help!!!

[Lien Rag]

le lien pour Flash Disinfector est Ok maintenant

 

Utilise le stp

 

Pour Combo il y a un autre rapport : C:\ComboFix.txt

 

merci de le poster également

Modifié le 24 juin 2007 par Lien Rag

[zyklon2]

j'ai refais le scann avec ComboFix et voici le rapport:

 

 

"YOYOOOTH" - 2007-06-24 16:24:20 - ComboFix 07-06-23.5 - Service Pack 2 NTFS [sAFE MODE]

 

 

((((((((((((((((((((((((( Files Created from 2007-05-24 to 2007-06-24 )))))))))))))))))))))))))))))))

 

 

2007-06-24 16:19 <REP> drahs---- C:\autorun.inf

2007-06-24 16:18 26,112 --a------ C:\WINDOWS\system32\nircmd.exe

2007-06-24 11:34 54,784 --a------ C:\WINDOWS\system32\drivers\CDAC11BA.EXE

2007-06-24 11:34 12,464 --a------ C:\WINDOWS\system32\drivers\CDAC15BA.SYS

2007-06-24 11:34 <REP> d-------- C:\Program Files\Fichiers communs\Macrovision Shared

2007-06-24 10:33 49,152 --a------ C:\WINDOWS\nircmd.exe

2007-06-23 13:32 <REP> d-------- C:\Program Files\Scan Hijack This

2007-06-22 16:32 87,824 -ra------ C:\WINDOWS\system32\drivers\w300mgmt.sys

2007-06-22 16:32 85,696 -ra------ C:\WINDOWS\system32\drivers\w300obex.sys

2007-06-22 16:31 96,352 -ra------ C:\WINDOWS\system32\drivers\w300mdm.sys

2007-06-22 16:31 9,264 -ra------ C:\WINDOWS\system32\drivers\w300mdfl.sys

2007-06-22 16:31 60,800 -ra------ C:\WINDOWS\system32\drivers\w300bus.sys

2007-06-22 16:31 6,208 -ra------ C:\WINDOWS\system32\drivers\w300cmnt.sys

2007-06-22 16:31 6,208 -ra------ C:\WINDOWS\system32\drivers\w300cm.sys

2007-06-22 16:31 5,840 -ra------ C:\WINDOWS\system32\drivers\w300whnt.sys

2007-06-22 16:31 5,840 -ra------ C:\WINDOWS\system32\drivers\w300wh.sys

2007-06-22 16:24 <REP> d-------- C:\DOCUME~1\YOYOOOTH\APPLIC~1\Teleca

2007-06-22 16:19 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson

2007-06-22 16:18 <REP> d-------- C:\Program Files\Sony Ericsson

2007-06-22 16:18 <REP> d-------- C:\Program Files\Fichiers communs\Teleca Shared

2007-06-22 16:18 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Teleca

2007-06-02 04:42 <REP> d-------- C:\Program Files\Common Files

2007-06-02 04:40 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Line 6

2007-06-01 01:57 <REP> d-------- C:\Program Files\Sonoma Wire Works

2007-06-01 01:57 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonoma Wire Works

2007-05-30 04:39 <REP> d-------- C:\DOCUME~1\YOYOOOTH\APPLIC~1\Line 6

2007-05-30 03:55 <REP> d-------- C:\Program Files\Line6

 

 

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

 

2007-06-24 14:13:18 -------- d-----w C:\Program Files\eMule

2007-06-24 12:49:08 -------- d-----w C:\DOCUME~1\YOYOOOTH\APPLIC~1\Skype

2007-06-24 10:43:34 -------- d-----w C:\Program Files\AutoCAD 2004

2007-06-24 09:32:30 -------- d-----w C:\Program Files\Fichiers communs\Autodesk Shared

2007-06-24 09:32:30 -------- d-----w C:\Program Files\AnswerWorks 4.0

2007-06-24 09:22:09 -------- d-----w C:\Program Files\Autodesk Architectural Desktop 2004

2007-06-23 11:33:31 -------- d-----w C:\Program Files\Apoint2K

2007-06-23 11:33:28 -------- d-----w C:\Program Files\ACAD2000

2007-06-18 13:20:41 -------- d-----w C:\DOCUME~1\YOYOOOTH\APPLIC~1\BitTorrent

2007-06-02 02:40:14 -------- d-----w C:\Program Files\Vstplugins

2007-05-16 15:13:53 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll

2007-05-07 11:49:14 -------- d-----w C:\Program Files\PDFCreator

2007-05-06 14:11:28 255 ----a-w C:\WINDOWS\system32\do16929.dll

2007-05-06 14:08:10 -------- d-----w C:\Program Files\Sybase

2007-05-06 13:59:04 80,018,669 ----a-w C:\PowerAMC952_Eval.exe

2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe

2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys

2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr

2007-04-25 14:22:35 144,896 ----a-w C:\WINDOWS\system32\schannel.dll

2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll

2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll

2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll

2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll

2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll

2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll

2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll

2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe

2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll

2007-04-16 01:40:29 145,410,801 ----a-w C:\PowerAMC121_Evaluation.exe

2007-03-28 12:13:29 64,052 ----a-w C:\WINDOWS\system32\perfc00C.dat

2007-03-28 12:13:29 445,672 ----a-w C:\WINDOWS\system32\perfh00C.dat

2006-05-29 19:52:46 56 --sh--r C:\WINDOWS\system32\AC79C8B69A.sys

2007-02-02 19:48:22 401,408 --shatr C:\WINDOWS\system32\ahr.exe

2006-11-12 16:34:08 4,704 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys

 

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

 

 

*Note* empty entries & legit default entries are not shown

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 14:17]

{AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar3.dll [2006-10-17 16:04]

{D5792AA9-D373-4039-8670-2CDAB6A71F15}=C:\Program Files\Torrent101\TorrentManager.dll [2006-12-22 14:06]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-20 21:15]

"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11]

"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-08-06 08:27]

"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2005-02-08 18:38]

"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-05-04 10:59]

"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-10-13 16:04]

"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 13:54]

"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 13:24]

"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-03-29 14:45]

"AGRSMMSG"="AGRSMMSG.exe" [2005-04-13 12:12 C:\WINDOWS\AGRSMMSG.exe]

"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 20:41]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-08-09 15:16]

"NWEReboot"="" []

"AGEIA PhysX SysTray"="C:\Program Files\AGEIA Technologies\TrayIcon.exe" [2006-03-20 21:43]

"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-02-24 13:13]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" [2005-06-03 03:52]

"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe" []

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18]

"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-09-10 21:46]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 10:00]

"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-14 01:37]

"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2006-09-28 22:02]

"eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2006-01-26 18:21]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegedit"=0 (0x0)

"NoFind"=0 (0x0)

"NoRun"=0 (0x0)

"NoDesktop"=0 (0x0)

"NoControlPanel"=0 (0x0)

"NoClose"=0 (0x0)

"StartMenuLogOff"=0 (0x0)

"HideClock"=0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

"none"=C:\Program Files\Key Generator\pmsngr.exe

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Documents and Settings\YOYOOOTH\Bureau\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 16:13]

 

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04a7c988-05e2-11dc-9e9d-0015004d0801}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{06130054-e981-11da-9c9c-0015004d0801}]

AutoRun\command- E:\RavMon.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{175ff8da-19a1-11db-9a8c-0015004d0801}]

AutoRun\command- RavMon.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18326417-88a4-11db-b3bb-0015004d0801}]

AutoRun\command- EXPLORER.EXE

explore\Command- EXPLORER.EXE

open\Command- EXPLORER.EXE

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1832641f-88a4-11db-b3bb-0015004d0801}]

AutoRun\command- E:\setupSNK.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1e4f5498-cda5-11db-9e58-0015004d0801}]

AutoRun\command- EXPLORER.EXE

explore\Command- EXPLORER.EXE

open\Command- EXPLORER.EXE

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ae432f8-7a55-11db-b396-0015004d0801}]

AutoRun\command- G:\fooool.exe

explore\Command- G:\fooool.exe

open\Command- G:\fooool.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dd9d786-8781-11db-b3b4-0015004d0801}]

AutoRun\command- 1.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35f542fe-e7f2-11da-9c94-0015004d0801}]

AutoRun\command- RavMon.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38c93986-e90f-11da-9c9a-0015004d0801}]

AutoRun\command- m.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68444a84-3662-11db-b31b-806d6172696f}]

AutoRun\command- F:\a.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{684810f7-0151-11db-9cff-0015004d0801}]

AutoRun\command- RavMon.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fe29a48-00cd-11dc-9e96-0015004d0801}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fe29a49-00cd-11dc-9e96-0015004d0801}]

AutoRun\command- F:\a.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8401b866-fb83-11da-9ce7-0015004d0801}]

AutoRun\command- RavMon.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8401b869-fb83-11da-9ce7-0015004d0801}]

AutoRun\command- RavMon.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b93b4c68-e5ad-11da-9c8a-0015004d0801}]

AutoRun\command- 1.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc4dc122-c74a-11db-9e44-806d6172696f}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c54e84d4-8495-11db-b3ae-0015004d0801}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d861b902-fb78-11da-9ce5-0015004d0801}]

AutoRun\command- RavMon.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dd803242-1279-11dc-9eae-0015004d0801}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f1ba8a12-35a7-11db-9ac0-0015004d0801}]

AutoRun\command- RavMon.exe

 

 

**************************************************************************

 

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-06-24 16:37:01

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

cmd.exe [1496]

 

 

scanning hidden autostart entries ...

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe??????????_????|?P???? ???B?????????????hLC? ??????

 

scanning hidden files ...

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mchInjDrv]

"ImagePath"="\??\C:\DOCUME~1\YOYOOOTH\LOCALS~1\Temp\mc21.tmp"

 

Completion time: 2007-06-24 16:39:05

C:\ComboFix-quarantined-files.txt ... 2007-06-24 16:38

 

--- E O F ---

 

 

 

 

et oui,le lien que tu m'as indiqué fonctionne maintenant.

[zyklon2]

......

[Lien Rag]

Bonsoir

 

on fait un point stp

 

a. As tu uploader le fichier comme je te l'ai demandé

b. As tu utilisé le lien pour le Fix

c. Quid de ton problème de leçon d'Espagnol non désirée

[zyklon2]

Bonsoir,

 

oui, j'ai suivi à la lettre ce que tu m'as demandé de faire? c'est quaoi la prochaine étape?

[Lien Rag]

la c.

[zyklon2]

merci, c'est cool!

[Lien Rag]

merci, c'est cool!

 

est ce à dire que ton problème est réglé...si c'est le cas tant mieux

 

me reste à te souhaiter une bonne continuation et à bientot sur Zeb