Pc qui bloque "virus" ?
Fermé
abderrahim2
Messages postés
143
Date d'inscription
dimanche 19 août 2007
Statut
Membre
Dernière intervention
19 avril 2012
-
17 mars 2010 à 01:05
abderrahim2 Messages postés 143 Date d'inscription dimanche 19 août 2007 Statut Membre Dernière intervention 19 avril 2012 - 17 mars 2010 à 11:36
abderrahim2 Messages postés 143 Date d'inscription dimanche 19 août 2007 Statut Membre Dernière intervention 19 avril 2012 - 17 mars 2010 à 11:36
A voir également:
- Pc qui bloque "virus" ?
- Pc qui rame - Guide
- Benchmark pc - Guide
- Reinitialiser pc - Guide
- Whatsapp pc - Télécharger - Messagerie
- Double ecran pc - Guide
2 réponses
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
17 mars 2010 à 01:30
17 mars 2010 à 01:30
Soir,
Un coup de cet outil devrait remettre les choses à leur place...
Télécharge combofix.exe (par sUBs) sur ton Bureau.
-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
@+
Un coup de cet outil devrait remettre les choses à leur place...
Télécharge combofix.exe (par sUBs) sur ton Bureau.
-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
@+
abderrahim2
Messages postés
143
Date d'inscription
dimanche 19 août 2007
Statut
Membre
Dernière intervention
19 avril 2012
1
17 mars 2010 à 11:36
17 mars 2010 à 11:36
bonjour,voila c'est fait:
ComboFix 10-03-16.03 - utilisateur 17/03/2010 1:53.2.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2039.1606 [GMT 1:00]
Lancé depuis: c:\documents and settings\utilisateur\Bureau\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning enabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\utilisateur\Bureau\movie 01\300\Desktop_.ini
c:\documents and settings\utilisateur\Bureau\movie 01\Desktop_.ini
c:\documents and settings\utilisateur\Bureau\movie 01\hitch\Desktop_.ini
c:\documents and settings\utilisateur\Bureau\movie 01\NOMAD.(2008)\Desktop_.ini
c:\program files\AskSearch\bin\DefaultSearch.dll
c:\windows\system32\oem10.inf
c:\windows\updater.exe
d:\religion\Al%20arbaeen%20al%20nawaweah.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-02-17 au 2010-03-17 ))))))))))))))))))))))))))))))))))))
.
2010-03-14 22:23 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-03-14 22:23 . 2010-03-14 22:23 -------- d-----w- c:\program files\PC Connectivity Solution
2010-03-14 22:22 . 2009-12-30 10:30 7936 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys
2010-03-14 22:22 . 2009-12-30 10:30 7936 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys
2010-03-14 22:22 . 2009-12-30 10:30 22016 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys
2010-03-14 22:22 . 2010-01-21 13:53 18048 ----a-w- c:\windows\system32\drivers\ccdcmb.sys
2010-03-14 22:22 . 2009-12-30 10:30 660480 ----a-w- c:\windows\system32\nmwcdcocls.dll
2010-03-14 22:22 . 2009-10-06 10:55 1112288 ----a-w- c:\windows\system32\wdfcoinstaller01007.dll
2010-03-14 22:22 . 2010-03-14 22:22 79368 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\RUP\vista.exe
2010-03-14 22:22 . 2010-03-14 22:22 64000 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll
2010-03-14 22:22 . 2010-03-14 22:22 52288 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\RUP\inst_config\gtapi.dll
2010-03-14 22:22 . 2010-03-14 22:22 50688 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll
2010-03-14 22:22 . 2010-03-14 22:22 49152 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll
2010-03-14 22:22 . 2010-03-14 22:22 118784 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\RUP\inst_config\compat.dll
2010-03-14 22:21 . 2010-03-14 18:31 34679832 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}\NokiaSoftwareUpdaterSetup_fr.exe
2010-03-14 22:20 . 2010-03-14 22:20 3351812 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}\Installer\CommonCustomActions\msxml6Exec.exe
2010-03-14 22:20 . 2010-03-14 22:20 36864 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}\Installer\CommonCustomActions\Sleep.exe
