PC lent

lodoss01 · le 12 juin 2008

Bonjour a tous et a toute

Voila depuis un bon moment mon pc c est mis a ramer sans aucune raison apparente et cela devient tres lourd comme vous pouvez l imaginer je sollicite donc votre aide si vous pouvez ... J ai bien sur essayer de tout scanner avec AVG anti-virus et Avast cela na rien donner...

Voici mon rapport HijackThis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:00:43, on 12/06/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\Program Files\AVG\AVG8\avgrsx.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Microsoft LifeCam\MSCamS32.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\EoRezo\EoEngine.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

C:\Program Files\Windows Live\Messenger\usnsvc.exe

C:\Program Files\Winamp\winamp.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Documents and Settings\Lodoss\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lo.st

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\Lodoss\LOCALS~1\Temp\winlogon.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - (no file)

O2 - BHO: (no name) - {3340BEBB-5503-008A-5765-2C00BFC88E9D} - (no file)

O2 - BHO: (no name) - {35AB30D6-E8D3-410D-B1A3-7C011F2B5025} - (no file)

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: 0 - {59E480B9-192C-4887-B9B8-550EB6674AF2} - (no file)

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)

O2 - BHO: (no name) - {6540EE93-060B-0BA8-5315-2F00BCBCDFB1} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O2 - BHO: (no name) - {E860F2B7-81DB-4924-87C1-A8B5EA8288C3} - (no file)

O2 - BHO: 0 - {FD8A5C5D-4982-4840-408A-48B288694332} - (no file)

O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Flash Driver] C:\DOCUME~1\Lodoss\LOCALS~1\Temp\winlogon.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"

O4 - HKLM\..\Run: [itsTV] "C:\Program Files\ItsLabel\ItsTV.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [uyynk] "C:\Program Files\?ymantec\w?wexec.exe"

O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background

O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1181245195843

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: avgrsstx.dll

O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\prokyzopr.html

--

End of file - 7059 bytes

Modifié le 12 juin 2008 par lodoss01

Thanos · le 12 juin 2008

salut et bienvenue

Le pc est infecté d'où la lenteur constatée!

On va utiliser ce programme afin de nettoyer les différentes infections >>

Désactive ton antivirus le temps du scan.

Télécharge combofix.exe de sUBs

Assure toi que tous les programmes sont fermés avant de lancer le fix!
Fait un double clique sur combofix.exe.
Clique sur Oui au message de Limitation de Garantie qui s'affiche.
Il est possible que ton parefeu te demande si tu acceptes ou non l'accès de nircmd.cfexe à la zone sure: accepte!
Note: Ne ferme pas la fenêtre qui vient de s'ouvrir , tu te retrouverais avec un bureau vide !
Lorsque le scan est terminé, un rapport sera généré : poste en le contenu dans ton prochain message.
Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

lodoss01 · le 12 juin 2008

Merci de ta reponse Thanos voici le rapport de Combofix :

ComboFix 08-06-10.5 - Lodoss 2008-06-12 18:57:42.1 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.237 [GMT 2:00]

Endroit: C:\Documents and Settings\Lodoss\Bureau\ComboFix.exe

* Création d'un nouveau point de restauration

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\Lodoss\Application Data\DOBE~1

C:\Documents and Settings\Lodoss\Local Settings\Temporary Internet Files\bestwiner.stt

C:\Documents and Settings\Lodoss\Local Settings\Temporary Internet Files\CPV.stt

C:\Documents and Settings\Lodoss\real.txt

C:\Program Files\CPV

C:\Program Files\inetget2

C:\Program Files\JavaCore

C:\Program Files\MapEDC

C:\Program Files\MapEDC\IDE.stt

C:\Program Files\NoDNS

C:\Program Files\NoDNS\UnInstall.exe

C:\Program Files\Temporary

C:\Program Files\Windows NT\prokyzopr.html

C:\Program Files\ymante~1

C:\WINDOWS\system32\real.txt

C:\WINDOWS\system32\wsnpoem

C:\WINDOWS\system32\wsnpoem\audio.dll

C:\WINDOWS\system32\wsnpoem\video.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_NPF

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-12 to 2008-06-12 ))))))))))))))))))))))))))))))))))))

.

