

swingle
Membres-
Compteur de contenus
60 -
Inscription
-
Dernière visite
Tout ce qui a été posté par swingle
-
windows security alert
swingle a répondu à un(e) sujet de swingle dans Analyses et éradication malwares
je fais ce que tu me dis de faire et j'espere bien le faire,peux tu me dire si ce que fais te semble correcte svp voici donc la derniere analyse combofix: ComboFix 08-08-26.03 - maison 2008-09-01 23:48:31.4 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1638 [GMT 2:00] Endroit: C:\Documents and Settings\maison\Bureau\antivirus\ComboFix.exe Command switches used :: C:\Documents and Settings\maison\Bureau\CFScript.txt * Création d'un nouveau point de restauration AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! FILE :: C:\WINDOWS\system32\admbsfaj.exe C:\WINDOWS\system32\fsrctcjm.exe C:\WINDOWS\system32\hmnivghk.exe C:\WINDOWS\system32\kdgxabqp.exe C:\WINDOWS\system32\kporodod.exe C:\WINDOWS\system32\tspelqxq.exe C:\WINDOWS\system32\zezilcpc.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\admbsfaj.exe C:\WINDOWS\system32\fsrctcjm.exe C:\WINDOWS\system32\hmnivghk.exe C:\WINDOWS\system32\kdgxabqp.exe C:\WINDOWS\system32\kporodod.exe C:\WINDOWS\system32\tspelqxq.exe C:\WINDOWS\system32\zezilcpc.exe . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-08-01 to 2008-09-01 )))))))))))))))))))))))))))))))))))) . 2008-09-01 13:17 . 2008-09-01 23:50 51,182 --a------ C:\VETlog.dmp 2008-09-01 11:06 . 2008-09-01 11:06 <REP> d-------- C:\Documents and Settings\maison\Application Data\Viewpoint 2008-08-30 11:24 . 2008-09-01 09:06 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-08-29 19:04 . 2008-08-29 19:04 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-29 19:04 . 2008-08-29 19:04 <REP> d-------- C:\Documents and Settings\maison\Application Data\Malwarebytes 2008-08-29 19:04 . 2008-08-29 19:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-29 19:04 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-29 19:04 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-29 18:33 . 2008-08-30 11:17 <REP> d-------- C:\Lop SD 2008-08-29 18:25 . 2008-08-29 18:25 <REP> d-------- C:\WINDOWS\ERUNT 2008-08-29 18:18 . 2008-08-29 18:30 <REP> d-------- C:\SDFix 2008-08-29 18:15 . 2008-08-29 18:15 <REP> d-------- C:\WINDOWS\Profiles 2008-08-29 18:15 . 2008-09-01 13:40 <REP> d-------- C:\Program Files\Sudden Strike 2 + Total Victory Addon 2008-08-29 18:15 . 2008-08-29 18:15 <REP> d-------- C:\Documents and Settings\maison\Application Data\InterTrust 2008-08-29 18:15 . 1998-11-13 11:16 308,224 --a------ C:\WINDOWS\IsUn040c.exe 2008-08-29 17:38 . 2008-08-29 17:38 <REP> d-------- C:\Documents and Settings\maison\Application Data\Anuman Interactive 2008-08-29 17:11 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-08-29 17:11 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-08-29 17:11 . 2008-08-26 20:19 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-08-29 17:11 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-08-29 17:11 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-08-29 17:11 . 2008-08-14 21:52 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-08-29 17:11 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe 2008-08-29 17:11 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-08-29 17:11 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-08-29 17:11 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-08-28 18:15 . 2008-08-28 18:15 <REP> d-------- C:\Program Files\Fichiers communs\Scanner 2008-08-28 15:13 . 2008-08-28 15:13 166 --a------ C:\WINDOWS\wininit.ini 2008-08-28 14:48 . 2008-08-28 14:53 <REP> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-28 14:48 . 2008-08-28 15:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-28 14:30 . 2008-08-28 15:14 <REP> d-------- C:\Program Files\NoAdware5.0 2008-08-27 14:40 . 2008-08-29 17:23 666 --a------ C:\WINDOWS\system32\tmp.reg 2008-08-26 12:01 . 2008-08-26 12:01 <REP> d-------- C:\Program Files\uTorrent 2008-08-26 12:01 . 2008-08-27 11:34 <REP> d-------- C:\Documents and Settings\maison\Application Data\uTorrent . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-01 11:28 --------- d-----w C:\Documents and Settings\maison\Application Data\AVG7 2008-09-01 11:09 --------- d-----w C:\Documents and Settings\maison\Application Data\EoRezo 2008-09-01 10:32 --------- d-----w C:\Program Files\DNA 2008-09-01 07:05 --------- d-----w C:\Documents and Settings\maison\Application Data\DNA 2008-08-31 10:36 --------- d-----w C:\Program Files\eMule 2008-08-30 16:16 --------- d-----w C:\Program Files\Soulseek 2008-08-29 09:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2008-08-28 16:15 --------- d-----w C:\Program Files\Fichiers communs\aol 2008-08-27 13:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2008-08-27 12:05 --------- d-----w C:\Program Files\Google 2008-08-27 09:34 --------- d-----w C:\Documents and Settings\maison\Application Data\BitTorrent 2008-08-25 11:29 --------- d-----w C:\Documents and Settings\maison\Application Data\U3 2008-07-09 12:06 --------- d-----w C:\Program Files\BASAL7 2008-07-08 15:13 --------- d-----w C:\Program Files\EasyFactures 2008-07-08 15:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\BASAL7 2008-07-08 13:14 --------- d-----w C:\Program Files\MSBuild 2008-07-08 13:14 --------- d-----w C:\Program Files\Microsoft Works 2008-07-08 13:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-07-03 17:20 450 ----a-w C:\Documents and Settings\maison\Application Data\wklnhst.dat 2008-07-02 22:25 --------- d-----w C:\Program Files\GameSpy Arcade 2008-04-14 00:42 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AOL Fast Start"="C:\Program Files\AOL 9.0 VRa\AOL.EXE" [2007-06-21 13:44 50480] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360] "AnumanLive"="C:\Documents and Settings\maison\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe" [2007-08-29 17:42 347648] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-14 14:03 219136] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLogOff"= 0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Fichiers communs\\aol\\acs\\AOLDial.exe"= "C:\\Program Files\\Fichiers communs\\aol\\acs\\AOLacsd.exe"= "C:\\Program Files\\AOL 9.0 VR\\waol.exe"= "C:\\Program Files\\Fichiers communs\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"= "C:\\Program Files\\Fichiers communs\\aol\\Loader\\aolload.exe"= "C:\\Program Files\\Fichiers communs\\aol\\System Information\\sinf.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\Fichiers communs\\aol\\1202989891\\ee\\aolsoftware.exe"= "C:\\Program Files\\AOL 9.0 VRa\\waol.exe"= "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"= "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "C:\\Program Files\\BitTorrent_DNA\\dna.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\Liquid.6\\Program\\RM.exe"= "C:\\Program Files\\Liquid.6\\Program\\Studiou.mod"= "C:\\Program Files\\Soulseek\\slsk.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= R3 alcan5ln;SpeedTouch USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys [2003-12-08 12:53] R3 AtiHdmiService;ATI Function Driver for HDMI Service;C:\WINDOWS\system32\drivers\AtiHdmi.sys [2007-07-20 14:40] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e1127e0e-eab1-11dc-a727-0090d0b674ad}] \Shell\Auto\command - MSOCache\doWTP_RESTORE_0.exe -autorun \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE_0.exe -autorun . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' 2008-08-30 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-01 23:50:50 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Fichiers communs\aol\acs\AOLacsd.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\AOL 9.0 VRa\waol.exe C:\Program Files\Fichiers communs\aol\1202989891\ee\aolsoftware.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\Fichiers communs\aol\1202989891\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\AOL 9.0 VRa\shellmon.exe . ************************************************************************** . Temps d'accomplissement: 2008-09-01 23:52:21 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-01 21:52:19 ComboFix2.txt 2008-09-01 09:07:52 ComboFix3.txt 2008-08-27 13:29:27 Pre-Run: 83,151,368,192 octets libres Post-Run: 83,224,948,736 octets libres 180 -
windows security alert
swingle a répondu à un(e) sujet de swingle dans Analyses et éradication malwares
