Bonjour,
Après formatage et reformatage je vous envoi deux fichier un hijackthis et un combofix
apres formatage et install de windows avec nlite tout va bien.
Je recopie les données tout va bien
et au bout de quelques heures
l'ordi rame beaucoup trop
Merci de votre aide
chris
rapport hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:28:48, on 05/09/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service - Unknown owner - F:\utilitaires\Ad-Aware2007Portable\aawservice.exe (file missing)
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 4767 bytes
rapport combofix
ComboFix 09-09-04.02 - jean-pierre 05/09/2009 19:13.1.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.1007.709 [GMT 2:00]
Running from: c:\documents and settings\jean-pierre\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-08-05 to 2009-09-05 )))))))))))))))))))))))))))))))
.
2009-09-05 09:19 . 2007-12-24 15:37 138384 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-09-05 09:16 . 2009-09-05 12:38 -------- d-----w- c:\windows\system32\HouseCall 6.6
2009-09-03 22:51 . 2009-09-03 22:51 -------- d-sh--w- c:\documents and settings\jean-pierre\IECompatCache
2009-09-03 21:10 . 2009-09-03 21:10 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes
2009-09-03 07:27 . 2009-09-03 07:27 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-09-03 07:27 . 2009-09-05 12:44 -------- d-----w- c:\documents and settings\jean-pierre\Application Data\skypePM
2009-09-03 07:25 . 2009-09-05 17:21 -------- d-----w- c:\documents and settings\jean-pierre\Application Data\Skype
2009-09-03 07:25 . 2009-09-03 07:25 -------- d-----w- c:\program files\Fichiers communs\Skype
2009-09-03 07:24 . 2009-09-03 22:48 -------- d-----r- c:\program files\Skype
2009-09-03 07:24 . 2009-09-03 07:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-09-02 15:26 . 2009-09-02 15:26 -------- d-----w- c:\documents and settings\jean-pierre\Local Settings\Application Data\Adobe
2009-09-02 15:24 . 2009-09-02 15:25 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-09-02 15:15 . 2009-09-02 15:16 -------- d-----w- c:\program files\PhotoFiltre
2009-09-02 15:11 . 2009-09-02 15:11 -------- d-sh--w- c:\documents and settings\jean-pierre\PrivacIE
2009-09-02 15:07 . 2009-09-02 15:07 -------- d-sh--w- c:\documents and settings\jean-pierre\IETldCache
2009-09-02 15:05 . 2009-08-07 08:48 100352 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-09-02 15:05 . 2009-09-02 15:06 -------- d-----w- c:\windows\ie8updates
2009-09-02 15:05 . 2009-07-19 16:45 11067392 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-09-02 15:05 . 2009-07-03 16:57 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-09-02 15:05 . 2009-07-03 16:57 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-09-02 15:05 . 2009-07-03 16:57 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-09-02 15:05 . 2009-07-03 16:57 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-09-02 15:05 . 2009-07-03 16:57 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-09-02 15:02 . 2009-09-02 15:05 -------- dc-h--w- c:\windows\ie8
2009-09-02 14:58 . 2009-09-02 14:58 -------- d-----w- c:\program files\Microsoft Works
2009-09-02 14:52 . 2009-09-02 15:00 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-09-02 14:51 . 2009-09-02 14:52 -------- d-----w- c:\windows\SHELLNEW
2009-09-02 14:51 . 2009-09-02 14:51 -------- d-----w- c:\documents and settings\jean-pierre\Local Settings\Application Data\Microsoft Help
2009-09-02 14:50 . 2009-09-02 15:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-02 14:49 . 2009-09-02 14:49 -------- d--h--r- C:\MSOCache
2009-09-02 14:44 . 2009-09-02 14:44 -------- d-----w- c:\program files\Elaborate Bytes
2009-09-02 10:51 . 2009-09-02 10:51 -------- d-----w- c:\windows\srchasst
2009-09-02 10:20 . 2009-09-02 15:04 -------- d-----w- c:\windows\system32\fr-fr
2009-09-02 10:20 . 2009-09-02 14:31 -------- d-----w- c:\windows\system32\fr
2009-09-02 10:20 . 2009-09-02 14:29 -------- d-----w- c:\windows\l2schemas
2009-09-02 10:20 . 2009-09-02 14:31 -------- d-----w- c:\windows\system32\bits
2009-09-02 10:08 . 2004-08-19 14:10 60416 ----a-w- c:\windows\system32\dllcache\msimn.exe
2009-09-02 10:07 . 2009-07-03 16:57 206848 -c----w- c:\windows\system32\dllcache\occache.dll
2009-09-02 09:38 . 2004-08-19 14:09 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-09-02 09:37 . 2004-08-19 14:09 4096 ----a-w- c:\windows\system32\ksuser.dll
2009-09-01 20:20 . 2009-09-01 20:20 -------- d-----w- c:\documents and settings\jean-pierre\Thunderbird
2009-09-01 20:18 . 2009-09-01 20:18 0 ----a-w- c:\windows\nsreg.dat
