atheros
2008-10-13 13:06 . 2008-10-13 13:06 <REP> d-------- C:\Drivers
2008-10-13 12:43 . 2007-09-02 19:56 1,686,016 --a------ c:\windows\system32\clinetsuitex6.ocx
2008-10-13 12:43 . 2004-06-14 13:56 427,864 --a------ c:\windows\system32\XceedZip.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-12 06:00 285,856 ----a-w c:\windows\system32\drivers\fwdrv.err
2008-11-12 05:49 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-12 05:49 --------- d-----w c:\program files\SpeedBit Video Accelerator
2008-11-11 21:07 --------- d-----w c:\documents and settings\Administrateur\Application Data\Skype
2008-11-09 14:31 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-09 14:31 --------- d-----w c:\program files\Google
2008-11-05 21:40 --------- d-----w c:\program files\Yahoo!
2008-11-05 21:11 --------- d-----w c:\program files\Navilog1
2008-11-05 15:22 --------- d-----w c:\program files\lx_cats
2008-11-05 15:03 --------- d-----w c:\documents and settings\Administrateur\Application Data\skypePM
2008-10-17 14:10 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-16 08:19 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-10-14 13:19 --------- d-----w c:\program files\adslTV
2008-10-14 13:19 --------- d-----w c:\documents and settings\Administrateur\Application Data\vlc
2008-10-14 09:06 --------- d-----w c:\program files\Realtek
2008-10-06 18:07 --------- d-----w c:\program files\ma-config.com
2008-10-06 18:07 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2008-10-05 19:28 --------- d-----w c:\program files\MyInternetTV
2008-10-05 16:22 --------- d-----w c:\documents and settings\Administrateur\Application Data\f2fElementary
2008-10-03 20:58 --------- d-----w c:\documents and settings\Administrateur\Application Data\Samsung
2008-10-03 20:38 --------- d-----w c:\program files\Samsung
2008-10-02 18:13 --------- d-----w c:\program files\CCleaner
2008-10-02 16:34 --------- d-----w c:\program files\Winamp
2008-10-02 11:23 --------- d-----w c:\program files\Raveille
2008-10-02 11:20 --------- d-----w c:\program files\Fichiers communs\GTK
2008-09-26 22:00 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-09-25 15:46 --------- d-----w c:\program files\Windows Live
2008-09-25 15:46 --------- d-----w c:\program files\Microsoft
2008-09-25 13:14 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-09-25 12:56 --------- d-----w c:\program files\Microsoft Silverlight
2008-09-25 10:44 --------- d-----w c:\program files\Opera 9
2008-09-20 11:44 --------- d-----w c:\program files\a-squared Anti-Malware
2008-09-19 09:37 --------- d-----w c:\program files\Zylom Games
2008-09-17 13:02 --------- d-----w c:\program files\DAP Premium
2008-09-17 13:02 --------- d-----w c:\documents and settings\All Users\Application Data\SpeedBit
2008-09-08 22:23 637,984 ----a-w c:\windows\system32\dllcache\iexplore.exe
2008-09-08 22:03 51,712 ----a-w c:\windows\system32\sirenacm.dll
2008-08-22 01:09 5,699,584 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-08-22 01:08 878,592 ----a-w c:\windows\system32\wininet.dll
2008-08-22 01:08 878,592 ----a-w c:\windows\system32\dllcache\wininet.dll
2008-08-22 01:08 43,008 ----a-w c:\windows\system32\licmgr10.dll
2008-08-22 01:08 43,008 ----a-w c:\windows\system32\dllcache\licmgr10.dll
2008-08-22 01:08 236,544 ----a-w c:\windows\system32\dllcache\webcheck.dll
2008-08-22 01:08 1,206,784 ----a-w c:\windows\system32\dllcache\urlmon.dll
2008-08-22 01:07 755,200 ----a-w c:\windows\system32\dllcache\VGX.dll
2008-08-22 01:07 193,536 ----a-w c:\windows\system32\dllcache\msrating.dll
2008-08-22 01:07 18,944 ----a-w c:\windows\system32\corpol.dll
2008-08-22 01:07 18,944 ------w c:\windows\system32\dllcache\corpol.dll
2008-08-22 01:07 116,224 ----a-w c:\windows\system32\dllcache\occache.dll
2008-08-22 01:07 105,984 ----a-w c:\windows\system32\dllcache\url.dll
2008-08-22 01:05 70,656 ----a-w c:\windows\system32\dllcache\mshtmled.dll
2008-08-22 01:05 630,272 ----a-w c:\windows\system32\dllcache\mstime.dll
2008-08-22 01:05 48,640 ------w c:\windows\system32\PrivacIE.dll
2008-08-22 01:05 48,128 ----a-w c:\windows\system32\mshtmler.dll