2010-03-14 22:20 . 2010-03-14 22:20 3203453 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}\Installer\CommonCustomActions\vcredistExec.exe
2010-03-13 01:07 . 2010-03-13 01:07 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-09 07:42 . 2010-03-09 07:43 3153784 ----a-w- c:\documents and settings\utilisateur\Application Data\IDM\idmupdt.exe
2010-03-08 15:48 . 2010-03-08 15:48 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-03-08 09:51 . 2010-03-08 09:51 -------- d-----w- c:\program files\Fichiers communs\DivX Shared
2010-03-08 09:51 . 2010-03-08 09:51 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-03-06 10:16 . 2010-03-13 10:17 443912 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\setup.exe
2010-02-27 15:38 . 2010-02-27 15:38 -------- d-----w- c:\program files\MSECache
2010-02-23 08:22 . 2010-02-23 08:22 -------- d-----w- c:\documents and settings\utilisateur\Application Data\Leadertech
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-17 01:31 . 2009-12-09 12:11 -------- d-----w- c:\documents and settings\utilisateur\Application Data\Orbit
2010-03-17 01:31 . 2008-12-07 16:15 -------- d-----w- c:\documents and settings\utilisateur\Application Data\DMCache
2010-03-17 00:18 . 2009-04-19 14:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-03-16 02:31 . 2009-12-26 11:42 -------- d-----w- c:\documents and settings\utilisateur\Application Data\IDM
2010-03-14 22:23 . 2009-12-28 21:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2010-03-14 22:22 . 2009-12-31 17:37 -------- d-----w- c:\program files\Nokia
2010-03-14 22:21 . 2009-12-31 17:38 -------- d-----w- c:\program files\Fichiers communs\Nokia
2010-03-14 00:28 . 2008-04-14 12:00 82854 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-14 00:28 . 2008-04-14 12:00 506062 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-13 23:03 . 2008-12-07 13:53 -------- d-----w- c:\documents and settings\utilisateur\Application Data\Skype
2010-03-13 01:07 . 2009-12-27 21:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-12 21:27 . 2009-05-19 01:23 -------- d-----w- c:\program files\Google
2010-03-08 09:52 . 2009-10-15 17:35 -------- d-----w- c:\program files\DivX
2010-02-27 15:40 . 2008-12-07 09:54 89888 ----a-w- c:\documents and settings\utilisateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-22 15:14 . 2009-11-28 16:41 -------- d-----w- c:\program files\PHPNukeEN
2010-01-31 21:53 . 2009-02-26 07:47 -------- d-----w- c:\program files\Windows Live
2010-01-31 21:52 . 2010-01-31 21:52 -------- d-----w- c:\program files\Microsoft
2010-01-31 00:14 . 2010-01-14 09:08 -------- d-----w- c:\program files\Zekr
2010-01-07 15:07 . 2009-12-27 21:45 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-12-27 21:45 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 17:36 . 2009-12-31 17:36 95232 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\pcswpcsi.exe
2009-12-31 17:36 . 2009-12-31 17:36 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstCCD.exe
2009-12-31 17:36 . 2009-12-31 17:36 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-12-31 17:36 . 2009-12-31 17:36 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCS.exe
2009-12-31 17:33 . 2009-12-31 17:36 34503600 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Nokia_PC_Suite_7_1_40_1_fre_web.exe
2009-12-31 16:50 . 2008-04-14 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-30 10:30 . 2009-12-28 21:27 91136 ----a-w- c:\windows\system32\nmwcdcls.dll
2009-12-26 11:45 . 2009-12-26 11:45 198064 ----a-w- c:\documents and settings\utilisateur\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-12-21 19:07 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 07:41 . 2008-12-06 16:08 347648 ----a-w- c:\windows\system32\mspaint.exe
2009-03-02 18:41 . 2009-03-02 17:00 2008 --sha-w- c:\windows\system32\sys_drv.dat
2009-09-09 09:52 . 2009-09-09 09:52 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
.