2008-06-12 16:24 . 2008-06-12 16:24 4,551,483 --a------ C:\WINDOWS\system32\Les m‚tiers du combat.scr

2008-06-11 11:11 . 2008-04-14 17:52 272,768 --------- C:\WINDOWS\system32\dllcache\bthport.sys

2008-06-06 21:08 . 2008-06-06 21:08 <REP> d-------- C:\Program Files\uTorrent

2008-06-06 21:08 . 2008-06-12 18:33 <REP> d-------- C:\Documents and Settings\Lodoss\Application Data\uTorrent

2008-06-05 10:59 . 2008-06-09 09:53 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2008-06-05 10:59 . 2008-06-05 10:59 1,409 --a------ C:\WINDOWS\QTFont.for

2008-05-20 23:37 . 2008-05-20 23:37 <REP> d-------- C:\Program Files\Command & Conquer Collection

2008-05-20 20:59 . 2008-05-20 20:59 <REP> d-------- C:\Program Files\Veoh Networks

2008-05-20 20:58 . 2008-05-20 20:58 <REP> d-------- C:\WINDOWS\Downloaded Installations

2008-05-20 20:31 . 2008-05-20 20:31 <REP> d-------- C:\Program Files\DivX

2008-05-14 14:18 . 2008-05-14 14:18 <REP> d-------- C:\Documents and Settings\Lodoss\Application Data\ItsLabel

2008-05-14 09:23 . 2008-05-14 09:24 <REP> d-------- C:\Program Files\Defcon

2008-05-13 16:39 . 2008-06-12 19:08 <REP> d-------- C:\Program Files\ItsLabel

2008-05-13 16:38 . 2008-05-13 16:57 <REP> d-------- C:\Program Files\EoRezo

2008-05-13 16:38 . 2008-06-12 19:08 <REP> d-------- C:\Documents and Settings\Lodoss\Application Data\EoRezo

2008-05-13 03:51 . 2008-05-13 03:51 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll

2008-05-13 03:51 . 2008-05-13 03:51 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-12 16:33 --------- d-----w C:\Documents and Settings\Lodoss\Application Data\Azureus

2008-06-12 16:23 --------- d-----w C:\Program Files\Valve

2008-06-01 22:10 --------- d-----w C:\Documents and Settings\Lodoss\Application Data\AVGTOOLBAR

2008-05-20 19:00 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-05-20 17:00 --------- d-----w C:\Documents and Settings\Lodoss\Application Data\Winamp

2008-05-16 14:18 --------- d-----w C:\Program Files\eMule

2008-05-15 13:06 --------- d-----w C:\Program Files\Astonsoft

2008-05-14 16:51 --------- d-----w C:\Program Files\MSN Spy 2004

2008-05-14 16:51 --------- d-----w C:\Program Files\LimeWire

2008-05-14 16:50 --------- d-----w C:\Program Files\Zylom Games

2008-05-14 16:50 --------- d-----w C:\Program Files\Runtime Software

2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys

2008-04-30 21:37 --------- d-----w C:\Program Files\MsnSpy

2008-04-30 17:59 1,409 ----a-w C:\WINDOWS\Fonts\SncfPre.fot

2008-04-30 17:59 1,409 ----a-w C:\WINDOWS\Fonts\sncf09.fot

2008-04-26 18:28 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP

2008-04-26 02:35 --------- d-----w C:\Program Files\PC Inspector File Recovery

2008-04-25 17:17 --------- d-----w C:\Program Files\Alice

2008-04-25 16:10 --------- d-----w C:\Program Files\Twain

2008-04-25 16:04 75,272 ----a-w C:\WINDOWS\system32\drivers\avgtdix.sys

2008-04-25 15:59 96,520 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys

2008-04-25 15:59 12,424 ----a-w C:\WINDOWS\system32\drivers\avgrkx86.sys

2008-04-25 15:59 --------- d-----w C:\Program Files\AVG

2008-04-25 15:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8

2008-04-25 14:45 --------- d-----w C:\Program Files\Fichiers communs\Panda Software

2008-04-15 12:18 --------- d-----w C:\Program Files\Dofus

2008-04-14 15:52 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys

2008-02-25 18:57 10 ----a-w C:\Program Files\.autoreg

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

REGEDIT4

*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]

"Uyynk"="C:\Program Files\?ymantec\w?wexec.exe" [ ]

"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 22:02 495616]

"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-05-08 16:53 3640368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]

"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-10-13 17:01 277296]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51 257088]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480]

"nwiz"="nwiz.exe" [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 13:22 86016]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-04-25 18:04 1177368]

"EoEngine"="C:\Program Files\EoRezo\EoEngine.exe" [2008-04-16 12:01 565248]

"ItsTV"="C:\Program Files\ItsLabel\ItsTV.exe" [2007-04-26 16:19 2908160]