2008-08-22 01:05 48,128 ----a-w c:\windows\system32\dllcache\mshtmler.dll
2008-08-22 01:05 45,056 ----a-w c:\windows\system32\dllcache\pngfilt.dll
2008-08-22 01:05 35,840 ----a-w c:\windows\system32\imgutil.dll
2008-08-22 01:05 35,840 ----a-w c:\windows\system32\dllcache\imgutil.dll
2008-08-22 01:05 346,624 ----a-w c:\windows\system32\dllcache\dxtmsft.dll
2008-08-22 01:05 217,088 ----a-w c:\windows\system32\dllcache\dxtrans.dll
2008-08-22 01:05 186,880 ----a-w c:\windows\system32\dllcache\iepeers.dll
2008-08-22 01:04 45,568 ----a-w c:\windows\system32\mshta.exe
2008-08-22 01:04 45,568 ----a-w c:\windows\system32\dllcache\mshta.exe
2008-08-22 01:00 68,608 ----a-w c:\windows\system32\dllcache\hmmapi.dll
2008-08-22 00:57 156,160 ----a-w c:\windows\system32\msls31.dll
2008-08-22 00:57 156,160 ----a-w c:\windows\system32\dllcache\msls31.dll
2007-01-25 02:52 65,536 ----a-w c:\program files\Fichiers communs\NMSAccessU.exe
2006-07-05 03:33 472,000 ----a-w c:\windows\inf\WG311T\WG311T13.sys
2006-04-25 15:30 35,232 ----a-w c:\windows\inf\WG311T\ME_INST.EXE
2006-04-25 15:30 26,112 ----a-w c:\windows\inf\WG311T\install.exe
2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll
2008-03-16 12:30 216,064 --sh--r c:\windows\system32\nbDX.dll
.
((((((((((((((((((((((((((((( snapshot@2008-11-05_17.48.04.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-09-16 12:26:40 12,634 ----a-w c:\windows\ADFUUD.SYS
+ 2004-09-16 12:26:40 12,634 ----a-w c:\windows\system32\drivers\AdfuUd.sys
- 2008-05-10 01:43:34 3,773,440 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2008-10-05 03:24:02 3,695,008 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32.dll
- 2008-05-10 01:34:46 232,960 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2008-10-05 03:24:04 235,936 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
- 2008-07-10 17:14:04 82,081 ----a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2008-11-07 21:55:08 84,661 ----a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2008-11-12 05:48:29 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_b8.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"DownloadAccelerator"="c:\program files\DAP Premium\DAP.EXE" [2008-09-17 3061248]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-12-06 344064]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"BigDog303"="c:\windows\VM303_STI.EXE" [2005-04-30 49152]
"PC Booster"="c:\program files\inKline Global\PC Booster\pcbooster.exe" [2007-11-30 14450688]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"LXCYCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll" [2006-02-24 65536]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-08-27 185896]
"sclauncher"="c:\program files\SimpleCenter\bin\win\sclauncher.exe" [2007-09-07 94208]
"ACU"="c:\program files\Atheros\ACU.exe" [2006-08-09 344187]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-03 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-08-22 c:\windows\system32\advpack.dll]
c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2007-12-11 3746856]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
NETGEAR WG311T Smart Wizard.lnk - c:\program files\NETGEAR\WG311T\wlancfg5.exe [2006-09-15 1503232]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.imc"= imc32.acm
"msacm.l3codecp"= l3codecp.acm
"VIDC.i263"= i263_32.drv
"VIDC.ACDV"= ACDV.dll
"vidc.mpg2"= c:\windows\mpg4c32.dll
"vidc.mpg3"= c:\windows\mpg4c32.dll
"vidc.GEOX"= c:\windows\system32\GeoCodec.dll
"vidc.GEOV"= c:\windows\system32\GeoCodec.dll
"vidc.G264"= c:\windows\system32\GX264.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
--a------ 2005-06-23 19:33 57344 c:\program files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-06-12 01:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Athan]
--a------ 2005-09-12 02:04 937984 c:\program files\Athan\Athan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
--a------ 2006-02-07 06:10 98304 c:\program files\Lexmark 3400 Series\ezprint.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
