Probleme !!!! Mon dossier caché a disparu.
Dernière réponse : dans Sécurité
Voila j'ai un gros probleme, depuis peu j'ai attrapé un virus qui je pense ma supprimé la possibilité de pouvoir ou non caché mes fichiers, quand je vais dans : outils, options des dossiers, affichage je n'ai plus dossiers cachés, comment le faire revenir, j'ai tenté de changé de compte d'utilisateurs rien, une restauration rien non plus, je suis meme allé voir dans mon registre et apparement il me manque des clés de registre !!!!!!
comment faire ???????????????????
vous etes mon dernier espoir jai passé 2 jours a fond dessus et rien ny fait !!! HELP MEEEEEEEEEEEEEEEE
mci a vs de vs etre penché sur mon probleme !!!!
comment faire ???????????????????
vous etes mon dernier espoir jai passé 2 jours a fond dessus et rien ny fait !!! HELP MEEEEEEEEEEEEEEEE
mci a vs de vs etre penché sur mon probleme !!!!
Autres pages sur : probleme dossier cache disparu
Lassé par la pub ? Créez un compte
bonsoir
Télécharge puis installe Hijackthis (Trend Micro)
Poste ensuite un rapport dans ta prochaine réponse.
AIDE : Comment utiliser Hijackthis v2.0.2
Télécharge puis installe Hijackthis (Trend Micro)
Poste ensuite un rapport dans ta prochaine réponse.
AIDE : Comment utiliser Hijackthis v2.0.2
Merci pour cette réponse super rapide voila le résultat !!!!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:59:14, on 16/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\hasplms.exe
C:\Program Files\Power Translator 11\LogoMedia TranslateDotNet Server.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\SLEE81.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Softissimo\Lexibase Pro\exe\L-Express.exe
C:\Program Files\Softissimo\Lexibase Pro\exe\lexibase.exe
C:\Documents and Settings\christophe\Menu Démarrer\Programmes\Démarrage\XT-Launcher.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Tooltipizer - {C004D9F0-A742-4DC7-AFD0-BC29CE3FE04A} - C:\WINDOWS\system32\dcadssuggest.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {41C29B07-6F91-4966-91BE-2E2841643C83} - (no file)
O3 - Toolbar: (no name) - {CC48EB38-F950-48C0-9F22-D64F829AE3DF} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\RunOnce: [wextract_cleanup1] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\IXP001.TMP\"
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'Default user')
O4 - Startup: CONFIG.ini
O4 - Startup: XT-Launcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lexibase Express.lnk = C:\Program Files\Softissimo\Lexibase Pro\exe\L-Express.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab569...
O17 - HKLM\System\CCS\Services\Tcpip\..\{DCB388E2-2171-45EB-A631-71EAAA52A16B}: NameServer = 80.10.246.2,80.10.246.129
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HASP License Manager (hasplms) - Aladdin Knowledge Systems Ltd. - C:\WINDOWS\system32\hasplms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator 11\LogoMedia TranslateDotNet Server.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe
--
End of file - 10188 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:59:14, on 16/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\hasplms.exe
C:\Program Files\Power Translator 11\LogoMedia TranslateDotNet Server.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\SLEE81.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Softissimo\Lexibase Pro\exe\L-Express.exe
C:\Program Files\Softissimo\Lexibase Pro\exe\lexibase.exe
C:\Documents and Settings\christophe\Menu Démarrer\Programmes\Démarrage\XT-Launcher.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Tooltipizer - {C004D9F0-A742-4DC7-AFD0-BC29CE3FE04A} - C:\WINDOWS\system32\dcadssuggest.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {41C29B07-6F91-4966-91BE-2E2841643C83} - (no file)
O3 - Toolbar: (no name) - {CC48EB38-F950-48C0-9F22-D64F829AE3DF} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\RunOnce: [wextract_cleanup1] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\IXP001.TMP\"
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'Default user')
O4 - Startup: CONFIG.ini
O4 - Startup: XT-Launcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lexibase Express.lnk = C:\Program Files\Softissimo\Lexibase Pro\exe\L-Express.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab569...
O17 - HKLM\System\CCS\Services\Tcpip\..\{DCB388E2-2171-45EB-A631-71EAAA52A16B}: NameServer = 80.10.246.2,80.10.246.129
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HASP License Manager (hasplms) - Aladdin Knowledge Systems Ltd. - C:\WINDOWS\system32\hasplms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator 11\LogoMedia TranslateDotNet Server.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe
--
End of file - 10188 bytes
re
Télécharge MalwareByte's Anti-Malware sur ton Bureau.
Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.
Une fois l'installation et la mise à jour effectuées, redémarre en mode sans échec.
AIDE : Redémarrer en mode sans échec
Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".
Afin de lancer la recherche, clic sur"Rechercher".
Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :
-- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
-- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.
[#ff0000]REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.[/#f]
AIDE : Tuto en images sur MBAM
Télécharge MalwareByte's Anti-Malware sur ton Bureau.
Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.
Une fois l'installation et la mise à jour effectuées, redémarre en mode sans échec.
AIDE : Redémarrer en mode sans échec
-- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
-- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.
[#ff0000]REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.[/#f]
AIDE : Tuto en images sur MBAM
Dsl pour le tps que sa a pris mais sa a mis 3 heures pour finir voici le rapport :
Malwarebytes' Anti-Malware 1.12
Version de la base de données: 755
Type de recherche: Examen complet (C:\|)
Eléments examinés: 204781
Temps écoulé: 2 hour(s), 58 minute(s), 10 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\AppID\{8d71eeb8-a1a7-4733-8fa2-1cac015c967d} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dc_ads.ads (Adware.Fotomoto) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dc_ads.ads.1 (Adware.Fotomoto) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6fc3c36d-7635-4d43-ba62-0d9d2f2cd06e} (Adware.Fotomoto) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\Sidebar.DLL (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\AdvRemoteDbg (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\PlayMP3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\OneStepSearch (Adware.OneStepSearch) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
J'aimerai aussi rajouté que la clé de registre hidden n'est plus dans le registre ainsi que no folderoptions (je crois pour celle ci), peut etre y a t-il un rapport avec l'option dossier caché ?
