Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

log combofix

lirio18

Par lirio18
dans Analyses et éradication malwares

 Partager

Messages recommandés

lirio18 Junior Member

lirio18

Posté(e)
Posté(e)

Bonjour à tous,

 

J'ai lancé combofix (problemes de lenteur) sur mon pc et j aimerais savoir si ce qu'il a

supprimé n'a pas endommagé des fichiers importants du pc.

 

Voici donc le log :

 

ComboFix 09-08-23.01 - hp 25/08/2009 11:10.3.2 - NTFSx86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.1022.239 [GMT 2:00]

Running from: c:\users\hp\Downloads\ComboFix.exe

AV: Antivirus BitDefender *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

FW: Pare-feu BitDefender *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}

SP: BitDefender AntiSpam *disabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\$recycle.bin\S-1-5-21-2948777954-3077025822-2221643753-500

c:\program files\Search Settings

c:\program files\Search Settings\kb127\SearchSettings.dll

c:\program files\Search Settings\kb127\SearchSettingsRes409.dll

c:\program files\Search Settings\SearchSettings.exe

c:\windows\Fonts\AcadEref.ttf

c:\windows\Fonts\AcadEref_0.ttf

c:\windows\Fonts\atari-kids.ttf

c:\windows\Fonts\refluxed.TTF

c:\windows\Installer\196de25.msp

c:\windows\pl.exe

 

.

((((((((((((((((((((((((( Files Created from 2009-07-25 to 2009-08-25 )))))))))))))))))))))))))))))))

.

 

2009-08-25 09:25 . 2009-08-25 09:25 -------- d-----w- c:\users\hp\AppData\Local\temp

2009-08-25 09:25 . 2009-08-25 09:25 -------- d-----w- c:\users\Public\AppData\Local\temp

2009-08-25 09:25 . 2009-08-25 09:25 -------- d-----w- c:\users\Default\AppData\Local\temp

2009-08-24 15:50 . 2009-08-17 16:04 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2009-08-24 15:50 . 2009-08-17 16:04 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2009-08-24 15:50 . 2009-08-17 16:05 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys

2009-08-24 15:50 . 2009-08-17 16:05 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2009-08-24 15:50 . 2009-08-17 16:02 97480 ----a-w- c:\windows\system32\AvastSS.scr

2009-08-24 15:50 . 2009-08-17 16:10 1279456 ----a-w- c:\windows\system32\aswBoot.exe

2009-08-24 15:50 . 2009-08-17 16:05 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2009-08-24 14:24 . 2009-08-24 15:14 -------- d-----w- c:\users\hp\AppData\Local\temp(:P

2009-08-23 10:54 . 2009-08-23 10:54 -------- d-----w- c:\programdata\Macrovision

2009-08-23 10:43 . 2009-08-23 10:43 12464 ----a-w- c:\windows\system32\drivers\CDAC15BA.SYS

2009-08-23 10:43 . 2009-08-23 10:43 54784 ----a-w- c:\windows\system32\drivers\CDAC11BA.EXE

2009-08-21 09:46 . 1993-07-23 16:31 210944 ----a-w- c:\windows\system32\MSVCRT10.DLL

2009-08-20 23:05 . 2008-05-28 17:33 37176 ----a-w- c:\users\hp\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2009-08-20 21:51 . 2009-08-20 21:51 -------- d-----w- c:\users\hp\AppData\Roaming\Ambient Design

2009-08-20 21:47 . 2009-08-20 21:47 -------- d-----w- c:\program files\Ambient Design

2009-08-20 21:15 . 2007-02-20 14:04 190696 ----a-w- c:\windows\system32\NPSWF32_FlashUtil.exe

2009-08-20 21:15 . 2007-02-20 14:04 2463976 ----a-w- c:\windows\system32\NPSWF32.dll

2009-08-20 20:23 . 2009-02-24 16:42 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys

2009-08-20 20:22 . 2009-08-20 20:25 -------- d-----w- c:\program files\MagicDisc

2009-08-20 15:50 . 2009-08-20 15:50 -------- d-----w- c:\program files\ASIO4ALL v2

2009-08-20 15:50 . 2009-08-20 15:50 -------- d-----w- c:\program files\VstPlugins

2009-08-20 15:50 . 2006-06-20 08:56 225280 ----a-w- c:\windows\system32\rewire.dll

