[Résolu] Analyse HijackThis - PC lent

[fhzebulon]

ComboFix 10-04-20.01 - Lou 21/04/2010 12:21:48.3.1 - x86

Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1023.451 [GMT 2:00]

Lancé depuis: d:\documents and settings\Lou\Bureau\ComboFix.exe

Commutateurs utilisés :: d:\documents and settings\Lou\Bureau\CFscript.txt

FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

 

file zipped: d:\documents and settings\Lou\Menu Démarrer\Programmes\Démarrage\monxga32.exe

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

d:\documents and settings\Lou\Menu Démarrer\Programmes\Démarrage\monxga32.exe

 

Une copie infectée de c:\windows\system32\drivers\ntfs.sys a été trouvée et désinfectée

Copie restaurée à partir de - c:\windows\ERDNT\cache\ntfs.sys

 

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_BDMUSICB

-------\Legacy_YBEYO

-------\Service_bDMusicb

-------\Service_ybeyo

 

 

((((((((((((((((((((((((((((( Fichiers créés du 2010-03-21 au 2010-04-21 ))))))))))))))))))))))))))))))))))))

.

 

2010-04-20 21:56 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe

2010-04-20 13:20 . 2010-04-20 13:20 5918776 ----a-w- d:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2010-04-05 06:39 . 2010-04-05 06:41 -------- d-----w- d:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-04-05 06:39 . 2010-04-05 06:41 -------- d-----w- c:\program files\iTunes

2010-04-05 06:30 . 2010-04-05 06:30 -------- d-----w- c:\program files\Bonjour

2010-04-05 06:21 . 2010-04-05 06:21 73000 ----a-w- d:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-04-21 10:53 . 2006-01-31 09:59 -------- d-----w- c:\program files\Lx_cats

2010-04-20 13:23 . 2009-12-27 17:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-19 09:25 . 2006-10-01 15:54 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-04-17 16:40 . 2010-04-17 16:40 12 ----a-w- d:\documents and settings\NetworkService\Application Data\kcmdte.dat

2010-04-13 06:17 . 2009-11-07 05:48 79488 ----a-w- d:\documents and settings\Lou\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

2010-04-05 17:11 . 2006-02-14 17:21 -------- d-----w- c:\program files\Google

2010-04-05 06:39 . 2006-03-16 13:07 -------- d-----w- c:\program files\iPod

2010-04-05 06:39 . 2007-07-08 18:15 -------- d-----w- c:\program files\Fichiers communs\Apple

2010-04-05 06:35 . 2006-05-04 10:09 -------- d-----w- c:\program files\QuickTime

2010-03-29 22:46 . 2009-12-27 17:47 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-03-29 22:45 . 2009-12-27 17:47 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-03-24 17:07 . 2006-01-05 05:02 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared

2010-03-10 06:16 . 2004-08-16 16:41 420352 ----a-w- c:\windows\system32\vbscript.dll

2010-02-26 17:02 . 2010-02-26 17:02 -------- d-----w- d:\documents and settings\All Users\Application Data\Norton

2010-02-26 17:02 . 2009-06-18 07:23 -------- d-----w- c:\program files\Norton Security Scan

2010-02-26 17:01 . 2010-02-26 17:01 -------- d-----w- d:\documents and settings\All Users\Application Data\NortonInstaller

2010-02-26 17:01 . 2010-02-26 17:01 -------- d-----w- c:\program files\NortonInstaller

2010-02-25 06:17 . 2004-08-16 16:41 916480 ----a-w- c:\windows\system32\wininet.dll

2010-02-24 13:11 . 2004-08-16 16:40 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-17 12:07 . 2004-08-16 16:40 2192000 ------w- c:\windows\system32\ntoskrnl.exe

2010-02-16 19:07 . 2004-08-03 23:48 2068864 ------w- c:\windows\system32\ntkrnlpa.exe

2010-02-12 09:46 . 2010-02-12 09:46 91424 ----a-w- c:\windows\system32\dnssd.dll

2010-02-12 09:46 . 2010-02-12 09:46 107808 ----a-w- c:\windows\system32\dns-sd.exe

