[RESOLU] double chapeau

ProQuiche · le 5 octobre 2010

Bonjour Apollo,

Je te mets ci-dessous le log MBAM.

Les connexions Internet sont maintenant hyperlentes. Comme si le PC faisait tout un tas de contrôle entre deux clics... :outch:

Je ferai les vérifications de sécurité tout à l'heure.

De retour vers 15h.

Merci

Bonne journée

____

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Version de la base de données: 4741

Windows 5.1.2600 Service Pack 2

Internet Explorer 7.0.5730.13

05/10/2010 00:21:57

mbam-log-2010-10-05 (00-21-57).txt

Type d'examen: Examen complet (C:\|)

Elément(s) analysé(s): 381574

Temps écoulé: 1 heure(s), 36 minute(s), 2 seconde(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 2

Valeur(s) du Registre infectée(s): 3

Elément(s) de données du Registre infecté(s): 4

Dossier(s) infecté(s): 7

Fichier(s) infecté(s): 70

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):

HKEY_CURRENT_USER\SOFTWARE\AdwareAlert (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\MPMFC1 (Rogue.SearchAndDestroy) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{a85515dc-fb8d-c632-2694-53618ad41e51} (Spyware.Passwords.XGen) -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spywaresweeperpromfc (Rogue.SpywareSweeper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\sd (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23 (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-50-51 (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Settings (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\Spyware Sweeper Pro (Rogue.SpywareSweeper) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):

C:\Documents and Settings\Léa Znaty\Application Data\Zuqeyw\biuko.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Local Settings\Temp\ptu135_tmp.exe (Adware.Casino) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Mes documents\SetupCasino_4a50.exe (Adware.Casino) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Mes documents\Téléchargements\SetupPoker.exe_796e99.exe (Adware.Casino) -> Quarantined and deleted successfully.

C:\Poker\Chilipoker.fr\_SetupPoker.exe_796e99.exe (Adware.Casino) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP1143\A0126580.exe (Adware.Casino) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\adwarealert.sys (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\rs.dat (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 08_57_11 PM_265.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 08_57_12 PM_984.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 08_59_36 PM_468.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 09_38_02 PM_781.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 09_46_05 PM_843.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 09_46_13 PM_640.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 09_49_47 PM_750.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 09_51_04 PM_546.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 11_27_34 PM_687.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 11_29_58 PM_312.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 11_32_39 PM_625.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 11_36_40 PM_703.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Log\2008 Feb 24 - 11_43_56 PM_796.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\0.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\0.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\1.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\1.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\10.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\10.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\11.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\11.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\12.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\12.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\13.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\13.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\14.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\14.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\15.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\15.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\16.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\16.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\17.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\17.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\18.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\18.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\19.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\19.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\2.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\2.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\20.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\20.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\3.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\3.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\4.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\4.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\5.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\5.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\6.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\6.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\7.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\7.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\8.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\8.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\9.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-48-23\9.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-50-51\0.qit (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-50-51\0.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Léa Znaty\Application Data\AdwareAlert\Quarantine\24-02-2008-21-50-51\1.qnf (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\Spyware Sweeper Pro\uninstall.exe (Rogue.SpywareSweeper) -> Quarantined and deleted successfully.

C:\WINDOWS\Spyware Sweeper Pro Setup Log.txt (Rogue.SpywareSweeper) -> Quarantined and deleted successfully.

C:\WINDOWS\Spyware Sweeper Pro Uninstall Log.txt (Rogue.SpywareSweeper) -> Quarantined and deleted successfully.

C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job (Trojan.Downloader) -> Quarantined and deleted successfully.

Apollo · le 5 octobre 2010

Re,

Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

Pour les systèmes 64 Bits: Télécharger RSIT 64 Bits

Double-clique sur RSIT.exe afin de lancer RSIT. Pour XP

Important :
* Sous Vista : il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur

* Sous Windows 7 : Il faut mettre le fichier RSIT.exe sur le bureau, faire un clic droit dessus et dans Propriétés, onglet Compatibilité, cocher la case "Exécuter ce programme en mode compatibilité pour" et dans le menu choisir Vista SP2 et la case dans Niveau de privilège.
Valide par Appliquer.
Clique Continue à l'écran Disclaimer.
Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

>>>Héberge le "info.txt" ici: Cijoint.fr - Service gratuit de dépôt de fichiers et me donner le liens pour que je puisse le consulter.

