résolu

catetmic · le 23 février 2008

Bonjour à tous,

j'ai besoin d'aide

depuis deux mois je suis ennuyé avec avast qui me signal que je suis infecté par des trojans sans pouvoir les éliminer. je viens de lire le post concernant avast mais en attendant que puis-je faire.

voici mon rapport

merci de votre aide

Logfile of HijackThis v1.99.1

Scan saved at 13:16:12, on 23/02/2008

Platform: Unknown Windows (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16609)

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Windows\System32\SVVH0ST.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\Google\Google Updater\GoogleUpdater.exe

C:\Program Files\IncrediMail\bin\IMApp.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/def...://fr.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.eazel.com/index.php?rvs=hompag

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/def...://fr.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O1 - Hosts: ::1 localhost

O1 - Hosts: 82.98.86.172 incridimail.com

O1 - Hosts: 210.72.13.14 lxszn.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll

O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [uVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [TrayServer] C:\Program Files\MAGIX\Video_deluxe_2008_e-version\TrayServer.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O13 - Gopher Prefix:

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: Routing Service (Routing) - Unknown owner - C:\Windows\system32\routing.exe

O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Modifié le 28 février 2008 par catetmic

toutoune · le 23 février 2008

Salut !

-Télécharge ComboFix de sUBs sur ton Bureau.

-Double clique sur combofix.exe puis tape 1 pour lancer le scan.

-Lorsque le scan sera terminé, un rapport apparaîtra, il est à coller dans ton prochain message. Le rapport se trouve également ici : %SYSTEMDRIVE%\Combofix.txt

NB: Combofix peut être détecté par certains antivirus. Dans ce cas-là, ignore l’alerte.

J'attends ton prochain post ! Bon courage !

catetmic · le 23 février 2008

Salut !

-Télécharge ComboFix de sUBs sur ton Bureau.

-Double clique sur combofix.exe puis tape 1 pour lancer le scan.

-Lorsque le scan sera terminé, un rapport apparaîtra, il est à coller dans ton prochain message. Le rapport se trouve également ici : %SYSTEMDRIVE%\Combofix.txt

NB: Combofix peut être détecté par certains antivirus. Dans ce cas-là, ignore l’alerte.

J'attends ton prochain post ! Bon courage !

Merci de ton aide toutoune

voici le rapport :

ComboFix 08-02-23.2 - neojunior 2008-02-23 13:59:41.1 - NTFSx86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.486 [GMT 1:00]

Endroit: D:\Mes Documents\téléchargements\ComboFix.exe

* Création d'un nouveau point de restauration

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Windows\2.exe

C:\Windows\system32\ddbcdebe1_r.dll

C:\Windows\system32\flyage.dll

C:\Windows\system32\lo.dll

C:\Windows\system32\sos2.txt

C:\Windows\system32\SVVH0ST.EXE

.

((((((((((((((((((((((((((((( Fichiers créés 2008-01-23 to 2008-02-23 ))))))))))))))))))))))))))))))))))))

.

Pas de nouveau fichier créé dans cet espace de temps

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-02-23 12:16 --------- d-----w C:\Program Files\Hijackthis Version Française

2008-02-23 12:14 --------- d-----w C:\Users\neojunior\AppData\Roaming\Download Manager