2009-09-01 20:17 . 2009-09-01 20:18 -------- d-----w- c:\documents and settings\jean-pierre\Local Settings\Application Data\Thunderbird
2009-09-01 20:17 . 2009-09-01 20:17 -------- d-----w- c:\documents and settings\jean-pierre\Application Data\Thunderbird
2009-09-01 20:16 . 2009-09-05 17:02 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-09-01 19:22 . 2009-09-02 14:40 -------- d-----w- c:\windows\ServicePackFiles
2009-09-01 19:12 . 2009-09-01 19:12 -------- d-sh--w- c:\documents and settings\jean-pierre\UserData
2009-09-01 18:19 . 2009-01-07 16:21 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-09-01 18:19 . 2009-09-03 22:42 -------- d--h--w- c:\windows\$hf_mig$
2009-09-01 17:35 . 2009-09-05 17:20 4532256 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-01 17:32 . 2009-09-01 17:32 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier
2009-09-01 17:32 . 2009-09-01 17:34 4212 ---h--w- c:\windows\system32\zllictbl.dat
2009-09-01 17:31 . 2009-09-01 17:31 -------- d-----w- c:\program files\Zone Labs
2009-09-01 17:31 . 2008-07-09 07:05 1086952 ----a-w- c:\windows\system32\zpeng24.dll
2009-09-01 17:29 . 2009-09-05 17:20 -------- d-----w- c:\windows\Internet Logs
2009-09-01 17:22 . 2009-09-04 12:47 44848 ----a-w- c:\documents and settings\jean-pierre\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-01 17:18 . 2009-09-01 17:23 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-09-01 17:18 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-01 17:18 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-09-01 17:18 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-09-01 17:18 . 2009-09-01 17:18 -------- d-----w- c:\program files\Avira
2009-09-01 17:18 . 2009-09-01 17:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-09-01 17:16 . 2009-09-01 17:16 -------- d-----w- c:\documents and settings\jean-pierre\Application Data\Malwarebytes
2009-09-01 17:16 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-01 17:16 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-01 17:16 . 2009-09-01 17:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-01 17:16 . 2009-09-01 17:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-01 17:09 . 2009-09-01 17:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-09-01 16:58 . 2004-06-23 19:36 3147776 ----a-r- c:\windows\system32\drivers\w22n51.sys
2009-09-01 16:58 . 2004-06-01 20:50 1003520 ----a-r- c:\windows\system32\W22MLRes.dll
2009-09-01 16:58 . 2004-06-01 20:50 344064 ----a-r- c:\windows\system32\w22NCPA.dll
2009-09-01 16:57 . 2003-10-29 18:14 34329 ------w- c:\windows\O2Remove.EXE
2009-09-01 16:57 . 2004-02-12 02:18 191092 ----a-r- c:\windows\system32\drivers\o2mmb.sys
2009-09-01 16:57 . 2004-01-28 15:15 6100 ----a-r- c:\windows\system32\drivers\MbxStby.sys
2009-09-01 16:56 . 2004-05-07 02:49 66048 ----a-w- c:\windows\system32\SynTPFcs.dll
2009-09-01 16:56 . 2004-05-07 02:51 77824 ----a-w- c:\windows\system32\SynTPCoI.dll
2009-09-01 16:56 . 2004-05-07 02:46 90112 ----a-w- c:\windows\system32\SynTPAPI.dll
2009-09-01 16:56 . 2004-05-07 02:44 182688 ----a-w- c:\windows\system32\drivers\SynTP.sys
2009-09-01 16:56 . 2004-05-07 02:46 114688 ----a-w- c:\windows\system32\SynCtrl.dll
2009-09-01 16:56 . 2004-05-07 02:46 77824 ----a-w- c:\windows\system32\SynCOM.dll
2009-09-01 16:56 . 2009-09-01 16:56 -------- d-----w- c:\program files\Synaptics
2009-09-01 16:56 . 2009-09-01 16:56 -------- d-----w- c:\windows\OPTIONS
2009-09-01 16:56 . 2004-04-13 12:14 70144 ----a-w- c:\windows\system32\drivers\Rtlnicxp.sys
2009-09-01 16:55 . 2004-10-08 00:32 167936 ----a-r- c:\windows\system32\igfxres.dll
2009-09-01 16:51 . 2009-09-01 16:58 -------- d-----w- c:\program files\Intel
2009-09-01 16:50 . 2009-09-01 16:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-01 16:50 . 2009-09-01 16:57 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-09-01 16:06 . 2001-08-17 21:59 3072 ----a-w- c:\windows\system32\drivers\audstub.sys
2009-09-01 16:04 . 2004-08-03 22:31 20992 ----a-w- c:\windows\system32\drivers\RTL8139.sys
2009-09-01 16:04 . 2001-08-17 21:46 6400 ----a-w- c:\windows\system32\drivers\enum1394.sys
2009-09-01 16:04 . 2004-08-19 14:09 77312 ----a-w- c:\windows\system32\usbui.dll
2009-09-01 16:03 . 2009-09-04 14:52 -------- d-sh--w- c:\windows\Installer
2009-09-01 16:03 . 2002-08-30 12:00 77824 -c--a-w- c:\windows\system32\dllcache\spcommon.dll
2009-09-01 16:03 . 2002-08-30 12:00 774144 -c--a-w- c:\windows\system32\dllcache\spttseng.dll
2009-09-01 16:03 . 2002-08-30 12:00 65536 -c--a-w- c:\windows\system32\dllcache\spcplui.dll
