aide rapports hijackthis

[VEGAS25BLD]

ok ca roule

voila mon rapport combo-fix et encore merci

 

 

ComboFix 08-10-17.01 - Julien 2008-10-18 16:55:49.2 - NTFSx86

Microsoft® Windows Vista™ Édition Intégrale 6.0.6001.1.1252.1.1036.18.2395 [GMT 2:00]

Lancé depuis: C:\Users\Julien\Desktop\Combo-Fix.exe.exe

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Previous Run -------

.

C:\Windows\system32\drivers\downld

 

.

((((((((((((((((((((((((((((( Fichiers créés du 2008-09-18 au 2008-10-18 ))))))))))))))))))))))))))))))))))))

.

 

2008-10-18 15:43 . 2008-10-18 15:44 <REP> d-------- C:\Combo-Fix

2008-10-18 14:09 . 2008-10-18 14:09 <REP> d-------- C:\Users\Julien\AppData\Roaming\PC Tools

2008-10-18 14:09 . 2008-10-18 14:11 <REP> d-------- C:\Program Files\Spyware Doctor

2008-10-18 14:09 . 2008-06-10 21:22 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys

2008-10-18 14:09 . 2008-06-02 15:19 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys

2008-10-18 14:09 . 2008-06-02 15:19 42,376 --a------ C:\Windows\System32\drivers\ikfilesec.sys

2008-10-18 14:09 . 2008-06-02 15:19 29,576 --a------ C:\Windows\System32\drivers\kcom.sys

2008-10-18 14:08 . 2008-10-18 15:08 <REP> d-------- C:\Users\All Users\Google Updater

2008-10-18 14:08 . 2008-10-18 15:08 <REP> d-------- C:\ProgramData\Google Updater

2008-10-18 14:08 . 2008-10-18 14:08 <REP> d-------- C:\Program Files\Google

2008-10-18 02:47 . 2008-10-18 15:45 <REP> d-a------ C:\Users\All Users\TEMP

2008-10-18 02:47 . 2008-10-18 15:45 <REP> d-a------ C:\ProgramData\TEMP

2008-10-17 22:37 . 2008-10-18 15:31 <REP> d-------- C:\Users\Julien\ATTENTION NAVILOG ET TOOLBARSD

2008-10-17 21:53 . 2008-10-18 00:47 <REP> d-------- C:\ToolBar SD

2008-10-17 21:36 . 2008-10-18 03:08 <REP> d-------- C:\Program Files\Navilog1

2008-10-17 17:50 . 2008-10-17 17:50 <REP> d-------- C:\Windows\Sun

2008-10-16 16:59 . 2008-10-17 11:04 <REP> dr------- C:\Users\Julien\DOCUMENT ETS LEFEBVRE

2008-10-16 16:50 . 2008-10-16 16:50 <REP> d-------- C:\Program Files\Microsoft Works

2008-10-16 16:48 . 2008-10-16 16:48 <REP> d-------- C:\Windows\PCHEALTH

2008-10-16 16:48 . 2008-10-16 16:48 <REP> d-------- C:\Program Files\Microsoft.NET

2008-10-16 16:46 . 2008-10-16 18:57 <REP> d-------- C:\Windows\SHELLNEW

2008-10-16 16:44 . 2008-10-16 16:44 <REP> dr-h----- C:\MSOCache

2008-10-14 18:25 . 2008-10-14 18:25 <REP> d-------- C:\Program Files\Microsoft Silverlight

2008-10-14 14:22 . 2008-10-14 14:22 237 --a------ C:\Windows\System32\Ahmbed.gz

2008-10-13 18:38 . 2008-10-13 18:38 <REP> d----c--- C:\Users\All Users\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}

2008-10-13 18:38 . 2008-10-13 18:38 <REP> d----c--- C:\ProgramData\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}

2008-10-13 05:37 . 2008-05-15 14:12 53,314 --------- C:\Windows\ExentInfo.exe

2008-10-13 05:00 . 2006-10-26 19:58 30,512 --a------ C:\Windows\System32\mdimon.dll