Mci
Malwarebytes' Anti-Malware 1.12
Version de la base de données: 755
Type de recherche: Examen complet (C:\|)
Eléments examinés: 204781
Temps écoulé: 2 hour(s), 58 minute(s), 10 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\AppID\{8d71eeb8-a1a7-4733-8fa2-1cac015c967d} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dc_ads.ads (Adware.Fotomoto) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dc_ads.ads.1 (Adware.Fotomoto) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6fc3c36d-7635-4d43-ba62-0d9d2f2cd06e} (Adware.Fotomoto) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\Sidebar.DLL (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\AdvRemoteDbg (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\PlayMP3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\OneStepSearch (Adware.OneStepSearch) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
J'aimerai aussi rajouté que la clé de registre hidden n'est plus dans le registre ainsi que no folderoptions (je crois pour celle ci), peut etre y a t-il un rapport avec l'option dossier caché ?
Mci
re
Désactive ton antivirus et tout autre type de protection.
Télécharge ComboFix de sUBs :
ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
Double-clic sur ComboFix, Il va te poser une question, suis les invites puis attends que combofix ait terminé, il est possible que ton PC reboot, c’est normal, un rapport sera créé.Poste le rapport:C:\Combofix.txt
clique dessus pour l'ouvrir, puis édition "sélectionner tout", édition "copier"
viens sur le forum et édition "coller"
ajoute un nouveau rapport Hijackthis.
Désactive ton antivirus et tout autre type de protection.
Télécharge ComboFix de sUBs :
ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
Double-clic sur ComboFix, Il va te poser une question, suis les invites puis attends que combofix ait terminé, il est possible que ton PC reboot, c’est normal, un rapport sera créé.Poste le rapport:C:\Combofix.txt
clique dessus pour l'ouvrir, puis édition "sélectionner tout", édition "copier"
viens sur le forum et édition "coller"
ajoute un nouveau rapport Hijackthis.
voici le premier :
ComboFix 08-05-15.3 - christophe 2008-05-17 11:05:19.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.464 [GMT 2:00]
Endroit: C:\Documents and Settings\christophe\Bureau\ComboFix.exe
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\dcads-remove.exe
C:\WINDOWS\system32\dcads_sidebar_uninstall.exe
C:\WINDOWS\system32\dcadssuggest.dll
C:\WINDOWS\system32\drivers\downld
.
((((((((((((((((((((((((((((( Fichiers créés 2008-04-17 to 2008-05-17 ))))))))))))))))))))))))))))))))))))
.
2008-05-17 00:12 . 2008-05-17 00:12 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-17 00:12 . 2008-05-17 00:12 <REP> d-------- C:\Documents and Settings\christophe\Application Data\Malwarebytes
2008-05-17 00:12 . 2008-05-17 00:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-17 00:12 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-17 00:12 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-16 21:58 . 2008-05-16 21:58 <REP> d-------- C:\Program Files\Trend Micro
2008-05-16 18:20 . 2008-05-16 18:20 <REP> d-------- C:\e85085399d7e6d1e40
2008-05-16 16:40 . 2005-09-25 20:11 2,494,464 --a------ C:\WINDOWS\system32\advrcntr2.dll
2008-05-15 20:39 . 2008-05-15 21:18 <REP> d-------- C:\Program Files\Steganos Secure FileSharing 6
2008-05-15 20:14 . 2008-05-15 20:24 <REP> d-------- C:\Documents and Settings\christophe\Application Data\Steganos
2008-05-15 20:12 . 2008-05-15 20:18 <REP> d-------- C:\Program Files\Steganos Safe Professional 2006 Admin
2008-05-15 15:17 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2008-05-15 15:17 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll
2008-05-15 15:17 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll
2008-05-15 15:17 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll
2008-05-15 15:05 . 2008-05-15 15:05 <REP> d-------- C:\Program Files\DAEMON Tools Lite
2008-05-15 14:41 . 2008-05-15 14:41 <REP> d-------- C:\Documents and Settings\christophe\Application Data\DAEMON Tools
2008-05-14 23:16 . 2008-05-15 22:02 <REP> d-------- C:\Program Files\Steganos Internet Anonym 2006
2008-05-14 19:44 . 2008-05-15 14:39 <REP> d-------- C:\Documents and Settings\christophe\Application Data\Steganos Safe 7
2008-05-14 18:29 . 2008-05-16 12:22 <REP> d-------- C:\Program Files\Steganos Safe 7
2008-05-14 17:26 . 2008-05-14 17:26 <REP> d-------- C:\Program Files\Fichiers communs\Everstrike Software
2008-05-14 17:02 . 2008-05-14 17:02 <REP> d-------- C:\Program Files\Prophet Soft
2008-05-12 14:28 . 2008-05-12 14:28 <REP> d-------- C:\Documents and Settings\christophe\Application Data\LG Image Editor
2008-05-12 02:00 . 2008-05-12 02:00 <REP> d-------- C:\Program Files\Artefacts Studio
2008-05-12 00:02 . 2008-05-12 00:02 <REP> d-------- C:\3e339930a69a65587849e388e7af49
2008-05-11 12:49 . 2008-05-11 12:49 <REP> d-------- C:\Program Files\MSXML 4.0
2008-05-11 01:29 . 2008-05-11 01:39 <REP> d-------- C:\Program Files\GedonSoft
2008-05-11 00:43 . 2008-05-11 00:43 <REP> d-------- C:\Documents and Settings\christophe\Application Data\DivX
2008-05-11 00:22 . 2008-05-12 15:13 <REP> d--h----- C:\LG3G
2008-05-11 00:22 . 2008-05-11 00:22 <REP> d-------- C:\Documents and Settings\christophe\Application Data\LG Electronics
2008-05-11 00:20 . 2008-05-11 00:21 <REP> d-------- C:\Program Files\DivX
2008-05-11 00:06 . 2008-05-11 00:06 <REP> d-------- C:\Program Files\LG Electronics
2008-05-11 00:06 . 2007-07-11 10:45 21,632 --a------ C:\WINDOWS\system32\drivers\lgusbmodem.sys
2008-05-11 00:06 . 2007-07-11 15:51 19,840 --a------ C:\WINDOWS\system32\drivers\lgusbdiag.sys
2008-05-11 00:06 . 2007-07-11 10:40 12,416 --a------ C:\WINDOWS\system32\drivers\lgusbbus.sys
2008-05-10 23:59 . 2008-05-11 00:01 <REP> d-------- C:\Program Files\LG PC Suite 2
2008-05-10 19:40 . 2007-05-02 11:11 109,704 --a------ C:\WINDOWS\system32\drivers\ss_mdm.sys
2008-05-10 19:40 . 2007-05-02 11:11 83,592 --a------ C:\WINDOWS\system32\drivers\ss_bus.sys
2008-05-10 19:40 . 2007-05-02 11:11 15,112 --a------ C:\WINDOWS\system32\drivers\ss_mdfl.sys