2009-08-20 15:48 . 2009-08-20 15:48 -------- d-----w- c:\program files\Outsim

2009-08-20 15:45 . 2009-08-20 15:50 -------- d-----w- c:\program files\Image-Line

2009-08-20 14:42 . 2009-08-20 14:42 -------- d-----w- c:\program files\Common Files\PX Storage Engine

2009-08-20 14:36 . 2009-08-20 14:36 -------- d-----w- c:\program files\Microsoft Visual Studio 8

2009-08-20 14:34 . 2009-08-20 14:34 -------- d-----w- c:\program files\backburner 2

2009-08-20 11:37 . 2009-08-20 11:37 6656 ----a-w- c:\windows\system32\haspvdd.dll

2009-08-20 11:37 . 2009-08-20 11:37 47616 ----a-w- c:\windows\system32\drivers\Haspnt.sys

2009-08-20 11:37 . 2009-08-20 11:37 383 ----a-w- c:\windows\system32\haspdos.sys

2009-08-20 11:37 . 2001-06-21 19:39 73728 ----a-w- c:\windows\system32\drivers\SENTINEL.SYS

2009-08-20 11:37 . 2001-06-21 19:39 49664 ----a-w- c:\windows\system32\SNTI386.DLL

2009-08-20 11:37 . 2001-06-21 19:39 18432 ----a-w- c:\windows\system32\RNBOVDD.DLL

2009-08-20 11:37 . 2001-06-21 19:39 20032 ----a-r- c:\windows\system32\drivers\SNTNLUSB.SYS

2009-08-20 11:37 . 2009-08-20 11:37 -------- d-----w- c:\windows\system32\RNBOSENT

2009-08-20 11:36 . 1998-07-10 02:31 7328 ----a-w- c:\windows\system32\drivers\ds1410d.sys

2009-08-20 11:36 . 2009-08-20 11:36 -------- d-----w- c:\program files\GLOBEtrotter Software Inc

2009-08-20 11:36 . 2006-11-22 08:01 693760 ----a-w- c:\windows\system32\drivers\hardlock.sys

2009-08-20 11:36 . 1998-07-30 11:51 305152 ----a-w- c:\windows\IsUninst.exe

2009-08-20 11:16 . 2009-08-20 11:19 -------- d-----w- c:\program files\Common Files\Alias Shared

2009-08-20 11:10 . 2009-08-23 09:57 -------- d-----w- C:\FLEXLM

2009-08-20 10:11 . 2007-05-16 14:45 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll

2009-08-20 09:58 . 2009-08-20 09:58 -------- d-----w- c:\program files\gBurner

2009-08-15 16:54 . 2008-03-30 17:55 1213784 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\vsapi32.dll

2009-08-15 16:54 . 2006-11-22 15:48 91744 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\BPMNT.dll

2009-08-15 16:53 . 2007-12-24 15:37 138384 ----a-w- c:\windows\system32\drivers\tmcomm.sys

2009-08-15 16:53 . 2007-12-24 15:37 138384 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\tmcomm.sys

2009-08-15 16:53 . 2006-07-07 14:29 1197584 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\ssapi32.dll

2009-08-15 16:53 . 2009-03-27 15:38 366344 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\tsc.exe

2009-08-15 16:47 . 2009-08-15 16:47 116048 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\TmEngDrv.dll

2009-08-15 16:47 . 2009-08-15 16:47 98304 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\getMac.exe

2009-08-15 16:47 . 2009-08-15 16:47 69632 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\mfcm80.dll

2009-08-15 16:47 . 2009-08-15 16:47 626688 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\msvcr80.dll

2009-08-15 16:47 . 2009-08-15 16:47 57344 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\mfcm80u.dll

2009-08-15 16:47 . 2009-08-15 16:47 548864 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\msvcp80.dll

2009-08-15 16:47 . 2009-08-15 16:47 479232 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\msvcm80.dll

2009-08-15 16:47 . 2009-08-15 16:47 1093632 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\mfc80.dll

2009-08-15 16:47 . 2009-08-15 16:47 1079808 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\mfc80u.dll

2009-08-15 16:46 . 2009-08-15 16:46 218736 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\patch.exe

2009-08-15 16:46 . 2009-08-15 16:46 189968 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\ciussi32.dll

2009-08-15 16:46 . 2009-08-15 16:46 170512 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\PATCHW32.DLL

2009-08-15 16:46 . 2009-08-15 16:46 1267320 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\TmUpdate.dll