2008-02-23 10:30 --------- d-----w C:\Users\neojunior\AppData\Roaming\Azureus

2008-02-23 08:26 --------- d-----w C:\PROGRA~2\Google Updater

2008-02-22 23:01 45,056 ----a-w C:\Windows\System32\Indt2.sys

2008-02-21 04:55 265,728 ----a-w C:\Windows\System32\andt.sys

2008-02-20 12:09 265,728 ----a-w C:\Windows\System32\ndt2.sys

2008-02-19 19:43 --------- d-----w C:\Program Files\IncrediMail

2008-02-18 15:55 --------- d-----w C:\Program Files\FpTest

2008-02-17 14:58 --------- d-----w C:\Users\neojunior\AppData\Roaming\dvdcss

2008-02-16 17:28 --------- d-----w C:\PROGRA~2\DVD Shrink

2008-02-16 17:27 --------- d-----w C:\Program Files\DVD Shrink

2008-02-16 08:03 --------- d-----w C:\Program Files\Google

2008-02-13 16:49 194,560 ----a-w C:\Windows\System32\WebClnt.dll

2008-02-13 16:49 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys

2008-02-13 16:46 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys

2008-02-13 16:46 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe

2008-02-13 16:46 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe

2008-02-13 16:46 24,064 ----a-w C:\Windows\System32\netcfg.exe

2008-02-13 16:46 22,016 ----a-w C:\Windows\System32\netiougc.exe

2008-02-13 16:46 216,632 ----a-w C:\Windows\system32\drivers\netio.sys

2008-02-13 16:46 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys

2008-02-13 16:46 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll

2008-02-13 16:46 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys

2008-02-13 16:46 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys

2008-02-13 16:46 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys

2008-02-13 16:46 --------- d-----w C:\PROGRA~2\Microsoft Help

2008-02-13 16:45 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys

2008-02-13 16:45 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll

2008-02-13 16:45 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll

2008-02-13 16:45 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll

2008-02-13 16:45 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll

2008-02-13 16:45 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll

2008-02-13 16:45 1,686,528 ----a-w C:\Windows\System32\gameux.dll

2008-02-13 16:43 824,832 ----a-w C:\Windows\System32\wininet.dll

2008-02-13 16:43 56,320 ----a-w C:\Windows\System32\iesetup.dll

2008-02-13 16:43 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll

2008-02-13 16:43 26,624 ----a-w C:\Windows\System32\ieUnatt.exe

2008-02-08 19:19 --------- d-----w C:\Users\neojunior\AppData\Roaming\Todae

2008-02-07 18:50 --------- d-----w C:\Users\neojunior\AppData\Roaming\XnView

2008-02-07 18:28 --------- d-----w C:\Program Files\XnView

2008-02-03 21:06 --------- d-----w C:\Program Files\Planestate

2008-02-01 19:12 --------- d-----w C:\Program Files\adslTV

2008-02-01 19:07 --------- d-----w C:\Users\neojunior\AppData\Roaming\vlc

2008-02-01 18:44 --------- d-----w C:\Program Files\HomePlayer1.5.3.1

2008-02-01 18:39 --------- d-----w C:\Program Files\Freeplayer

2008-01-26 12:08 69,689 ----a-w C:\Windows\UNZIP.DLL

2008-01-26 12:08 507,904 ----a-w C:\Windows\TMUPDATE.DLL

2008-01-26 12:08 286,720 ----a-w C:\Windows\PATCH.EXE

2008-01-20 12:43 --------- d-----w C:\Program Files\Alwil Software

2008-01-20 12:39 --------- d-----w C:\Program Files\Common Files\Symantec Shared

2008-01-20 12:37 --------- d-----w C:\PROGRA~2\Symantec

2008-01-19 10:56 --------- d-----w C:\Users\neojunior\AppData\Roaming\LimeWire

2008-01-17 15:49 --------- d-----w C:\PROGRA~2\IM

2008-01-17 15:48 --------- d-----w C:\PROGRA~2\IncrediMail

2008-01-13 13:59 --------- d-----w C:\Program Files\Common Files\MAGIX Shared

2008-01-13 13:58 --------- d-----w C:\Program Files\MAGIX

2008-01-13 13:58 --------- d-----w C:\PROGRA~2\MAGIX

2008-01-12 23:23 --------- d-----w C:\Users\neojunior\AppData\Roaming\Media Player Classic

2008-01-10 05:50 1,244,672 ----a-w C:\Windows\System32\mcmde.dll

2008-01-09 14:01 53,248 ----a-w C:\Windows\bdoscandel.exe

2008-01-09 05:28 --------- d-----w C:\Program Files\Windows Mail

2008-01-09 05:24 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys

2008-01-09 05:24 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys

2008-01-09 05:23 11,776 ----a-w C:\Windows\System32\sbunattend.exe

2008-01-09 05:23 --------- d-----w C:\Program Files\Windows Sidebar

2008-01-06 10:14 --------- d-----w C:\Program Files\DivX

2008-01-06 09:54 --------- d-----w C:\Program Files\K-Lite Codec Pack

2008-01-04 19:25 --------- d-----w C:\Program Files\Azureus

2008-01-04 05:36 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF

2008-01-04 05:36 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT

2008-01-03 20:02 --------- d-----w C:\Program Files\Foxit Software

2008-01-03 16:49 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-01-03 16:48 --------- d-----w C:\Program Files\eBay