2008-05-10 19:40 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_whnt.sys
2008-05-10 19:40 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_wh.sys
2008-05-10 19:40 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_cmnt.sys
2008-05-10 19:40 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_cm.sys
2008-05-10 19:37 . 2008-05-10 19:37 <REP> d-------- C:\Program Files\Samsung
2008-05-10 12:50 . 2008-05-10 12:50 <REP> d-------- C:\Program Files\Happyneuron
2008-05-09 00:49 . 2008-05-09 00:49 <REP> d-------- C:\Program Files\GameSpy Arcade
2008-05-08 16:04 . 1999-04-27 10:59 995,384 --------- C:\WINDOWS\MFC42U.DLL
2008-05-08 16:04 . 1999-04-27 10:59 995,383 --------- C:\WINDOWS\Mfc42.dll
2008-05-08 16:04 . 1999-03-01 22:44 266,293 --------- C:\WINDOWS\MSVCRT.DLL
2008-05-08 16:04 . 1999-09-08 20:56 195,856 --------- C:\WINDOWS\DSetup32.dll
2008-05-08 16:04 . 2002-06-26 10:04 151,552 --------- C:\WINDOWS\UnGdg5FR.exe
2008-05-08 16:04 . 2002-07-01 10:30 99,734 --------- C:\WINDOWS\UnGdg5FR.b2
2008-05-08 16:04 . 1999-09-08 20:51 40,208 --------- C:\WINDOWS\DSetup.dll
2008-05-08 16:04 . 2002-07-02 12:55 5,005 --------- C:\WINDOWS\UnGdg5FR.cfg
2008-05-08 13:09 . 2008-05-15 16:36 <REP> d-------- C:\Program Files\Ubisoft
2008-05-07 17:01 . 2008-05-07 17:01 571 --a------ C:\WINDOWS\system32\FeMakro.ini
2008-05-07 17:01 . 2008-05-07 17:01 497 --a------ C:\WINDOWS\system32\FeAnim.ini
2008-05-07 16:58 . 2004-03-10 20:49 1,069 --a------ C:\WINDOWS\system32\vbrun60.inf
2008-05-07 00:52 . 2004-10-20 12:03 21,776 -ra------ C:\WINDOWS\system32\msxml2a.dll
2008-05-07 00:38 . 2008-05-07 00:39 <REP> d-------- C:\Program Files\free-downloads.net
2008-05-06 23:14 . 2008-05-06 23:14 <REP> d-------- C:\Program Files\Fichiers communs\Borland Shared
2008-05-06 23:14 . 1999-06-21 05:10 185,344 --------- C:\WINDOWS\system32\bdeadmin.cpl
2008-05-05 13:45 . 1998-11-12 13:13 667,136 --------- C:\WINDOWS\system32\oik32.ocx
2008-05-05 13:45 . 1999-03-15 19:02 61,952 --------- C:\WINDOWS\system32\twiz32.ocx
2008-05-05 13:45 . 2001-08-29 11:31 5,108 --a------ C:\WINDOWS\dbcddfmt.ini
2008-05-05 10:42 . 2008-05-05 10:42 <REP> d-------- C:\TEMPO
2008-05-05 10:42 . 1993-04-27 23:00 710,752 --a------ C:\WINDOWS\system\MSAJT110.DLL
2008-05-05 10:42 . 1995-01-01 07:53 398,416 --a------ C:\WINDOWS\system\VBRUN300.DLL
2008-05-05 10:42 . 1993-04-27 23:00 99,888 --a------ C:\WINDOWS\system\ANIBUTON.VBX
2008-05-05 10:42 . 1993-04-27 23:00 95,200 --a------ C:\WINDOWS\system\VBDB300.DLL
2008-05-05 10:42 . 1993-04-27 23:00 64,544 --a------ C:\WINDOWS\system\THREED.VBX
2008-05-05 10:42 . 1993-04-27 23:00 33,280 --a------ C:\WINDOWS\system\MSAES110.DLL
2008-05-05 10:42 . 1993-04-27 23:00 30,112 --a------ C:\WINDOWS\system\MCI.VBX
2008-05-05 10:42 . 1994-02-13 05:21 11,056 --a------ C:\WINDOWS\system\SHARE.EXE
2008-05-02 17:54 . 2008-05-02 17:54 754 --a------ C:\WINDOWS\WORDPAD.INI
2008-05-02 12:25 . 2008-05-02 12:25 <REP> d-------- C:\Documents and Settings\christophe\Application Data\Nero
2008-05-02 12:24 . 2008-05-02 12:24 <REP> d-------- C:\Program Files\Nero
2008-05-02 12:24 . 2008-05-02 12:24 <REP> d-------- C:\Program Files\Fichiers communs\Nero
2008-05-02 12:24 . 2008-05-02 12:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-05-02 12:24 . 2006-03-17 11:45 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll
2008-05-02 12:24 . 2006-03-17 11:45 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll
2008-05-02 12:24 . 2006-03-17 11:45 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll
2008-05-02 12:24 . 2006-03-17 14:49 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll
2008-05-02 12:24 . 2006-03-17 11:45 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll
2008-05-02 11:19 . 2008-05-02 11:19 <REP> d-------- C:\Program Files\MC2
2008-04-23 10:44 . 2008-05-09 14:18 <REP> d-------- C:\Program Files\FastStone Capture
2008-04-23 10:44 . 2008-04-23 10:44 <REP> d-------- C:\Documents and Settings\christophe\Application Data\FastStone
2008-04-21 10:12 . 2008-04-27 23:05 <REP> d-------- C:\cbdata
2008-04-21 00:11 . 2008-04-21 00:11 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2008-04-19 12:52 . 2008-04-23 10:51 230,424 --a------ C:\img2-001.raw
2008-04-19 12:00 . 2008-04-19 12:00 <REP> d-------- C:\Documents and Settings\christophe\Application Data\SimonTools
2008-04-17 10:52 . 2008-04-17 10:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\HP
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-17 01:46 --------- d-----w C:\Documents and Settings\christophe\Application Data\LimeWire
2008-05-17 01:45 --------- d-----w C:\Program Files\eMule
2008-05-17 01:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-16 22:20 2,052,640 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-16 17:13 81,048,608 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-16 17:13 192,920 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-16 17:13 1,078,208 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-15 14:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-15 12:41 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-15 12:30 --------- d-----w C:\Program Files\Micro Application
2008-05-14 19:37 --------- d-----w C:\Program Files\NewsLeecher
2008-05-14 19:11 --------- d-----w C:\Program Files\Sierra Entertainment
2008-05-13 21:10 --------- d-----w C:\Documents and Settings\christophe\Application Data\Graphisoft
2008-05-10 17:45 --------- d-----w C:\Documents and Settings\christophe\Application Data\Samsung
2008-05-08 19:29 --------- d-----w C:\Program Files\Java
2008-05-02 10:23 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-05-02 10:23 --------- d-----w C:\Program Files\Ahead
2008-04-30 15:07 --------- d-----w C:\Documents and Settings\christophe\Application Data\Faces
2008-04-27 21:05 --------- d-----w C:\Documents and Settings\christophe\Application Data\ChessBase
2008-04-25 18:49 --------- d-----w C:\Program Files\LimeWire
2008-04-23 07:48 --------- d-----w C:\Program Files\Paint.NET
2008-04-20 22:02 --------- d-----w C:\Documents and Settings\christophe\Application Data\Ahead