2009-08-15 16:45 . 2009-08-15 16:45 61440 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\Toolkit.dll

2009-08-15 16:45 . 2009-08-15 16:45 832776 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\lea.dll

2009-08-15 16:45 . 2009-08-15 16:45 439560 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\jlea.dll

2009-08-15 16:45 . 2009-08-15 16:45 42320 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\dsvout.dll

2009-08-15 16:45 . 2009-08-15 16:45 183356 ----a-w- c:\users\hp\AppData\Roaming\HouseCall 6.6\Uninstaller.exe

2009-08-15 16:45 . 2009-08-17 08:48 -------- d-----w- c:\users\hp\AppData\Roaming\HouseCall 6.6

2009-08-13 18:43 . 2009-06-04 12:07 2066432 ----a-w- c:\windows\system32\mstscax.dll

2009-08-13 18:43 . 2009-07-17 13:54 71680 ----a-w- c:\windows\system32\atl.dll

2009-08-13 18:43 . 2009-06-10 11:38 91136 ----a-w- c:\windows\system32\avifil32.dll

2009-07-31 19:33 . 2009-07-31 19:33 -------- d-----w- c:\programdata\TomTom

2009-07-28 19:58 . 2009-07-28 19:58 -------- d-----w- c:\programdata\ALM

2009-07-28 19:34 . 2008-04-17 01:01 7680 ----a-w- c:\programdata\EPSON\EPSON Stylus SX400 Series\Language\040c.E_DUPA3E.DLL

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-25 06:52 . 2008-11-21 17:40 -------- d-----w- c:\users\hp\AppData\Roaming\WTablet

2009-08-25 00:02 . 2009-07-10 11:53 85076 ----a-w- c:\programdata\nvModes.dat

2009-08-24 15:27 . 2009-01-31 13:06 -------- d-----w- c:\program files\Common Files\BitDefender

2009-08-24 15:26 . 2009-01-31 16:17 81984 ----a-w- c:\windows\system32\bdod.bin

2009-08-24 13:39 . 2008-11-22 13:26 -------- d-----w- c:\program files\Sony

2009-08-24 04:42 . 2008-11-17 20:51 -------- d-----w- c:\users\hp\AppData\Roaming\BitTorrent

2009-08-23 10:44 . 2008-11-28 22:20 -------- d-----w- c:\program files\Common Files\Macrovision Shared

2009-08-23 10:42 . 2008-11-21 12:11 -------- d-----w- c:\program files\Common Files\Autodesk Shared

2009-08-23 10:38 . 2008-11-21 12:13 -------- d-----w- c:\programdata\Autodesk

2009-08-23 10:33 . 2008-11-21 12:11 -------- d-----w- c:\program files\Autodesk

2009-08-23 09:51 . 2008-11-26 18:00 -------- d-----w- c:\programdata\Microsoft Help

2009-08-20 20:39 . 2006-11-02 15:48 669566 ----a-w- c:\windows\system32\perfh00C.dat

2009-08-20 20:39 . 2006-11-02 15:48 123556 ----a-w- c:\windows\system32\perfc00C.dat

2009-08-20 16:02 . 2008-11-29 17:57 -------- d-----w- c:\program files\Sony Setup

2009-08-20 15:28 . 2008-12-13 16:17 -------- d-----w- c:\program files\Common Files\AVSMedia

2009-08-20 15:28 . 2008-12-13 16:17 -------- d-----w- c:\program files\AVS4YOU

2009-08-20 15:00 . 2008-11-07 14:46 275920 ----a-w- c:\users\hp\AppData\Local\GDIPFONTCACHEV1.DAT

2009-08-13 18:54 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail

2009-08-02 08:20 . 2009-01-31 16:27 -------- d-----w- c:\program files\Microsoft Silverlight

2009-07-29 20:18 . 2008-11-17 20:51 -------- d-----w- c:\users\hp\AppData\Roaming\DNA

2009-07-29 16:17 . 2008-11-17 20:51 -------- d-----w- c:\program files\DNA

2009-07-28 19:54 . 2006-12-18 15:11 -------- d-----w- c:\program files\Common Files\Adobe

2009-07-28 17:54 . 2008-12-23 12:45 -------- d-----w- c:\programdata\FLEXnet

2009-07-28 17:08 . 2009-04-06 19:00 132 ----a-w- C:\httpdwl.dat

2009-07-25 18:22 . 2006-12-18 14:47 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-07-25 18:10 . 2009-03-16 19:25 -------- d-----w- c:\programdata\eMule