------- Sigcheck -------
[-] 2008-12-06 . 33578A738C564B4F84D906EFD91025E5 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2010-02-22 2349080]
[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
2010-02-22 15:16 2349080 ----a-w- c:\program files\PHPNukeEN\tbPHP0.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2010-02-22 2349080]
[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{DD02A4EB-4AFD-4D60-99D8-E67F964CA813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2010-02-22 2349080]
[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-11-12 3171760]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-06-03 177456]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-05-31 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"Athan"="c:\program files\Athan\Athan.exe" [2009-07-29 1114112]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-03-08 128512]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
DSLMON.lnk - c:\program files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe [2009-2-16 946270]
Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2009-12-9 1719568]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Larousse Expression.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Larousse Expression.lnk
backup=c:\windows\pss\Larousse Expression.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Orbit.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Orbit.lnk
backup=c:\windows\pss\Orbit.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
2009-11-12 09:35 3171760 ----a-w- c:\program files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-11-11 09:57 1451520 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TTMessengerPDF]
2004-03-22 12:06 61440 ----a-w- c:\program files\TTMessenger\spool\PDFSaver.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Fichiers communs\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\zekr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9913:TCP"= 9913:TCP:aqmeakry
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [15/12/2008 20:41 33808]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [13/03/2009 22:15 717296]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [07/12/2008 12:09 193840]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/05/2009 17:46 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [16/05/2009 20:59 19472]
S2 evrddmizy;Center Update;c:\windows\system32\svchost.exe -k netsvcs [14/04/2008 13:00 14336]
S2 iwwosah;Task Helper;c:\windows\system32\svchost.exe -k netsvcs [14/04/2008 13:00 14336]
S2 jgdtjoe;System Support;c:\windows\system32\svchost.exe -k netsvcs [14/04/2008 13:00 14336]
S2 jlckglq;Task System;c:\windows\system32\svchost.exe -k netsvcs [14/04/2008 13:00 14336]
S3 adiusbae;USB ADSL LAN Adapter;c:\windows\system32\drivers\adiusbae.sys [16/02/2009 13:19 117289]
S3 ahzbzkuuy;ahzbzkuuy; [x]
S3 attnlh;attnlh; [x]
S3 axkveiogf;axkveiogf; [x]
S3 ayboahm;ayboahm; [x]
S3 cutlxmx;cutlxmx; [x]
S3 dafcaxamt;dafcaxamt; [x]
S3 dgljm;dgljm; [x]
S3 dqztv;dqztv;-" --> - [?]
S3 fexxcye;fexxcye; [x]
S3 frduruk;frduruk; [x]
S3 fwbpw;fwbpw; [x]
S3 gnlzuw;gnlzuw; [x]
S3 gouez;gouez; [x]
S3 guljzro;guljzro; [x]
S3 gxpflvpf;gxpflvpf; [x]
S3 hyieotdnl;hyieotdnl;\??\c:\windows\system32\01.tmp --> c:\windows\system32\01.tmp [?]
S3 jfgpmhbe;jfgpmhbe; [x]
S3 jhnaiaz;jhnaiaz; [x]
S3 kxcthd;kxcthd; [x]
S3 kyoduxqcf;kyoduxqcf; [x]
S3 llbegfliy;llbegfliy; [x]
S3 lrjoedni;lrjoedni; [x]
S3 lufqi;lufqi; [x]
S3 lvkqgib;lvkqgib; [x]
S3 lxjzgrbq;lxjzgrbq; [x]
S3 miecf;miecf; [x]
S3 nijox;nijox; [x]
S3 olhzwcew;olhzwcew; [x]
S3 olterr;olterr; [x]
S3 omvtowyi;omvtowyi; [x]
S3 pkosv;pkosv; [x]
S3 przuwlpd;przuwlpd; [x]
S3 qddbm;qddbm; [x]
S3 qfcnr;qfcnr; [x]
S3 qipjkon;qipjkon; [x]
S3 qusciumee;qusciumee; [x]
S3 rbolc;rbolc; [x]
S3 rdaat;rdaat; [x]
S3 rqhvyhqwr;rqhvyhqwr; [x]
S3 skigaoo;skigaoo; [x]
S3 stllvukk;stllvukk; [x]
S3 tdqnskrvp;tdqnskrvp; [x]
S3 tflirteit;tflirteit; [x]
S3 tvrsx;tvrsx; [x]
S3 uhcsmca;uhcsmca; [x]
S3 utzfdv;utzfdv; [x]
S3 vibftejas;vibftejas; [x]
S3 vzridpyb;vzridpyb; [x]
S3 wcafigsv;wcafigsv; [x]
S3 xbuntsua;xbuntsua; [x]
S3 xhscczquo;xhscczquo; [x]
S3 xorslqk;xorslqk; [x]
S3 xpknatlk;xpknatlk; [x]
S3 xunwalxhk;xunwalxhk; [x]
S3 xxsix;xxsix; [x]
S3 yecfn;yecfn; [x]
S3 yosganlr;yosganlr; [x]
S3 ypnvsrjd;ypnvsrjd; [x]
S3 zorgg;zorgg; [x]
S3 zsaffw;zsaffw; [x]
S3 zsexs;zsexs; [x]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
jgdtjoe
iwwosah
.