2008-04-19 12:46 --------- d-----w C:\Program Files\Ludiclub
2008-04-19 11:11 --------- d-----w C:\Program Files\Apple Software Update
2008-04-17 14:53 96,645 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-04-17 14:53 87,941 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-04-17 08:52 --------- d-----w C:\Documents and Settings\christophe\Application Data\HP
2008-04-15 21:06 --------- d-----w C:\Program Files\Sierra On-Line
2008-04-15 21:04 --------- d-----w C:\Program Files\WON
2008-04-15 20:55 --------- d-----w C:\Program Files\Encyclopédie Médicale Française
2008-04-15 15:33 --------- d-----w C:\Program Files\Fichiers communs\Aladdin Shared
2008-04-15 15:33 --------- d-----w C:\Program Files\DIFX
2008-04-15 15:32 --------- d-----w C:\Documents and Settings\christophe\Application Data\Chief Architect Full Version 11
2008-04-05 13:18 --------- d-----w C:\Documents and Settings\christophe\Application Data\Apple Computer
2008-04-05 13:07 --------- d-----w C:\Program Files\QuickTime
2008-04-05 13:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-04-05 12:54 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-04-05 12:54 --------- d-----w C:\Documents and Settings\christophe\Application Data\InterTrust
2008-04-05 12:05 51,200 ----a-w C:\WINDOWS\system32\libexslt.dll
2008-04-05 12:05 150,016 ----a-w C:\WINDOWS\system32\libxslt.dll
2008-04-05 10:43 878,080 ----a-w C:\WINDOWS\system32\iconv.dll
2008-04-05 10:43 721,920 ----a-w C:\WINDOWS\system32\libxml2.dll
2008-04-05 10:43 144,896 ----a-w C:\WINDOWS\system32\libsyslic1.dll
2008-04-03 22:57 --------- d--h--r C:\Documents and Settings\christophe\Application Data\SecuROM
2008-04-03 22:49 --------- d-----w C:\Program Files\EA GAMES
2008-04-03 14:11 --------- d-----w C:\Program Files\directx
2008-04-03 09:37 --------- d-----w C:\Program Files\Faces
2008-04-02 18:20 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-21 16:56 --------- d-----w C:\Program Files\Fichiers communs\Control Panels
2008-03-21 16:27 --------- d-----w C:\Program Files\Bonjour
2008-03-20 16:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-03-20 16:55 --------- d-----w C:\Program Files\Fichiers communs\Macrovision Shared
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 19:36 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-19 19:36 25,416 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-07 15:24 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-27 17:45 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll
2008-02-27 17:45 2,272 ----a-w C:\WINDOWS\system32\w95inf16.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-01-09 16:36 22,328 ----a-w C:\Documents and Settings\christophe\Application Data\PnkBstrK.sys
2007-11-22 12:16 37,572 ----a-w C:\Documents and Settings\christophe\Application Data\mdbu.bin
2007-10-29 17:10 774,144 ----a-w C:\Program Files\RngInterstitial.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:54 15360]
"AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 22:57 30208]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 11:09 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"VX3000"="C:\WINDOWS\vVX3000.exe" [2006-06-30 01:55 707376]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-06-30 01:54 269104]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
"DXDllRegExe"="dxdllreg.exe" []
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 13:51 218376]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [ ]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 07:03 81920]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"HDAudDeck"="C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe" [2006-09-29 07:56 720896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 04:54 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SAFE7"="C:\Program Files\Steganos Safe 7\safe7.exe" [2005-01-19 10:50 258048]
C:\Documents and Settings\christophe\Menu D‚marrer\Programmes\D‚marrage\
CONFIG.ini [2007-10-13 18:22:25 77]
XT-Launcher.exe [2006-11-26 23:46:02 1290240]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 06:19:24 237568]
Lexibase Express.lnk - C:\Program Files\Softissimo\Lexibase Pro\exe\L-Express.exe [2008-03-07 17:25:51 61440]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.3ivx"= 3ivxVfWCodec.dll
"vidc.3iv2"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm
"VIDC.HFYU"= huffyuv.dll
"VIDC.i263"= i263_32.drv
"msacm.imc"= imc32.acm
"VIDC.VP31"= vp31vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"=
"C:\\Program Files\\Sierra Entertainment\\Empire Earth III\\EE3.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1947:TCP"= 1947:TCP:HASP SRM
"1947:UDP"= 1947:UDP:HASP SRM
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 05:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 05:39]
R2 aksfridge;aksfridge;C:\WINDOWS\system32\drivers\aksfridge.sys [2007-03-12 20:48]
R2 hasplms;HASP License Manager;C:\WINDOWS\system32\hasplms.exe -run []
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" [2006-06-30 01:54]
R2 SLEE_81_DRIVER;Steganos Live Encryption Engine 8.1 [Driver];C:\WINDOWS\system32\drivers\SLEE81.sys [2004-11-19 09:28]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 15:58]
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-05 20:46]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2007-05-02 11:11]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2007-05-02 11:11]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2007-05-02 11:11]
*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-05-10 11:11:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-04-28 07:00:01 C:\WINDOWS\Tasks\rpc.job"
- C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-17 11:09:21
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
C:\Documents and Settings\christophe\Local Settings\Application Data\Microsoft\Windows\GameExplorer\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}\PlayTasks\1\Les Sims™ 2 : Boit@Look.lnk 1087 bytes hidden from API
Scan terminé avec succès
Les fichiers cachés: 1
**************************************************************************
.