"EoWeather"="" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.l3acm"= l3codecp.acm

"VIDC.DIV4"= divxc32f.dll

"VIDC.DIV3"= divxc32.dll

"MSACM.DIVXA32"= divxa32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Access Password Recovery]

C:\Program Files\Intelore\Access Password Recovery\AccessPasswordRecovery.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]

-ra------ 2007-03-01 11:37 2321600 C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

--a------ 2004-08-20 01:09 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\flockbox]

--a------ 2007-12-14 17:59 1071472 C:\Sierra\My Lockbox\flockbox.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]

--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

--a------ 2003-12-05 15:41 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]

--a------ 2006-01-07 06:26 176128 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]

--a------ 2006-01-07 06:26 491520 C:\WINDOWS\system32\hphmon05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]

--a------ 2006-01-07 06:26 49152 C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

--a------ 2004-04-17 12:41 196608 C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

--a------ 2004-04-13 06:07 69632 C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Security]

C:\WINDOWS\System32\NSecurity.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

--a------ 2007-11-30 11:40 1266936 C:\Program Files\Valve\Steam\\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2007-07-12 04:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX1000]

--a------ 2006-10-13 17:04 707376 C:\WINDOWS\vVX1000.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZoneAlarm Client]

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"vsmon"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Program Files\\Messenger\\msmsgs.exe"=

"C:\\Program Files\\Azureus\\Azureus.exe"=

"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=

"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=

"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=

"C:\\Program Files\\eMule\\emule.exe"=

"C:\\Program Files\\iTunes\\iTunes.exe"=

"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=

"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=

"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-04-25 17:59]

R0 MPRIFL;MPRIFL;C:\WINDOWS\system32\DRIVERS\MPRIFL.SYS [2007-12-13 21:13]

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-04-25 17:59]

R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-04-25 18:03]

R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-04-25 18:04]

R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2006-10-13 17:01]

R3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-10-13 17:04]

S2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-04-25 17:59]

S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-12-25 17:19]

S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-03-27 17:53]

S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-04 08:04]

.

Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

"2008-05-15 20:54:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Program Files\Apple Software Update\SoftwareUpdate.exe

"2008-06-12 15:00:09 C:\WINDOWS\Tasks\HP Usg Daily.job"

- C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-12 19:06:28

Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs

Les fichiers cach‚s: 0

**************************************************************************

.

--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe

-> C:\WINDOWS\system32\RtlGina2.dll

.

------------------------ Other Running Processes ------------------------

.

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\PROGRA~1\AVG\AVG8\aAvgApi.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\AVG\AVG8\avgrsx.exe

.

**************************************************************************

.

Temps d'accomplissement: 2008-06-12 19:18:19 - machine was rebooted

ComboFix-quarantined-files.txt 2008-06-12 17:18:12

Pre-Run: 35,215,790,080 octets libres

Post-Run: 37,004,578,816 octets libres

220 --- E O F --- 2008-06-11 12:04:51

lodoss01 · le 12 juin 2008

Petit up si ca derange personne ^^

Thanos · le 12 juin 2008

re!

Voici la suite >>

Désinstalle ce programme si tu trouves >> EoEngine ou/et eoRezo

1°) Rend toi sur cette page afin de télécharger le fichier CFScript > http://www.sendspace.com/file/0rothy

pour cela, clique sur le lien en bas de page > Download Link: CFScript

Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture
Patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

2°) Fais un scan en ligne >>

Assure toi que les contrôles activeX soient bien configurés dans les options internet comme décrit sur ce lien=> Cybersécurité

Fais un scan en ligne Kaspersky
Clique sur Accept
Une barre jaune va te demander si tu acceptes d'installer le Kavwebscan_Unicode.cab, installe l'Active X.
clique une nouvelle fois sur "Accept"
Les bases de mises à jour vont s'installer, patiente un moment
Clique sur Next.
Clique sur My Computer, le scan se met en route; attends la fin du scan sans fermer la fenêtre sinon il s'arrêtera.

A la fin du scan, si des objets infectés sont découverts, clique sur Save report as... Choisis bureau et nomme le rapport "rapport Kaspersky" et dans le champ d'enregistrement, choisis "fichiers texte" enregistre alors le rapport.

Copie/colle l'entièreté du fichier texte ouvert, par clic droit dessus, sélectionner tout/copier.

Colle ce rapport dans ta réponse sur le forum.

Aide en cas de problème :Cybersécurité

NOTE: Le scan est à faire avec Internet Explorer.

poste les deux rapports stp ainsi qu'un nouveau rapport hijackthis.