Contenu du dossier 'Tâches planifiées'
2010-03-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2010-03-17 c:\windows\Tasks\User_Feed_Synchronization-{57A4C9BE-7A8D-4505-A9B9-6F6418A3691E}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Examen supplémentaire -------
.
uInternet Connection Wizard,ShellNext = hxxp://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=321957&prodSeriesId=3442832&prodNameId=3442833&swEnvOID=1093&swLang=17&mode=2&taskId=135&swItem=ob-56416-1
uInternet Settings,ProxyOverride = local
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download with Rapget - c:\docume~1\UTILIS~1\MESDOC~1\DOWNLO~1\COMPRE~1\RAPGET~1.FR_\RAPGET~1.FRB\rapget.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
FF - ProfilePath - c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\oxei6klf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.yahoo.fr
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 9666
FF - prefs.js: network.proxy.socks - localhost
FF - prefs.js: network.proxy.socks_port - 9050
FF - prefs.js: network.proxy.ssl - localhost
FF - prefs.js: network.proxy.ssl_port - 9666
FF - prefs.js: network.proxy.type - 2
FF - component: c:\documents and settings\utilisateur\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - component: c:\program files\Orbitdownloader\addons\OneClickYouTubeDownloader\components\GrabXpcom.dll
FF - plugin: c:\docume~1\UTILIS~1\APPLIC~1\POWERC~1\nppowerloader.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
pref(dom.disable_open_during_load, true);c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-updater32 - c:\windows\updater.exe
MSConfigStartUp-DW6 - c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe
MSConfigStartUp-TTMessenger - c:\program files\TTMessenger\ttmessenger2.exe
MSConfigStartUp-uTorrent - c:\program files\uTorrent\uTorrent.exe
ActiveSetup-{F4DB8CD4-0B8F-3383-D3E8-9D3DC9ECA55B} - c:\windows\updater.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-17 02:31
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
updater32 = c:\windows\updater.exe????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dqztv]
"ImagePath"="-\""
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\hyieotdnl]
"ImagePath"="\??\c:\windows\system32\01.tmp"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iwwosah]
ComboFix 10-03-16.03 - utilisateur 17/03/2010 1:53.2.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2039.1606 [GMT 1:00]
Lancé depuis: c:\documents and settings\utilisateur\Bureau\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning enabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\utilisateur\Bureau\movie 01\300\Desktop_.ini
c:\documents and settings\utilisateur\Bureau\movie 01\Desktop_.ini
c:\documents and settings\utilisateur\Bureau\movie 01\hitch\Desktop_.ini
c:\documents and settings\utilisateur\Bureau\movie 01\NOMAD.(2008)\Desktop_.ini
c:\program files\AskSearch\bin\DefaultSearch.dll
c:\windows\system32\oem10.inf
c:\windows\updater.exe
d:\religion\Al%20arbaeen%20al%20nawaweah.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-02-17 au 2010-03-17 ))))))))))))))))))))))))))))))))))))
.