2008-10-13 04:27 . 2008-10-16 16:46 <REP> d-------- C:\Program Files\Microsoft Visual Studio 8

2008-10-13 04:20 . 2008-10-14 14:50 28 --a------ C:\Windows\ODBC.INI

2008-10-13 03:17 . 2008-10-13 03:17 <REP> d-------- C:\Program Files\PowerISO

2008-10-12 01:48 . 2008-10-12 01:48 <REP> d-------- C:\Program Files\VirginMega

2008-10-12 01:47 . 2008-10-12 01:47 <REP> d-------- C:\Users\All Users\Downloaded Installations

2008-10-12 01:47 . 2008-10-12 01:47 <REP> d-------- C:\ProgramData\Downloaded Installations

2008-10-11 16:39 . 2008-10-18 00:34 <REP> d-------- C:\Users\Julien\Downloads

2008-10-11 14:27 . 2008-10-14 21:28 <REP> d-------- C:\Program Files\360Share Pro

2008-10-11 05:04 . 2008-10-11 05:04 <REP> d-------- C:\Users\All Users\FLEXnet

2008-10-11 05:04 . 2008-10-11 05:04 <REP> d-------- C:\ProgramData\FLEXnet

2008-10-11 04:47 . 2007-02-20 16:04 2,463,976 --a------ C:\Windows\System32\NPSWF32.dll

2008-10-11 04:47 . 2007-02-20 16:04 190,696 --a------ C:\Windows\System32\NPSWF32_FlashUtil.exe

2008-10-11 04:43 . 2008-10-14 13:25 <REP> d-------- C:\Program Files\Bonjour

2008-10-11 04:39 . 2008-10-14 13:25 <REP> d-------- C:\Program Files\Common Files\Macrovision Shared

2008-10-11 03:50 . 2008-10-13 06:58 <REP> d-------- C:\Users\Julien\AppData\Roaming\DivX

2008-10-11 03:36 . 2008-10-15 01:21 <REP> d-------- C:\Program Files\DivX

2008-10-11 03:36 . 2008-10-11 03:36 <REP> d-------- C:\Program Files\Common Files\PX Storage Engine

2008-10-11 03:11 . 2008-10-11 03:12 <REP> d-------- C:\Program Files\DAEMON Tools Lite

2008-10-10 18:09 . 2008-10-10 18:13 <REP> d-------- C:\Users\All Users\Lavasoft

2008-10-10 18:09 . 2008-10-10 18:13 <REP> d-------- C:\ProgramData\Lavasoft

2008-10-10 17:54 . 2008-10-10 17:54 <REP> d-------- C:\Users\Julien\AppData\Roaming\Sammsoft

2008-10-10 17:53 . 2008-10-10 18:18 <REP> d-------- C:\Program Files\Advanced Registry Optimizer

2008-10-10 15:46 . 2008-10-14 13:25 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy

2008-10-10 15:46 . 2008-10-14 13:25 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy

2008-10-10 15:46 . 2008-10-10 15:50 <REP> d-------- C:\Program Files\Spybot - Search & Destroy

2008-10-10 15:04 . 2000-05-22 16:58 647,872 --a------ C:\Windows\System32\mscomct2.ocx

2008-10-10 11:37 . 2008-10-16 21:55 103 --a------ C:\Windows\pro.INI

2008-10-09 21:16 . 2008-10-10 11:44 <REP> d-------- C:\Program Files\Yahoo!