2010-02-12 04:34 . 2004-08-16 16:39 100864 ----a-w- c:\windows\system32\6to4svc.dll

2010-02-11 12:02 . 2004-08-16 16:41 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys

2009-05-06 17:30 . 2009-05-04 12:05 19165248 ----a-w- c:\program files\TomTomHOME2winlatest.exe

2009-01-06 09:33 . 2009-01-06 09:32 12814336 -c--a-w- c:\program files\mp10setup.exe

2008-10-19 15:09 . 2008-10-19 15:09 4865408 -c--a-w- c:\program files\Silverlight.2.0.exe

2008-10-19 15:07 . 2008-10-19 15:07 1837280 -c--a-w- c:\program files\snpvw.exe

2007-07-15 07:14 . 2007-07-15 06:51 49943864 -c--a-w- c:\program files\iTunesSetup.exe

2007-04-08 07:51 . 2007-04-08 07:38 7930697 -c--a-w- c:\program files\gimp-2.2.13-i586-setup-1.zip

2007-04-08 07:44 . 2007-04-08 07:44 5671965 -c--a-w- c:\program files\gtk+-2.10.6-1-setup.zip

2006-03-07 14:38 . 2006-03-07 14:37 8619112 -c--a-w- c:\program files\IncrediMailSetup_fr.exe

2006-02-14 17:21 . 2006-02-14 17:21 11817800 -c--a-w- c:\program files\GoogleEarth.exe

.

 

((((((((((((((((((((((((((((( SnapShot_2010-04-21_08.40.29 )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-04-21 10:47 . 2010-04-21 10:47 16384 c:\windows\temp\Perflib_Perfdata_6a8.dat

+ 2006-01-03 19:30 . 2010-04-21 10:48 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

- 2006-01-03 19:30 . 2010-04-21 06:22 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

+ 2006-01-03 19:30 . 2010-04-21 10:48 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat

- 2006-01-03 19:30 . 2010-04-21 06:22 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat

+ 2010-04-21 10:48 . 2010-04-21 10:48 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat

- 2009-12-27 18:05 . 2010-04-21 06:22 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]

"Magentic"="c:\progra~1\Magentic\bin\Magentic.exe" [2008-08-04 488808]

"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-11-13 247144]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ATSwpNav"="c:\program files\Fingerprint Sensor\ATSwpNav -run" [X]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-08-02 7110656]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-08-02 86016]

"NECHotkey"="mHotkey.exe" [2005-10-12 548864]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-10 148888]

"Vade Retro Outlook Express"="c:\progra~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2004-10-04 310272]

"MM_MODULE"="c:\program files\MIC\HAWAII\Hawaii.exe" [2005-07-12 90112]

"OmniPass"="c:\apps\Softex\OmniPass\scureapp.exe" [2005-08-12 1859584]

"PCMService"="c:\apps\Powercinema\PCMService.exe" [2005-05-11 127118]

"LXCECATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll" [2005-07-20 73728]

"lxcemon.exe"="c:\program files\Lexmark 4300 Series\lxcemon.exe" [2005-08-02 192512]

"HiYo"="c:\program files\HiYo\bin\HiYo.exe" [2008-06-11 148784]

"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-16 47392]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120]

 

d:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

D‚marrage rapide de HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-2-27 67128]

Microsoft Office.lnk - d:\office\OSA9.EXE [1999-1-20 65588]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]

2005-08-12 16:01 49152 ----a-w- c:\apps\Softex\OmniPass\OPXPGina.dll

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%ProgramFiles%\\AOL 9.0\\aol.exe"=

"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=

"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\APPS\\Inventime\\my.exe"=

"c:\\Program Files\\AOL 9.0\\waol.exe"=

"c:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=

"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=

"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\WINDOWS\\incredimail_install.exe"=

"c:\\Program Files\\IncrediMail\\bin\\IncrediMail_Install.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\WINDOWS\\system32\\rtcshare.exe"=