2010-03-14 22:23 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-03-14 22:23 . 2010-03-14 22:23 -------- d-----w- c:\program files\PC Connectivity Solution
2010-03-14 22:22 . 2009-12-30 10:30 7936 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys
2010-03-14 22:22 . 2009-12-30 10:30 7936 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys
2010-03-14 22:22 . 2009-12-30 10:30 22016 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys
2010-03-14 22:22 . 2010-01-21 13:53 18048 ----a-w- c:\windows\system32\drivers\ccdcmb.sys
2010-03-14 22:22 . 2009-12-30 10:30 660480 ----a-w- c:\windows\system32\nmwcdcocls.dll
2010-03-14 22:22 . 2009-10-06 10:55 1112288 ----a-w- c:\windows\system32\wdfcoinstaller01007.dll
2010-03-14 22:22 . 2010-03-14 22:22 79368 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\RUP\vista.exe
2010-03-14 22:22 . 2010-03-14 22:22 64000 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll
2010-03-14 22:22 . 2010-03-14 22:22 52288 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\RUP\inst_config\gtapi.dll
2010-03-14 22:22 . 2010-03-14 22:22 50688 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll
2010-03-14 22:22 . 2010-03-14 22:22 49152 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll
2010-03-14 22:22 . 2010-03-14 22:22 118784 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\RUP\inst_config\compat.dll
2010-03-14 22:21 . 2010-03-14 18:31 34679832 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}\NokiaSoftwareUpdaterSetup_fr.exe
2010-03-14 22:20 . 2010-03-14 22:20 3351812 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}\Installer\CommonCustomActions\msxml6Exec.exe
2010-03-14 22:20 . 2010-03-14 22:20 36864 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}\Installer\CommonCustomActions\Sleep.exe
2010-03-14 22:20 . 2010-03-14 22:20 3203453 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}\Installer\CommonCustomActions\vcredistExec.exe
2010-03-13 01:07 . 2010-03-13 01:07 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-09 07:42 . 2010-03-09 07:43 3153784 ----a-w- c:\documents and settings\utilisateur\Application Data\IDM\idmupdt.exe
2010-03-08 15:48 . 2010-03-08 15:48 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-03-08 09:51 . 2010-03-08 09:51 -------- d-----w- c:\program files\Fichiers communs\DivX Shared
2010-03-08 09:51 . 2010-03-08 09:51 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-03-06 10:16 . 2010-03-13 10:17 443912 ----a-w- c:\documents and settings\utilisateur\Application Data\Real\Update\setup3.10\setup.exe
2010-02-27 15:38 . 2010-02-27 15:38 -------- d-----w- c:\program files\MSECache
2010-02-23 08:22 . 2010-02-23 08:22 -------- d-----w- c:\documents and settings\utilisateur\Application Data\Leadertech
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-17 01:31 . 2009-12-09 12:11 -------- d-----w- c:\documents and settings\utilisateur\Application Data\Orbit
2010-03-17 01:31 . 2008-12-07 16:15 -------- d-----w- c:\documents and settings\utilisateur\Application Data\DMCache
2010-03-17 00:18 . 2009-04-19 14:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-03-16 02:31 . 2009-12-26 11:42 -------- d-----w- c:\documents and settings\utilisateur\Application Data\IDM
2010-03-14 22:23 . 2009-12-28 21:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2010-03-14 22:22 . 2009-12-31 17:37 -------- d-----w- c:\program files\Nokia
2010-03-14 22:21 . 2009-12-31 17:38 -------- d-----w- c:\program files\Fichiers communs\Nokia
2010-03-14 00:28 . 2008-04-14 12:00 82854 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-14 00:28 . 2008-04-14 12:00 506062 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-13 23:03 . 2008-12-07 13:53 -------- d-----w- c:\documents and settings\utilisateur\Application Data\Skype
2010-03-13 01:07 . 2009-12-27 21:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-12 21:27 . 2009-05-19 01:23 -------- d-----w- c:\program files\Google
2010-03-08 09:52 . 2009-10-15 17:35 -------- d-----w- c:\program files\DivX
2010-02-27 15:40 . 2008-12-07 09:54 89888 ----a-w- c:\documents and settings\utilisateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-22 15:14 . 2009-11-28 16:41 -------- d-----w- c:\program files\PHPNukeEN
2010-01-31 21:53 . 2009-02-26 07:47 -------- d-----w- c:\program files\Windows Live
2010-01-31 21:52 . 2010-01-31 21:52 -------- d-----w- c:\program files\Microsoft
2010-01-31 00:14 . 2010-01-14 09:08 -------- d-----w- c:\program files\Zekr
2010-01-07 15:07 . 2009-12-27 21:45 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-12-27 21:45 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 17:36 . 2009-12-31 17:36 95232 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\pcswpcsi.exe
2009-12-31 17:36 . 2009-12-31 17:36 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstCCD.exe
2009-12-31 17:36 . 2009-12-31 17:36 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-12-31 17:36 . 2009-12-31 17:36 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCS.exe
2009-12-31 17:33 . 2009-12-31 17:36 34503600 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Nokia_PC_Suite_7_1_40_1_fre_web.exe
2009-12-31 16:50 . 2008-04-14 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-30 10:30 . 2009-12-28 21:27 91136 ----a-w- c:\windows\system32\nmwcdcls.dll
2009-12-26 11:45 . 2009-12-26 11:45 198064 ----a-w- c:\documents and settings\utilisateur\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-12-21 19:07 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 07:41 . 2008-12-06 16:08 347648 ----a-w- c:\windows\system32\mspaint.exe
2009-03-02 18:41 . 2009-03-02 17:00 2008 --sha-w- c:\windows\system32\sys_drv.dat
2009-09-09 09:52 . 2009-09-09 09:52 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
.
