carhaix
Messages postés10Date d'inscriptionjeudi 10 avril 2008StatutMembreDernière intervention18 avril 2008
-
10 avril 2008 à 18:49
carhaix
Messages postés10Date d'inscriptionjeudi 10 avril 2008StatutMembreDernière intervention18 avril 2008
-
10 avril 2008 à 20:20
Bonjour, j'expose mon probléme
un petit troyan sur mon pc qui, quand j'ouvre IE se dirige vers un lien... (pub,...)
avec un URL de ce type "83.149.115.142/index.php?cmp=ghrnc&uid=51BCFDBC067011DDA706152174CFFFFF&guid=7D4D153F87BF49B9922D1EE01B61273F&affid=152174&lid=http&z=de"
J'ai eus au demarrage de windows un message qui me disé qu'il avait supprimé "Vundo"
Voici le raport :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:30:56, on 10/04/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal
carhaix
Messages postés10Date d'inscriptionjeudi 10 avril 2008StatutMembreDernière intervention18 avril 20081 10 avril 2008 à 19:21
Merci Je viens de relancer mon PC et en lançant Internet explorer ou même mozilla firefox les pub n'apparaisse plus.
J'ai suivi les indication du lien que tu ma donné et voici le rapport
ComboFix 08-04-09.9 - johan 2008-04-10 19:08:02.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.2091 [GMT 2:00]
Endroit: C:\Users\johan\Desktop\ComboFix.exe
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-10 19:15:23
Windows 6.0.6000 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\audiodg.exe
C:\Windows\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\MediaServer.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\System32\conime.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-04-10 19:17:39 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-10 17:17:27
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Le texte du message associ‚ au num‚ro 0x2379 est introuvable dans le fichier de messages pour Application.
.
2008-04-10 16:09:06 --- E O F ---
carhaix
Messages postés10Date d'inscriptionjeudi 10 avril 2008StatutMembreDernière intervention18 avril 20081
>
carhaix
Messages postés10Date d'inscriptionjeudi 10 avril 2008StatutMembreDernière intervention18 avril 2008 10 avril 2008 à 20:20
j'ais encore de message d'antispyware qui aparaissent, des message douteux.
Et il m'est impossible de faire une restauration, j'ai esseyé sur plusieur jour et il me marque que la restauration
a eu un probléme.
10 avril 2008 à 19:21
J'ai suivi les indication du lien que tu ma donné et voici le rapport
ComboFix 08-04-09.9 - johan 2008-04-10 19:08:02.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.2091 [GMT 2:00]
Endroit: C:\Users\johan\Desktop\ComboFix.exe
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Users\johan\Desktopblackbird.jpg
C:\Users\johan\DesktopEditorFKWP1.5.exe
C:\Users\johan\DesktopEditorFKWP2.0.exe
C:\Users\johan\Desktopfilemanagerclient.exe
C:\Users\johan\Desktopfkwp1.5.exe
C:\Users\johan\Desktopfkwp2.0.exe
C:\Users\johan\Desktopfwebd.exe
C:\Users\johan\DesktopFWebdEditor.exe
C:\Users\johan\DesktopTrojan.Win32.BlackBird.exe
C:\Users\johan\Desktopvirii
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-10 to 2008-04-10 ))))))))))))))))))))))))))))))))))))
.