2008-10-09 21:16 . 2008-10-09 21:19 <REP> d-------- C:\Program Files\CCleaner

2008-10-09 18:39 . 2008-10-09 18:39 <REP> d-------- C:\Program Files\OpenAL

2008-10-09 18:39 . 2008-10-09 18:39 413,696 --a------ C:\Windows\System32\wrap_oal.dll

2008-10-09 18:39 . 2008-10-09 18:39 110,592 --a------ C:\Windows\System32\OpenAL32.dll

2008-10-09 18:00 . 2008-10-09 18:00 <REP> d-------- C:\Users\All Users\Codemasters

2008-10-09 18:00 . 2008-10-09 18:00 <REP> d-------- C:\ProgramData\Codemasters

2008-10-09 12:34 . 2008-10-09 12:34 <REP> d-------- C:\Users\Julien\AppData\Roaming\uniblue

2008-10-09 12:05 . 2008-06-20 03:14 781,344 --a------ C:\Windows\System32\PresentationNative_v0300.dll

2008-10-09 12:05 . 2008-06-20 03:14 622,080 --a------ C:\Windows\System32\icardagt.exe

2008-10-09 12:05 . 2008-06-20 03:14 326,160 --a------ C:\Windows\System32\PresentationHost.exe

2008-10-09 12:05 . 2008-06-20 03:14 105,016 --a------ C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll

2008-10-09 12:05 . 2008-06-20 03:14 97,800 --a------ C:\Windows\System32\infocardapi.dll

2008-10-09 12:05 . 2008-06-20 03:14 43,544 --a------ C:\Windows\System32\PresentationHostProxy.dll

2008-10-09 12:05 . 2008-06-20 03:14 37,384 --a------ C:\Windows\System32\infocardcpl.cpl

2008-10-09 12:05 . 2008-06-20 03:14 11,264 --a------ C:\Windows\System32\icardres.dll

2008-10-09 12:00 . 2008-07-27 20:03 282,112 --a------ C:\Windows\System32\mscoree.dll

2008-10-09 12:00 . 2008-07-27 20:03 158,720 --a------ C:\Windows\System32\mscorier.dll

2008-10-09 12:00 . 2008-07-27 20:03 96,760 --a------ C:\Windows\System32\dfshim.dll

2008-10-09 12:00 . 2008-07-27 20:03 83,968 --a------ C:\Windows\System32\mscories.dll

2008-10-09 12:00 . 2008-07-27 20:03 41,984 --a------ C:\Windows\System32\netfxperf.dll

2008-10-09 11:57 . 2008-10-09 11:57 <REP> dr-h----- C:\AHCache

2008-10-09 11:49 . 2008-10-09 11:49 <REP> d-------- C:\Users\All Users\WindowsSearch

2008-10-09 11:49 . 2008-10-09 11:49 <REP> d-------- C:\ProgramData\WindowsSearch

2008-10-09 11:41 . 2008-10-09 11:41 <REP> d-------- C:\Users\Julien\AppData\Roaming\DAEMON Tools

2008-10-09 11:41 . 2008-10-09 11:41 717,296 --a------ C:\Windows\System32\drivers\sptd.sys

2008-10-09 11:34 . 2008-10-09 11:34 <REP> d-------- C:\Users\Julien\AppData\Roaming\Propellerhead Software

2008-10-09 11:34 . 2008-10-09 11:34 <REP> d-------- C:\Users\All Users\Propellerhead Software

2008-10-09 11:34 . 2008-10-09 11:34 <REP> d-------- C:\ProgramData\Propellerhead Software

2008-10-09 02:38 . 2008-10-09 02:39 <REP> d-------- C:\Users\Julien\AppData\Roaming\Ableton

2008-10-09 00:21 . 2003-06-20 12:28 1,777,664 --a------ C:\Windows\System32\gdiplus.dll

2008-10-08 23:21 . 2008-10-14 13:29 <REP> d-------- C:\Program Files\Norton Support

2008-10-08 21:27 . 2008-10-08 21:27 <REP> d-------- C:\Users\Julien\AppData\Roaming\nCleaner

2008-10-08 21:27 . 2008-10-08 21:27 <REP> d-------- C:\Program Files\NKProds

2008-10-07 00:39 . 2008-10-16 22:54 <REP> d-------- C:\Users\Julien\AppData\Roaming\uTorrent

2008-10-07 00:39 . 2008-10-07 00:39 <REP> d-------- C:\Program Files\uTorrent

2008-10-05 22:24 . 2008-10-11 15:30 <REP> d-------- C:\Users\Julien\AppData\Roaming\LimeWire

