Bonsoir,
Désolé si je ne poste pas mon message au bonne endroit...j'ai par erreur récupérer un virus sur msn
J'ai donc utilisé combofix...mais je ne sais pas lire le rapport votre aide serait bienvenue
merci d'avance aux courageux qui s'attaqueront au rapport
ComboFix 09-09-23.02 - Famille Dreux 24/09/2009 23:26.1.2 - NTFSx86
Lancé depuis: c:\documents and settings\Famille Dreux\Mes documents\Téléchargements\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\pdfforge Toolbar\SeARchsettings.dll
c:\program files\QUAD Utilities
c:\program files\QUAD Utilities\QUAD Registry Cleaner\program.log
c:\program files\QUAD Utilities\QUAD Registry Cleaner\Styles\Vista.cjstyles
c:\recycler\S-1-5-21-4230163953-1765287014-2669462618-500
c:\windows\Installer\WMEncoder.msi
c:\windows\kb913800.exe
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-08-24 au 2009-09-24 ))))))))))))))))))))))))))))))))))))
.
2009-09-22 19:30 . 2009-09-24 20:15 -------- d-----w- C:\$AVG8.VAULT$
2009-09-21 15:04 . 2009-09-21 15:04 -------- d-----w- c:\documents and settings\Famille Dreux\Local Settings\Application Data\AVG Security Toolbar
2009-09-21 15:02 . 2009-09-21 15:02 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-09-21 15:02 . 2009-09-21 15:02 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-09-21 15:02 . 2009-09-21 15:02 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-09-21 15:02 . 2009-09-21 15:02 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-09-21 15:01 . 2009-09-24 08:14 -------- d-----w- c:\windows\system32\drivers\Avg
2009-09-21 15:01 . 2009-09-21 15:07 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-09-21 15:01 . 2009-09-21 15:01 -------- d-----w- c:\program files\AVG
2009-09-21 15:01 . 2009-09-21 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-21 09:01 . 2009-09-21 09:01 -------- d-----w- c:\documents and settings\Famille Dreux\Application Data\Aisle 5 Games, Inc
2009-09-20 21:43 . 2009-09-20 21:44 -------- d-----w- c:\program files\G.H.O.S.T. Chronicles - Le Fantome de la Foire de la Renaissance
2009-09-18 12:05 . 2009-09-18 12:05 -------- d-----w- c:\documents and settings\Famille Dreux\Application Data\blg
2009-09-18 12:05 . 2009-09-18 12:05 -------- d-----w- c:\documents and settings\All Users\Application Data\blg
2009-09-11 11:02 . 2009-09-11 11:02 -------- d-----w- c:\documents and settings\Famille Dreux\Application Data\dvdcss
2009-09-09 19:11 . 2009-09-09 19:11 -------- d-----w- c:\documents and settings\Famille Dreux\Application Data\SultansLabyrinth
2009-09-08 09:08 . 2009-09-08 09:09 -------- d-----w- c:\documents and settings\Famille Dreux\Application Data\HiT-MM
2009-09-04 21:15 . 2009-09-04 21:15 -------- d-----w- c:\documents and settings\Famille Dreux\Application Data\GAMESHASTRA
2009-09-04 21:15 . 2009-09-04 21:15 -------- d-----w- c:\documents and settings\All Users\Application Data\GAMESHASTRA
2009-09-04 09:25 . 2009-09-04 09:25 -------- d-----w- c:\documents and settings\Famille Dreux\Application Data\Search Settings
2009-09-04 09:25 . 2009-09-04 09:25 -------- d-----w- c:\documents and settings\Famille Dreux\Application Data\pdfforge
2009-09-02 19:23 . 2009-09-02 19:23 -------- d-----w- c:\documents and settings\Famille Dreux\Application Data\Lost in the City
2009-09-02 15:55 . 2009-09-02 15:55 -------- d-----r- C:\MSOCache
2009-09-02 14:56 . 2009-09-24 21:35 -------- d-----w- c:\program files\pdfforge Toolbar
2009-08-29 11:03 . 2009-08-29 11:03 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayPond
2009-08-28 18:03 . 2009-08-28 18:03 -------- d-----w- c:\documents and settings\All Users\Application Data\BigFishSavedGames
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-21 11:15 . 2008-11-23 15:33 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-21 10:00 . 2008-11-23 15:02 -------- d-----w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-09-10 08:53 . 2009-02-20 23:48 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-08 16:36 . 2008-11-10 11:48 -------- d-----w- c:\program files\Google
2009-09-08 16:29 . 2008-11-20 14:13 -------- d-----w- c:\program files\Windows Media Connect 2
2009-09-08 16:29 . 2008-11-10 11:51 -------- d-----w- c:\documents and settings\Famille Dreux\Application Data\Delicious IE Extension
2009-09-08 16:24 . 2008-08-27 13:54 -------- d-----w- c:\program files\QuickTime
2009-09-08 16:22 . 2009-04-14 08:59 -------- d-----w- c:\program files\iTunes
2009-09-08 16:22 . 2008-11-24 15:17 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-09-02 20:25 . 2008-08-27 13:29 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-02 20:25 . 2008-11-10 14:21 -------- d-----w- c:\program files\Canon