Pas de nouveau fichier cr‚‚ dans cet espace de temps
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-10 17:05 --------- d-----w C:\ProgramData\ATI
2008-04-10 16:20 --------- d-----w C:\Program Files\Windows Mail
2008-04-10 16:20 --------- d-----w C:\Program Files\Google
2008-04-10 16:09 --------- d-----w C:\ProgramData\Microsoft Help
2008-04-10 16:01 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-09 20:00 --------- d-----w C:\ProgramData\xynivyfc
2008-04-09 20:00 --------- d-----w C:\ProgramData\jvkoymov
2008-04-09 18:50 --------- d-----w C:\Program Files\CARTEL's EUROS 3000
2008-04-09 18:49 74,752 ----a-w C:\Windows\ST6UNST.EXE
2008-04-09 18:49 253,952 ------w C:\Windows\Setup1.exe
2008-04-09 16:15 --------- d-----w C:\Program Files\Steam
2008-04-08 17:57 --------- d-----w C:\Program Files\ATI Technologies
2008-04-07 21:46 --------- d-----w C:\Users\johan\AppData\Roaming\Mp3tag
2008-04-07 21:44 --------- d-----w C:\Program Files\Mp3tag
2008-04-07 18:22 --------- d-----w C:\Users\johan\AppData\Roaming\LimeWire
2008-04-06 17:16 --------- d-----w C:\Users\johan\AppData\Roaming\Azureus
2008-04-05 13:09 --------- d-----w C:\Program Files\ffdshow
2008-04-05 12:37 --------- d-----w C:\Program Files\DivX
2008-04-05 12:37 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-04-05 12:12 --------- d-----w C:\Program Files\Java
2008-04-04 23:50 --------- d-----w C:\Users\johan\AppData\Roaming\Winamp
2008-04-04 23:15 --------- d-----w C:\ProgramData\OrbNetworks
2008-04-04 23:08 --------- d-----w C:\Program Files\Winamp Remote
2008-04-04 22:58 --------- d-----w C:\Program Files\Winamp
2008-04-04 15:42 --------- d-----w C:\Users\johan\AppData\Roaming\teamspeak2
2008-04-04 15:42 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-04-04 15:00 --------- d-----w C:\Program Files\World of Warcraft
2008-04-04 14:59 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-04-04 12:05 --------- d-----w C:\ProgramData\Azureus
2008-04-04 12:04 --------- d-----w C:\Program Files\Azureus
2008-04-04 12:01 --------- d-----w C:\Program Files\LimeWire
2008-04-04 12:00 --------- d-----w C:\Program Files\Common Files\Java
2008-04-03 18:01 --------- d-----w C:\Program Files\Common Files\Steam
2008-04-03 16:13 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-03 16:13 --------- d-----w C:\Program Files\Alwil Software
2008-04-03 16:12 --------- d-----w C:\ProgramData\Symantec
2008-04-02 20:51 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-02 20:37 --------- d-----w C:\ProgramData\Yahoo! Companion
2008-04-02 20:34 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-02 20:34 --------- d-----w C:\Program Files\Windows Live
2008-04-02 20:29 --------- d-----w C:\ProgramData\WLInstaller
2008-04-02 19:00 --------- d-----w C:\Program Files\TVersity Codec Pack
2008-04-02 16:46 --------- d-----w C:\Program Files\EA GAMES
2008-04-02 16:32 --------- d-----w C:\Program Files\Bethesda Softworks
2008-04-02 16:13 --------- d-----w C:\ProgramData\eSobi
2008-04-01 23:04 --------- d-----w C:\Program Files\Vista Anti-Lag
2008-04-01 22:58 174 --sha-w C:\Program Files\desktop.ini
2008-04-01 22:53 --------- d-----w C:\Program Files\Windows Defender
2008-04-01 22:53 --------- d-----w C:\Program Files\Windows Calendar
2008-04-01 22:52 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-01 22:46 70,144 ----a-w C:\Windows\system32\drivers\pacer.sys
2008-04-01 22:46 619,008 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2008-04-01 22:46 61,952 ----a-w C:\Windows\system32\drivers\wanarp.sys
2008-04-01 22:46 48,640 ----a-w C:\Windows\system32\drivers\ndproxy.sys
2008-04-01 22:46 20,480 ----a-w C:\Windows\system32\drivers\ndistapi.sys
2008-04-01 22:45 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-04-01 22:45 2,923,520 ----a-w C:\Windows\explorer.exe
2008-04-01 22:43 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-04-01 22:41 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-04-01 22:41 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-04-01 22:41 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-04-01 22:41 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-04-01 22:41 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-04-01 22:41 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-04-01 22:41 15,872 ----a-w C:\Windows\system32\drivers\mouhid.sys
2008-04-01 22:41 15,872 ----a-w C:\Windows\system32\drivers\kbdhid.sys
2008-04-01 22:38 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys
2008-04-01 22:38 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2008-04-01 22:36 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-04-01 22:36 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-04-01 22:36 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
2008-04-01 22:35 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-04-01 22:35 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-04-01 22:35 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-04-01 22:35 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-04-01 22:35 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-04-01 22:35 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-04-01 22:34 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-04-01 22:34 73,216 ----a-w C:\Windows\system32\drivers\usbccgp.sys
2008-04-01 22:34 5,888 ----a-w C:\Windows\system32\drivers\usbd.sys
2008-04-01 22:34 38,400 ----a-w C:\Windows\system32\drivers\usbehci.sys
2008-04-01 22:34 224,768 ----a-w C:\Windows\system32\drivers\usbport.sys
2008-04-01 22:34 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-04-01 22:34 192,000 ----a-w C:\Windows\system32\drivers\usbhub.sys
2008-04-01 22:34 19,456 ----a-w C:\Windows\system32\drivers\usbohci.sys
2008-04-01 22:30 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-04-01 22:30 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-04-01 22:30 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-04-01 22:30 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-04-01 22:29 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-04-01 22:29 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-04-01 22:29 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-04-01 22:29 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-04-01 22:28 12,800 ----a-w C:\Windows\system32\drivers\fs_rec.sys
2008-04-01 22:28 --------- d-----w C:\Program Files\MSXML 4.0
2008-04-01 21:53 --------- d-----w C:\Program Files\Neuf
2008-03-29 17:35 20,560 ----a-w C:\Windows\system32\drivers\aswFsBlk.sys
2008-03-29 17:32 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-03-29 17:31 75,856 ----a-w C:\Windows\system32\drivers\aswSP.sys
2008-03-29 17:29 23,152 ----a-w C:\Windows\system32\drivers\aswRdr.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C7AE1D1A-0D33-417F-A7C4-93CD0B19BE29}]
2008-04-09 22:05 270336 --a------ C:\Users\johan\AppData\Local\Temp\geBspPJy.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-04-02 00:29 1232896]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-04-10 17:57 171448]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]
"jvkoymov"="C:\ProgramData\jvkoymov\xkhclyhg.exe" [2008-04-09 22:00 102400]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-04-02 00:39 1006264]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 09:38 4390912 C:\Windows\RtHDVCpl.exe]
"Acer Empowering Technology Monitor"="C:\Acer\Empowering Technology\SysMonitor.exe" [2007-01-24 10:27 319488]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 00:04 464168]
"Acer Tour"="" []
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 21:48 57344]
"eRecoveryService"="" []
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]
"Apanel"="C:\ACERSW\config\NewSetApanel.cmd" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-04-24 14:53:40 528384]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
PCM Media Sharing.lnk - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe [2007-04-24 14:32:04 200812]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{F95798C9-BF0A-4D20-BD7C-6B38E7FF9FEE}"= C:\Program Files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live
"{A5333138-7820-4A45-A0F8-9FD93BB4D627}"= C:\Program Files\Acer Arcade Live\Acer DV Magician\Component\ARAWP.exe:DV Magician ARA workprocess
"{D585109C-A3E9-47A0-B1F8-BEF827E9F6D7}"= C:\Program Files\Acer Arcade Live\Acer DV Magician\Component\DVAX2Process.exe:DV Magician AVAX workprocess
"{31A60708-F002-42F4-9908-B33BD16550DD}"= C:\Program Files\Acer Arcade Live\SlideShow DVD\Component\CLSLDVD.exe:SlideShow DVD workprocess
"{932D4E56-6D5F-4909-A913-8B5947834283}"= C:\Program Files\Acer Arcade Live\Acer VideoMagician\VideoMagician.exe:VideoMagician
"{B4E3A7E7-6249-4309-B05F-B68B9B030828}"= C:\Program Files\Acer Arcade Live\Acer DVDivine\DVDivine.exe:DVDivine
"{383C1570-BA3C-4015-8188-2C4B6D3284C4}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia\HomeMedia.exe:HomeMedia
"{96FB5B8F-6D95-4F7A-809C-7952FC936ACB}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\HomeMedia Connect.exe:HomeMedia Connect