voici l'analyse: ComboFix 08-08-26.03 - maison 2008-09-01 11:03:44.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1628 [GMT 2:00] Endroit: C:\Documents and Settings\maison\Bureau\antivirus\ComboFix.exe Command switches used :: C:\Documents and Settings\maison\Bureau\CFScript.txt * Création d'un nouveau point de restauration AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! FILE :: C:\Documents and Settings\All Users\Application Data\sjapgbuv\uxyzsrwj.exe C:\Program Files\rmttfdc\aplinfoweb.dll C:\WINDOWS\system32\edqpebcb.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\sjapgbuv C:\Documents and Settings\All Users\Application Data\sjapgbuv\uxyzsrwj.exe C:\Program Files\rmttfdc C:\Program Files\rmttfdc\aplinfoweb.dll C:\WINDOWS\system32\edqpebcb.exe . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-08-01 to 2008-09-01 )))))))))))))))))))))))))))))))))))) . 2008-09-01 11:06 . 2008-09-01 11:06 <REP> d-------- C:\Documents and Settings\maison\Application Data\Viewpoint 2008-08-30 11:24 . 2008-09-01 09:06 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-08-29 19:04 . 2008-08-29 19:04 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-29 19:04 . 2008-08-29 19:04 <REP> d-------- C:\Documents and Settings\maison\Application Data\Malwarebytes 2008-08-29 19:04 . 2008-08-29 19:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-29 19:04 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-29 19:04 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-29 18:33 . 2008-08-30 11:17 <REP> d-------- C:\Lop SD 2008-08-29 18:25 . 2008-08-29 18:25 <REP> d-------- C:\WINDOWS\ERUNT 2008-08-29 18:18 . 2008-08-29 18:30 <REP> d-------- C:\SDFix 2008-08-29 18:15 . 2008-08-29 18:15 <REP> d-------- C:\WINDOWS\Profiles 2008-08-29 18:15 . 2008-08-29 18:16 <REP> d-------- C:\Program Files\Sudden Strike 2 + Total Victory Addon 2008-08-29 18:15 . 2008-08-29 18:15 <REP> d-------- C:\Documents and Settings\maison\Application Data\InterTrust 2008-08-29 18:15 . 1998-11-13 11:16 308,224 --a------ C:\WINDOWS\IsUn040c.exe 2008-08-29 17:38 . 2008-08-29 17:38 <REP> d-------- C:\Documents and Settings\maison\Application Data\Anuman Interactive 2008-08-29 17:11 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-08-29 17:11 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-08-29 17:11 . 2008-08-26 20:19 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-08-29 17:11 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-08-29 17:11 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-08-29 17:11 . 2008-08-14 21:52 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-08-29 17:11 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe 2008-08-29 17:11 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-08-29 17:11 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-08-29 17:11 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-08-29 14:06 . 2008-08-29 14:06 66,048 --a------ C:\WINDOWS\system32\kporodod.exe 2008-08-29 11:29 . 2008-08-29 11:29 203,776 --a------ C:\WINDOWS\system32\fsrctcjm.exe 2008-08-29 00:30 . 2008-08-29 00:30 203,776 --a------ C:\WINDOWS\system32\kdgxabqp.exe 2008-08-28 18:15 . 2008-08-28 18:15 <REP> d-------- C:\Program Files\Fichiers communs\Scanner 2008-08-28 15:48 . 2008-08-28 15:48 203,776 --a------ C:\WINDOWS\system32\zezilcpc.exe 2008-08-28 15:48 . 2008-08-28 15:48 90,112 --a------ C:\WINDOWS\system32\hmnivghk.exe 2008-08-28 15:13 . 2008-08-28 15:13 166 --a------ C:\WINDOWS\wininit.ini 2008-08-28 14:48 . 2008-08-28 14:53 <REP> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-28 14:48 . 2008-08-28 15:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-28 14:30 . 2008-08-28 15:14 <REP> d-------- C:\Program Files\NoAdware5.0 2008-08-28 13:23 . 2008-08-28 13:23 203,776 --a------ C:\WINDOWS\system32\tspelqxq.exe 2008-08-27 16:05 . 2008-08-27 16:05 110,592 --a------ C:\WINDOWS\system32\admbsfaj.exe 2008-08-27 14:40 . 2008-08-29 17:23 666 --a------ C:\WINDOWS\system32\tmp.reg 2008-08-26 12:01 . 2008-08-26 12:01 <REP> d-------- C:\Program Files\uTorrent 2008-08-26 12:01 . 2008-08-27 11:34 <REP> d-------- C:\Documents and Settings\maison\Application Data\uTorrent . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-01 08:51 --------- d-----w C:\Documents and Settings\maison\Application Data\AVG7 2008-09-01 07:05 --------- d-----w C:\Documents and Settings\maison\Application Data\DNA 2008-08-31 15:46 --------- d-----w C:\Program Files\DNA 2008-08-31 10:36 --------- d-----w C:\Program Files\eMule 2008-08-30 16:16 --------- d-----w C:\Program Files\Soulseek 2008-08-29 10:18 --------- d-----w C:\Documents and Settings\maison\Application Data\EoRezo 2008-08-29 09:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2008-08-28 16:15 --------- d-----w C:\Program Files\Fichiers communs\aol 2008-08-27 13:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2008-08-27 12:05 --------- d-----w C:\Program Files\Google 2008-08-27 09:34 --------- d-----w C:\Documents and Settings\maison\Application Data\BitTorrent 2008-08-25 11:29 --------- d-----w C:\Documents and Settings\maison\Application Data\U3 2008-07-09 12:06 --------- d-----w C:\Program Files\BASAL7 2008-07-08 15:13 --------- d-----w C:\Program Files\EasyFactures 2008-07-08 15:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\BASAL7 2008-07-08 13:14 --------- d-----w C:\Program Files\MSBuild 2008-07-08 13:14 --------- d-----w C:\Program Files\Microsoft Works 2008-07-08 13:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-07-03 17:20 450 ----a-w C:\Documents and Settings\maison\Application Data\wklnhst.dat 2008-07-02 22:25 --------- d-----w C:\Program Files\GameSpy Arcade 2008-04-14 00:42 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AOL Fast Start"="C:\Program Files\AOL 9.0 VRa\AOL.EXE" [2007-06-21 13:44 50480] "SysHlpCfg"="C:\WINDOWS\system32\admbsfaj.exe" [2008-08-27 16:05 110592] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360] "AnumanLive"="C:\Documents and Settings\maison\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe" [2007-08-29 17:42 347648] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-14 14:03 219136] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLogOff"= 0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Fichiers communs\\aol\\acs\\AOLDial.exe"= "C:\\Program Files\\Fichiers communs\\aol\\acs\\AOLacsd.exe"= "C:\\Program Files\\AOL 9.0 VR\\waol.exe"= "C:\\Program Files\\Fichiers communs\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"= "C:\\Program Files\\Fichiers communs\\aol\\Loader\\aolload.exe"= "C:\\Program Files\\Fichiers communs\\aol\\System Information\\sinf.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\Fichiers communs\\aol\\1202989891\\ee\\aolsoftware.exe"= "C:\\Program Files\\AOL 9.0 VRa\\waol.exe"= "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"= "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "C:\\Program Files\\BitTorrent_DNA\\dna.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\Liquid.6\\Program\\RM.exe"= "C:\\Program Files\\Liquid.6\\Program\\Studiou.mod"= "C:\\Program Files\\Soulseek\\slsk.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= R3 alcan5ln;SpeedTouch USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys [2003-12-08 12:53] R3 AtiHdmiService;ATI Function Driver for HDMI Service;C:\WINDOWS\system32\drivers\AtiHdmi.sys [2007-07-20 14:40] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e1127e0e-eab1-11dc-a727-0090d0b674ad}] \Shell\Auto\command - MSOCache\doWTP_RESTORE_0.exe -autorun \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE_0.exe -autorun . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' 2008-08-30 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-01 11:06:15 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... C:\Documents and Settings\maison\Application Data\Viewpoint C:\Documents and Settings\maison\Application Data\Viewpoint\Viewpoint Experience Technology C:\Documents and Settings\maison\Application Data\Viewpoint\Viewpoint Experience Technology\Resources C:\Documents and Settings\maison\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 C:\Documents and Settings\maison\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 C:\Documents and Settings\maison\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 C:\Documents and Settings\maison\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 Scan termin‚ avec succŠs Les fichiers cach‚s: 7 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Fichiers communs\aol\acs\AOLacsd.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\AOL 9.0 VRa\waol.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\Fichiers communs\aol\1202989891\ee\aolsoftware.exe C:\Program Files\Fichiers communs\aol\1202989891\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\AOL 9.0 VRa\shellmon.exe . ************************************************************************** . Temps d'accomplissement: 2008-09-01 11:07:52 - machine was rebooted [maison] ComboFix-quarantined-files.txt 2008-09-01 09:07:50 ComboFix2.txt 2008-08-27 13:29:27 Pre-Run: 83,120,263,168 octets libres Post-Run: 83,284,729,856 octets libres 188 -
windows security alert
swingle a répondu à un(e) sujet de swingle dans Analyses et éradication malwares