------- Sigcheck -------
[-] 2008-12-06 . 33578A738C564B4F84D906EFD91025E5 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2010-02-22 2349080]
[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
2010-02-22 15:16 2349080 ----a-w- c:\program files\PHPNukeEN\tbPHP0.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2010-02-22 2349080]
[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{DD02A4EB-4AFD-4D60-99D8-E67F964CA813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2010-02-22 2349080]
[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-11-12 3171760]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-06-03 177456]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-05-31 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"Athan"="c:\program files\Athan\Athan.exe" [2009-07-29 1114112]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-03-08 128512]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
DSLMON.lnk - c:\program files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe [2009-2-16 946270]
Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2009-12-9 1719568]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Larousse Expression.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Larousse Expression.lnk
backup=c:\windows\pss\Larousse Expression.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Orbit.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Orbit.lnk
backup=c:\windows\pss\Orbit.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
2009-11-12 09:35 3171760 ----a-w- c:\program files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-11-11 09:57 1451520 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TTMessengerPDF]
2004-03-22 12:06 61440 ----a-w- c:\program files\TTMessenger\spool\PDFSaver.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Fichiers communs\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\zekr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9913:TCP"= 9913:TCP:aqmeakry
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [15/12/2008 20:41 33808]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [13/03/2009 22:15 717296]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [07/12/2008 12:09 193840]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/05/2009 17:46 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [16/05/2009 20:59 19472]
S2 evrddmizy;Center Update;c:\windows\system32\svchost.exe -k netsvcs [14/04/2008 13:00 14336]
S2 iwwosah;Task Helper;c:\windows\system32\svchost.exe -k netsvcs [14/04/2008 13:00 14336]
S2 jgdtjoe;System Support;c:\windows\system32\svchost.exe -k netsvcs [14/04/2008 13:00 14336]
S2 jlckglq;Task System;c:\windows\system32\svchost.exe -k netsvcs [14/04/2008 13:00 14336]
S3 adiusbae;USB ADSL LAN Adapter;c:\windows\system32\drivers\adiusbae.sys [16/02/2009 13:19 117289]
S3 ahzbzkuuy;ahzbzkuuy; [x]
S3 attnlh;attnlh; [x]
S3 axkveiogf;axkveiogf; [x]
S3 ayboahm;ayboahm; [x]
S3 cutlxmx;cutlxmx; [x]
S3 dafcaxamt;dafcaxamt; [x]
S3 dgljm;dgljm; [x]
S3 dqztv;dqztv;-" --> - [?]
S3 fexxcye;fexxcye; [x]
S3 frduruk;frduruk; [x]
S3 fwbpw;fwbpw; [x]
S3 gnlzuw;gnlzuw; [x]
S3 gouez;gouez; [x]
S3 guljzro;guljzro; [x]
S3 gxpflvpf;gxpflvpf; [x]
S3 hyieotdnl;hyieotdnl;\??\c:\windows\system32\01.tmp --> c:\windows\system32\01.tmp [?]
