Bonjour,
Et merci d'avance pour vos reponse
J'ai fait la recontre cette apres midi du virus total protection qui me laisse des message toute les 30secondes m'invitant a acheter leurs produits ainsi que des racourci vers des sites cochon ...
Bref apres avoir lue un topic relatant du sujet j'ai telecharger combo fix tout en au paravant lu le topic d'utilisation de ce dernier
Je ne sait pas si J'ai bien fait mais en tout cas au redemarrage de ma becan ca a l'air de fonctionner (a premiere vue)
Analyse terminer je vous joint le rapport de combo fix :
Merci a vous tous pour tout ces topic qui sont souvent une aide providencielle pour ce depatoullier de toutes ces m****s
ComboFix 10-04-30.03 - Administrateur 01/05/2010 17:26:39.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1014.326 [GMT 2:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
AV: Total Protection Service *On-access scanning enabled* (Updated) {8C354827-2F54-4E28-90DC-AD391E77808C}
* Un antivirus résident est actif
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Administrateur\Application Data\Microsoft\Internet Explorer\Quick Launch\Digital Protection.lnk
c:\documents and settings\Administrateur\Bureau\Digital Protection Support.lnk
c:\documents and settings\Administrateur\Bureau\Digital Protection.lnk
c:\documents and settings\All Users\Favoris\_favdata.dat
c:\program files\Digital Protection
c:\program files\Digital Protection\about.ico
c:\program files\Digital Protection\activate.ico
c:\program files\Digital Protection\buy.ico
c:\program files\Digital Protection\dig.db
c:\program files\Digital Protection\digext.dll
c:\program files\Digital Protection\dighook.dll
c:\program files\Digital Protection\help.ico
c:\program files\Digital Protection\scan.ico
c:\program files\Digital Protection\settings.ico
c:\program files\Digital Protection\Uninstall.exe
c:\program files\Digital Protection\update.ico
c:\program files\WindowsUpdate
c:\recycler\S-1-5-21-2351989778-1105197615-2622552963-500
c:\windows\PRAGMAwwkijxvird
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_PRAGMAwwkijxvird
-------\Service_PRAGMAwwkijxvird
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-01 au 2010-05-01 ))))))))))))))))))))))))))))))))))))
.
2010-05-01 15:07 . 2010-05-01 15:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-01 15:03 . 2010-05-01 15:03 -------- d-----w- c:\program files\trend micro
2010-05-01 15:03 . 2010-05-01 15:03 -------- d-----w- C:\rsit
2010-04-12 22:54 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-01 00:11 . 2009-02-17 07:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-04-27 14:33 . 2007-12-11 09:39 -------- d-----w- c:\documents and settings\Administrateur\Application Data\ntr
2010-04-15 02:18 . 2009-02-17 07:42 -------- d-----w- c:\program files\Google
2010-04-12 18:03 . 2007-12-12 10:39 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-04-12 18:03 . 2007-12-12 10:36 -------- d-----w- c:\program files\McAfee
2010-04-01 15:40 . 2007-12-11 10:05 -------- d-----w- c:\program files\Fichiers communs\Java
2010-04-01 15:39 . 2007-12-11 10:05 -------- d-----w- c:\program files\Java
2010-03-29 07:12 . 2004-08-24 08:38 85992 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-29 07:12 . 2004-08-24 08:38 513830 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-10 06:16 . 2004-08-24 08:37 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-09 02:28 . 2009-07-31 14:33 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-25 06:17 . 2004-08-24 08:37 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2004-08-24 08:37 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-22 17:23 . 2007-12-06 16:23 69136 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-16 19:06 . 2004-08-24 08:37 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:06 . 2004-08-04 00:48 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:34 . 2004-08-24 08:37 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-24 08:37 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2002-12-13 12:16 . 2007-12-11 09:50 5645 ----a-w- c:\program files\ICAR.LOG
1999-02-11 11:00 . 2007-12-11 09:50 82967 ----a-w- c:\program files\Uninstal.EXE