voila le resultat: ComboFix 08-08-26.03 - maison 2008-09-01 11:03:44.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1628 [GMT 2:00] Endroit: C:\Documents and Settings\maison\Bureau\antivirus\ComboFix.exe Command switches used :: C:\Documents and Settings\maison\Bureau\CFScript.txt * Création d'un nouveau point de restauration AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! FILE :: C:\Documents and Settings\All Users\Application Data\sjapgbuv\uxyzsrwj.exe C:\Program Files\rmttfdc\aplinfoweb.dll C:\WINDOWS\system32\edqpebcb.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\sjapgbuv C:\Documents and Settings\All Users\Application Data\sjapgbuv\uxyzsrwj.exe C:\Program Files\rmttfdc C:\Program Files\rmttfdc\aplinfoweb.dll C:\WINDOWS\system32\edqpebcb.exe . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-08-01 to 2008-09-01 )))))))))))))))))))))))))))))))))))) . 2008-09-01 11:06 . 2008-09-01 11:06 <REP> d-------- C:\Documents and Settings\maison\Application Data\Viewpoint 2008-08-30 11:24 . 2008-09-01 09:06 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-08-29 19:04 . 2008-08-29 19:04 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-29 19:04 . 2008-08-29 19:04 <REP> d-------- C:\Documents and Settings\maison\Application Data\Malwarebytes 2008-08-29 19:04 . 2008-08-29 19:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-29 19:04 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-29 19:04 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-29 18:33 . 2008-08-30 11:17 <REP> d-------- C:\Lop SD 2008-08-29 18:25 . 2008-08-29 18:25 <REP> d-------- C:\WINDOWS\ERUNT 2008-08-29 18:18 . 2008-08-29 18:30 <REP> d-------- C:\SDFix 2008-08-29 18:15 . 2008-08-29 18:15 <REP> d-------- C:\WINDOWS\Profiles 2008-08-29 18:15 . 2008-08-29 18:16 <REP> d-------- C:\Program Files\Sudden Strike 2 + Total Victory Addon 2008-08-29 18:15 . 2008-08-29 18:15 <REP> d-------- C:\Documents and Settings\maison\Application Data\InterTrust 2008-08-29 18:15 . 1998-11-13 11:16 308,224 --a------ C:\WINDOWS\IsUn040c.exe 2008-08-29 17:38 . 2008-08-29 17:38 <REP> d-------- C:\Documents and Settings\maison\Application Data\Anuman Interactive 2008-08-29 17:11 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-08-29 17:11 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-08-29 17:11 . 2008-08-26 20:19 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-08-29 17:11 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-08-29 17:11 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-08-29 17:11 . 2008-08-14 21:52 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-08-29 17:11 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe 2008-08-29 17:11 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-08-29 17:11 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-08-29 17:11 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-08-29 14:06 . 2008-08-29 14:06 66,048 --a------ C:\WINDOWS\system32\kporodod.exe 2008-08-29 11:29 . 2008-08-29 11:29 203,776 --a------ C:\WINDOWS\system32\fsrctcjm.exe 2008-08-29 00:30 . 2008-08-29 00:30 203,776 --a------ C:\WINDOWS\system32\kdgxabqp.exe 2008-08-28 18:15 . 2008-08-28 18:15 <REP> d-------- C:\Program Files\Fichiers communs\Scanner 2008-08-28 15:48 . 2008-08-28 15:48 203,776 --a------ C:\WINDOWS\system32\zezilcpc.exe 2008-08-28 15:48 . 2008-08-28 15:48 90,112 --a------ C:\WINDOWS\system32\hmnivghk.exe 2008-08-28 15:13 . 2008-08-28 15:13 166 --a------ C:\WINDOWS\wininit.ini 2008-08-28 14:48 . 2008-08-28 14:53 <REP> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-28 14:48 . 2008-08-28 15:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-28 14:30 . 2008-08-28 15:14 <REP> d-------- C:\Program Files\NoAdware5.0 2008-08-28 13:23 . 2008-08-28 13:23 203,776 --a------ C:\WINDOWS\system32\tspelqxq.exe 2008-08-27 16:05 . 2008-08-27 16:05 110,592 --a------ C:\WINDOWS\system32\admbsfaj.exe 2008-08-27 14:40 . 2008-08-29 17:23 666 --a------ C:\WINDOWS\system32\tmp.reg 2008-08-26 12:01 . 2008-08-26 12:01 <REP> d-------- C:\Program Files\uTorrent 2008-08-26 12:01 . 2008-08-27 11:34 <REP> d-------- C:\Documents and Settings\maison\Application Data\uTorrent . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-01 08:51 --------- d-----w C:\Documents and Settings\maison\Application Data\AVG7 2008-09-01 07:05 --------- d-----w C:\Documents and Settings\maison\Application Data\DNA 2008-08-31 15:46 --------- d-----w C:\Program Files\DNA 2008-08-31 10:36 --------- d-----w C:\Program Files\eMule 2008-08-30 16:16 --------- d-----w C:\Program Files\Soulseek 2008-08-29 10:18 --------- d-----w C:\Documents and Settings\maison\Application Data\EoRezo 2008-08-29 09:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2008-08-28 16:15 --------- d-----w C:\Program Files\Fichiers communs\aol 2008-08-27 13:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2008-08-27 12:05 --------- d-----w C:\Program Files\Google 2008-08-27 09:34 --------- d-----w C:\Documents and Settings\maison\Application Data\BitTorrent 2008-08-25 11:29 --------- d-----w C:\Documents and Settings\maison\Application Data\U3 2008-07-09 12:06 --------- d-----w C:\Program Files\BASAL7 2008-07-08 15:13 --------- d-----w C:\Program Files\EasyFactures 2008-07-08 15:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\BASAL7 2008-07-08 13:14 --------- d-----w C:\Program Files\MSBuild 2008-07-08 13:14 --------- d-----w C:\Program Files\Microsoft Works 2008-07-08 13:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-07-03 17:20 450 ----a-w C:\Documents and Settings\maison\Application Data\wklnhst.dat 2008-07-02 22:25 --------- d-----w C:\Program Files\GameSpy Arcade 2008-04-14 00:42 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AOL Fast Start"="C:\Program Files\AOL 9.0 VRa\AOL.EXE" [2007-06-21 13:44 50480] "SysHlpCfg"="C:\WINDOWS\system32\admbsfaj.exe" [2008-08-27 16:05 110592] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360] "AnumanLive"="C:\Documents and Settings\maison\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe" [2007-08-29 17:42 347648] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-14 14:03 219136] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLogOff"= 0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Fichiers communs\\aol\\acs\\AOLDial.exe"= "C:\\Program Files\\Fichiers communs\\aol\\acs\\AOLacsd.exe"= "C:\\Program Files\\AOL 9.0 VR\\waol.exe"= "C:\\Program Files\\Fichiers communs\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"= "C:\\Program Files\\Fichiers communs\\aol\\Loader\\aolload.exe"= "C:\\Program Files\\Fichiers communs\\aol\\System Information\\sinf.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\Fichiers communs\\aol\\1202989891\\ee\\aolsoftware.exe"= "C:\\Program Files\\AOL 9.0 VRa\\waol.exe"= "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"= "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "C:\\Program Files\\BitTorrent_DNA\\dna.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\Liquid.6\\Program\\RM.exe"= "C:\\Program Files\\Liquid.6\\Program\\Studiou.mod"= "C:\\Program Files\\Soulseek\\slsk.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= R3 alcan5ln;SpeedTouch USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys [2003-12-08 12:53] R3 AtiHdmiService;ATI Function Driver for HDMI Service;C:\WINDOWS\system32\drivers\AtiHdmi.sys [2007-07-20 14:40] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e1127e0e-eab1-11dc-a727-0090d0b674ad}] \Shell\Auto\command - MSOCache\doWTP_RESTORE_0.exe -autorun \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE_0.exe -autorun . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' 2008-08-30 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-01 11:06:15 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... C:\Documents and Settings\maison\Application Data\Viewpoint C:\Documents and Settings\maison\Application Data\Viewpoint\Viewpoint Experience Technology C:\Documents and Settings\maison\Application Data\Viewpoint\Viewpoint Experience Technology\Resources C:\Documents and Settings\maison\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 C:\Documents and Settings\maison\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 C:\Documents and Settings\maison\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 C:\Documents and Settings\maison\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 Scan termin‚ avec succŠs Les fichiers cach‚s: 7 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Fichiers communs\aol\acs\AOLacsd.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\AOL 9.0 VRa\waol.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\Fichiers communs\aol\1202989891\ee\aolsoftware.exe C:\Program Files\Fichiers communs\aol\1202989891\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\AOL 9.0 VRa\shellmon.exe . ************************************************************************** . Temps d'accomplissement: 2008-09-01 11:07:52 - machine was rebooted [maison] ComboFix-quarantined-files.txt 2008-09-01 09:07:50 ComboFix2.txt 2008-08-27 13:29:27 Pre-Run: 83,120,263,168 octets libres Post-Run: 83,284,729,856 octets libres 188 -
windows security alert
swingle a répondu à un(e) sujet de swingle dans Analyses et éradication malwares