--a------ 2006-02-02 09:11 290816 c:\program files\Lexmark Fax Solutions\fm3032.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2006-12-05 22:55 54832 c:\program files\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcymon.exe]
--a------ 2006-03-06 18:48 286720 c:\program files\Lexmark 3400 Series\lxcymon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSLauncher]
--a------ 2007-11-06 09:16 3096576 c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2006-12-06 18:37 69216 c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sclauncher]
--a------ 2007-09-07 15:05 94208 c:\program files\SimpleCenter\bin\win\sclauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedBitVideoAccelerator]
--a------ 2008-09-17 14:14 2705008 c:\program files\SpeedBit Video Accelerator\VideoAccelerator.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--------- 2008-08-18 17:41 1832272 c:\program files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-08-27 15:58 185896 c:\program files\Fichiers communs\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2006-09-07 18:19 15872 c:\program files\Unlocker\UnlockerAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-08-04 00:02 36352 c:\program files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Workshelf]
c:\program files\Winstep\workshelf.exe [BU]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
--a------ 2007-11-20 17:15 1826816 c:\windows\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:UDP"= 443:UDP:*:Disabled:UDP port 443 ooVoo
"37674:TCP"= 37674:TCP:*:Disabled:TCP port 37674 ooVoo
"37674:UDP"= 37674:UDP:*:Disabled:UDP port 37674 ooVoo
"37675:UDP"= 37675:UDP:*:Disabled:UDP port 37675 ooVoo
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2007-04-26 302000]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2007-04-26 72624]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:\program files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2006-11-02 16:51 13560]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 sbbotdi;sbbotdi;c:\progra~1\SPEEDB~1\sbbotdi.sys [2008-09-17 35584]
R2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 1234480]
R2 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe [2008-09-17 292472]
R3 lxcy_device;lxcy_device;c:\windows\system32\lxcycoms.exe [2006-02-20 495616]
R3 WSIMD;wsimd Service;c:\windows\system32\DRIVERS\wsimd.sys [2006-06-02 54432]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-09-02 191656]
S3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\Drivers\usb2vcom.sys [2005-09-02 28928]
S3 usbscan;Pilote de scanneur USB;c:\windows\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Pilote de stockage de masse USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1955477e-a0dd-11dd-82b5-0016e3bf82e3}]
\Shell\AutoRun\command - F:\9yqusig.bat
\Shell\explore\Command - F:\9yqusig.bat
\Shell\open\Command - F:\9yqusig.bat
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\q0jwonj7.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr/
FF -: plugin - c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npoji610.dll
FF -: plugin - c:\program files\ma-config.com\nphardwaredetection.dll
FF -: plugin - c:\program files\Microsoft Silverlight\2.0.30523.8\npctrl.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\np_gp.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-12 07:47:39
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCYCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\[u]0[/u]00.fcl"
.
Heure de fin: 2008-11-12 7:50:38
ComboFix-quarantined-files.txt 2008-11-12 06:50:30
ComboFix2.txt 2008-11-05 16:49:58
Avant-CF: 17 466 175 488 octets libres
Après-CF: 17,454,968,832 octets libres
304
12 nov. 2008 à 09:22
http://site-naheulbeuk.com/
https://www.clubic.com/telecharger-fiche215092-malwarebytes-anti-malware.html
Fait les mises à jour -------------"important"
puis en mode sans échec "f8 au demarrage du pc aprés l'apparition du bios"
Lancez le ,en examen complet ,sur tous tes disques durs
Une fois le scan terminé, clique sur supprimer
redemarre le pc, redemarre MBAM recherche le rapport et poste le