Temps d'accomplissement: 2008-05-17 11:17:22
ComboFix-quarantined-files.txt 2008-05-17 09:17:19
Pre-Run: 124,018,954,240 octets libres
Post-Run: 135,730,077,696 octets libres
277 --- E O F --- 2008-05-17 01:34:55
et le nouveau rapport hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:27:29, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\hasplms.exe
C:\Program Files\Power Translator 11\LogoMedia TranslateDotNet Server.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\SLEE81.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Softissimo\Lexibase Pro\exe\L-Express.exe
C:\Documents and Settings\christophe\Menu Démarrer\Programmes\Démarrage\XT-Launcher.exe
C:\Program Files\Softissimo\Lexibase Pro\exe\lexibase.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\Install\msxml4-KB936181-enu.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\msiexec.exe
c:\WINDOWS\system32\MsiExec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {C004D9F0-A742-4DC7-AFD0-BC29CE3FE04A} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {CC48EB38-F950-48C0-9F22-D64F829AE3DF} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'Default user')
O4 - Startup: CONFIG.ini
O4 - Startup: XT-Launcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lexibase Express.lnk = C:\Program Files\Softissimo\Lexibase Pro\exe\L-Express.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab569...
O17 - HKLM\System\CCS\Services\Tcpip\..\{DCB388E2-2171-45EB-A631-71EAAA52A16B}: NameServer = 80.10.246.2,80.10.246.129
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HASP License Manager (hasplms) - Aladdin Knowledge Systems Ltd. - C:\WINDOWS\system32\hasplms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator 11\LogoMedia TranslateDotNet Server.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe
--
End of file - 10416 bytes
ComboFix 08-05-15.3 - christophe 2008-05-17 11:05:19.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.464 [GMT 2:00]
Endroit: C:\Documents and Settings\christophe\Bureau\ComboFix.exe
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\dcads-remove.exe
C:\WINDOWS\system32\dcads_sidebar_uninstall.exe
C:\WINDOWS\system32\dcadssuggest.dll
C:\WINDOWS\system32\drivers\downld
.
((((((((((((((((((((((((((((( Fichiers créés 2008-04-17 to 2008-05-17 ))))))))))))))))))))))))))))))))))))
.
2008-05-17 00:12 . 2008-05-17 00:12 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-17 00:12 . 2008-05-17 00:12 <REP> d-------- C:\Documents and Settings\christophe\Application Data\Malwarebytes
2008-05-17 00:12 . 2008-05-17 00:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-17 00:12 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-17 00:12 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-16 21:58 . 2008-05-16 21:58 <REP> d-------- C:\Program Files\Trend Micro
2008-05-16 18:20 . 2008-05-16 18:20 <REP> d-------- C:\e85085399d7e6d1e40
2008-05-16 16:40 . 2005-09-25 20:11 2,494,464 --a------ C:\WINDOWS\system32\advrcntr2.dll
2008-05-15 20:39 . 2008-05-15 21:18 <REP> d-------- C:\Program Files\Steganos Secure FileSharing 6
2008-05-15 20:14 . 2008-05-15 20:24 <REP> d-------- C:\Documents and Settings\christophe\Application Data\Steganos
2008-05-15 20:12 . 2008-05-15 20:18 <REP> d-------- C:\Program Files\Steganos Safe Professional 2006 Admin
2008-05-15 15:17 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2008-05-15 15:17 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll
2008-05-15 15:17 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll
2008-05-15 15:17 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll
2008-05-15 15:05 . 2008-05-15 15:05 <REP> d-------- C:\Program Files\DAEMON Tools Lite
2008-05-15 14:41 . 2008-05-15 14:41 <REP> d-------- C:\Documents and Settings\christophe\Application Data\DAEMON Tools
2008-05-14 23:16 . 2008-05-15 22:02 <REP> d-------- C:\Program Files\Steganos Internet Anonym 2006
2008-05-14 19:44 . 2008-05-15 14:39 <REP> d-------- C:\Documents and Settings\christophe\Application Data\Steganos Safe 7
2008-05-14 18:29 . 2008-05-16 12:22 <REP> d-------- C:\Program Files\Steganos Safe 7
2008-05-14 17:26 . 2008-05-14 17:26 <REP> d-------- C:\Program Files\Fichiers communs\Everstrike Software
2008-05-14 17:02 . 2008-05-14 17:02 <REP> d-------- C:\Program Files\Prophet Soft
2008-05-12 14:28 . 2008-05-12 14:28 <REP> d-------- C:\Documents and Settings\christophe\Application Data\LG Image Editor
2008-05-12 02:00 . 2008-05-12 02:00 <REP> d-------- C:\Program Files\Artefacts Studio
2008-05-12 00:02 . 2008-05-12 00:02 <REP> d-------- C:\3e339930a69a65587849e388e7af49
2008-05-11 12:49 . 2008-05-11 12:49 <REP> d-------- C:\Program Files\MSXML 4.0
2008-05-11 01:29 . 2008-05-11 01:39 <REP> d-------- C:\Program Files\GedonSoft
2008-05-11 00:43 . 2008-05-11 00:43 <REP> d-------- C:\Documents and Settings\christophe\Application Data\DivX
2008-05-11 00:22 . 2008-05-12 15:13 <REP> d--h----- C:\LG3G
2008-05-11 00:22 . 2008-05-11 00:22 <REP> d-------- C:\Documents and Settings\christophe\Application Data\LG Electronics
2008-05-11 00:20 . 2008-05-11 00:21 <REP> d-------- C:\Program Files\DivX
2008-05-11 00:06 . 2008-05-11 00:06 <REP> d-------- C:\Program Files\LG Electronics
2008-05-11 00:06 . 2007-07-11 10:45 21,632 --a------ C:\WINDOWS\system32\drivers\lgusbmodem.sys
2008-05-11 00:06 . 2007-07-11 15:51 19,840 --a------ C:\WINDOWS\system32\drivers\lgusbdiag.sys
2008-05-11 00:06 . 2007-07-11 10:40 12,416 --a------ C:\WINDOWS\system32\drivers\lgusbbus.sys
2008-05-10 23:59 . 2008-05-11 00:01 <REP> d-------- C:\Program Files\LG PC Suite 2
2008-05-10 19:40 . 2007-05-02 11:11 109,704 --a------ C:\WINDOWS\system32\drivers\ss_mdm.sys
2008-05-10 19:40 . 2007-05-02 11:11 83,592 --a------ C:\WINDOWS\system32\drivers\ss_bus.sys
2008-05-10 19:40 . 2007-05-02 11:11 15,112 --a------ C:\WINDOWS\system32\drivers\ss_mdfl.sys
2008-05-10 19:40 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_whnt.sys
2008-05-10 19:40 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_wh.sys