C:\WINDOWS\system32\edqpebcb.exe: AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.30 - Authentium 5.1.0.4 2008.08.30 - Avast 4.8.1195.0 2008.08.30 - AVG 8.0.0.161 2008.08.29 - BitDefender 7.2 2008.08.30 - CAT-QuickHeal 9.50 2008.08.29 - ClamAV 0.93.1 2008.08.30 - DrWeb 4.44.0.09170 2008.08.30 - eSafe 7.0.17.0 2008.08.28 - eTrust-Vet 31.6.6057 2008.08.29 - Ewido 4.0 2008.08.30 - F-Prot 4.4.4.56 2008.08.29 - F-Secure 7.60.13501.0 2008.08.30 - Fortinet 3.14.0.0 2008.08.30 W32/PolySmall.BP!tr GData 19 2008.08.30 - Ikarus T3.1.1.34.0 2008.08.30 - K7AntiVirus 7.10.433 2008.08.30 - Kaspersky 7.0.0.125 2008.08.30 - McAfee 5373 2008.08.29 - Microsoft 1.3807 2008.08.25 TrojanDownloader:Win32/FakeAlert.C NOD32v2 3401 2008.08.30 - Norman 5.80.02 2008.08.29 - Panda 9.0.0.4 2008.08.30 - PCTools 4.4.2.0 2008.08.30 - Prevx1 V2 2008.08.30 - Rising 20.59.51.00 2008.08.30 - Sophos 4.33.0 2008.08.30 Mal/EncPk-DG Sunbelt 3.1.1592.1 2008.08.30 - Symantec 10 2008.08.30 - TheHacker 6.3.0.6.068 2008.08.30 - TrendMicro 8.700.0.1004 2008.08.29 - VBA32 3.12.8.4 2008.08.30 - ViRobot 2008.8.30.1357 2008.08.30 - VirusBuster 4.5.11.0 2008.08.30 - Webwasher-Gateway 6.6.2 2008.08.30 - Information additionnelle File size: 90112 bytes MD5...: d4b53cf01c4ad09c26c95fd972bd206c SHA1..: fb833fb5f0e8ef173de0f4ad2d64d9b2bf69cad5 SHA256: be8b2c213a2221d1c93c9639944d585ec0f8c7dfe7d60182d9cf4e4ab6b4be76 SHA512: ad1a0e7b5fb8f65bfa74a315951b961ae190abd6f60bb36a69c15e7150c6d9ca ab1c7af379a7d11808add77dd1311759be1c6d599d06473d88b89479c88d344e PEiD..: - TrID..: File type identification Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x40eeea timedatestamp.....: 0x48b50a06 (Wed Aug 27 08:02:14 2008) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .zzxo 0x1000 0x12710 0x13000 6.80 f5c115fedaacc95069b2fb31886ebbba .phbr 0x14000 0x6ee 0x1000 2.89 706d923aaa12b19a94ec4f50aa900cef .vvcm 0x15000 0x59f0 0x1000 0.62 c7df363ddad65ff9c3ef1fdc21b6c34a ( 4 imports ) > KERNEL32.dll: GetVersion, VirtualFree, GetCurrentThread, WideCharToMultiByte, WriteFile, GetPrivateProfileStringW, CreateFileW, CreateThread, FreeLibrary, LoadLibraryA, GetCurrentProcessId, FindFirstChangeNotificationW, QueryDosDeviceW, GetModuleFileNameW, GetLastError, GetProcAddress, WaitForSingleObject, GlobalFree, WritePrivateProfileStringW, GetTickCount, MoveFileW, GlobalUnlock, GlobalLock, CreateWaitableTimerW, SetLastError, SetCurrentDirectoryW, ResumeThread, GetUserDefaultLangID > USER32.dll: IsDlgButtonChecked, SystemParametersInfoW, CreateWindowExW, GetWindowDC, RedrawWindow, LoadIconW, GetSysColor, LoadCursorW, RegisterWindowMessageW, SetCursorPos, DrawTextW, SetLayeredWindowAttributes, SetDlgItemTextW, wsprintfW, OffsetRect, GetKeyState, GetMessageW, DestroyIcon, GetWindowThreadProcessId, DestroyMenu, GetWindowRect > GDI32.dll: SelectObject, CreateICW, DeleteObject, SetBkColor, DPtoLP, DeleteDC, GetDeviceCaps, SetMapMode > ADVAPI32.dll: RegNotifyChangeKeyValue, RegCreateKeyExW, LookupPrivilegeValueW, RegOpenKeyExW, RegCloseKey ( 0 exports ) -
windows security alert
swingle a répondu à un(e) sujet de swingle dans Analyses et éradication malwares
C:\Documents and Settings\All Users\Application Data\sjapgbuv\uxyzsrwj.exe: Antivirus Version Dernière mise à jour Résultat AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.30 - Authentium 5.1.0.4 2008.08.30 - Avast 4.8.1195.0 2008.08.30 - AVG 8.0.0.161 2008.08.29 - BitDefender 7.2 2008.08.30 - CAT-QuickHeal 9.50 2008.08.29 - ClamAV 0.93.1 2008.08.30 - DrWeb 4.44.0.09170 2008.08.30 - eSafe 7.0.17.0 2008.08.28 - eTrust-Vet 31.6.6057 2008.08.29 - Ewido 4.0 2008.08.30 - F-Prot 4.4.4.56 2008.08.29 - F-Secure 7.60.13501.0 2008.08.30 - Fortinet 3.14.0.0 2008.08.30 W32/PolySmall.BP!tr GData 19 2008.08.30 - Ikarus T3.1.1.34.0 2008.08.30 - K7AntiVirus 7.10.433 2008.08.30 - Kaspersky 7.0.0.125 2008.08.30 - McAfee 5373 2008.08.29 - Microsoft 1.3807 2008.08.25 Trojan:Win32/Busky.EH NOD32v2 3401 2008.08.30 - Norman 5.80.02 2008.08.29 - Panda 9.0.0.4 2008.08.30 - PCTools 4.4.2.0 2008.08.30 - Prevx1 V2 2008.08.30 - Rising 20.59.51.00 2008.08.30 - Sophos 4.33.0 2008.08.30 - Sunbelt 3.1.1592.1 2008.08.30 - Symantec 10 2008.08.30 - TheHacker 6.3.0.6.068 2008.08.30 - TrendMicro 8.700.0.1004 2008.08.29 - VBA32 3.12.8.4 2008.08.30 - ViRobot 2008.8.30.1357 2008.08.30 - VirusBuster 4.5.11.0 2008.08.30 - Webwasher-Gateway 6.6.2 2008.08.30 - Information additionnelle File size: 65536 bytes MD5...: 9f438d01517c91fbf859f45bb931720c SHA1..: d1fba6210d18eff87d39ae33466ed4d1b57ca214 SHA256: 10143a0d92dc919e954b69ab303ab8a48fdedfbed5773062f2020a1ca7104802 SHA512: 56796796451033c7b44adda4aa40b62c5e8a640ab310a257acc8cdf15d1c02f8 7a5075122da10c0934163f381fd787a145a009801732fda56fd76a2a9e0555bc PEiD..: - TrID..: File type identification Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x4035c5 timedatestamp.....: 0x48b519bd (Wed Aug 27 09:09:17 2008) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xc3e2 0xd000 6.60 75880e70f5a2f728744d4605a108d633 .rdata 0xe000 0x6d2 0x1000 2.69 7eefd8a7f29d086da651e1aa64e1c22f .data 0xf000 0x408 0x1000 0.28 fe239fbfbc226732ef4db6dea14cdcc0 ( 4 imports ) > KERNEL32.dll: LockResource, QueryDosDeviceW, GetUserDefaultLangID, SetEvent, MulDiv, GetModuleFileNameW, MoveFileW, GetLastError, TerminateThread, SetFilePointer, InterlockedDecrement, ResetEvent, SetLastError, CloseHandle, GetFileSize, FreeLibrary, LoadLibraryA, SetEndOfFile, SizeofResource, GetFileAttributesExW, CreateThread, GetProcAddress, FindFirstChangeNotificationW, Sleep, WaitForMultipleObjects, GlobalLock, GetCurrentThreadId, GlobalFree > USER32.dll: PostThreadMessageW, WindowFromPoint, LoadBitmapW, OffsetRect, SetDlgItemTextW, EnableWindow, GetMessageW, EndDialog, SetCursor, GetDlgItem, GetCursorPos, RedrawWindow, SystemParametersInfoW, SetWindowTextW, GetSystemMetrics, DispatchMessageW, FillRect, IsDlgButtonChecked, LoadImageW, GetSysColor > GDI32.dll: SetTextColor, Rectangle, CreateBitmap, SetBkMode, GetMapMode, StretchBlt, DeleteDC, CreateSolidBrush, CreatePen, SelectObject, DeleteObject, CreateCompatibleBitmap > ADVAPI32.dll: LookupPrivilegeValueW, RegDeleteValueW, GetUserNameW ( 0 exports ) ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas -
windows security alert
swingle a répondu à un(e) sujet de swingle dans Analyses et éradication malwares
Antivirus Version Dernière mise à jour Résultat AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.30 - Authentium 5.1.0.4 2008.08.30 - Avast 4.8.1195.0 2008.08.30 - AVG 8.0.0.161 2008.08.29 - BitDefender 7.2 2008.08.30 - CAT-QuickHeal 9.50 2008.08.29 - ClamAV 0.93.1 2008.08.30 - DrWeb 4.44.0.09170 2008.08.30 - eSafe 7.0.17.0 2008.08.28 - eTrust-Vet 31.6.6057 2008.08.29 - Ewido 4.0 2008.08.30 - F-Prot 4.4.4.56 2008.08.29 - F-Secure 7.60.13501.0 2008.08.30 - Fortinet 3.14.0.0 2008.08.30 - GData 19 2008.08.30 - Ikarus T3.1.1.34.0 2008.08.30 - K7AntiVirus 7.10.433 2008.08.30 - Kaspersky 7.0.0.125 2008.08.30 - McAfee 5373 2008.08.29 - Microsoft 1.3807 2008.08.25 - NOD32v2 3401 2008.08.30 - Norman 5.80.02 2008.08.29 - Panda 9.0.0.4 2008.08.30 - PCTools 4.4.2.0 2008.08.30 - Prevx1 V2 2008.08.30 - Rising 20.59.51.00 2008.08.30 - Sophos 4.33.0 2008.08.30 Mal/EncPk-DG Sunbelt 3.1.1592.1 2008.08.30 - Symantec 10 2008.08.30 - TheHacker 6.3.0.6.068 2008.08.30 - TrendMicro 8.700.0.1004 2008.08.29 - VBA32 3.12.8.4 2008.08.30 - ViRobot 2008.8.30.1357 2008.08.30 - VirusBuster 4.5.11.0 2008.08.30 - Webwasher-Gateway 6.6.2 2008.08.30 - Information additionnelle File size: 126976 bytes MD5...: 8439f76c96a4773ee65a3ac7e89d5442 SHA1..: a696c6ac8bcc5aef888358f4a00ddd07ee4b4295 SHA256: 0f52a83eb033efdead372c8887472e707ceaaad3dd9d6117b53c9962bc510f6f SHA512: babac2dfc5e59bdeb86275ba7d1116fb6cece18802be299eb487ab8cda052212 ea009c0bb9c01a47481e929ade28bd010194499b5fa621fd27e5267c6f56e93a PEiD..: - TrID..: File type identification Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x10018c09 timedatestamp.....: 0x48b50a0c (Wed Aug 27 08:02:20 2008) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .bzvgzi 0x1000 0x19d08 0x1a000 6.93 56f0684e50ae7a3e9d43039d594c7084 .rzfsv 0x1b000 0x873 0x1000 3.44 be04922c3df8ebfa7c5b3f621ff44f07 .sjdzqw 0x1c000 0x1f98 0x1000 0.61 8d7abceacbe4e0463186504202865029 .reloc 0x1e000 0x1988 0x2000 6.01 ca53c28fbc9200e2345cd7f8bd725d91 ( 4 imports ) > KERNEL32.dll: LoadLibraryW, lstrcpyW, GetFileAttributesExW, CreateThread, GlobalFree, GlobalUnlock, GetProcAddress, CreateEventW, SetCurrentDirectoryW, GetUserDefaultLangID, WaitForSingleObject, TerminateThread, FreeResource, InterlockedDecrement, LockResource, GlobalAddAtomW, GetSystemTime, GetLocalTime, FindFirstChangeNotificationW, FindResourceExW, SetEndOfFile, LoadLibraryA, DuplicateHandle, SuspendThread, MulDiv, FindClose, GetCurrentProcessId, FindResourceW, ResetEvent, GetModuleHandleW > USER32.dll: DefWindowProcW, TrackPopupMenu, GetSysColor, GetWindowThreadProcessId, GetDlgItem, AppendMenuW, MessageBoxW, SendDlgItemMessageW, PostThreadMessageW, GetCursorPos, SetForegroundWindow, SetLayeredWindowAttributes, wsprintfW, RedrawWindow, GetWindowRect, RegisterClassExW, IsWindow, SystemParametersInfoW, IsDlgButtonChecked, VkKeyScanW, GetWindowTextW, TranslateMessage, RegisterWindowMessageW, LoadBitmapW, SetCursorPos, SetWindowTextW, GetMessageW > GDI32.dll: CreateSolidBrush, CreateFontIndirectW, MoveToEx, CreateCompatibleDC, BitBlt, SetMapMode, Rectangle, CreateDCW > ADVAPI32.dll: StartServiceW, RegQueryValueExW, RegCloseKey, InitializeSecurityDescriptor, RegDeleteValueW ( 4 exports ) DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer packers (Kaspersky): PE_Patch -
windows security alert
swingle a répondu à un(e) sujet de swingle dans Analyses et éradication malwares