2008-01-03 16:48 --------- d-----w C:\PROGRA~2\eBay

2008-01-02 22:29 --------- d-----w C:\Program Files\Picasa2

2008-01-02 22:29 --------- d-----w C:\Program Files\Microsoft Works

2008-01-02 22:29 --------- d-----w C:\Program Files\Microsoft Picture It! 9

2008-01-02 22:29 --------- d-----w C:\PROGRA~2\Ulead Systems

2008-01-02 15:46 --------- d-----w C:\Users\neojunior\AppData\Roaming\Symantec

2007-12-29 14:09 --------- d-----w C:\PROGRA~2\Azureus

2007-12-13 11:47 32,768 ----a-w C:\Windows\System32\routing.exe

2007-12-12 16:24 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL

2007-12-12 16:24 223,232 ----a-w C:\Windows\System32\WMASF.DLL

2007-12-12 16:24 1,327,104 ----a-w C:\Windows\System32\quartz.dll

2007-12-04 13:04 837,496 ----a-w C:\Windows\System32\aswBoot.exe

2007-12-04 12:54 95,608 ----a-w C:\Windows\System32\AvastSS.scr

2007-12-04 01:33 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll

2007-12-04 01:33 823,296 ----a-w C:\Windows\System32\divx_xx07.dll

2007-12-04 01:33 802,816 ----a-w C:\Windows\System32\divx_xx11.dll

2007-12-04 01:33 682,496 ----a-w C:\Windows\System32\DivX.dll

2007-11-29 22:30 524,288 ----a-w C:\Windows\System32\DivXsm.exe

2007-11-29 22:30 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll

2007-11-29 22:30 200,704 ----a-w C:\Windows\System32\ssldivx.dll

2007-11-29 22:30 1,044,480 ----a-w C:\Windows\System32\libdivx.dll

2007-11-29 22:28 81,920 ----a-w C:\Windows\System32\dpl100.dll

2007-11-29 22:28 196,608 ----a-w C:\Windows\System32\dtu100.dll

2007-11-28 21:55 156,992 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe

2007-11-28 21:53 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll

2007-11-28 21:53 57,344 ----a-w C:\Windows\System32\dpv11.dll

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

REGEDIT4

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"????r"="" []

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-15 15:24 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-09-15 12:32 1006264]

"RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 03:57 3784704 C:\Windows\RtHDVCpl.exe]

"eRecoveryService"="" []

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]

"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-12 04:28 86016]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-12 04:28 8497696]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-12 04:28 81920]

"UVS11 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 14:12 341488]

"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-15 15:27 185632]

"TrayServer"="C:\Program Files\MAGIX\Video_deluxe_2008_e-version\TrayServer.exe" [2007-07-17 13:58 90112]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-09-15 15:24:16 126136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

"mt"= SVVH0ST.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{CBA664D7-7845-4748-A78F-A801EA076BBF}"= UDP:C:\Program Files\Acer Zone\Acer Zone Main Page\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite

"{88ECF735-BA95-4C4C-B1DD-F8A0505D0210}"= TCP:C:\Program Files\Acer Zone\Acer Zone Main Page\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite

"{BDE6C266-D4E0-412E-8BDC-137FDAFD962D}"= UDP:C:\Program Files\Acer Zone\Acer Picture Slide DVD\Component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess

"{95A589C8-AC04-4F93-BBA6-CFE965C0573A}"= TCP:C:\Program Files\Acer Zone\Acer Picture Slide DVD\Component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess

"{9357837E-EEB8-4804-AEE7-FBB2A61280F4}"= UDP:C:\Program Files\Acer Zone\Acer Plug and Record\Component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess

"{6539D799-7174-4EA6-AFEC-7E368AF33207}"= TCP:C:\Program Files\Acer Zone\Acer Plug and Record\Component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess

"{3644AAC3-5A91-49CD-AFF0-3574437F4077}"= UDP:C:\Program Files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess

"{BDD9BF01-7BE7-4893-B26C-DBF76962231A}"= TCP:C:\Program Files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess

"{D107C740-DFB4-4E00-9C4E-0465AC8388A5}"= UDP:C:\Program Files\Acer Zone\Acer Zone SoftDMA\SoftDMA.exe:CyberLink SoftDMA

"{E2EC3638-EB6F-463F-AD0E-8C6100D6E4DD}"= TCP:C:\Program Files\Acer Zone\Acer Zone SoftDMA\SoftDMA.exe:CyberLink SoftDMA

"{582B234A-2EDA-4496-ACF3-432D2680BA55}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

"{1E8DF448-EECC-4757-A187-477D0F6DE5E3}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

"{A6AF243E-3A6B-476B-B97E-9AF101C48F03}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)|Edge=TRUE|

"{688C1D77-79C3-4CCB-A2B3-A4DAC6791371}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)|Edge=TRUE|

"{3ABDB307-A8DB-4B39-BEA8-28F597BF19D9}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail

"{BF57F5F5-4216-4471-83B5-319650D4EC95}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail

"{2B8925AA-D197-49A0-A5A0-66473832B174}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail

"{12D966A4-5EA8-4E2B-BDAD-599F380EBDB2}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail

"{47D9AE8D-E94B-4205-B349-72D36033631A}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail

"{456FA2CD-7B28-44FB-B342-668BC32B915F}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail

"TCP Query User{5B2644DC-0EB4-4001-95FD-EA332A9FAC4D}C:\program files\adsltv\adsltv.exe"= UDP:C:\program files\adsltv\adsltv.exe:adsltv|Desc=adsltv

"UDP Query User{E5145B18-140E-4C7B-8902-FAE3507AAC88}C:\program files\adsltv\adsltv.exe"= TCP:C:\program files\adsltv\adsltv.exe:adsltv|Desc=adsltv

"TCP Query User{A761E0BD-53AC-48DC-9FB2-6124ADC088E6}C:\program files\adsltv\vlc.exe"= UDP:C:\program files\adsltv\vlc.exe:VLC media player|Desc=VLC media player

"UDP Query User{69F4105D-B29D-468F-BF35-4E813984EAFA}C:\program files\adsltv\vlc.exe"= TCP:C:\program files\adsltv\vlc.exe:VLC media player|Desc=VLC media player

"TCP Query User{4E014A16-CF61-4839-8A80-61D6FEB4F738}C:\program files\azureus\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus|Desc=Azureus

"UDP Query User{FAE9906E-C9EC-471E-8588-DC6F02D6BAE7}C:\program files\azureus\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus|Desc=Azureus

"TCP Query User{17D2B551-462C-427F-ABF1-F4D4840C1096}C:\program files\homeplayer1.5.1.2\homeplayer.exe"= UDP:C:\program files\homeplayer1.5.1.2\homeplayer.exe:HomePlayer|Desc=HomePlayer

"UDP Query User{CBED141E-B8AF-40F0-AF06-2A094E08CFAB}C:\program files\homeplayer1.5.1.2\homeplayer.exe"= TCP:C:\program files\homeplayer1.5.1.2\homeplayer.exe:HomePlayer|Desc=HomePlayer

"TCP Query User{D4773AAF-C287-489A-9E1D-2DBE748A83A1}C:\program files\freeplayer\vlc\vlc.exe"= UDP:C:\program files\freeplayer\vlc\vlc.exe:VLC media player|Desc=VLC media player

"UDP Query User{734EEDCA-77C9-4529-A14F-B4252901E386}C:\program files\freeplayer\vlc\vlc.exe"= TCP:C:\program files\freeplayer\vlc\vlc.exe:VLC media player|Desc=VLC media player

"TCP Query User{91D6016E-B905-409D-A49E-BE688931C1FE}C:\program files\adsltv\adsltv.exe"= UDP:C:\program files\adsltv\adsltv.exe:adsltv|Desc=adsltv