Pour l'instant, il vaut mieux procéder de la sorte pour ne pas planter le sujet du forum.

@++

ProQuiche · le 5 octobre 2010

Re Apollo

J'utilise un autre ordinateur pour te répondre.

Les connexions internet sont maintenant tellement lente sur le PC en réparation que je ne peux même pas aller voir les liens que tu me donnes.

Une idée pour corriger ça ?

En attendant, je vais essayer de télécharger les utilitaires que tu proposes depuis ce poste et les basculer vers l'autre...

Merci

Quiche

Apollo · le 5 octobre 2010

Re,

Non je ne vois pas ce qui pourrait avoir été responsable de ça, on n'a fait que virer des malwares de ton pc.

S'il le faut, on enverra un missile balistique pour voir s'il traîne encore des saletés.

Mais MBAM en a déjà viré un fameux paquet.

Je verrais déjà avec le RSIT.

@++

ProQuiche · le 5 octobre 2010

Re Apo

Voici le lien pour le fichier RSITinfo

Cijoint.fr - Service gratuit de dépôt de fichiers

Voici le contenu du RSITlog

Merci

Quiche :mexicain:

____RSITlog_________

Logfile of random's system information tool 1.08 (written by random/random)

Run by Philippe Devillers at 2010-10-05 16:55:00

Microsoft Windows XP Professionnel Service Pack 2

System drive C: has 212 GB (45%) free of 474 GB

Total RAM: 2046 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 16:55:14, on 05/10/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.17055)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe

C:\Program Files\Fichiers communs\McAfee\SystemCore\mfevtps.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\SiteAdvisor\6253\SAService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\McAfee\SystemCore\mcshield.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\Fichiers communs\McAfee\SystemCore\mfefire.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program Files\Hercules\DualPix Exchange\Camservice.exe

C:\Program Files\McAfee.com\Agent\mcagent.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiStationLB.exe

C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Léa Znaty\Bureau\RSIT.exe

C:\Program Files\trend micro\Philippe Devillers.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Fichiers communs\McAfee\SystemCore\ScriptSn.20100917095838.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [CamserviceDP] C:\Program Files\Hercules\DualPix Exchange\Camservice.exe /startup

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

O4 - Global Startup: WiFi Station pour Livebox.lnk = C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiStationLB.exe

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe

O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe

O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe

O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

O23 - Service: Service McAfee Personal Firewall (McMPFSvc) - McAfee, Inc. - C:\Program Files\Fichiers communs\Mcafee\McSvcHost\McSvHost.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe

O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe

O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\SystemCore\\mcshield.exe

O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\SystemCore\\mfefire.exe

O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\SystemCore\mfevtps.exe

O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe

O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Fichiers communs\Mcafee\McSvcHost\McSvHost.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe

O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe

O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe

O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe

O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe

O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

--

End of file - 10443 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

C:\WINDOWS\tasks\Recherche de virus de McAfee.com - Mon ordinateur (CANOPUS-Léa Znaty).job

C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}]

McAfee Phishing Filter - c:\PROGRA~1\mcafee\msk\mskapbho.dll [2010-05-03 245272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]

DriveLetterAccess - C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2005-09-08 110652]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]

scriptproxy - C:\Program Files\Fichiers communs\McAfee\SystemCore\ScriptSn.20100917095838.dll [2010-08-24 73288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2007-01-19 2436160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]

Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2007-05-10 321120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]

Skype add-on for Internet Explorer - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-05 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-02-05 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2007-01-19 2436160]

{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2007-05-10 321120]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"DLA"=C:\WINDOWS\System32\DLA\DLACTRLW.EXE [2005-09-08 122940]

"PinnacleDriverCheck"=C:\WINDOWS\system32\PSDrvCheck.exe [2004-03-11 406016]

"Acrobat Assistant 8.0"=C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [2008-01-11 623992]