"{4FF06BD9-4370-4B76-ACF7-40542F1CF716}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:HomeMedia Connect Service
"{A3545E1B-C746-447F-9041-B38D5406AB1D}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{B27F2B2A-F1C3-4E65-8725-F857C07B7BEF}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{6A70B4E0-6290-4A36-BCEA-F075D570EBA2}C:\\program files\\steam\\steamapps\\chico_62\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\chico_62\counter-strike source\hl2.exe:hl2
"UDP Query User{156676AD-7D38-437A-B6DA-CD41B6122257}C:\\program files\\steam\\steamapps\\chico_62\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\chico_62\counter-strike source\hl2.exe:hl2
"{B7F44902-2260-4587-ACA8-7EF1D0DCA769}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{A1B2555C-92BE-4745-947A-3507769B0906}C:\\program files\\steam\\steamapps\\chico_62\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\chico_62\counter-strike source\hl2.exe:hl2
"UDP Query User{18F7D670-7BC9-43E5-BA32-E471BDC95592}C:\\program files\\steam\\steamapps\\chico_62\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\chico_62\counter-strike source\hl2.exe:hl2
"{E73766ED-4EFC-4583-B30F-C7768C42CE30}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{94E72EBC-9554-4455-BA26-58762CD37CC7}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{EE582F98-5239-451F-8A65-13C9F129782D}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{D5E5C818-61E7-43F5-9070-EB7575DFF46B}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{F60E5E6B-7E0E-402B-912C-2B38574E1F6B}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{27EC9EB6-2BCF-4599-9B16-253228D26E45}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{56DD113E-0466-4D86-9DAB-66926EB86EA8}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{D49425E3-BC56-43B5-95FB-BFC691CF7C0F}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"TCP Query User{4B49298C-7347-4CD0-96A0-B78F9B5D1EC3}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{3481CD0E-0839-4079-9A76-22005F38872D}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"{E7639178-3AE4-4EC9-85C1-C5FADAE4D4E5}"= UDP:C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\TVersity.exe:TVersity Media Server
"{7BE884FE-C1C8-434F-98AA-DB9B8516C046}"= TCP:C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\TVersity.exe:TVersity Media Server
"{1CC56AA8-310F-469E-B2DF-74A304388494}"= UDP:C:\Program Files\Windows Media Player\wmplayer.exe:wmplayer
"{D58E688A-135D-4C90-8101-F2BABA80BB54}"= TCP:C:\Program Files\Windows Media Player\wmplayer.exe:wmplayer
"TCP Query User{4FEC81E8-31FD-473D-9FE5-E1A7853A3268}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus
"UDP Query User{7BB5E3D4-8D5B-44AF-94BF-BF09F3EE7A50}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-02-07 00:04]
R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-02-07 00:04]
R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2007-02-07 00:04]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;"C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe" [2007-04-04 18:54]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 19:32]
R2 eDataSecurity Service;eDSService.exe;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-02-07 00:04]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-08-14 00:07]
R3 NBXG7031;NB 802.11g XG703 SP1 Driver;C:\Windows\system32\DRIVERS\WlanUIG.sys [2004-09-17 12:56]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51]
S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-08-14 00:07]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-04-02 20:56]
S3 WSVD;WSVD;C:\Windows\system32\drivers\WSVD.sys [2006-09-19 16:47]
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-10 19:15:23
Windows 6.0.6000 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\audiodg.exe
C:\Windows\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\MediaServer.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\System32\conime.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-04-10 19:17:39 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-10 17:17:27
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Le texte du message associ‚ au num‚ro 0x2379 est introuvable dans le fichier de messages pour Application.
.
2008-04-10 16:09:06 --- E O F ---
10 avril 2008 à 20:20
Et il m'est impossible de faire une restauration, j'ai esseyé sur plusieur jour et il me marque que la restauration
a eu un probléme.