Bonjour,
je viens de lancer comme un bébête un .exe qui étais censé être un patch pour un jeux, une fois une fenêtre dos lancer toutes mes icônes du bureau ont disparu et les dossiers y étant ce sont vidés ainsi que les dossiers de mes documents qui sont tous vide et dans demarrer->programmes->… tout les lien sont vides.
HELP !! Merci
Merci et voila :
ComboFix 09-10-18.06 - Chido 19/10/2009 19:06.1.4 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2047.971 [GMT 2:00]
Lancé depuis: c:\documents and settings\Chido\Bureau\chidory.exe
AV: avast! antivirus 4.8.1356 [VPS 091019-0] On-access scanning disabled (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Chido\Application Data\BITS
c:\documents and settings\Chido\Application Data\Microsoft\svchost.exe
c:\program files\FlashGet Network
c:\program files\FlashGet Network\FlashGet universal\dbtrans_verbose.log
c:\program files\FlashGet Network\FlashGet universal\fgoption.ini
c:\program files\FlashGet Network\FlashGet universal\P2PCfg.ini
c:\program files\FlashGet Network\FlashGet universal\p2spmgr.ini
c:\program files\FlashGet Network\FlashGet universal\p4spmgr.ini
c:\program files\FlashGet Network\FlashGet universal\Profiles\config.dat
c:\program files\FlashGet Network\FlashGet universal\Profiles\tasks.dat
c:\program files\FlashGet Network\FlashGet universal\transaction.log
c:\windows\system32\Data
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-09-19 au 2009-10-19 ))))))))))))))))))))))))))))))))))))
.
2009-10-15 17:15 . 2009-10-19 16:10 -------- d-----w- c:\documents and settings\Chido\Application Data\La Bataille pour la Terre du Milieu II
2009-10-14 17:20 . 2009-10-14 17:27 -------- d-----w- c:\program files\FlashGet
2009-10-14 17:16 . 2009-10-19 16:10 -------- d-----w- C:\profiles
2009-10-13 19:24 . 2002-12-11 22:14 1798144 -c–a-w- c:\windows\system32\dllcache\qedit.dll
2009-10-13 19:24 . 2002-12-11 22:14 173056 -c–a-w- c:\windows\system32\dllcache\qasf.dll
2009-10-13 19:24 . 2002-12-11 22:14 13312 -c–a-w- c:\windows\system32\dllcache\msdmo.dll
2009-10-13 19:24 . 2004-07-09 02:27 470528 -c–a-w- c:\windows\system32\dllcache\qdvd.dll
2009-10-13 19:24 . 2004-07-09 02:27 316928 -c–a-w- c:\windows\system32\dllcache\qdv.dll
2009-10-13 19:24 . 2002-12-11 22:14 257024 -c–a-w- c:\windows\system32\dllcache\qcap.dll
2009-10-13 19:24 . 2003-05-30 07:00 132608 -c–a-w- c:\windows\system32\dllcache\devenum.dll
2009-10-13 19:24 . 2004-07-09 02:27 1201152 -c–a-w- c:\windows\system32\dllcache\d3d8.dll
2009-10-13 19:24 . 2002-08-29 01:40 667648 -c–a-w- c:\windows\system32\dllcache\dinput8.dll
2009-10-13 19:24 . 2005-12-05 16:07 63696 ----a-w- c:\windows\system32\dxdllreg.exe
2009-10-13 19:23 . 2004-07-09 02:27 381952 -c–a-w- c:\windows\system32\dllcache\dsound.dll
2009-10-13 19:23 . 2003-03-24 07:00 68096 -c–a-w- c:\windows\system32\dllcache\dpnhupnp.dll
2009-10-13 19:23 . 2002-12-11 22:14 8192 -c–a-w- c:\windows\system32\dllcache\d3d8thk.dll
2009-10-13 19:23 . 2004-07-09 02:27 292864 -c–a-w- c:\windows\system32\dllcache\ddraw.dll
2009-10-13 19:23 . 2003-05-30 07:00 797184 -c–a-w- c:\windows\system32\dllcache\d3dim700.dll
2009-10-13 19:23 . 2002-12-11 22:14 24064 -c–a-w- c:\windows\system32\dllcache\ddrawex.dll
2009-10-13 19:23 . 2002-08-29 01:40 648704 -c–a-w- c:\windows\system32\dllcache\dinput.dll
2009-10-13 06:24 . 2009-09-23 08:41 26176 —ha-w- c:\windows\system32\hamachi.sys
2009-10-13 06:24 . 2009-10-13 06:24 -------- d-----w- c:\program files\LogMeIn Hamachi
2009-10-12 15:54 . 2009-10-12 15:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Codemasters
2009-10-12 15:54 . 2009-10-12 15:54 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2009-10-12 15:54 . 2009-10-12 15:54 -------- d-----w- c:\program files\OpenAL
2009-10-12 14:41 . 2009-10-12 14:41 -------- d-----w- c:\program files\SystemRequirementsLab
2009-10-12 14:41 . 2009-10-19 16:10 -------- d-----w- c:\documents and settings\Chido\Application Data\SystemRequirementsLab
2009-10-12 11:19 . 2009-10-12 11:19 -------- d-----w- c:\documents and settings\Chido\Local Settings\Application Data\Monte Cristo