""= []

"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-08-08 7630848]

"CamserviceDP"=C:\Program Files\Hercules\DualPix Exchange\Camservice.exe [2007-08-10 81920]

"Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2009-06-17 55824]

"mcui_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2010-07-01 1193848]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-05 15360]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage

Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe

Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe

McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

WiFi Station pour Livebox.lnk - C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiStationLB.exe

WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]

c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll [2009-07-20 72208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2004-08-05 240128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefire]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefirek]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefirek.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfehidk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfehidk.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfevtp]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"DisableTaskMgr"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=145

"NoWindowsUpdate"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program Files\Pinnacle\Studio 10\programs\RM.exe"="C:\Program Files\Pinnacle\Studio 10\programs\RM.exe:*:Enabled:Render Manager"

"C:\Program Files\Pinnacle\Studio 10\programs\Studio.exe"="C:\Program Files\Pinnacle\Studio 10\programs\Studio.exe:*:Enabled:Studio"

"C:\Program Files\Pinnacle\Studio 10\programs\PMSRegisterFile.exe"="C:\Program Files\Pinnacle\Studio 10\programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile"

"C:\Program Files\Pinnacle\Studio 10\programs\umi.exe"="C:\Program Files\Pinnacle\Studio 10\programs\umi.exe:*:Enabled:umi"

"C:\Program Files\Dell Network Assistant\ezi_hnm2.exe"="C:\Program Files\Dell Network Assistant\ezi_hnm2.exe:*:Enabled:Dell Network Assistant"

"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\Program Files\Fichiers communs\McAfee\MNA\McNASvc.exe"="C:\Program Files\Fichiers communs\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent"

"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Disabled:eMule"

"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"

"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe"="C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe:*:Enabled:McAfee Shared Service Host"

"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"

"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======File associations======

.scr - open - "C:\WINDOWS\system32\NOTEPAD.EXE" "%1"

.scr - install -

.scr - config -

======List of files/folders created in the last 1 months======

2010-10-05 16:55:00 ----D---- C:\rsit

2010-10-05 00:33:19 ----SHD---- C:\found.000

2010-10-04 19:20:57 ----D---- C:\Documents and Settings\Léa Znaty\Application Data\Malwarebytes

2010-10-04 19:20:42 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2010-10-04 19:20:42 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys

2010-10-04 19:20:41 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

2010-10-04 19:20:41 ----A---- C:\WINDOWS\system32\drivers\mbam.sys

2010-10-01 19:51:05 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee Security Scan

2010-10-01 19:51:03 ----D---- C:\Program Files\McAfee Security Scan

2010-10-01 19:44:04 ----D---- C:\Program Files\Winamax Poker

2010-09-23 17:41:40 ----D---- C:\Documents and Settings\Léa Znaty\Application Data\FileZilla

2010-09-23 17:41:26 ----D---- C:\Program Files\FileZilla FTP Client

2010-09-16 11:47:35 ----D---- C:\Program Files\WinZip

======List of files/folders modified in the last 1 months======

2010-10-05 16:55:14 ----D---- C:\WINDOWS\Prefetch

2010-10-05 16:55:14 ----D---- C:\Program Files\Trend Micro

2010-10-05 16:55:02 ----D---- C:\WINDOWS\Temp

2010-10-05 16:55:01 ----D---- C:\WINDOWS\system32\CatRoot2

2010-10-05 16:22:32 ----D---- C:\WINDOWS\system32

2010-10-05 16:22:32 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

2010-10-05 16:18:35 ----D---- C:\WINDOWS

2010-10-05 16:18:32 ----A---- C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt

2010-10-05 16:17:20 ----A---- C:\WINDOWS\SchedLgU.Txt

2010-10-05 07:04:21 ----HD---- C:\WINDOWS\inf

2010-10-05 00:36:27 ----RD---- C:\Program Files

2010-10-05 00:36:20 ----SD---- C:\WINDOWS\Downloaded Program Files

2010-10-05 00:23:19 ----HDC---- C:\WINDOWS\$NtUninstallKB936021$

2010-10-05 00:23:19 ----D---- C:\WINDOWS\system32\drivers

2010-10-05 00:21:57 ----SD---- C:\WINDOWS\Tasks

2010-10-05 00:21:56 ----D---- C:\Documents and Settings\Léa Znaty\Application Data\Zuqeyw