"c:\\Program Files\\NetMeeting\\conf.exe"=

"c:\\APPS\\skype\\phone\\Skype.exe"=

"c:\\Program Files\\Magentic\\bin\\MgImp.exe"=

"c:\\Program Files\\Magentic\\bin\\Magentic.exe"=

"c:\\Program Files\\Magentic\\bin\\MgApp.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

 

R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 13:31 92008]

R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [03/01/2006 21:07 799744]

R3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\drivers\MosIrUsb.sys [01/01/1980 01:00 20736]

S2 gupdate1c9aed76e7466f6;Google Update Service (gupdate1c9aed76e7466f6);c:\program files\Google\Update\GoogleUpdate.exe [27/03/2009 14:27 133104]

S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;c:\windows\system32\drivers\usb8023.sys [16/08/2004 18:41 12800]

.

Contenu du dossier 'Tâches planifiées'

 

2010-03-26 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]

 

2010-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-27 12:27]

 

2010-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-27 12:27]

 

2010-04-11 c:\windows\Tasks\Norton Security Scan for Caro.job

- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.3.0.44\Nss.exe [2010-02-26 15:45]

 

2010-04-21 c:\windows\Tasks\User_Feed_Synchronization-{560AF3C5-0A5E-43FE-A8BD-EED5401EDBB3}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]

.

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://fr.weather.com/weather/10day-lisle-jourdain-frpc0411

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = localhost;*.local

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - hxxp://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-04-21 12:52

Windows 5.1.2600 Service Pack 3 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LXCECATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MysqlInventime]

"ImagePath"="c:\apps\INVENT~1\mysql\bin\mysqld-nt --defaults-file=c:\apps\Inventime\mysql\my.ini MysqlInventime"

.

--------------------- DLLs chargées dans les processus actifs ---------------------

 

- - - - - - - > 'winlogon.exe'(572)

c:\apps\Softex\OmniPass\opxpgina.dll

 

- - - - - - - > 'explorer.exe'(1836)

c:\progra~1\GOTOSO~1\VADERE~1\VrOe_hook.dll

c:\apps\Softex\OmniPass\SCUREDLL.dll

c:\windows\system32\eappprxy.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe

c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe

c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

c:\apps\HIDSERVICE\HIDSERVICE.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

c:\windows\system32\nvsvc32.exe

c:\apps\Softex\OmniPass\Omniserv.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

c:\apps\Powercinema\Kernel\TV\CLSched.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\apps\Softex\OmniPass\OPXPApp.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\RUNDLL32.EXE

c:\windows\mHotkey.exe

c:\program files\Fingerprint Sensor\ATSwpNav.exe

c:\windows\system32\lxcecoms.exe

c:\progra~1\Magentic\bin\MgApp.exe

c:\program files\SnapShot\SnapShot.exe

c:\program files\HP\Digital Imaging\bin\hpqimzone.exe

c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\Windows Live\Contacts\wlcomm.exe

.

**************************************************************************

.

Heure de fin: 2010-04-21 12:56:20 - La machine a redémarré

ComboFix-quarantined-files.txt 2010-04-21 10:56

ComboFix2.txt 2010-04-21 08:47

ComboFix3.txt 2009-12-27 16:38

 

Avant-CF: 133 713 174 528 octets libres

Après-CF: 133 555 646 464 octets libres

 

- - End Of File - - EF125BBA4E468FDFA9D5CA6A1273B662

[Falkra]

Ca doit aller mieux.

 

Poste un nouveau rapport HijackThis stp, et dis moi comment se comporte la machine.

[fhzebulon]

Waouh... je ne sais pas si le rapport a bien été calculé, c'est allé à 200 km/h, et d'ailleurs le PC fonctionne parfaitement... ! ! !