2009-07-21 21:52 . 2009-08-01 21:33 915456 ----a-w- c:\windows\system32\wininet.dll

2009-07-21 21:47 . 2009-08-01 21:33 109056 ----a-w- c:\windows\system32\iesysprep.dll

2009-07-21 21:47 . 2009-08-01 21:33 71680 ----a-w- c:\windows\system32\iesetup.dll

2009-07-21 20:13 . 2009-08-01 21:33 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2009-07-18 12:56 . 2009-07-18 12:56 -------- d-----w- c:\program files\Mio Technology

2009-07-16 19:12 . 2009-07-16 19:12 -------- d-----w- c:\program files\TomTom HOME 2

2009-07-16 18:52 . 2009-07-16 18:44 19165248 ----a-w- c:\users\hp\AppData\Roaming\TomTom\HOME\Profiles\wpqf1rpr.default\Updates\v2_6_2_1586_win.exe

2009-07-16 18:43 . 2009-07-16 18:43 -------- d-----w- c:\users\hp\AppData\Roaming\TomTom

2009-07-15 17:53 . 2009-07-15 17:53 -------- d-----w- c:\users\hp\AppData\Roaming\EPSON

2009-07-15 17:18 . 2009-07-09 18:30 -------- d-----w- c:\program files\epson

2009-07-15 12:40 . 2009-08-13 18:44 8147456 ----a-w- c:\windows\system32\wmploc.DLL

2009-07-15 12:39 . 2009-08-13 18:44 313344 ----a-w- c:\windows\system32\wmpdxm.dll

2009-07-15 12:39 . 2009-08-13 18:44 4096 ----a-w- c:\windows\system32\dxmasf.dll

2009-07-15 12:39 . 2009-08-13 18:44 7680 ----a-w- c:\windows\system32\spwmp.dll

2009-07-12 10:37 . 2009-07-09 17:41 -------- d-----w- c:\programdata\EPSON

2009-07-10 12:06 . 2008-12-26 18:13 -------- d-----w- c:\programdata\NVIDIA

2009-07-09 18:54 . 2008-11-10 17:42 54228 ----a-w- c:\users\hp\AppData\Roaming\nvModes.dat

2009-07-09 18:29 . 2009-07-09 18:29 -------- d-----w- c:\users\hp\AppData\Roaming\InstallShield

2009-06-15 23:15 . 2009-08-13 18:44 439864 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2009-06-15 14:54 . 2009-08-13 18:44 175104 ----a-w- c:\windows\system32\wdigest.dll

2009-06-15 14:53 . 2009-07-15 16:19 156672 ----a-w- c:\windows\system32\t2embed.dll

2009-06-15 14:53 . 2009-08-13 18:44 72704 ----a-w- c:\windows\system32\secur32.dll

2009-06-15 14:53 . 2009-08-13 18:44 270848 ----a-w- c:\windows\system32\schannel.dll

2009-06-15 14:53 . 2009-08-13 18:44 218624 ----a-w- c:\windows\system32\msv1_0.dll

2009-06-15 14:52 . 2009-08-13 18:44 1259008 ----a-w- c:\windows\system32\lsasrv.dll

2009-06-15 14:52 . 2009-07-15 16:19 23552 ----a-w- c:\windows\system32\lpk.dll

2009-06-15 14:52 . 2009-08-13 18:44 499712 ----a-w- c:\windows\system32\kerberos.dll

2009-06-15 14:52 . 2009-07-15 16:19 72704 ----a-w- c:\windows\system32\fontsub.dll

2009-06-15 14:51 . 2009-07-15 16:19 10240 ----a-w- c:\windows\system32\dciman32.dll

2009-06-15 12:48 . 2009-08-13 18:44 9728 ----a-w- c:\windows\system32\lsass.exe

2009-06-15 12:42 . 2009-07-15 16:19 289792 ----a-w- c:\windows\system32\atmfd.dll

2009-06-10 11:42 . 2009-08-13 18:44 160256 ----a-w- c:\windows\system32\wkssvc.dll

2009-06-08 19:21 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]

"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 159744]

"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2006-10-18 317152]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2006-10-18 472800]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]

"Adobe Photo Downloader"="c:\program files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe" [2007-11-05 61440]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