2008-05-10 19:40 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_cmnt.sys
2008-05-10 19:40 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_cm.sys
2008-05-10 19:37 . 2008-05-10 19:37 <REP> d-------- C:\Program Files\Samsung
2008-05-10 12:50 . 2008-05-10 12:50 <REP> d-------- C:\Program Files\Happyneuron
2008-05-09 00:49 . 2008-05-09 00:49 <REP> d-------- C:\Program Files\GameSpy Arcade
2008-05-08 16:04 . 1999-04-27 10:59 995,384 --------- C:\WINDOWS\MFC42U.DLL
2008-05-08 16:04 . 1999-04-27 10:59 995,383 --------- C:\WINDOWS\Mfc42.dll
2008-05-08 16:04 . 1999-03-01 22:44 266,293 --------- C:\WINDOWS\MSVCRT.DLL
2008-05-08 16:04 . 1999-09-08 20:56 195,856 --------- C:\WINDOWS\DSetup32.dll
2008-05-08 16:04 . 2002-06-26 10:04 151,552 --------- C:\WINDOWS\UnGdg5FR.exe
2008-05-08 16:04 . 2002-07-01 10:30 99,734 --------- C:\WINDOWS\UnGdg5FR.b2
2008-05-08 16:04 . 1999-09-08 20:51 40,208 --------- C:\WINDOWS\DSetup.dll
2008-05-08 16:04 . 2002-07-02 12:55 5,005 --------- C:\WINDOWS\UnGdg5FR.cfg
2008-05-08 13:09 . 2008-05-15 16:36 <REP> d-------- C:\Program Files\Ubisoft
2008-05-07 17:01 . 2008-05-07 17:01 571 --a------ C:\WINDOWS\system32\FeMakro.ini
2008-05-07 17:01 . 2008-05-07 17:01 497 --a------ C:\WINDOWS\system32\FeAnim.ini
2008-05-07 16:58 . 2004-03-10 20:49 1,069 --a------ C:\WINDOWS\system32\vbrun60.inf
2008-05-07 00:52 . 2004-10-20 12:03 21,776 -ra------ C:\WINDOWS\system32\msxml2a.dll
2008-05-07 00:38 . 2008-05-07 00:39 <REP> d-------- C:\Program Files\free-downloads.net
2008-05-06 23:14 . 2008-05-06 23:14 <REP> d-------- C:\Program Files\Fichiers communs\Borland Shared
2008-05-06 23:14 . 1999-06-21 05:10 185,344 --------- C:\WINDOWS\system32\bdeadmin.cpl
2008-05-05 13:45 . 1998-11-12 13:13 667,136 --------- C:\WINDOWS\system32\oik32.ocx
2008-05-05 13:45 . 1999-03-15 19:02 61,952 --------- C:\WINDOWS\system32\twiz32.ocx
2008-05-05 13:45 . 2001-08-29 11:31 5,108 --a------ C:\WINDOWS\dbcddfmt.ini
2008-05-05 10:42 . 2008-05-05 10:42 <REP> d-------- C:\TEMPO
2008-05-05 10:42 . 1993-04-27 23:00 710,752 --a------ C:\WINDOWS\system\MSAJT110.DLL
2008-05-05 10:42 . 1995-01-01 07:53 398,416 --a------ C:\WINDOWS\system\VBRUN300.DLL
2008-05-05 10:42 . 1993-04-27 23:00 99,888 --a------ C:\WINDOWS\system\ANIBUTON.VBX
2008-05-05 10:42 . 1993-04-27 23:00 95,200 --a------ C:\WINDOWS\system\VBDB300.DLL
2008-05-05 10:42 . 1993-04-27 23:00 64,544 --a------ C:\WINDOWS\system\THREED.VBX
2008-05-05 10:42 . 1993-04-27 23:00 33,280 --a------ C:\WINDOWS\system\MSAES110.DLL
2008-05-05 10:42 . 1993-04-27 23:00 30,112 --a------ C:\WINDOWS\system\MCI.VBX
2008-05-05 10:42 . 1994-02-13 05:21 11,056 --a------ C:\WINDOWS\system\SHARE.EXE
2008-05-02 17:54 . 2008-05-02 17:54 754 --a------ C:\WINDOWS\WORDPAD.INI
2008-05-02 12:25 . 2008-05-02 12:25 <REP> d-------- C:\Documents and Settings\christophe\Application Data\Nero
2008-05-02 12:24 . 2008-05-02 12:24 <REP> d-------- C:\Program Files\Nero
2008-05-02 12:24 . 2008-05-02 12:24 <REP> d-------- C:\Program Files\Fichiers communs\Nero
2008-05-02 12:24 . 2008-05-02 12:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-05-02 12:24 . 2006-03-17 11:45 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll
2008-05-02 12:24 . 2006-03-17 11:45 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll
2008-05-02 12:24 . 2006-03-17 11:45 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll
2008-05-02 12:24 . 2006-03-17 14:49 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll
2008-05-02 12:24 . 2006-03-17 11:45 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll
2008-05-02 11:19 . 2008-05-02 11:19 <REP> d-------- C:\Program Files\MC2
2008-04-23 10:44 . 2008-05-09 14:18 <REP> d-------- C:\Program Files\FastStone Capture
2008-04-23 10:44 . 2008-04-23 10:44 <REP> d-------- C:\Documents and Settings\christophe\Application Data\FastStone
2008-04-21 10:12 . 2008-04-27 23:05 <REP> d-------- C:\cbdata
2008-04-21 00:11 . 2008-04-21 00:11 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2008-04-19 12:52 . 2008-04-23 10:51 230,424 --a------ C:\img2-001.raw
2008-04-19 12:00 . 2008-04-19 12:00 <REP> d-------- C:\Documents and Settings\christophe\Application Data\SimonTools
2008-04-17 10:52 . 2008-04-17 10:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\HP
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-17 01:46 --------- d-----w C:\Documents and Settings\christophe\Application Data\LimeWire
2008-05-17 01:45 --------- d-----w C:\Program Files\eMule
2008-05-17 01:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-16 22:20 2,052,640 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-16 17:13 81,048,608 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-16 17:13 192,920 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-16 17:13 1,078,208 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-15 14:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-15 12:41 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-15 12:30 --------- d-----w C:\Program Files\Micro Application
2008-05-14 19:37 --------- d-----w C:\Program Files\NewsLeecher
2008-05-14 19:11 --------- d-----w C:\Program Files\Sierra Entertainment
2008-05-13 21:10 --------- d-----w C:\Documents and Settings\christophe\Application Data\Graphisoft
2008-05-10 17:45 --------- d-----w C:\Documents and Settings\christophe\Application Data\Samsung
2008-05-08 19:29 --------- d-----w C:\Program Files\Java
2008-05-02 10:23 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-05-02 10:23 --------- d-----w C:\Program Files\Ahead
2008-04-30 15:07 --------- d-----w C:\Documents and Settings\christophe\Application Data\Faces
2008-04-27 21:05 --------- d-----w C:\Documents and Settings\christophe\Application Data\ChessBase
2008-04-25 18:49 --------- d-----w C:\Program Files\LimeWire
2008-04-23 07:48 --------- d-----w C:\Program Files\Paint.NET
2008-04-20 22:02 --------- d-----w C:\Documents and Settings\christophe\Application Data\Ahead
2008-04-19 12:46 --------- d-----w C:\Program Files\Ludiclub