2010-10-05 00:18:17 ----D---- C:\Documents and Settings\Léa Znaty\Application Data\Erutxe

2010-10-04 18:53:28 ----D---- C:\Program Files\eMule

2010-10-04 00:00:44 ----D---- C:\Program Files\PokerStars.FR

2010-10-02 03:02:26 ----D---- C:\WINDOWS\system32\CatRoot

2010-10-01 19:44:05 ----SHD---- C:\WINDOWS\Installer

2010-10-01 19:44:05 ----SHD---- C:\Config.Msi

2010-10-01 10:19:26 ----D---- C:\Documents and Settings\Léa Znaty\Application Data\Skype

2010-10-01 08:53:34 ----D---- C:\Program Files\Microsoft Silverlight

2010-09-28 00:07:51 ----D---- C:\Program Files\Mozilla Firefox

2010-09-21 08:08:50 ----D---- C:\Program Files\Google

2010-09-21 00:07:14 ----D---- C:\WINDOWS\system32\wbem

2010-09-16 11:53:44 ----D---- C:\Program Files\PokerStars

2010-09-16 11:52:24 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft

2010-09-16 11:50:40 ----D---- C:\Poker

2010-09-16 11:47:57 ----D---- C:\Documents and Settings\All Users\Application Data\WinZip

2010-09-16 03:05:47 ----A---- C:\WINDOWS\win.ini

2010-09-16 03:00:47 ----A---- C:\WINDOWS\system32\MRT.exe

2010-09-11 13:38:28 ----D---- C:\Program Files\McAfee.com

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 DRVMCDB;DRVMCDB; C:\WINDOWS\System32\Drivers\DRVMCDB.SYS [2005-09-12 89264]

R0 iaStor;Intel RAID Controller; C:\WINDOWS\system32\drivers\iaStor.sys [2006-07-06 246784]

R0 mfehidk;McAfee Inc. mfehidk; C:\WINDOWS\system32\drivers\mfehidk.sys [2010-08-24 386712]

R0 ohci1394;Contrôleurs hôte IEEE 1394 compatible OHCI; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2004-08-04 61056]

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2006-07-27 20640]

R1 cdrbsdrv;cdrbsdrv; C:\WINDOWS\system32\drivers\cdrbsdrv.sys [2004-03-08 13567]

R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2005-08-25 5628]

R1 DLARTL_N;DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [2005-08-25 22684]

R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-05 40320]

R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]

R1 mfetdi2k;McAfee Inc. mfetdi2k; C:\WINDOWS\system32\drivers\mfetdi2k.sys [2010-08-24 84072]

R1 PCLEPCI;PCLEPCI; \??\C:\WINDOWS\system32\drivers\pclepci.sys []

R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.5.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2010-02-28 21419]

R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2005-09-08 25628]

R2 DLADResN;DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2005-09-08 2496]

R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2005-09-08 86524]

R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [2005-09-08 14684]

R2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [2005-09-08 6364]

R2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [2005-09-08 87036]

R2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [2005-09-08 94332]

R2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2005-08-12 40544]

R2 LBeepKE;LBeepKE; C:\WINDOWS\System32\Drivers\LBeepKE.sys [2009-06-17 10384]

R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2003-04-09 11043]

R3 ASAPIW2K;ASAPIW2K; C:\WINDOWS\system32\drivers\ASAPIW2k.sys [2005-02-23 11264]

R3 cfwids;McAfee Inc. cfwids; C:\WINDOWS\system32\drivers\cfwids.sys [2010-08-24 55840]

R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-08-12 137728]

R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-18 9600]

R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2003-11-17 1042432]

R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys [2003-11-17 212224]

R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2009-06-17 35472]

R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2009-06-17 37392]

R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2005-07-13 171008]

R3 mfeapfk;McAfee Inc. mfeapfk; C:\WINDOWS\system32\drivers\mfeapfk.sys [2010-08-24 95600]