2008-10-05 22:22 . 2008-10-05 22:23 <REP> d-------- C:\Program Files\Java

2008-10-05 22:22 . 2008-10-05 22:22 <REP> d-------- C:\Program Files\Common Files\Java

2008-10-05 15:33 . 2008-10-05 15:33 108,144 --a------ C:\Windows\System32\CmdLineExt.dll

2008-10-05 09:01 . 2008-10-07 11:46 <REP> d-------- C:\Users\All Users\eMule

2008-10-05 09:01 . 2008-10-07 11:46 <REP> d-------- C:\ProgramData\eMule

2008-10-05 06:16 . 2008-10-11 14:30 <REP> d-------- C:\Program Files\VideoLAN

2008-10-05 04:24 . 2008-10-05 04:24 <REP> dr-h----- C:\Users\Julien\AppData\Roaming\SecuROM

2008-10-04 18:06 . 2008-10-04 18:07 <REP> d-------- C:\Users\All Users\Tages

2008-10-04 18:06 . 2008-10-04 18:07 <REP> d-------- C:\ProgramData\Tages

2008-10-04 18:06 . 2008-10-04 18:06 278,984 --a------ C:\Windows\System32\drivers\atksgt.sys

2008-10-04 18:06 . 2008-10-04 18:06 25,416 --a------ C:\Windows\System32\drivers\lirsgt.sys

2008-10-04 16:51 . 2008-10-09 16:24 <REP> d-------- C:\Windows\System32\FlashAX

2008-10-04 16:51 . 2008-10-04 16:51 <REP> d-------- C:\Users\All Users\Microgaming

2008-10-04 16:51 . 2008-10-04 17:07 <REP> d-------- C:\Users\All Users\MGS

2008-10-04 16:51 . 2008-10-04 16:51 <REP> d-------- C:\ProgramData\Microgaming

2008-10-04 16:51 . 2008-10-04 17:07 <REP> d-------- C:\ProgramData\MGS

2008-10-04 15:54 . 2008-10-04 15:54 <REP> d-------- C:\Program Files\ASIO4ALL v2

2008-10-04 15:53 . 2008-10-09 01:53 <REP> d-------- C:\Program Files\VstPlugins

2008-10-04 15:53 . 2008-10-04 15:53 <REP> d-------- C:\Program Files\Outsim

2008-10-04 15:53 . 2008-10-18 03:05 <REP> d-------- C:\Program Files\Image-Line

2008-10-04 15:53 . 2002-07-08 00:14 1,294,336 --a------ C:\Windows\System32\vorbis.acm

2008-10-04 15:53 . 2008-03-14 13:22 368,640 --a------ C:\Windows\System32\rewire.dll

2008-10-04 15:52 . 2008-10-04 15:56 <REP> d-a------ C:\Program Files\Data

2008-10-04 15:33 . 2008-10-04 15:33 <REP> d-------- C:\Windows\System32\VSS

2008-10-04 15:22 . 2007-03-12 16:42 3,495,784 --a------ C:\Windows\System32\d3dx9_33.dll

2008-10-04 15:06 . 2008-10-13 05:38 <REP> d-------- C:\Users\All Users\Player Metaboli

2008-10-04 15:06 . 2008-10-04 15:06 <REP> d-------- C:\Remote Programs

2008-10-04 15:06 . 2008-10-13 05:38 <REP> d-------- C:\ProgramData\Player Metaboli

2008-10-04 15:06 . 2008-10-13 05:40 <REP> d-------- C:\Program Files\Player Metaboli

2008-10-04 15:06 . 2004-02-04 10:01 2,238 --------- C:\Windows\metaboli.ico

2008-10-04 15:06 . 2008-10-13 05:38 68 --a------ C:\Windows\GPlrLanc.dat

2008-10-04 15:03 . 2008-10-04 15:03 <REP> d--hs---- C:\System Recovery

2008-10-04 14:25 . 2008-10-04 14:25 <REP> d-------- C:\Users\Julien\AppData\Roaming\DisplayTune