2008-04-19 11:11 --------- d-----w C:\Program Files\Apple Software Update
2008-04-17 14:53 96,645 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-04-17 14:53 87,941 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-04-17 08:52 --------- d-----w C:\Documents and Settings\christophe\Application Data\HP
2008-04-15 21:06 --------- d-----w C:\Program Files\Sierra On-Line
2008-04-15 21:04 --------- d-----w C:\Program Files\WON
2008-04-15 20:55 --------- d-----w C:\Program Files\Encyclopédie Médicale Française
2008-04-15 15:33 --------- d-----w C:\Program Files\Fichiers communs\Aladdin Shared
2008-04-15 15:33 --------- d-----w C:\Program Files\DIFX
2008-04-15 15:32 --------- d-----w C:\Documents and Settings\christophe\Application Data\Chief Architect Full Version 11
2008-04-05 13:18 --------- d-----w C:\Documents and Settings\christophe\Application Data\Apple Computer
2008-04-05 13:07 --------- d-----w C:\Program Files\QuickTime
2008-04-05 13:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-04-05 12:54 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-04-05 12:54 --------- d-----w C:\Documents and Settings\christophe\Application Data\InterTrust
2008-04-05 12:05 51,200 ----a-w C:\WINDOWS\system32\libexslt.dll
2008-04-05 12:05 150,016 ----a-w C:\WINDOWS\system32\libxslt.dll
2008-04-05 10:43 878,080 ----a-w C:\WINDOWS\system32\iconv.dll
2008-04-05 10:43 721,920 ----a-w C:\WINDOWS\system32\libxml2.dll
2008-04-05 10:43 144,896 ----a-w C:\WINDOWS\system32\libsyslic1.dll
2008-04-03 22:57 --------- d--h--r C:\Documents and Settings\christophe\Application Data\SecuROM
2008-04-03 22:49 --------- d-----w C:\Program Files\EA GAMES
2008-04-03 14:11 --------- d-----w C:\Program Files\directx
2008-04-03 09:37 --------- d-----w C:\Program Files\Faces
2008-04-02 18:20 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-21 16:56 --------- d-----w C:\Program Files\Fichiers communs\Control Panels
2008-03-21 16:27 --------- d-----w C:\Program Files\Bonjour
2008-03-20 16:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-03-20 16:55 --------- d-----w C:\Program Files\Fichiers communs\Macrovision Shared
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 19:36 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-19 19:36 25,416 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-07 15:24 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-27 17:45 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll
2008-02-27 17:45 2,272 ----a-w C:\WINDOWS\system32\w95inf16.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-01-09 16:36 22,328 ----a-w C:\Documents and Settings\christophe\Application Data\PnkBstrK.sys
2007-11-22 12:16 37,572 ----a-w C:\Documents and Settings\christophe\Application Data\mdbu.bin
2007-10-29 17:10 774,144 ----a-w C:\Program Files\RngInterstitial.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:54 15360]
"AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 22:57 30208]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 11:09 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"VX3000"="C:\WINDOWS\vVX3000.exe" [2006-06-30 01:55 707376]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-06-30 01:54 269104]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
"DXDllRegExe"="dxdllreg.exe" []
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 13:51 218376]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [ ]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 07:03 81920]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"HDAudDeck"="C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe" [2006-09-29 07:56 720896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 04:54 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SAFE7"="C:\Program Files\Steganos Safe 7\safe7.exe" [2005-01-19 10:50 258048]
C:\Documents and Settings\christophe\Menu D‚marrer\Programmes\D‚marrage\
CONFIG.ini [2007-10-13 18:22:25 77]
XT-Launcher.exe [2006-11-26 23:46:02 1290240]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 06:19:24 237568]
Lexibase Express.lnk - C:\Program Files\Softissimo\Lexibase Pro\exe\L-Express.exe [2008-03-07 17:25:51 61440]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.3ivx"= 3ivxVfWCodec.dll
"vidc.3iv2"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm
"VIDC.HFYU"= huffyuv.dll
"VIDC.i263"= i263_32.drv
"msacm.imc"= imc32.acm
"VIDC.VP31"= vp31vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"=
"C:\\Program Files\\Sierra Entertainment\\Empire Earth III\\EE3.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1947:TCP"= 1947:TCP:HASP SRM
"1947:UDP"= 1947:UDP:HASP SRM
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 05:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 05:39]
R2 aksfridge;aksfridge;C:\WINDOWS\system32\drivers\aksfridge.sys [2007-03-12 20:48]
R2 hasplms;HASP License Manager;C:\WINDOWS\system32\hasplms.exe -run []
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" [2006-06-30 01:54]
R2 SLEE_81_DRIVER;Steganos Live Encryption Engine 8.1 [Driver];C:\WINDOWS\system32\drivers\SLEE81.sys [2004-11-19 09:28]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 15:58]
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-05 20:46]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2007-05-02 11:11]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2007-05-02 11:11]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2007-05-02 11:11]
*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-05-10 11:11:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-04-28 07:00:01 C:\WINDOWS\Tasks\rpc.job"
- C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-17 11:09:21
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
C:\Documents and Settings\christophe\Local Settings\Application Data\Microsoft\Windows\GameExplorer\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}\PlayTasks\1\Les Sims™ 2 : Boit@Look.lnk 1087 bytes hidden from API
Scan terminé avec succès
Les fichiers cachés: 1
**************************************************************************
.