2009-09-01 16:03 . 2002-08-30 12:00 36864 -c--a-w- c:\windows\system32\dllcache\sapisvr.exe
2009-09-01 16:03 . 2009-09-04 10:20 -------- d-----r- C:\Program Files
2009-09-01 16:01 . 2009-09-03 21:09 -------- d-----w- C:\Documents and Settings
2009-09-01 16:01 . 2009-09-01 14:13 -------- d--h--w- c:\documents and settings\Default User
2009-09-01 16:01 . 2009-09-01 14:11 -------- d-----w- c:\documents and settings\All Users
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-05 17:17 . 2009-09-01 17:35 57224 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-05 06:10 . 2009-09-04 10:20 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-09-04 14:52 . 2009-09-04 08:53 -------- d-----w- c:\program files\Java
2009-09-04 10:20 . 2009-09-04 10:20 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-09-04 10:20 . 2009-09-04 10:20 -------- d-----w- c:\documents and settings\jean-pierre\Application Data\SUPERAntiSpyware.com
2009-09-04 10:19 . 2009-09-04 10:19 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
2009-09-04 09:48 . 2009-09-04 09:48 -------- d-----w- c:\program files\Trend Micro
2009-09-04 09:01 . 2009-09-04 09:01 -------- d-----w- c:\documents and settings\jean-pierre\Application Data\OpenOffice.org
2009-09-04 08:54 . 2009-09-04 08:54 -------- d-----w- c:\program files\JRE
2009-09-04 08:54 . 2009-09-04 08:53 -------- d-----w- c:\program files\OpenOffice.org 3
2009-09-02 14:47 . 2002-08-30 12:00 49054 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-02 14:47 . 2002-08-30 12:00 368314 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-01 14:13 . 2009-09-01 14:13 -------- d-----w- c:\program files\microsoft frontpage
2009-09-01 14:11 . 2009-09-01 14:11 -------- d-----w- c:\program files\Services en ligne
2009-09-01 14:09 . 2009-09-01 14:09 21892 ----a-w- c:\windows\system32\emptyregdb.dat
2009-08-05 09:06 . 2004-08-19 14:09 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:53 . 2004-08-19 14:09 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-29 04:53 . 2002-08-30 12:00 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-07-25 03:23 . 2009-09-04 08:53 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 18:56 . 2004-08-19 14:09 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 00:18 . 2004-08-19 14:09 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2004-08-19 14:09 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-15 11:33 . 2004-08-19 14:10 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:23 . 2004-08-19 14:09 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:30 . 2009-09-02 10:07 132096 ----a-w- c:\windows\system32\wkssvc.dll
.
------- Sigcheck -------
[-] 2008-04-14 02:33 1571840 E17C85D5B5CF477638433B851A98499E c:\windows\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\sfcfiles.dll
[-] 2008-04-26 12:28 1548288 ED5C110C351EC3429F6959923E9517CF c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-07-16 25604904]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-09-05 1994480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-10-08 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-10-08 126976]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-07 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-07 536576]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2008-06-29 52168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]
c:\documents and settings\jean-pierre\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"StartMenuLogoff"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [03/09/2009 15:22 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [03/09/2009 15:22 74480]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [01/09/2009 19:18 108289]
R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [01/09/2009 18:57 191092]
R3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [01/09/2009 18:57 6100]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [03/09/2009 15:22 7408]
S3 Ad-Aware 2007 Service;Ad-Aware 2007 Service;f:\utilitaires\Ad-Aware2007Portable\aawservice.exe --> f:\utilitaires\Ad-Aware2007Portable\aawservice.exe [?]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -
Notify-dimsntfy - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-05 19:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(508)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
- - - - - - - > 'explorer.exe'(2780)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Completion time: 2009-09-05 19:25 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-05 17:25
Pre-Run: 19 572 428 800 octets libres
Post-Run: 19 572 703 232 octets libres
250 --- E O F --- 2009-09-02 16:22