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-10-16 19:20 --------- d-----w C:\Program Files\Windows Mail

2008-10-16 14:50 --------- d-----w C:\Program Files\MSBuild

2008-10-03 16:06 --------- d-sh--w C:\ProgramData\Modèles

2008-10-03 16:06 --------- d-sh--w C:\ProgramData\Menu Démarrer

2008-10-03 16:06 --------- d-sh--w C:\ProgramData\Favoris

2008-10-03 16:06 --------- d-sh--w C:\ProgramData\Bureau

2008-10-03 16:06 --------- d-sh--w C:\Program Files\Fichiers communs

2008-10-02 03:49 827,392 ----a-w C:\Windows\System32\wininet.dll

2008-09-18 05:09 3,601,464 ----a-w C:\Windows\System32\ntkrnlpa.exe

2008-09-18 05:09 3,549,240 ----a-w C:\Windows\System32\ntoskrnl.exe

2008-09-18 02:16 2,032,640 ----a-w C:\Windows\System32\win32k.sys

2008-09-16 00:14 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll

2008-09-16 00:12 81,920 ----a-w C:\Windows\System32\dpl100.dll

2008-09-16 00:12 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll

2008-09-16 00:12 57,344 ----a-w C:\Windows\System32\dpv11.dll

2008-09-16 00:12 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll

2008-09-16 00:12 344,064 ----a-w C:\Windows\System32\dpus11.dll

2008-09-16 00:12 294,912 ----a-w C:\Windows\System32\dpu11.dll

2008-09-16 00:12 294,912 ----a-w C:\Windows\System32\dpu10.dll

2008-09-16 00:12 200,704 ----a-w C:\Windows\System32\ssldivx.dll

2008-09-16 00:12 196,608 ----a-w C:\Windows\System32\dtu100.dll

2008-09-16 00:12 1,044,480 ----a-w C:\Windows\System32\libdivx.dll

2008-09-16 00:11 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe

2008-09-04 07:31 288,024 ----a-w C:\Windows\System32\PhysXCplUI.exe

2008-08-29 06:57 70,936 ----a-w C:\Windows\System32\PhysXLoader.dll

2008-08-28 08:50 30,720 ----a-w C:\Windows\System32\soundschemes2.exe

2008-08-27 01:06 288,768 ----a-w C:\Windows\system32\drivers\srv.sys

2008-08-05 09:49 428,544 ----a-w C:\Windows\System32\EncDec.dll

2008-08-05 09:49 293,376 ----a-w C:\Windows\System32\psisdecd.dll

2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll

2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll

2008-07-31 03:32 28,160 ----a-w C:\Windows\System32\Apphlpdm.dll

2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll

2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll

2008-01-21 02:41 174 --sha-w C:\Program Files\desktop.ini

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-21 125952]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Ai Nap"="C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe" [2008-01-28 1413120]

"Cpu Level Up help"="C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe" [2007-11-30 881152]

"DT LGE"="C:\Program Files\Portrait Displays\forteManager\DTHtml.exe" [2007-06-12 291328]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-09-17 13580832]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-09-17 92704]

"CPU Power Monitor"="C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe" [2008-01-09 627200]

"JMB36X IDE Setup"="C:\Windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]

"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

"Protect"="SHVRTF.EXE" [2006-03-29 C:\Windows\System32\SHVRTF.EXE]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2008-06-12 02:38 34672 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

--a------ 2007-03-20 16:40 1884160 C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

--------- 2006-11-23 15:10 56928 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]

--a------ 2004-07-25 09:02 847880 C:\Program Files\Analog Devices\Core\smax4pnp.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundTray]

--a------ 2007-09-27 13:51 53248 C:\Program Files\Analog Devices\SoundMAX\SoundTray.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

--a------ 2008-01-21 04:21 1008184 C:\Program Files\Windows Defender\MSASCui.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

"PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3606253093-3031328857-3702792077-1000]

"EnableNotificationsRef"=dword:00000005

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{DEA6E208-F932-4CB5-9BA2-B980DA9CCAEF}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{A9B064CD-E8F4-4E97-860C-9A75B404165F}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{D2BF6865-97A1-43EC-B354-26F63092B193}"= UDP:S:\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)

"{A20014B3-7D11-4CBB-8921-72B104EB7FF2}"= TCP:S:\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)

"{60CDC2EE-3331-45DF-8C72-A1C48D7B8FEC}"= UDP:S:\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)

"{1B384587-944D-4E72-B443-E8B26D33B31A}"= TCP:S:\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)

"{A7A8049D-6146-417A-BDB6-7035AADAE1A6}"= UDP:S:\eMule\emule.exe:eMule

"{DAFD53A8-BD97-4F3E-B38C-F1D462251DCB}"= TCP:S:\eMule\emule.exe:eMule

"{44BEF86C-967E-4C21-9DA6-E0C67F0AAF1E}"= UDP:S:\\uTorrent.exe:µTorrent (TCP-In)

"{29A8F115-5DF0-443D-8C8E-619433A85064}"= TCP:S:\\uTorrent.exe:µTorrent (UDP-In)

"{F6BDB638-7207-4401-A51A-328972A6143E}"= UDP:S:\uTorrent.exe:µTorrent (TCP-In)

"{8731DD61-C664-425F-9BFE-190CEF71CD86}"= TCP:S:\uTorrent.exe:µTorrent (UDP-In)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)

 

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NIS\1000000.07D\SYMEFA.SYS [2008-10-03 309296]

R1 BHDrvx86;Symantec Heuristics Driver;C:\Windows\system32\drivers\NIS\1000000.07D\BHDrvx86.sys [2008-10-03 254512]

R1 ccHP;Symantec Hash Provider;C:\Windows\system32\drivers\NIS\1000000.07D\ccHPx86.sys [2008-10-03 362544]

R1 IDSVix86;IDSVix86;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20081015.001\IDSvix86.sys [2008-10-03 289840]

R2 AEADIFilters;Andrea ADI Filters Service;C:\Windows\system32\AEADISRV.EXE [2007-10-19 86016]

R2 Norton Internet Security;Norton Internet Security;C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe /s Norton Internet Security /m C:\Program Files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll [ ]

R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-07-07 809296]

R2 X4HSX32Ex;X4HSX32Ex;C:\Program Files\Player Metaboli\X4HSX32Ex.Sys [2007-11-14 29856]

R3 SYMNDISV;SYMNDISV;C:\Windows\system32\drivers\NIS\1000000.07D\SYMNDISV.SYS [2008-10-03 40496]

R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 298496]

S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]

S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]

\shell\AutoRun\command - K:\SETUP.EXE

\shell\configure\command - K:\SETUP.EXE

\shell\install\command - K:\SETUP.EXE

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b141bdf9-9157-11dd-97d2-806e6f6e6963}]

\shell\AutoRun\command - D:\.\Bin\ASSETUP.exe

 

*Newly Created Service* - ECACHE

 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]

%SystemRoot%\system32\soundschemes2.exe /AddRegistration

.

Contenu du dossier 'Tâches planifiées'

 

2008-10-18 C:\Windows\Tasks\User_Feed_Synchronization-{69B7A548-BAA3-4138-BFEE-DA560F2CAF2A}.job

- C:\Windows\system32\msfeedssync.exe [2008-01-21 04:23]

.

.

------- Examen supplémentaire -------

.

FireFox -: Profile - C:\Users\Julien\AppData\Roaming\Mozilla\Firefox\Profiles\pyx3dsdo.default\

FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.exalead.fr/

FF -: plugin - C:\Program Files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll

FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npExentCtl.dll

FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll

FF -: plugin - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

.

 

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-10-18 17:01:05

Windows 6.0.6001 Service Pack 1 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

.