Temps d'accomplissement: 2008-05-17 11:17:22
ComboFix-quarantined-files.txt 2008-05-17 09:17:19
Pre-Run: 124,018,954,240 octets libres
Post-Run: 135,730,077,696 octets libres
277 --- E O F --- 2008-05-17 01:34:55
et le nouveau rapport hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:27:29, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\hasplms.exe
C:\Program Files\Power Translator 11\LogoMedia TranslateDotNet Server.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\SLEE81.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Softissimo\Lexibase Pro\exe\L-Express.exe
C:\Documents and Settings\christophe\Menu Démarrer\Programmes\Démarrage\XT-Launcher.exe
C:\Program Files\Softissimo\Lexibase Pro\exe\lexibase.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\Install\msxml4-KB936181-enu.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\msiexec.exe
c:\WINDOWS\system32\MsiExec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {C004D9F0-A742-4DC7-AFD0-BC29CE3FE04A} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {CC48EB38-F950-48C0-9F22-D64F829AE3DF} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SAFE7] "C:\Program Files\Steganos Safe 7\safe7.exe" -firstboot (User 'Default user')
O4 - Startup: CONFIG.ini
O4 - Startup: XT-Launcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lexibase Express.lnk = C:\Program Files\Softissimo\Lexibase Pro\exe\L-Express.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab569...
O17 - HKLM\System\CCS\Services\Tcpip\..\{DCB388E2-2171-45EB-A631-71EAAA52A16B}: NameServer = 80.10.246.2,80.10.246.129
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HASP License Manager (hasplms) - Aladdin Knowledge Systems Ltd. - C:\WINDOWS\system32\hasplms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator 11\LogoMedia TranslateDotNet Server.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe
--
End of file - 10416 bytes
j'ai le dossier qui est revenu c'est bon, j'aimerai savoir si les dll cas supprimé combo fix
C:\WINDOWS\system32\dcads-remove.exe
C:\WINDOWS\system32\dcads_sidebar_uninstall.exe
C:\WINDOWS\system32\dcadssuggest.dll
C:\WINDOWS\system32\drivers\downld
ne vas pas généré de bug sur mon pc ?
je voudrai te remercier pour ton aide super rapide et efficace, c'était koi le probleme un virus ???
au faite si ta un peu de tps j'aimerai te demandé autre chose,
dernierement j'ai installé un logiciel qui s'appele internet anonym et kan l'installation est terminé et que je lance le mode anonyme, tout se passe bien jusqu'à ce que je lance mozilla firefox et la la page ne s'ouvre pas, as tu une solution ?
MERCI POUR TOUT !!!!!!!!!!!
C:\WINDOWS\system32\dcads-remove.exe
C:\WINDOWS\system32\dcads_sidebar_uninstall.exe
C:\WINDOWS\system32\dcadssuggest.dll
C:\WINDOWS\system32\drivers\downld
ne vas pas généré de bug sur mon pc ?
je voudrai te remercier pour ton aide super rapide et efficace, c'était koi le probleme un virus ???
au faite si ta un peu de tps j'aimerai te demandé autre chose,
dernierement j'ai installé un logiciel qui s'appele internet anonym et kan l'installation est terminé et que je lance le mode anonyme, tout se passe bien jusqu'à ce que je lance mozilla firefox et la la page ne s'ouvre pas, as tu une solution ?
MERCI POUR TOUT !!!!!!!!!!!
re
ComboFix a supprimé des malwares, ne t'inquiète pas.
je voudrais voir le rapport du scan en ligne, si tu ne souhaites pas le poster sur le public, tu peux me le poster en mp. (rappelle moi juste ce topic dans ton mp)
pour le surf anonyme, je n'y crois pas une seconde.donc j'ai rien à te dire de plus![:D]( ":D")
ComboFix a supprimé des malwares, ne t'inquiète pas.
je voudrais voir le rapport du scan en ligne, si tu ne souhaites pas le poster sur le public, tu peux me le poster en mp. (rappelle moi juste ce topic dans ton mp)
pour le surf anonyme, je n'y crois pas une seconde.donc j'ai rien à te dire de plus
Lassé par la pub ? Créez un compte
- Contenus similaires :
- ForumMon dossier images a completement disparu
- ForumMon dossier itunes media a disparu
- ForumDossier caché
- ForumDossier disparu mac
- ForumOption des dossier disparu
- ForumVista dossier disparu
- solutionsDossier image disparu
- ForumNom dossier disparu
- ForumLe dossier document a disparu
- ForumVirus dossier disparu
- Voir plus