2009-10-11 17:55 . 2009-10-11 17:55 -------- d-----w- c:\program files\Microsoft Games
2009-10-09 22:45 . 2009-10-09 22:45 -------- d–h--r- c:\documents and settings\Chido\Application Data\SecuROM
2009-10-06 21:58 . 2009-10-06 21:58 -------- d-----w- c:\documents and settings\Chido\Local Settings\Application Data\Activision
2009-10-06 21:40 . 2009-10-07 17:01 -------- d-----w- c:\documents and settings\Chido\Local Settings\Application Data\NFS Underground 2
2009-10-06 20:15 . 2009-10-19 16:11 -------- d-----w- c:\documents and settings\Chido\Application Data\skypePM
2009-10-06 20:15 . 2009-10-06 20:15 48 —ha-w- c:\windows\system32\ezsidmv.dat
2009-10-06 20:11 . 2009-10-19 17:08 -------- d-----w- c:\documents and settings\Chido\Application Data\Skype
2009-10-06 20:11 . 2009-10-06 20:11 -------- d-----w- c:\program files\Fichiers communs\Skype
2009-10-06 20:11 . 2009-10-14 18:58 -------- d-----r- c:\program files\Skype
2009-10-06 20:11 . 2009-10-06 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-10-05 20:02 . 2009-10-19 16:10 -------- d-----w- c:\documents and settings\Chido\Local Settings\Application Data\LogMeIn Hamachi
2009-10-05 20:01 . 2009-10-19 16:10 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\LogMeIn Hamachi
2009-10-03 12:26 . 2009-10-03 12:26 13824 ----a-w- c:\windows\system32\drivers\splitcam.sys
2009-10-03 12:26 . 2009-10-03 12:30 -------- d-----w- c:\program files\SplitCam
2009-10-03 11:50 . 2009-10-03 11:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Adobe Systems
2009-10-03 11:50 . 2009-10-03 11:51 -------- d-----w- c:\documents and settings\Chido\Local Settings\Application Data\Adobe
2009-10-03 11:47 . 2009-10-03 11:47 -------- d-----w- c:\program files\Fichiers communs\Adobe Systems Shared
2009-09-29 17:01 . 2009-09-29 17:14 -------- d-----w- c:\program files\DivX
2009-09-29 17:01 . 2009-09-29 17:01 -------- d-----w- c:\program files\Fichiers communs\DivX Shared
2009-09-24 17:36 . 2009-09-24 17:36 -------- d-----w- c:\program files\Pivot Stickfigure Animator
2009-09-21 20:03 . 2009-10-19 16:10 -------- d-----w- c:\documents and settings\Chido\Application Data\dvdcss
2009-09-21 15:10 . 2009-09-21 15:10 -------- d-----w- c:\program files\Fichiers communs\Vbox
2009-09-21 15:09 . 2009-10-03 11:48 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-09-21 10:53 . 2009-09-21 10:53 -------- d-----w- c:\program files\VirtualDub
2009-09-21 10:52 . 2009-09-21 10:52 -------- d-----w- c:\program files\KC Softwares
2009-09-21 09:18 . 2009-09-21 09:18 -------- d-----w- c:\program files\IVCsoft
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-19 17:05 . 2009-10-19 16:28 -------- d-----w- c:\documents and settings\Chido\Application Data\HouseCall 6.6
2009-10-19 16:14 . 2009-07-17 15:34 -------- d-----w- c:\documents and settings\Chido\Application Data\uTorrent
2009-10-19 16:11 . 2009-08-05 10:58 -------- d-----w- c:\program files\AGEIA Technologies
2009-10-19 16:10 . 2009-08-25 12:36 -------- d-----w- c:\documents and settings\Chido\Application Data\vlc
2009-10-19 16:10 . 2009-08-15 21:56 -------- d-----w- c:\documents and settings\Chido\Application Data\SumatraPDF
2009-10-19 16:10 . 2009-07-14 22:09 -------- d-----w- c:\documents and settings\Chido\Application Data\TMP
2009-10-19 16:10 . 2009-07-15 17:29 -------- d-----w- c:\documents and settings\Chido\Application Data\Media Player Classic
2009-10-19 16:10 . 2009-08-21 19:36 -------- d-----w- c:\documents and settings\Chido\Application Data\Blueberry
2009-10-19 16:10 . 2009-07-14 22:45 -------- d-----w- c:\documents and settings\Chido\Application Data\DAEMON Tools Lite
2009-10-19 16:10 . 2009-08-21 19:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Blueberry
2009-10-12 16:59 . 2009-07-14 22:16 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
2009-10-12 15:54 . 2003-03-28 03:24 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2009-10-12 15:51 . 2009-07-14 21:57 -------- d–h--w- c:\program files\InstallShield Installation Information