2009-09-02 16:18 . 2008-12-14 16:01 1822 -c--a-w- c:\documents and settings\Famille Dreux\Application Data\wklnhst.dat
2009-08-27 13:05 . 2009-05-12 14:21 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-07 13:30 . 2008-08-27 13:22 78288 -c--a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-07 04:56 . 2004-09-23 16:12 84874 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-07 04:56 . 2004-09-23 16:12 510656 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-05 09:00 . 2004-09-23 16:10 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-27 15:33 . 2008-08-27 13:50 -------- d-----w- c:\program files\Java
2009-07-17 19:03 . 2004-09-23 16:09 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 08:08 . 2004-09-23 16:13 286720 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-06 10:00 . 2009-07-06 10:00 4096 -c--a-w- c:\windows\d3dx.dat
2009-07-03 16:57 . 2004-09-23 16:11 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-13 12:03 . 2009-05-12 13:35 32 -csha-w- c:\windows\system32\drivers\fidbox.dat
2009-05-13 12:03 . 2009-05-12 13:35 32 -csha-w- c:\windows\system32\drivers\fidbox2.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-07-24 07:55 1090816 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
2009-07-31 00:00 698880 ----a-w- c:\program files\pdfforge Toolbar\pdfforgeToolbarIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files\pdfforge Toolbar\pdfforgeToolbarIE.dll" [2009-07-31 698880]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]
[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadwin PrintScreen"="c:\program files\Gadwin Systems\PrintScreen\PrintScreen.exe" [2007-08-20 495616]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"RTHDCPL"="c:\windows\RTHDCPL.EXE" [2005-12-09 15691264]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SoftwareHelper"="c:\documents and settings\Famille Dreux\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe" [2008-12-09 368224]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
"SearchSettings"="c:\program files\pdfforge Toolbar\SearchSettings.exe" [2009-07-29 1024512]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-21 2007832]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-09-21 15:02 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Famille Dreux^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\Famille Dreux\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Adobe\\Photoshop Elements 5.0\\AdobePhotoshopElementsMediaServer.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [21/09/2009 17:02 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [21/09/2009 17:02 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [21/09/2009 17:01 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [21/09/2009 17:01 297752]
R2 Eset_TrialReset_serv;Eset TrialReset;c:\windows\Eset_TrialReset_serv.exe [27/07/2008 12:27 69632]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [21/02/2009 01:48 55152]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 19:08 533360]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'
2009-09-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://y.lo.st
mStart Page = hxxp://www.tinit.org/
uInternet Connection Wizard,ShellNext = hxxp://www.yahoo.fr/
uInternet Settings,ProxyOverride = *.local
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\documents and settings\Famille Dreux\Application Data\Mozilla\Firefox\Profiles\864hlc80.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://fr.mg41.mail.yahoo.com/dc/launch?.gx=1&.rand=0elgpbhbeboo5
FF - prefs.js: keyword.URL - hxxp://fr.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_fr&p=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}\components\pdfforgeToolbarFF.dll
FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
.
- - - - ORPHELINS SUPPRIMES - - - -
URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
HKLM-Run-EoEngine - (no file)
AddRemove-{DBC3FDEC-D5F4-439C-9A18-EF454A74E3DE}_is1 - c:\documents and settings\Famille Dreux\Bureau\NOD32\NOD32\crack\1\Obsolete\unins000.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-24 23:40
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(564)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3780)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\logishrd\LVCOMSER\LVComSer.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\dllhost.exe
c:\program files\Fichiers communs\logishrd\LVCOMSER\LVComSer.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Heure de fin: 2009-09-24 23:49 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-09-24 21:48
Avant-CF: 56 334 843 904 octets libres
Après-CF: 57 440 886 784 octets libres
221 --- E O F --- 2009-09-22 21:27