R3 mfeavfk;McAfee Inc. mfeavfk; C:\WINDOWS\system32\drivers\mfeavfk.sys [2010-08-24 152992]

R3 mfebopk;McAfee Inc. mfebopk; C:\WINDOWS\system32\drivers\mfebopk.sys [2010-08-24 52104]

R3 mfefirek;McAfee Inc. mfefirek; C:\WINDOWS\system32\drivers\mfefirek.sys [2010-08-24 312904]

R3 mfendiskmp;mfendiskmp; C:\WINDOWS\system32\DRIVERS\mfendisk.sys [2010-08-24 88544]

R3 MODEMCSA;Périphérique de filtrage de flux Unimodem; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]

R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]

R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-08-08 3958272]

R3 RT73;Hercules Wireless USB Dongle Driver ; C:\WINDOWS\system32\DRIVERS\rt73.sys [2006-12-21 429440]

R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2006-07-24 1156648]

R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]

R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]

R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]

R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]

R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2003-11-17 680704]

S0 gjeocjlu;gjeocjlu; C:\WINDOWS\System32\drivers\kpvrahob.sys []

S3 61883;Pilote d'unité 61883; C:\WINDOWS\system32\DRIVERS\61883.sys [2004-08-04 48128]

S3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-05 60800]

S3 Avc;Périphérique AVC; C:\WINDOWS\system32\DRIVERS\avc.sys [2004-08-04 38912]

S3 camfilt2;camfilt2; C:\WINDOWS\System32\Drivers\camfilt2.sys [2007-05-29 94208]

S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]

S3 DSproct;DSproct; \??\C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys []

S3 E100B;Pilote de carte Intel ® PRO; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-08-23 117760]

S3 e1express;Intel® PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2006-07-19 230400]

S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2003-03-09 51024]

S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2003-03-09 16080]

S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2003-03-09 21456]

S3 mfeavfk01;McAfee Inc.; C:\WINDOWS\system32\drivers\mfeavfk01.sys []

S3 mfendisk;McAfee Core NDIS Intermediate Filter; C:\WINDOWS\system32\DRIVERS\mfendisk.sys [2010-08-24 88544]

S3 mferkdet;McAfee Inc. mferkdet; C:\WINDOWS\system32\drivers\mferkdet.sys [2010-08-24 84264]

S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2004-08-04 51328]

S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]

S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]

S3 NAL;Nal Service ; \??\C:\WINDOWS\system32\Drivers\iqvw32.sys []

S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]

S3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-05 61824]

S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]

S3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\WINDOWS\system32\DRIVERS\snp2uvc.sys [2007-05-16 9602944]

S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]

S3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-04 59264]

S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]

S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]

S3 usbvideo;Périphérique vidéo USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2004-08-04 78464]

S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]

S4 agp440;Filtre de bus AGP Intel; C:\WINDOWS\system32\DRIVERS\agp440.sys [2004-08-04 42368]

S4 agpCPQ;Filtre de bus AGP Compaq; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2004-08-04 44928]

S4 alim1541;Filtre de bus AGP ALI; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2004-08-04 42752]

S4 amdagp;Pilote de filtre du bus AMD AGP; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2004-08-04 43008]

S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]

S4 sisagp;Filtre de bus AGP SIS; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2004-08-04 41088]

S4 viaagp;Filtre de bus AGP VIA; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 IAANTMON;Intel® Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2006-07-06 90112]

R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-02-05 153376]

R2 McMPFSvc;Service McAfee Personal Firewall; C:\Program Files\Fichiers communs\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]

R2 mcmscsvc;McAfee Services; C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe [2010-03-10 271480]

R2 McNaiAnn;McAfee VirusScan Announcer; C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe [2010-03-10 271480]

R2 McNASvc;McAfee Network Agent; C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe [2010-03-10 271480]

R2 McProxy;McAfee Proxy Service; C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe [2010-03-10 271480]

R2 McShield;McShield; C:\Program Files\Fichiers communs\McAfee\SystemCore\\mcshield.exe [2010-08-24 171168]