"UDP Query User{0602E324-C378-44F0-8459-97D2B75B9961}C:\program files\adsltv\adsltv.exe"= TCP:C:\program files\adsltv\adsltv.exe:adsltv|Desc=adsltv

"TCP Query User{9DE06431-B0F9-4185-93F6-68E930F68578}C:\program files\adsltv\vlc.exe"= UDP:C:\program files\adsltv\vlc.exe:VLC media player|Desc=VLC media player

"UDP Query User{68B44CD2-2E9F-4E02-A917-132CEF23ED7D}C:\program files\adsltv\vlc.exe"= TCP:C:\program files\adsltv\vlc.exe:VLC media player|Desc=VLC media player

"TCP Query User{75D46E29-2BB6-4CC0-83BE-7C0808338EFD}C:\program files\homeplayer1.5.3.1\homeplayer.exe"= UDP:C:\program files\homeplayer1.5.3.1\homeplayer.exe:HomePlayer|Desc=HomePlayer

"UDP Query User{12778A4F-6E32-49F1-8CB0-5581ABF5AD0B}C:\program files\homeplayer1.5.3.1\homeplayer.exe"= TCP:C:\program files\homeplayer1.5.3.1\homeplayer.exe:HomePlayer|Desc=HomePlayer

"TCP Query User{04674E89-3B87-4197-B2CD-76654BE18266}C:\users\neojunior\appdata\local\octoshape\octoshape streaming services\octoshapeclient.exe"= UDP:C:\users\neojunior\appdata\local\octoshape\octoshape streaming services\octoshapeclient.exe:octoshapeclient.exe|Desc=octoshapeclient.exe

"UDP Query User{1F28E1CC-9C76-4FE3-822A-BC17A3825189}C:\users\neojunior\appdata\local\octoshape\octoshape streaming services\octoshapeclient.exe"= TCP:C:\users\neojunior\appdata\local\octoshape\octoshape streaming services\octoshapeclient.exe:octoshapeclient.exe|Desc=octoshapeclient.exe

"TCP Query User{9BB719DD-A684-4E9F-831B-7F4F4FE50566}C:\program files\azureus\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus|Desc=Azureus

"UDP Query User{99926E98-E439-462B-844B-4FBAA0AD0646}C:\program files\azureus\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus|Desc=Azureus

"{F661871F-3775-4276-B6C7-F932D137D77C}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail

"{725063DB-72AE-496E-8D19-B54EB8D580EF}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail

"{F6EC2F6A-31E8-434F-8BEA-7A9F2AACC749}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail

"{0B185E86-EFF9-4D28-B6AB-6B61E196BC94}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail

"{B93315E9-0135-4F63-96FC-27F5BD8D027B}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail

"{D9BA60C0-E478-49EA-8941-B317F822AFF1}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]

"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2006-11-10 14:10]

R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2006-11-10 14:21]

R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2006-11-08 15:11]

R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 15:52]

R2 int15;int15;C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 17:12]

R2 Routing;Routing Service;C:\Windows\system32\routing.exe [2007-12-13 12:47]

R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-25 06:46]

R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51]

S2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" []

S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 15:18]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\shell\AutoRun\command - E:\start.exe /checksection

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]

\shell\AutoRun\command - K:\start.exe /checksection

.

Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

"2008-02-18 19:00:00 C:\Windows\Tasks\Norton Internet Security - Effectuer une analyse complète du système - neojunior.job"

- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeB/TASK:

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-23 14:01:37

Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès

Les fichiers cachés: 0

**************************************************************************

.

Temps d'accomplissement: 2008-02-23 14:02:27

ComboFix-quarantined-files.txt 2008-02-23 13:02:23

.

2008-02-22 05:15:35 --- E O F ---

toutoune · le 23 février 2008

Bon ben ça m'a l'air pas trop mal !

Peux-tu nous poster un nouveau rapport Hijackthis stp ?

Merci !

catetmic · le 23 février 2008

Bon ben ça m'a l'air pas trop mal !

Peux-tu nous poster un nouveau rapport Hijackthis stp ?

Merci !