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-02-26 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-02-26 155648]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-02-26 131072]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"eTCoreManager"="c:\program files\Fichiers communs\Aladdin Shared\eToken\etCoreMgr.exe" [2007-03-12 69632]
"eTMonitor"="c:\program files\Fichiers communs\Aladdin Shared\eToken\StoreSyncExe.exe" [2007-03-12 73728]
"MVS Splash"="c:\program files\McAfee\Managed VirusScan\DesktopUI\XTray.exe" [2010-04-05 476480]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040]
"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-12-04 665424]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
autoexec.cmd [2005-11-13 426]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\java\\jre1.5.0_05\\bin\\java.exe"=
"c:\\Program Files\\IDX-SCM\\IDXSCMLauncher\\IDXSCMLauncher.exe"=
"c:\\Windows\\system32\\ntvdm.exe"=
"c:\\Windows\\system32\\tcpsvcs.exe"=
"c:\\Program Files\\McAfee\\Managed VirusScan\\Agent\\myAgtSvc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Sidexa\\TOOLS\\inquiero.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:VNC
R2 EngineServer;EngineServer;c:\program files\McAfee\Managed VirusScan\VScan\EngineServer.exe [19/05/2008 07:45 14144]
R2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\McAfee\SiteAdvisor Enterprise\McSACore.exe [16/12/2009 20:31 222528]
R2 myAgtSvc;Service McAfee de protection antivirus et antispyware;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [12/12/2007 12:36 282824]
R3 eTSCFLT;eToken SmartCard Upper Class Filter Driver;c:\windows\system32\drivers\eTSCFLT.sys [11/12/2007 12:07 12720]
S2 gupdate1c990d3947d2b20;Service Google Update (gupdate1c990d3947d2b20);c:\program files\Google\Update\GoogleUpdate.exe [17/02/2009 09:44 133104]
S3 AKSUP;AKSUP;c:\windows\system32\drivers\aksup.sys [11/12/2007 12:07 33712]
S3 OracleClientCache80;OracleClientCache80;c:\orant\BIN\ONRSD80.EXE [11/12/2007 11:50 101136]
.
Contenu du dossier 'Tâches planifiées'
2010-04-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2010-05-01 c:\windows\Tasks\AudaUpdate Client.job
- c:\sidexa\AudaUpdate\audaupdate.exe [2007-12-13 09:06]
2010-05-01 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-17 07:45]
2010-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-17 07:44]
2010-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-17 07:44]
2010-05-01 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uInternet Settings,ProxyOverride = *.local
Trusted Zone: renault.com\dcs
Trusted Zone: renault.com\dcs2
Trusted Zone: renault.com\netmail.dcs
Trusted Zone: renault.com\tdf.dcs
TCP: {F6B01082-1461-40F9-89D5-D7E91906E94F} = 192.168.1.1
.
- - - - ORPHELINS SUPPRIMES - - - -
Toolbar-Locked - (no file)
HKLM-Run-INST - (no file)
HKLM-Run-McAfee Managed Services Tray - c:\program files\McAfee\Managed VirusScan\Agent\StartMyagtTry.exe
AddRemove-infallsoft Screen Capture_is1 - c:\program files\infallsoft\Screen Capture\unins000.exe
AddRemove-MVS - c:\progra~1\McAfee\MANAGE~1\Agent\myinx
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-01 18:03
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-1777960829-1411459869-930356148-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,9e,81,cf,50,cb,cd,22,42,b9,3e,9b,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,9e,81,cf,50,cb,cd,22,42,b9,3e,9b,\
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'explorer.exe'(268)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\SCardSvr.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\documents and settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
c:\documents and settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MANAGE~1\VScan\McShield.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\RTHDCPL.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\Fichiers communs\Java\Java Update\jucheck.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Heure de fin: 2010-05-01 18:13:23 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-05-01 16:13
Avant-CF: 46 304 956 416 octets libres
Après-CF: 47 346 462 720 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
- - End Of File - - CB109D83F99EED1DAC168232B596039F