R2 mfefire;McAfee Firewall Core Service; C:\Program Files\Fichiers communs\McAfee\SystemCore\\mfefire.exe [2010-08-24 188136]

R2 mfevtp;McAfee Validation Trust Protection Service; C:\Program Files\Fichiers communs\McAfee\SystemCore\mfevtps.exe [2010-08-24 141792]

R2 MSK80Service;McAfee Anti-Spam Service; C:\Program Files\Fichiers communs\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]

R2 SiteAdvisor Service;Service SiteAdvisor; C:\Program Files\SiteAdvisor\6253\SAService.exe [2008-02-27 345376]

R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]

R3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-02-21 654848]

S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2004-08-05 268800]

S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-04-25 136176]

S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-08-08 155715]

S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]

S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe [2008-02-21 77944]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]

S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]

S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-05-25 138168]

S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]

S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]

S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe [2009-07-20 121360]

S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]

S3 McODS;McAfee Scanner; C:\Program Files\McAfee\VirusScan\mcods.exe [2010-04-15 364216]

S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2003-03-09 65795]

S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Apollo · le 5 octobre 2010

Bon, avant de tirer au canon , je voudrais faire une vérification:

Tu sais, explorer7 et SP2 ça va plus hein. Tu ne vas plus avoir de mises à jour chez Microsoft.

Le SP3 est obligatoire pour ça, mais pas sur un système encore potentiellement infecté.

Télécharge TDSSKiller.zip de Kaspersky sur ton bureau.

Décompresse-le. (clic droit/extraire ici).

Besoin d'un utilitaire de décompression? 7Zip

Télécharger le fichier non-compressé: http://s upport.k a s per s k y.com/download s /util s /td s s k iller.exe

Ouvre le dossier si la décompression a donné un répertoire TDSSKiller.

Double-clique sur TDSSKiller.exe

L'écran de TDSSKiller s'affiche:

Cliquer sur Start scan pour lancer l'analyse.

Lorsque l'outil a terminé son travail d'inspection, si des nuisibles ("Malicious objects") ont été trouvés,

vérifier que l'option Cure est sélectionnée, puis cliquer sur le bouton Continue puis sur le bouton Reboot now.

Envoyer en réponse:

*- Le rapport de TDSSKiller (contenu du fichier SystemDrive \TDSSKiller.Version_Date_Heure_log.txt)

[systemDrive représente la partition sur laquelle est installé le système, généralement C:] .

@++

ProQuiche · le 5 octobre 2010

Re Apo,

J'ai commencé à suivre les conseils de Apollo et Compagnie "à vérifier de temps en temps"

J'ai supprimé Acrobat Standard v8... mais maintenant je n'ai plus accès à Acrobat Writer...

J'ai en effet une licence payante d'Acrobat v8 que je n'ai pas upgradée, par économie.

Cela permet de créer des PDF à partir d'Office.

Je crois qu'il faut que je la réinstalle.

Qu'en penses-tu ?

Quiche

Apollo · le 5 octobre 2010

Si tu as une licence, oui réinstalle mais ce n'est pas la dernière à jour; c'est assez risqué car elle contient des failles. Avoir une licence ne permet pas de mettre le logiciel à jour? C'est grotesque.

En fait, c'est surtout le lecteur qui est sujet à caution.

@++

ProQuiche · le 5 octobre 2010

Je suis sujet à caution ?

Explique...

ProQuiche · le 5 octobre 2010

OK j'ai fait le TDSSKiller.

Il n'a rien trouvé.

ça a été quasi instantané... c normal ?

Merci

Je suis d'accord avec toi... ma configuration est certainement obsolète.

Je veux bien changer... mais d'expérience, c toujours une galère pour retrouver une configuration aussi opérationnelle que la précédente (aux virus près...).

Par manque de compétence, aucun doute...

@+

Connexion

Pas encore inscrit ?

[RESOLU] double chapeau

Messages recommandés

ProQuiche

Apollo

ProQuiche

Apollo

ProQuiche

Apollo

ProQuiche

Apollo

ProQuiche

ProQuiche

Rejoindre la conversation

En ligne récemment 0 membre est en ligne

Zebulon

Outils en ligne

Naviguer