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:29:32, on 21/04/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

c:\APPS\HIDSERVICE\HIDSERVICE.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Apps\Softex\OmniPass\Omniserv.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

c:\APPS\Powercinema\Kernel\TV\CLSched.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Apps\Softex\OmniPass\OPXPApp.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\mHotkey.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Fingerprint Sensor\ATSwpNav.exe

C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe

C:\Program Files\MIC\HAWAII\Hawaii.exe

C:\Apps\Softex\OmniPass\scureapp.exe

C:\Apps\Powercinema\PCMService.exe

C:\Program Files\Lexmark 4300 Series\lxcemon.exe

C:\Program Files\HiYo\bin\HiYo.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\lxcecoms.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\PROGRA~1\Magentic\bin\MgApp.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\Program Files\SnapShot\SnapShot.exe

C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\IncrediMail\bin\IncMail.exe

C:\Program Files\IncrediMail\bin\IMApp.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

D:\Documents and Settings\Lou\Bureau\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.weather.com/weather/10day-lisle-jourdain-frpc0411

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NECHotkey] mHotkey.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run

O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"

O4 - HKLM\..\Run: [MM_MODULE] C:\Program Files\MIC\HAWAII\Hawaii.exe

O4 - HKLM\..\Run: [OmniPass] C:\Apps\Softex\OmniPass\scureapp.exe

O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"

O4 - HKLM\..\Run: [LXCECATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16

O4 - HKLM\..\Run: [lxcemon.exe] "C:\Program Files\Lexmark 4300 Series\lxcemon.exe"

O4 - HKLM\..\Run: [HiYo] C:\Program Files\HiYo\bin\HiYo.exe /RunFromStartup

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c

O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe

O4 - Startup: SnapShot.lnk = C:\Program Files\SnapShot\SnapShot.exe

O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - Global Startup: Microsoft Office.lnk = D:\Office\OSA9.EXE

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm

O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - http://www.virginmega.fr/DownloadManager/R...rod/DownMan.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...5/installer.exe

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe

O23 - Service: Google Update Service (gupdate1c9aed76e7466f6) (gupdate1c9aed76e7466f6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)

O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE

O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcecoms.exe

O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Sptisrv.exe

O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

 

--

End of file - 11713 bytes

[Falkra]

Waouh... je ne sais pas si le rapport a bien été calculé, c'est allé à 200 km/h, et d'ailleurs le PC fonctionne parfaitement... ! ! !

J'aime bien lire ça.

 

Ton rapport est clean, plus d'infection en tout cas.

 

Peux-tu faire un zip (si tu sais faire) du dossier c:\qoobox ? Et me dire combien il pèse en Mo ?

[fhzebulon]

4.3 Mo

 

Je le zippe sur place ?

 

Quid de l'antivirus sympathique maintenant ?

 

Merci encore en tout cas, je respire mieux...

[Falkra]

Je t'envoie un message privé pour me faire parvenir les fichiers infectieux.

[fhzebulon]

Good, c'est fait. Quand tu auras un peu de temps pour les moindres urgences...: si tu peux me guider vers un anti-virus sympa et plutôt du genre "free".......

 

Merci encore pour tout, c'est sans doute le site le + efficace que je connaisse, tous domaines confondus, si je puis dire......

[Falkra]

C'est bon, je l'ai. Merci beaucoup.

 

Désinstalle combofix : entre combofix /uninstall dans la boite exécuter du menu démarrer.

=> combofix espace slasht uninstall

Après cela, efface ce dossier s'il existe encore :

C:\QooBox

Tu peux effacer le ZIP que tu m'as envoyé aussi. Je vais envoyer le fichier aux éditeurs d'AV pour améliorer la détection, ton fichier va aider du monde !

 

Maintenant (après cette désinstallation, j'attendais exprès), on peut installer un antivirus.

Je te conseille Antivir : gratuit (disponible en français) et surtout efficace.

Pour Antivir voici un lien de téléchargement direct (version en français) :

http://dlce.antivir.com/package/wks_avira/...personal_fr.exe

Tuto Fr sur la version 9 française : http://www.libellules.ch/tuto_antivir.php

[fhzebulon]

Désinstallé, ainsi que la version .zip. Puis-je lancer Antivir ? Merci ! ! !

[Falkra]

Vas-y.