@+

lodoss01 · le 12 juin 2008

Re thanos ^^

Premier Rapport :

ComboFix 08-06-10.5 - Lodoss 2008-06-13 0:47:51.2 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.176 [GMT 2:00]

Endroit: C:\Documents and Settings\Lodoss\Bureau\ComboFix.exe

Command switches used :: C:\Documents and Settings\Lodoss\Bureau\CFScript.txt

* Création d'un nouveau point de restauration

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\Lodoss\Application Data\EoRezo

C:\Documents and Settings\Lodoss\Application Data\EoRezo\cmhost.cyp

C:\Documents and Settings\Lodoss\Application Data\EoRezo\ConfMedia.cyp

C:\Documents and Settings\Lodoss\Application Data\EoRezo\db\cat.cyp

C:\Documents and Settings\Lodoss\Application Data\EoRezo\eoDesktop\config.xml

C:\Documents and Settings\Lodoss\Application Data\EoRezo\eoDesktop\eoDesktop.html

C:\Documents and Settings\Lodoss\Application Data\EoRezo\eoDesktop\userConfig.xml

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather.cfg

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\EoWeather.cfg

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\EoWeatherVal_02EC282.cfg

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\67_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\67_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\69_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\69_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\70_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\70_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\78_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\78_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\82_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\82_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\83_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\83_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\84_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\84_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\85_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\85_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\89_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\89_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\back.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\background.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\background_1.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\background_1days.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\background_2days.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\background_7days.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\backPressed.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\band.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\band_small.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\close.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\closePressed.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\dayPrevisionBackground.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\dayPrevisionClose.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\earth.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\fonds_écran.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\help.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\helpPressed.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\minimise.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\minimisePressed.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\next.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\nextPressed.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\option.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\optionPressed.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\reflet_ecran.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\small_background.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\Thumbs.db

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\67_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\67_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\69_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\69_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\70_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\70_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\78_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\78_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\82_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\82_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\83_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\83_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\84_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\84_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\85_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\85_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\89_day.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\89_night.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\about.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\back.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\background.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\background_1.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\background_1days.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\background_2days.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\background_7days.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\backPressed.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\close.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\closePressed.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\dayPrevisionBackground.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\dayPrevisionClose.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\earth.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\fonds_écran.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\help.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\helpPressed.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\minimise.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\minimisePressed.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\next.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\nextPressed.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\option.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\optionPressed.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\reflet_ecran.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\Thumbs.db

C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\txt_14x13.png

C:\Documents and Settings\Lodoss\Application Data\EoRezo\host.cyp

C:\Documents and Settings\Lodoss\Application Data\EoRezo\towns.cfg

C:\Documents and Settings\Lodoss\Application Data\EoRezo\user.cyp

C:\PROGRA~1\ALWILS~1

C:\Program Files\BOONTY

C:\Program Files\BOONTY\Components\J_apprends_la_guitare_Electrique_Telecharger(fr_2566){246440}.exe

C:\Program Files\EoRezo

C:\Program Files\EoRezo\EoAdv\EoAdv.dll

C:\Program Files\EoRezo\EoAdv\eoAdv.url

C:\Program Files\EoRezo\EoAdv\tmp\eoRezoBho.dll.3861

C:\Program Files\EoRezo\EoAdv\tmp\eoRezoBho.dll.5841

C:\Program Files\EoRezo\EoEngine.exe

C:\Program Files\EoRezo\EoMultiLanguage.dll

C:\Program Files\EoRezo\EoRezoTools_16.dll

C:\Program Files\EoRezo\EoRezoTools_25.dll

C:\Program Files\EoRezo\FreeImage.dll

C:\Program Files\Fichiers communs\BOONTY Shared

C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe

.

((((((((((((((((((((((((((((( Fichiers créés 2008-05-12 to 2008-06-12 ))))))))))))))))))))))))))))))))))))

.

2008-06-12 16:24 . 2008-06-12 16:24 4,551,483 --a------ C:\WINDOWS\system32\Les métiers du combat.scr

2008-06-11 11:11 . 2008-04-14 17:52 272,768 --------- C:\WINDOWS\system32\dllcache\bthport.sys

2008-06-06 21:08 . 2008-06-12 23:33 <REP> d-------- C:\Program Files\uTorrent

2008-06-06 21:08 . 2008-06-13 00:52 <REP> d-------- C:\Documents and Settings\Lodoss\Application Data\uTorrent