lop option 2: --------------------\\ Lop S&D 4.2.3-6 XP/Vista Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2 X86-based PC ( Multiprocessor Free : Intel® Core2 Duo CPU E6550 @ 2.33GHz ) BIOS : Phoenix - AwardBIOS v6.00PG USER : maison ( Administrator ) BOOT : Normal boot Antivirus : AVG 7.5.524 7.5.524 (Activated) "C:\Lop SD" ( MAJ : 27-08-2008|22:40 ) Option : [2] ( 30/08/2008|11:16 ) \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION Supprime! - C:\Program Files\BitTorrent Fastest Tool\BitDownload-4.5-setup.exe Supprime! - C:\Program Files\BitTorrent Fastest Tool\BitP.exe Supprime! - C:\Program Files\BitTorrent Fastest Tool\INSTALL.LOG Supprime! - C:\DOCUME~1\maison\Cookies\maison@advertising[2].txt Supprime! - C:\Program Files\BitDownload Supprime! - C:\Program Files\BitTorrent Fastest Tool - [ Fichier Hosts ] .. Restaure! \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ --------------------\\ Listing des dossiers dans APPLIC~1 [27/08/2008|15:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe [11/03/2008|19:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead [14/02/2008|14:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL [14/02/2008|14:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads [25/05/2008|23:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple [25/05/2008|23:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer [27/08/2008|15:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg7 [08/07/2008|17:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BASAL7 [14/02/2008|14:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini [14/04/2008|02:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EnterNHelp [14/02/2008|14:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft [14/02/2008|13:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macromedia [14/02/2008|14:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision [29/08/2008|19:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes [08/07/2008|15:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft [08/07/2008|15:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help [01/03/2008|15:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle [14/04/2008|02:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PKP_DLec.DAT [24/03/2008|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime [27/08/2008|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\sjapgbuv [28/08/2008|15:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy [14/04/2008|02:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ultima_T15 [29/08/2008|11:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip [14/02/2008|14:14] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini [14/02/2008|13:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft [14/02/2008|14:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\AVG7 [14/02/2008|13:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft [27/08/2008|15:44] C:\DOCUME~1\maison\APPLIC~1\Adobe [13/03/2008|14:23] C:\DOCUME~1\maison\APPLIC~1\Ahead [29/08/2008|17:38] C:\DOCUME~1\maison\APPLIC~1\Anuman Interactive [14/02/2008|13:53] C:\DOCUME~1\maison\APPLIC~1\AOL [25/05/2008|23:39] C:\DOCUME~1\maison\APPLIC~1\Apple Computer [27/08/2008|13:57] C:\DOCUME~1\maison\APPLIC~1\AVG7 [27/08/2008|11:34] C:\DOCUME~1\maison\APPLIC~1\BitTorrent [05/04/2008|13:52] C:\DOCUME~1\maison\APPLIC~1\BitTorrent DNA [14/02/2008|14:14] C:\DOCUME~1\maison\APPLIC~1\desktop.ini [30/08/2008|04:29] C:\DOCUME~1\maison\APPLIC~1\DNA [29/08/2008|12:18] C:\DOCUME~1\maison\APPLIC~1\EoRezo [14/02/2008|13:27] C:\DOCUME~1\maison\APPLIC~1\Identities [29/08/2008|18:15] C:\DOCUME~1\maison\APPLIC~1\InterTrust [17/03/2008|01:13] C:\DOCUME~1\maison\APPLIC~1\ItsLabel [10/03/2008|21:51] C:\DOCUME~1\maison\APPLIC~1\Macromedia [29/08/2008|19:04] C:\DOCUME~1\maison\APPLIC~1\Malwarebytes [08/07/2008|17:14] C:\DOCUME~1\maison\APPLIC~1\Microsoft [14/02/2008|14:56] C:\DOCUME~1\maison\APPLIC~1\Mozilla [29/02/2008|16:39] C:\DOCUME~1\maison\APPLIC~1\My Games [20/02/2008|15:20] C:\DOCUME~1\maison\APPLIC~1\MySpace [14/02/2008|16:35] C:\DOCUME~1\maison\APPLIC~1\Nikon [22/05/2008|19:19] C:\DOCUME~1\maison\APPLIC~1\Sun [14/02/2008|14:04] C:\DOCUME~1\maison\APPLIC~1\Talkback [25/02/2008|19:38] C:\DOCUME~1\maison\APPLIC~1\Template [25/08/2008|13:29] C:\DOCUME~1\maison\APPLIC~1\U3 [27/08/2008|11:34] C:\DOCUME~1\maison\APPLIC~1\uTorrent [12/04/2008|13:51] C:\DOCUME~1\maison\APPLIC~1\vlc [14/06/2008|18:08] C:\DOCUME~1\maison\APPLIC~1\VTC Preferences Folder [16/03/2008|17:50] C:\DOCUME~1\maison\APPLIC~1\WinRAR [03/07/2008|19:20] C:\DOCUME~1\maison\APPLIC~1\wklnhst.dat [14/02/2008|13:25] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks [31/05/2008 20:41][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job [30/08/2008 11:13][--ah-----] C:\WINDOWS\tasks\SA.DAT [30/08/2002 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini --------------------\\ Listing des dossiers dans C:\Program Files [29/08/2008|18:15] C:\Program Files\Adobe [11/03/2008|19:15] C:\Program Files\Ahead [14/02/2008|14:34] C:\Program Files\Alcatel [14/02/2008|14:58] C:\Program Files\AOL [14/02/2008|13:53] C:\Program Files\AOL 9.0 VR [14/02/2008|14:59] C:\Program Files\AOL 9.0 VRa [25/05/2008|23:38] C:\Program Files\Apple Software Update [14/02/2008|13:32] C:\Program Files\ATI Technologies [09/07/2008|14:06] C:\Program Files\BASAL7 [29/02/2008|17:43] C:\Program Files\BitTorrent [05/04/2008|13:52] C:\Program Files\BitTorrent_DNA [25/05/2008|23:38] C:\Program Files\Bonjour [14/02/2008|13:22] C:\Program Files\ComPlus Applications [14/02/2008|13:40] C:\Program Files\Dell [04/06/2008|23:18] C:\Program Files\directx [05/04/2008|13:52] C:\Program Files\DNA [08/07/2008|17:13] C:\Program Files\EasyFactures [29/08/2008|13:40] C:\Program Files\eMule [16/03/2008|17:57] C:\Program Files\EoRezo [14/02/2008|16:29] C:\Program Files\EPSON [28/08/2008|18:15] C:\Program Files\Fichiers communs [18/02/2008|18:05] C:\Program Files\Firaxis Games [19/06/2008|14:32] C:\Program Files\Food Force - Version Fran‡aise [03/07/2008|00:25] C:\Program Files\GameSpy Arcade [27/08/2008|14:05] C:\Program Files\Google [14/02/2008|14:03] C:\Program Files\Grisoft [01/03/2008|15:28] C:\Program Files\InstallShield Installation Information [14/02/2008|13:44] C:\Program Files\Intel [14/02/2008|13:24] C:\Program Files\Internet Explorer [25/05/2008|23:38] C:\Program Files\iPod [25/05/2008|23:39] C:\Program Files\iTunes [17/03/2008|13:23] C:\Program Files\Java [15/03/2008|18:05] C:\Program Files\Lavalys [01/03/2008|14:37] C:\Program Files\Liquid.6 [29/08/2008|19:04] C:\Program Files\Malwarebytes' Anti-Malware [14/02/2008|13:22] C:\Program Files\Messenger [14/02/2008|13:25] C:\Program Files\microsoft frontpage [08/07/2008|15:14] C:\Program Files\Microsoft Office [08/07/2008|15:14] C:\Program Files\Microsoft Visual Studio [08/07/2008|15:14] C:\Program Files\Microsoft Works [14/02/2008|13:23] C:\Program Files\Movie Maker [29/08/2008|14:14] C:\Program Files\Mozilla Firefox [08/07/2008|15:14] C:\Program Files\MSBuild [14/02/2008|13:22] C:\Program Files\MSN [14/02/2008|13:22] C:\Program Files\MSN Gaming Zone [21/04/2008|16:58] C:\Program Files\MySpace [14/02/2008|13:23] C:\Program Files\NetMeeting [14/02/2008|16:35] C:\Program Files\Nikon [04/06/2008|23:09] C:\Program Files\Nival Interactive [28/08/2008|15:14] C:\Program Files\NoAdware5.0 [14/02/2008|13:22] C:\Program Files\Online Services [14/02/2008|13:23] C:\Program Files\Outlook Express [01/03/2008|15:28] C:\Program Files\Pinnacle [25/05/2008|23:38] C:\Program Files\QuickTime [14/02/2008|13:41] C:\Program Files\Realtek [27/08/2008|12:05] C:\Program Files\rmttfdc [14/02/2008|13:24] C:\Program Files\Services en ligne [26/08/2008|12:37] C:\Program Files\Soulseek [28/08/2008|14:53] C:\Program Files\Spybot - Search & Destroy [29/08/2008|18:16] C:\Program Files\Sudden Strike 2 + Total Victory Addon [14/02/2008|14:35] C:\Program Files\Thomson [14/02/2008|13:27] C:\Program Files\Uninstall Information [26/08/2008|12:01] C:\Program Files\uTorrent [12/04/2008|13:49] C:\Program Files\VideoLAN [14/02/2008|13:52] C:\Program Files\Viewpoint [18/02/2008|17:06] C:\Program Files\Windows Media Player [14/02/2008|13:22] C:\Program Files\Windows NT [14/02/2008|13:24] C:\Program Files\WindowsUpdate [08/03/2008|16:17] C:\Program Files\WinRAR [29/08/2008|11:43] C:\Program Files\WinZip [14/02/2008|13:25] C:\Program Files\xerox --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs [16/03/2008|18:02] C:\Program Files\Fichiers communs\Adobe [14/02/2008|14:00] C:\Program Files\Fichiers communs\Adobe Systems Shared [11/03/2008|19:11] C:\Program Files\Fichiers communs\Ahead [28/08/2008|18:15] C:\Program Files\Fichiers communs\aol [14/02/2008|13:53] C:\Program Files\Fichiers communs\aolback [14/02/2008|14:57] C:\Program Files\Fichiers communs\aolshare [25/05/2008|23:38] C:\Program Files\Fichiers communs\Apple [08/07/2008|15:14] C:\Program Files\Fichiers communs\DESIGNER [14/02/2008|16:30] C:\Program Files\Fichiers communs\EPSON [14/02/2008|13:33] C:\Program Files\Fichiers communs\InstallShield [17/03/2008|13:22] C:\Program Files\Fichiers communs\Java [08/07/2008|15:14] C:\Program Files\Fichiers communs\Microsoft Shared [14/02/2008|13:23] C:\Program Files\Fichiers communs\MSSoap [14/02/2008|16:35] C:\Program Files\Fichiers communs\muvee Technologies [14/02/2008|16:35] C:\Program Files\Fichiers communs\Nikon [14/02/2008|13:52] C:\Program Files\Fichiers communs\Nullsoft [14/02/2008|14:15] C:\Program Files\Fichiers communs\ODBC [28/08/2008|18:15] C:\Program Files\Fichiers communs\Scanner [14/02/2008|13:23] C:\Program Files\Fichiers communs\Services [14/02/2008|14:15] C:\Program Files\Fichiers communs\SpeechEngines [08/07/2008|15:11] C:\Program Files\Fichiers communs\System --------------------\\ Process ( 38 Processus ) ... OK ! --------------------\\ Recherche avec S_Lop Aucun fichier / dossier Lop trouvé ! --------------------\\ Recherche de Fichiers / Dossiers Lop Aucun fichier / dossier Lop trouvé ! --------------------\\ Verification du Registre ..... OK ! --------------------\\ Verification du fichier Hosts Fichier Hosts PROPRE --------------------\\ Recherche de fichiers avec Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-30 11:17:18 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden files: 0 --------------------\\ Recherche d'autres infections Aucune autre infection trouvée ! [F:3][D:5]-> C:\DOCUME~1\maison\LOCALS~1\Temp [F:56][D:0]-> C:\DOCUME~1\maison\Cookies [F:1873][D:32]-> C:\DOCUME~1\maison\LOCALS~1\TEMPOR~1\content.IE5 --------------------\\ Fin du rapport a 11:17:44 p -
windows security alert
swingle a répondu à un(e) sujet de swingle dans Analyses et éradication malwares
voici le rapport sdfix: SDFix: Version 1.220 Run by maison on 29/08/2008 at 18:27 Microsoft Windows XP [version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Default Security Values Restoring Default Hosts File Rebooting Checking Files : No Trojan Files Found Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-29 18:30:03 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Fichiers communs\\aol\\acs\\AOLDial.exe"="C:\\Program Files\\Fichiers communs\\aol\\acs\\AOLDial.exe:*:Enabled:AOL Autoconnect" "C:\\Program Files\\Fichiers communs\\aol\\acs\\AOLacsd.exe"="C:\\Program Files\\Fichiers communs\\aol\\acs\\AOLacsd.exe:*:Enabled:module de connexion AOL" "C:\\Program Files\\AOL 9.0 VR\\waol.exe"="C:\\Program Files\\AOL 9.0 VR\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\Fichiers communs\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"="C:\\Program Files\\Fichiers communs\\aol\\TopSpeed\\3.0\\aoltpsd3.exe:*:Enabled:AOL TopSpeed" "C:\\Program Files\\Fichiers communs\\aol\\Loader\\aolload.exe"="C:\\Program Files\\Fichiers communs\\aol\\Loader\\aolload.exe:*:Enabled:AOL Loader" "C:\\Program Files\\Fichiers communs\\aol\\System Information\\sinf.exe"="C:\\Program Files\\Fichiers communs\\aol\\System Information\\sinf.exe:*:Enabled:AOL System Information" "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe" "C:\\Program Files\\Fichiers communs\\aol\\1202989891\\ee\\aolsoftware.exe"="C:\\Program Files\\Fichiers communs\\aol\\1202989891\\ee\\aolsoftware.exe:*:Enabled:AOL Shared Components" "C:\\Program Files\\AOL 9.0 VRa\\waol.exe"="C:\\Program Files\\AOL 9.0 VRa\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"="C:\\Program Files\\GameSpy Arcade\\Aphex.exe:*:Enabled:GameSpy Arcade 1.0, Public Beta 4" "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"="C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4" "C:\\Program Files\\BitTorrent_DNA\\dna.exe"="C:\\Program Files\\BitTorrent_DNA\\dna.exe:*:Enabled:BitTorrent DNA" "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent" "C:\\Program Files\\Liquid.6\\Program\\RM.exe"="C:\\Program Files\\Liquid.6\\Program\\RM.exe:*:Enabled:Render Manager" "C:\\Program Files\\Liquid.6\\Program\\Studiou.mod"="C:\\Program Files\\Liquid.6\\Program\\Studiou.mod:*:Enabled:Liquid" "C:\\Program Files\\Soulseek\\slsk.exe"="C:\\Program Files\\Soulseek\\slsk.exe:*:Enabled:SoulSeek" "C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" Remaining Files : Files with Hidden Attributes : Thu 23 Nov 2006 46,640 A..H. --- "C:\Program Files\AOL 9.0 VR\AOLphx.exe" Fri 17 Nov 2006 54,832 A..H. --- "C:\Program Files\AOL 9.0 VR\AOLphxex.exe" Fri 17 Nov 2006 33,328 A..H. --- "C:\Program Files\AOL 9.0 VR\rbm.exe" Thu 21 Jun 2007 46,384 A..H. --- "C:\Program Files\AOL 9.0 VRa\AOLphx.exe" Thu 24 May 2007 54,832 A..H. --- "C:\Program Files\AOL 9.0 VRa\AOLphxex.exe" Thu 24 May 2007 33,328 A..H. --- "C:\Program Files\AOL 9.0 VRa\rbm.exe" Mon 7 Jul 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Mon 7 Jul 2008 4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Mon 18 Aug 2008 1,832,272 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" Sun 20 Apr 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 14 Feb 2008 96,072 ...H. --- "C:\Program Files\Fichiers communs\aol\TopSpeed\3.0\WBUnins.exe" Finished! puis lopr: --------------------\\ Lop S&D 4.2.3-6 XP/Vista Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2 X86-based PC ( Multiprocessor Free : Intel® Core2 Duo CPU E6550 @ 2.33GHz ) BIOS : Phoenix - AwardBIOS v6.00PG USER : maison ( Administrator ) BOOT : Normal boot Antivirus : AVG 7.5.524 7.5.524 (Activated) "C:\Lop SD" ( MAJ : 27-08-2008|22:40 ) Option : [1] ( 29/08/2008|18:33 ) --------------------\\ Listing des dossiers dans APPLIC~1 [27/08/2008|15:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe [11/03/2008|19:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead [14/02/2008|14:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL [14/02/2008|14:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads [25/05/2008|23:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple [25/05/2008|23:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer [27/08/2008|15:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg7 [08/07/2008|17:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BASAL7 [14/02/2008|14:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini [14/04/2008|02:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EnterNHelp [14/02/2008|14:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft [14/02/2008|13:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macromedia [14/02/2008|14:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision [08/07/2008|15:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft [08/07/2008|15:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help [01/03/2008|15:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle [14/04/2008|02:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PKP_DLec.DAT [24/03/2008|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime [27/08/2008|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\sjapgbuv [28/08/2008|15:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy [14/04/2008|02:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ultima_T15 [14/02/2008|13:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint [29/08/2008|11:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip [14/02/2008|14:14] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini [14/02/2008|13:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft [14/02/2008|14:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\AVG7 [14/02/2008|13:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft [27/08/2008|15:44] C:\DOCUME~1\maison\APPLIC~1\Adobe [13/03/2008|14:23] C:\DOCUME~1\maison\APPLIC~1\Ahead [29/08/2008|17:38] C:\DOCUME~1\maison\APPLIC~1\Anuman Interactive [14/02/2008|13:53] C:\DOCUME~1\maison\APPLIC~1\AOL [25/05/2008|23:39] C:\DOCUME~1\maison\APPLIC~1\Apple Computer [27/08/2008|13:57] C:\DOCUME~1\maison\APPLIC~1\AVG7 [27/08/2008|11:34] C:\DOCUME~1\maison\APPLIC~1\BitTorrent [05/04/2008|13:52] C:\DOCUME~1\maison\APPLIC~1\BitTorrent DNA [14/02/2008|14:14] C:\DOCUME~1\maison\APPLIC~1\desktop.ini [29/08/2008|18:20] C:\DOCUME~1\maison\APPLIC~1\DNA [29/08/2008|12:18] C:\DOCUME~1\maison\APPLIC~1\EoRezo [14/02/2008|13:27] C:\DOCUME~1\maison\APPLIC~1\Identities [29/08/2008|18:15] C:\DOCUME~1\maison\APPLIC~1\InterTrust [17/03/2008|01:13] C:\DOCUME~1\maison\APPLIC~1\ItsLabel [10/03/2008|21:51] C:\DOCUME~1\maison\APPLIC~1\Macromedia [08/07/2008|17:14] C:\DOCUME~1\maison\APPLIC~1\Microsoft [14/02/2008|14:56] C:\DOCUME~1\maison\APPLIC~1\Mozilla [29/02/2008|16:39] C:\DOCUME~1\maison\APPLIC~1\My Games [20/02/2008|15:20] C:\DOCUME~1\maison\APPLIC~1\MySpace [14/02/2008|16:35] C:\DOCUME~1\maison\APPLIC~1\Nikon [22/05/2008|19:19] C:\DOCUME~1\maison\APPLIC~1\Sun [14/02/2008|14:04] C:\DOCUME~1\maison\APPLIC~1\Talkback [25/02/2008|19:38] C:\DOCUME~1\maison\APPLIC~1\Template [25/08/2008|13:29] C:\DOCUME~1\maison\APPLIC~1\U3 [27/08/2008|11:34] C:\DOCUME~1\maison\APPLIC~1\uTorrent [12/04/2008|13:51] C:\DOCUME~1\maison\APPLIC~1\vlc [14/06/2008|18:08] C:\DOCUME~1\maison\APPLIC~1\VTC Preferences Folder [16/03/2008|17:50] C:\DOCUME~1\maison\APPLIC~1\WinRAR [03/07/2008|19:20] C:\DOCUME~1\maison\APPLIC~1\wklnhst.dat [14/02/2008|13:25] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks [31/05/2008 20:41][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job [29/08/2008 18:28][--ah-----] C:\WINDOWS\tasks\SA.DAT [30/08/2002 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini --------------------\\ Listing des dossiers dans C:\Program Files [29/08/2008|18:15] C:\Program Files\Adobe [11/03/2008|19:15] C:\Program Files\Ahead [14/02/2008|14:34] C:\Program Files\Alcatel [14/02/2008|14:58] C:\Program Files\AOL [14/02/2008|13:53] C:\Program Files\AOL 9.0 VR [14/02/2008|14:59] C:\Program Files\AOL 9.0 VRa [25/05/2008|23:38] C:\Program Files\Apple Software Update [14/02/2008|13:32] C:\Program Files\ATI Technologies [09/07/2008|14:06] C:\Program Files\BASAL7 [23/06/2008|22:09] C:\Program Files\BitDownload [29/02/2008|17:43] C:\Program Files\BitTorrent [23/06/2008|22:10] C:\Program Files\BitTorrent Fastest Tool [05/04/2008|13:52] C:\Program Files\BitTorrent_DNA [25/05/2008|23:38] C:\Program Files\Bonjour [14/02/2008|13:22] C:\Program Files\ComPlus Applications [14/02/2008|13:40] C:\Program Files\Dell [04/06/2008|23:18] C:\Program Files\directx [05/04/2008|13:52] C:\Program Files\DNA [08/07/2008|17:13] C:\Program Files\EasyFactures [29/08/2008|13:40] C:\Program Files\eMule [16/03/2008|17:57] C:\Program Files\EoRezo [14/02/2008|16:29] C:\Program Files\EPSON [28/08/2008|18:15] C:\Program Files\Fichiers communs [18/02/2008|18:05] C:\Program Files\Firaxis Games [19/06/2008|14:32] C:\Program Files\Food Force - Version Fran‡aise [03/07/2008|00:25] C:\Program Files\GameSpy Arcade [27/08/2008|14:05] C:\Program Files\Google [14/02/2008|14:03] C:\Program Files\Grisoft [01/03/2008|15:28] C:\Program Files\InstallShield Installation Information [14/02/2008|13:44] C:\Program Files\Intel [14/02/2008|13:24] C:\Program Files\Internet Explorer [25/05/2008|23:38] C:\Program Files\iPod [25/05/2008|23:39] C:\Program Files\iTunes [17/03/2008|13:23] C:\Program Files\Java [15/03/2008|18:05] C:\Program Files\Lavalys [01/03/2008|14:37] C:\Program Files\Liquid.6 [14/02/2008|13:22] C:\Program Files\Messenger [14/02/2008|13:25] C:\Program Files\microsoft frontpage [08/07/2008|15:14] C:\Program Files\Microsoft Office [08/07/2008|15:14] C:\Program Files\Microsoft Visual Studio [08/07/2008|15:14] C:\Program Files\Microsoft Works [14/02/2008|13:23] C:\Program Files\Movie Maker [29/08/2008|14:14] C:\Program Files\Mozilla Firefox [08/07/2008|15:14] C:\Program Files\MSBuild [14/02/2008|13:22] C:\Program Files\MSN [14/02/2008|13:22] C:\Program Files\MSN Gaming Zone [21/04/2008|16:58] C:\Program Files\MySpace [14/02/2008|13:23] C:\Program Files\NetMeeting [14/02/2008|16:35] C:\Program Files\Nikon [04/06/2008|23:09] C:\Program Files\Nival Interactive [28/08/2008|15:14] C:\Program Files\NoAdware5.0 [14/02/2008|13:22] C:\Program Files\Online Services [14/02/2008|13:23] C:\Program Files\Outlook Express [01/03/2008|15:28] C:\Program Files\Pinnacle [25/05/2008|23:38] C:\Program Files\QuickTime [14/02/2008|13:41] C:\Program Files\Realtek [27/08/2008|12:05] C:\Program Files\rmttfdc [14/02/2008|13:24] C:\Program Files\Services en ligne [26/08/2008|12:37] C:\Program Files\Soulseek [28/08/2008|14:53] C:\Program Files\Spybot - Search & Destroy [29/08/2008|18:16] C:\Program Files\Sudden Strike 2 + Total Victory Addon [14/02/2008|14:35] C:\Program Files\Thomson [14/02/2008|13:27] C:\Program Files\Uninstall Information [26/08/2008|12:01] C:\Program Files\uTorrent [12/04/2008|13:49] C:\Program Files\VideoLAN [14/02/2008|13:52] C:\Program Files\Viewpoint [18/02/2008|17:06] C:\Program Files\Windows Media Player [14/02/2008|13:22] C:\Program Files\Windows NT [14/02/2008|13:24] C:\Program Files\WindowsUpdate [08/03/2008|16:17] C:\Program Files\WinRAR [29/08/2008|11:43] C:\Program Files\WinZip [14/02/2008|13:25] C:\Program Files\xerox --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs [16/03/2008|18:02] C:\Program Files\Fichiers communs\Adobe [14/02/2008|14:00] C:\Program Files\Fichiers communs\Adobe Systems Shared [11/03/2008|19:11] C:\Program Files\Fichiers communs\Ahead [28/08/2008|18:15] C:\Program Files\Fichiers communs\aol [14/02/2008|13:53] C:\Program Files\Fichiers communs\aolback [14/02/2008|14:57] C:\Program Files\Fichiers communs\aolshare [25/05/2008|23:38] C:\Program Files\Fichiers communs\Apple [08/07/2008|15:14] C:\Program Files\Fichiers communs\DESIGNER [14/02/2008|16:30] C:\Program Files\Fichiers communs\EPSON [14/02/2008|13:33] C:\Program Files\Fichiers communs\InstallShield [17/03/2008|13:22] C:\Program Files\Fichiers communs\Java [08/07/2008|15:14] C:\Program Files\Fichiers communs\Microsoft Shared [14/02/2008|13:23] C:\Program Files\Fichiers communs\MSSoap [14/02/2008|16:35] C:\Program Files\Fichiers communs\muvee Technologies [14/02/2008|16:35] C:\Program Files\Fichiers communs\Nikon [14/02/2008|13:52] C:\Program Files\Fichiers communs\Nullsoft [14/02/2008|14:15] C:\Program Files\Fichiers communs\ODBC [28/08/2008|18:15] C:\Program Files\Fichiers communs\Scanner [14/02/2008|13:23] C:\Program Files\Fichiers communs\Services [14/02/2008|14:15] C:\Program Files\Fichiers communs\SpeechEngines [08/07/2008|15:11] C:\Program Files\Fichiers communs\System --------------------\\ Process ( 41 Processus ) ... OK ! --------------------\\ Recherche avec S_Lop Aucun fichier / dossier Lop trouvé ! --------------------\\ Recherche de Fichiers / Dossiers Lop C:\Program Files\BitDownload C:\Program Files\BitTorrent Fastest Tool C:\Program Files\BitTorrent Fastest Tool\BitDownload-4.5-setup.exe C:\Program Files\BitTorrent Fastest Tool\BitP.exe C:\Program Files\BitTorrent Fastest Tool\INSTALL.LOG C:\DOCUME~1\maison\Cookies\maison@advertising[2].txt --------------------\\ Verification du Registre ..... OK ! --------------------\\ Verification du fichier Hosts Fichier Hosts PROPRE --------------------\\ Recherche de fichiers avec Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-29 18:34:13 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden files: 0 --------------------\\ Recherche d'autres infections Aucune autre infection trouvée ! [F:1][D:5]-> C:\DOCUME~1\maison\LOCALS~1\Temp [F:52][D:0]-> C:\DOCUME~1\maison\Cookies [F:1005][D:32]-> C:\DOCUME~1\maison\LOCALS~1\TEMPOR~1\content.IE5 --------------------\\ Fin du rapport a 18:34:31 -
windows security alert
swingle a répondu à un(e) sujet de swingle dans Analyses et éradication malwares
voila le complet hijackthis je pense: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:30:47, on 29/08/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Documents and Settings\maison\Bureau\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.adobe.fr/products/tips/photoshop.html R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [AdmApiHlp] C:\WINDOWS\system32\edqpebcb.exe O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0 VRa\AOL.EXE" -b O4 - HKCU\..\Run: [sysHlpCfg] C:\WINDOWS\system32\admbsfaj.exe O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKLM\..\Policies\Explorer\Run: [g6V3HUFDhT] C:\Documents and Settings\All Users\Application Data\sjapgbuv\uxyzsrwj.exe O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 4.0\resources\fr-FR\local\search.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O21 - SSODL: aplinfoweb - {531DFF6B-710E-CBF7-1FB3-07138DE94DF0} - C:\Program Files\rmttfdc\aplinfoweb.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe -- End of file - 5942 bytes smit fraudix: SmitFraudFix v2.339 Rapport fait à 17:23:39,20, 29/08/2008 Executé à partir de C:\Documents and Settings\maison\Bureau\antivirus\SmitfraudFix OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT Le type du système de fichiers est NTFS Fix executé en mode normal »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\Documents and Settings\All Users\Application Data\sjapgbuv\uxyzsrwj.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\DNA\btdna.exe C:\WINDOWS\system32\edqpebcb.exe C:\Program Files\AOL 9.0 VRa\waol.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Fichiers communs\AOL\1202989891\ee\aolsoftware.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe c:\program files\fichiers communs\aol\1202989891\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe c:\program files\fichiers communs\aol\1202989891\ee\aolsoftware.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\AOL 9.0 VRa\shellmon.exe C:\Program Files\Fichiers communs\AOL\Topspeed\3.0\aoltpsd3.exe C:\Program Files\eMule\emule.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\maison »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\maison\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\maison\Favoris »»»»»»»»»»»»»»»»»»»»»»»» Bureau »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! AntiXPVSTFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," "System"="" »»»»»»»»»»»»»»»»»»»»»»»» RK »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: WAN (PPP/SLIP) Interface DNS Server Search Order: 86.64.145.146 DNS Server Search Order: 84.103.237.146 HKLM\SYSTEM\CCS\Services\Tcpip\..\{7196B512-65CF-42C6-B22C-05BD31209A90}: NameServer=86.64.145.146 84.103.237.146 HKLM\SYSTEM\CS1\Services\Tcpip\..\{7196B512-65CF-42C6-B22C-05BD31209A90}: NameServer=86.64.145.146 84.103.237.146 »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll »»»»»»»»»»»»»»»»»»»»»»»» Fin combofix: ComboFix 08-08-26.03 - maison 2008-08-27 15:25:43.