Heure de fin: 2008-10-18 17:02:06

ComboFix-quarantined-files.txt 2008-10-18 15:02:03

 

Avant-CF: 251,838,881,792 octets libres

Après-CF: 251,835,670,528 octets libres

 

288 --- E O F --- 2008-10-16 19:19:50

 

 

alors docteur?

[Falkra]

Des restes, rien de méchant, tu as eu Bagle dernièrement. Et tu n'aurais pas essayé quelques outils spéciaux, pour voir ?

 

Poste un nouveau rapport HijackThis stp, ça doit tourner comme il faut là.

[VEGAS25BLD]

j avais utiliser ad-aware mais voyant que spybot search and destroy me disait au demarrage qu il détectait ad-aware et que cela pouvait que cele génere des incompatibilité ,je l ai finalement désinstaler.autrement pour les outils spéciaux je vois pas?HA SI J UTILISE REGULIEREMENT ADVANCED REGISTRY OPTOMYSER 2008

tout a l aire detre rentré dans l ordre merci beaucoup

voila mon dernier rapport hijack

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:21:04, on 18/10/2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

 

Running processes:

C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\ASUS\AI Suite\EnergySaving\PwSave.exe

C:\Program Files\ASUS\AASP\1.00.59\aaCenter.exe

C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe

C:\Program Files\Portrait Displays\forteManager\dthtml.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\system32\conime.exe

C:\Users\Julien\TELECHARGEMENT\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.exalead.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - (no file)

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\IPSBHO.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - (no file)

O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"

O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe

O4 - HKLM\..\Run: [DT LGE] C:\Program Files\Portrait Displays\forteManager\DTHtml.exe -startup_folder

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe"

O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe

O4 - HKLM\..\Run: [Protect] SHVRTF.EXE

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O8 - Extra context menu item: Crawler Search - tbr:iemenu

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)

O13 - Gopher Prefix:

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd...ows-i586-jc.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{0C0CFA57-D2B5-44BF-8223-768C2DB61A46}: NameServer = 193.252.19.3,193.252.19.4

O17 - HKLM\System\CS1\Services\Tcpip\..\{0C0CFA57-D2B5-44BF-8223-768C2DB61A46}: NameServer = 193.252.19.3,193.252.19.4

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll

O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE

O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

 

--

End of file - 8141 bytes

 

 

merci d avance

Modifié le 18 octobre 2008 par VEGAS25BLD

[Falkra]

Ton rapport est ok.

 

Tu peux désinstaller combofix : entre combo-fix /u dans la boite exécuter du menu démarrer.

Après cela, efface ces dossier s'ils existent encore.

C:\QooBox

C:\combo-fix

 

Désinstalle Fixnavilog et toolbar S&D via Ajout/suppression de programmes.

 

Ad-aware et spybot sont dépassés. Je te propose en remplacement un antimalware performant : MalwareBytes' Anti-malware.

Site officiel : http://www.malwarebytes.org/

 

C'est un outil tout public, contrairement à certains utilisés pour nettoyer la machine, et bien plus efficace qu'ad-aware et spybot, dans la pratique.

Le module résident (qui tourne à l'arrière plan) est payant, mais le programme fonctionne en mode gratuit, ce module ne s'active simplement pas. Du coup dans sa version gratuite il cohabite avec tout, en tant que scanneur à la demande.

 

Il peut aussi remplacer PCTools spyware doctor.

[VEGAS25BLD]

ok la je vais aller manger..

et se soir j appliquerai tes conseil a la lettre.

1 ENORME MERCI pour le temps que tu ma consacrer.

votre forum est tout simplement genial...merci ..merci...merci

a+ master FALKRA

[Falkra]

Voici un peu de lecture, une compilation de conseils pour éviter une réinfection et sécuriser la machine.

 

Un petit point sur les risques du P2P en matière de sécurité logicielle (par Ogu) :

 

N'hésite pas à poser des questions, cette partie est aussi importante que la désinfection.

 

Tu peux marquer résolu dans le titre, (en éditant le premier post, le titre devient modifiable).