S3 jfgpmhbe;jfgpmhbe; [x]
S3 jhnaiaz;jhnaiaz; [x]
S3 kxcthd;kxcthd; [x]
S3 kyoduxqcf;kyoduxqcf; [x]
S3 llbegfliy;llbegfliy; [x]
S3 lrjoedni;lrjoedni; [x]
S3 lufqi;lufqi; [x]
S3 lvkqgib;lvkqgib; [x]
S3 lxjzgrbq;lxjzgrbq; [x]
S3 miecf;miecf; [x]
S3 nijox;nijox; [x]
S3 olhzwcew;olhzwcew; [x]
S3 olterr;olterr; [x]
S3 omvtowyi;omvtowyi; [x]
S3 pkosv;pkosv; [x]
S3 przuwlpd;przuwlpd; [x]
S3 qddbm;qddbm; [x]
S3 qfcnr;qfcnr; [x]
S3 qipjkon;qipjkon; [x]
S3 qusciumee;qusciumee; [x]
S3 rbolc;rbolc; [x]
S3 rdaat;rdaat; [x]
S3 rqhvyhqwr;rqhvyhqwr; [x]
S3 skigaoo;skigaoo; [x]
S3 stllvukk;stllvukk; [x]
S3 tdqnskrvp;tdqnskrvp; [x]
S3 tflirteit;tflirteit; [x]
S3 tvrsx;tvrsx; [x]
S3 uhcsmca;uhcsmca; [x]
S3 utzfdv;utzfdv; [x]
S3 vibftejas;vibftejas; [x]
S3 vzridpyb;vzridpyb; [x]
S3 wcafigsv;wcafigsv; [x]
S3 xbuntsua;xbuntsua; [x]
S3 xhscczquo;xhscczquo; [x]
S3 xorslqk;xorslqk; [x]
S3 xpknatlk;xpknatlk; [x]
S3 xunwalxhk;xunwalxhk; [x]
S3 xxsix;xxsix; [x]
S3 yecfn;yecfn; [x]
S3 yosganlr;yosganlr; [x]
S3 ypnvsrjd;ypnvsrjd; [x]
S3 zorgg;zorgg; [x]
S3 zsaffw;zsaffw; [x]
S3 zsexs;zsexs; [x]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
jgdtjoe
iwwosah
.
Contenu du dossier 'Tâches planifiées'
2010-03-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2010-03-17 c:\windows\Tasks\User_Feed_Synchronization-{57A4C9BE-7A8D-4505-A9B9-6F6418A3691E}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Examen supplémentaire -------
.
uInternet Connection Wizard,ShellNext = hxxp://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=321957&prodSeriesId=3442832&prodNameId=3442833&swEnvOID=1093&swLang=17&mode=2&taskId=135&swItem=ob-56416-1
uInternet Settings,ProxyOverride = local
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download with Rapget - c:\docume~1\UTILIS~1\MESDOC~1\DOWNLO~1\COMPRE~1\RAPGET~1.FR_\RAPGET~1.FRB\rapget.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
FF - ProfilePath - c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\oxei6klf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.yahoo.fr
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 9666
FF - prefs.js: network.proxy.socks - localhost
FF - prefs.js: network.proxy.socks_port - 9050
FF - prefs.js: network.proxy.ssl - localhost
FF - prefs.js: network.proxy.ssl_port - 9666
FF - prefs.js: network.proxy.type - 2
FF - component: c:\documents and settings\utilisateur\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - component: c:\program files\Orbitdownloader\addons\OneClickYouTubeDownloader\components\GrabXpcom.dll
FF - plugin: c:\docume~1\UTILIS~1\APPLIC~1\POWERC~1\nppowerloader.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
pref(dom.disable_open_during_load, true);c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-updater32 - c:\windows\updater.exe
MSConfigStartUp-DW6 - c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe
MSConfigStartUp-TTMessenger - c:\program files\TTMessenger\ttmessenger2.exe
MSConfigStartUp-uTorrent - c:\program files\uTorrent\uTorrent.exe
ActiveSetup-{F4DB8CD4-0B8F-3383-D3E8-9D3DC9ECA55B} - c:\windows\updater.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-17 02:31
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
updater32 = c:\windows\updater.exe????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dqztv]
"ImagePath"="-\""
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\hyieotdnl]
"ImagePath"="\??\c:\windows\system32\01.tmp"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iwwosah]