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1410 [GMT 2:00] Endroit: C:\Documents and Settings\maison\Bureau\ComboFix.exe * Création d'un nouveau point de restauration AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\maison\Application Data\macromedia\Flash Player\#SharedObjects\Z32NE5E7\bin.clearspring.com C:\Documents and Settings\maison\Application Data\macromedia\Flash Player\#SharedObjects\Z32NE5E7\bin.clearspring.com\clearspring.sol C:\Documents and Settings\maison\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com C:\Documents and Settings\maison\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol C:\Documents and Settings\maison\Application Data\rhce8hj0e3a7 C:\Program Files\Inet Delivery C:\Program Files\Inet Delivery\inetdl.exe C:\Program Files\Inet Delivery\intdel.exe C:\Program Files\Microsoft Security Adviser C:\Program Files\rhce8hj0e3a7 C:\WINDOWS\a.bat C:\WINDOWS\base64.tmp C:\WINDOWS\bdn.com C:\WINDOWS\FVProtect.exe C:\WINDOWS\iTunesMusic.exe C:\WINDOWS\mslagent C:\WINDOWS\mslagent\2_mslagent.dll C:\WINDOWS\mslagent\mslagent.exe C:\WINDOWS\mslagent\uninstall.exe C:\WINDOWS\mssecu.exe C:\WINDOWS\system32\akttzn.exe C:\WINDOWS\system32\anticipator.dll C:\WINDOWS\system32\awtoolb.dll C:\WINDOWS\system32\bdn.com C:\WINDOWS\system32\bsva-egihsg52.exe C:\WINDOWS\system32\dpcproxy.exe C:\WINDOWS\system32\emesx.dll C:\WINDOWS\system32\h@tkeysh@@k.dll C:\WINDOWS\system32\hoproxy.dll C:\WINDOWS\system32\hxiwlgpm.dat C:\WINDOWS\system32\hxiwlgpm.exe C:\WINDOWS\system32\medup012.dll C:\WINDOWS\system32\medup020.dll C:\WINDOWS\system32\msgp.exe C:\WINDOWS\system32\msnbho.dll C:\WINDOWS\system32\mssecu.exe C:\WINDOWS\system32\msvchost.exe C:\WINDOWS\system32\mtr2.exe C:\WINDOWS\system32\mwin32.exe C:\WINDOWS\system32\netode.exe C:\WINDOWS\system32\newsd32.exe C:\WINDOWS\system32\phca8hj0e3a7.bmp C:\WINDOWS\system32\pphca8hj0e3a7.exe C:\WINDOWS\system32\ps1.exe C:\WINDOWS\system32\psof1.exe C:\WINDOWS\system32\psoft1.exe C:\WINDOWS\system32\regc64.dll C:\WINDOWS\system32\regm64.dll C:\WINDOWS\system32\Rundl1.exe C:\WINDOWS\system32\smp C:\WINDOWS\system32\smp\msrc.exe C:\WINDOWS\system32\sncntr.exe C:\WINDOWS\system32\ssurf022.dll C:\WINDOWS\system32\ssvchost.com C:\WINDOWS\system32\ssvchost.exe C:\WINDOWS\system32\sysreq.exe C:\WINDOWS\system32\taack.dat C:\WINDOWS\system32\taack.exe C:\WINDOWS\system32\temp#01.exe C:\WINDOWS\system32\thun.dll C:\WINDOWS\system32\thun32.dll C:\WINDOWS\system32\VBIEWER.OCX C:\WINDOWS\system32\vbsys2.dll C:\WINDOWS\system32\vcatchpi.dll C:\WINDOWS\system32\winlogonpc.exe C:\WINDOWS\system32\winsystem.exe C:\WINDOWS\system32\WINWGPX.EXE C:\WINDOWS\userconfig9x.dll C:\WINDOWS\winsystem.exe C:\WINDOWS\zip1.tmp C:\WINDOWS\zip2.tmp C:\WINDOWS\zip3.tmp C:\WINDOWS\zipped.tmp . ((((((((((((((((((((((((((((( Fichiers créés 2008-07-27 to 2008-08-27 )))))))))))))))))))))))))))))))))))) . 2008-08-27 14:40 . 2008-08-27 14:55 816 --a------ C:\WINDOWS\system32\tmp.reg 2008-08-27 12:05 . 2008-08-27 12:05 <REP> d-------- C:\Program Files\rmttfdc 2008-08-27 12:05 . 2008-08-27 12:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\sjapgbuv 2008-08-27 12:05 . 2008-08-27 12:05 90,112 --a------ C:\WINDOWS\system32\edqpebcb.exe 2008-08-26 12:01 . 2008-08-26 12:01 <REP> d-------- C:\Program Files\uTorrent 2008-08-26 12:01 . 2008-08-27 11:34 <REP> d-------- C:\Documents and Settings\maison\Application Data\uTorrent . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-27 13:25 --------- d-----w C:\Documents and Settings\maison\Application Data\DNA 2008-08-27 13:23 --------- d-----w C:\Program Files\eMule 2008-08-27 13:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2008-08-27 12:06 --------- d-----w C:\Documents and Settings\maison\Application Data\EoRezo 2008-08-27 12:05 --------- d-----w C:\Program Files\Google 2008-08-27 11:57 --------- d-----w C:\Documents and Settings\maison\Application Data\AVG7 2008-08-27 09:34 --------- d-----w C:\Documents and Settings\maison\Application Data\BitTorrent 2008-08-26 10:37 --------- d-----w C:\Program Files\Soulseek 2008-08-25 11:29 --------- d-----w C:\Documents and Settings\maison\Application Data\U3 2008-07-09 12:06 --------- d-----w C:\Program Files\BASAL7 2008-07-08 15:13 --------- d-----w C:\Program Files\EasyFactures 2008-07-08 15:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\BASAL7 2008-07-08 13:14 --------- d-----w C:\Program Files\MSBuild 2008-07-08 13:14 --------- d-----w C:\Program Files\Microsoft Works 2008-07-08 13:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-07-03 17:20 450 ----a-w C:\Documents and Settings\maison\Application Data\wklnhst.dat 2008-07-02 22:25 --------- d-----w C:\Program Files\GameSpy Arcade 2008-04-14 00:42 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-26 08:35 289088] "AdmApiHlp"="C:\WINDOWS\system32\edqpebcb.exe" [2008-08-27 12:05 90112] "AOL Fast Start"="C:\Program Files\AOL 9.0 VRa\AOL.EXE" [2007-06-21 13:44 50480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-14 14:03 219136] [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run] "g6V3HUFDhT"="C:\Documents and Settings\All Users\Application Data\sjapgbuv\uxyzsrwj.exe" [2008-08-27 12:05 65536] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2008-02-14 14:00:16 113664] EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2008-02-14 16:30:54 127488] NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2008-02-14 16:35:18 118784] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLogOff"= 0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "aplinfoweb"= {531DFF6B-710E-CBF7-1FB3-07138DE94DF0} - C:\Program Files\rmttfdc\aplinfoweb.dll [2008-08-27 12:05 126976] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Fichiers communs\\aol\\acs\\AOLDial.exe"= "C:\\Program Files\\Fichiers communs\\aol\\acs\\AOLacsd.exe"= "C:\\Program Files\\AOL 9.0 VR\\waol.exe"= "C:\\Program Files\\Fichiers communs\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"= "C:\\Program Files\\Fichiers communs\\aol\\Loader\\aolload.exe"= "C:\\Program Files\\Fichiers communs\\aol\\System Information\\sinf.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\Fichiers communs\\aol\\1202989891\\ee\\aolsoftware.exe"= "C:\\Program Files\\AOL 9.0 VRa\\waol.exe"= "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"= "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "C:\\Program Files\\BitTorrent_DNA\\dna.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\Liquid.6\\Program\\RM.exe"= "C:\\Program Files\\Liquid.6\\Program\\Studiou.mod"= "C:\\Program Files\\Soulseek\\slsk.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= R3 alcan5ln;SpeedTouch USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys [2003-12-08 12:53] R3 AtiHdmiService;ATI Function Driver for HDMI Service;C:\WINDOWS\system32\drivers\AtiHdmi.sys [2007-07-20 14:40] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e1127e0e-eab1-11dc-a727-0090d0b674ad}] \Shell\Auto\command - MSOCache\doWTP_RESTORE_0.exe -autorun \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE_0.exe -autorun *Newly Created Service* - ATWPKT2 *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' 2008-05-31 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-SMrhce8hj0e3a7 - C:\Program Files\rhce8hj0e3a7\rhce8hj0e3a7.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\maison\Application Data\Mozilla\Firefox\Profiles\5p2iebxl.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://french.ircfast2.com/index.php?rvs=hompag . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-27 15:29:00 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-08-27 15:29:27 ComboFix-quarantined-files.txt 2008-08-27 13:29:24 Pre-Run: 77,783,203,840 octets libres Post-Run: 81,115,746,304 octets libres 202 voila et merci -
bonjour j'ai depuis trois jours une fenetre windows security alert qui s'affiche et je ne parvients pas à m'en débarrasser. je lis les forums mais je ne comprends pas très bien les differents résultats des analyses que j'ai fais avec smitfraudfix et combofix ainsi que hikackthis.j'ai eu une premiere fenetre qui elle etait au beau milieu du bureau et qui ne partait pas mais que j'ai pu regler avec smit et combo. voici l'analyse hijackthis R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.adobe.fr/products/tips/photoshop.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [AdmApiHlp] C:\WINDOWS\system32\edqpebcb.exe O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0 VRa\AOL.EXE" -b O4 - HKCU\..\Run: [sysHlpCfg] C:\WINDOWS\system32\admbsfaj.exe O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKLM\..\Policies\Explorer\Run: [g6V3HUFDhT] C:\Documents and Settings\All Users\Application Data\sjapgbuv\uxyzsrwj.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 4.0\resources\fr-FR\local\search.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{7196B512-65CF-42C6-B22C-05BD31209A90}: NameServer = 86.64.145.142 84.103.237.142 O21 - SSODL: aplinfoweb - {531DFF6B-710E-CBF7-1FB3-07138DE94DF0} - C:\Program Files\rmttfdc\aplinfoweb.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe -- End of file - 7435 bytes voila merci pour votre aide