 

c:\users\hp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-8-20 576000]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"VistaSp2"=hex(b):8f,a4,fa,a3,6f,e8,c9,01

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-338664184-4014282007-519315535-1000]

"EnableNotificationsRef"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{E6EAD248-3380-420E-8AC7-31548A61C8DA}"= UDP:c:\program files\HP\QuickPlay\QP.exe:QP

"{615648ED-EC8F-43D5-828E-0A5BBF002C89}"= TCP:c:\program files\HP\QuickPlay\QP.exe:QP

"{9FBB0E94-271F-497D-9242-6853245229E4}"= Disabled:UDP:c:\program files\Skype\Phone\Skype.exe:Skype

"{A68FAB80-2FB4-494F-975C-1CA983F27C67}"= TCP:c:\program files\Skype\Phone\Skype.exe:Skype

"{F057381B-D1CE-4F1D-A181-833875C46737}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent (TCP-In)

"{FF42A23F-2ACE-47B2-81E5-78CA8A2B308B}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent (UDP-In)

"{34CB0660-E782-4FAD-973F-90C1794AFAB6}"= UDP:c:\program files\Winamp Remote\bin\Orb.exe:Orb

"{11F80C90-F283-4A4B-B35D-34B949AB222A}"= TCP:c:\program files\Winamp Remote\bin\Orb.exe:Orb

"{EADCA2E7-047B-4DE6-8670-43FC68E640F7}"= UDP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray

"{E4B79923-5089-4626-A5A6-01C58610F9CF}"= TCP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray

"{D47D2003-4C0B-4256-81AD-9A67F064C2A2}"= UDP:c:\program files\Winamp Remote\bin\OrbIR.exe:OrbIR

"{5D1B9EB6-2BCC-4D29-AC8A-D7956828FAD7}"= TCP:c:\program files\Winamp Remote\bin\OrbIR.exe:OrbIR

"{73ABB6D8-C49E-4407-92A0-7D8C098960D2}"= UDP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client

"{7D58D658-B8C3-42C2-9A2F-F4E8FB346662}"= TCP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client

"{18AEC15C-07CD-4B0B-A6F5-51698E071BFE}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)

"{AB956D54-3CAA-4C3D-A64A-13104A51A4DE}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)

"{CAFA18FC-5F13-40FA-901D-7C71AC6B592D}"= UDP:5353:Adobe CSI CS4

"{63804777-09AF-4AC6-8AA8-FD93C2E5C4BE}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4

"{D84740A2-9BEA-40E2-ABF7-C3490FF824DE}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4

"{3CFFD61D-247D-4CAB-97BE-92F9D1AC191A}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

 

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [24/08/2009 17:50 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [24/08/2009 17:50 20560]

R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [24/08/2009 17:50 53328]

R2 TabletServicePen;TabletServicePen;c:\windows\System32\Pen_Tablet.exe [21/11/2008 19:33 1373480]

S2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [30/03/2009 16:28 1533808]

S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [22/11/2008 19:55 33752]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs REG_MULTI_SZ BthServ

 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

 

2009-08-25 c:\windows\Tasks\User_Feed_Synchronization-{E64E62FE-0363-4D9F-BB68-EC69F699DE6C}.job

- c:\windows\system32\msfeedssync.exe [2009-08-01 20:13]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.fr/

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=71&bd=Pavilion&pf=laptop

uInternet Settings,ProxyOverride = *.local

IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

Trusted Zone: bitdefender.com

FF - ProfilePath - c:\users\hp\AppData\Roaming\Mozilla\Firefox\Profiles\n9f87mcj.default\

FF - prefs.js: browser.startup.homepage - hxxp://google.fr

FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll

FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll

FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll

FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll

FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll

FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll

FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll

FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

 

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

.

.

------- File Associations -------

.

inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-25 11:25

Windows 6.0.6002 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Completion time: 2009-08-25 11:32

ComboFix-quarantined-files.txt 2009-08-25 09:32

ComboFix2.txt 2009-08-24 14:24

ComboFix3.txt 2009-04-11 11:39

ComboFix4.txt 2009-03-19 23:05

 

Pre-Run: 51 093 909 504 octets libres

Post-Run: 51 463 266 304 octets libres

 

366 --- E O F --- 2009-08-23 09:51

 

Voilà , si quelqu'un peut me venir en aide!!

merci d'avance

 

 

Lirio

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...