2009-09-24 17:07 . 2004-08-05 12:00 80748 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-24 17:07 . 2004-08-05 12:00 500872 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-23 05:18 . 2009-09-19 12:05 -------- d-----w- c:\documents and settings\Chido\Application Data\GHISLER
2009-09-19 11:36 . 2009-09-19 11:36 -------- d-----w- c:\program files\PC Inspector File Recovery
2009-09-19 11:33 . 2009-09-19 11:33 -------- d-----w- c:\program files\Smart Projects
2009-09-16 19:31 . 2009-09-16 19:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Games-Attack
2009-09-15 10:59 . 2009-07-14 23:36 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-09-15 10:56 . 2009-07-14 23:36 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-09-15 10:56 . 2009-07-14 23:36 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-09-15 10:55 . 2009-07-14 23:36 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-09-15 10:55 . 2009-07-14 23:36 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 10:54 . 2009-07-14 23:36 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-09-15 10:54 . 2009-07-14 23:36 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-09-15 10:53 . 2009-07-14 23:36 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-09-15 10:53 . 2009-07-14 23:36 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-09-13 18:34 . 2009-09-13 18:34 -------- d-----w- c:\documents and settings\Chido\Application Data\Ahead
2009-09-13 18:32 . 2009-09-13 18:32 -------- d-----w- c:\program files\Fichiers communs\Ahead
2009-09-13 18:32 . 2009-09-13 18:32 -------- d-----w- c:\program files\Nero
2009-09-13 18:32 . 2009-09-13 18:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-09-09 05:50 . 2009-09-19 12:05 545 ----a-w- c:\windows\UC.PIF
2009-09-09 05:50 . 2009-09-19 12:05 545 ----a-w- c:\windows\RAR.PIF
2009-09-09 05:50 . 2009-09-19 12:05 545 ----a-w- c:\windows\PKZIP.PIF
2009-09-09 05:50 . 2009-09-19 12:05 545 ----a-w- c:\windows\PKUNZIP.PIF
2009-09-09 05:50 . 2009-09-19 12:05 545 ----a-w- c:\windows\NOCLOSE.PIF
2009-09-09 05:50 . 2009-09-19 12:05 545 ----a-w- c:\windows\LHA.PIF
2009-09-09 05:50 . 2009-09-19 12:05 545 ----a-w- c:\windows\ARJ.PIF
2009-09-09 00:22 . 2009-07-14 21:59 -------- d-----w- c:\program files\Creative
2009-08-28 11:45 . 2009-08-28 11:45 -------- d-----w- c:\program files\Common Files
2009-08-26 17:22 . 2009-08-23 12:46 -------- d-----w- c:\program files\OGPlanet
2009-08-25 12:34 . 2009-08-25 12:34 -------- d-----w- c:\program files\VideoLAN
2009-08-25 11:13 . 2009-08-25 11:13 -------- d-----w- c:\program files\AviSynth 2.5
2009-08-25 11:13 . 2009-08-25 11:13 -------- d-----w- c:\program files\eRightSoft
2009-08-21 19:36 . 2009-08-21 19:36 4608 ----a-w- c:\windows\system32\bbchlp.dll
2009-08-21 19:36 . 2009-08-21 19:36 2944 ----a-w- c:\windows\system32\drivers\bbcap.sys
2009-08-21 19:36 . 2009-08-21 19:36 27776 ----a-w- c:\windows\system32\bbcap.dll
2009-08-05 10:58 . 2009-08-05 10:58 281504 ----a-w- c:\windows\system32\drivers\atksgt.sys
2009-08-05 10:58 . 2009-08-05 10:58 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2009-07-25 03:23 . 2009-07-29 20:36 411368 -c–a-w- c:\windows\system32\deploytk.dll
2009-07-24 15:12 . 2009-07-24 15:12 98304 ----a-w- c:\windows\system32CmdLineExt.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2006-05-03 09:06 . 2009-08-25 11:13 163328 --sh–r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-08-25 11:13 31232 --sh–r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-08-25 11:13 216064 --sh–r- c:\windows\system32\nbDX.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Note les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
“WiseStubReboot”=“MSIEXEC” [X]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“NvCplDaemon”=“c:\windows\system32\NvCpl.dll” [2009-06-10 13758464]
“avast!”=“c:\progra~1\ALWILS~1\Avast4\ashDisp.exe” [2009-09-15 81000]
“TkBellExe”=“c:\program files\Fichiers communs\Real\Update_OB\realsched.exe” [2009-08-11 198160]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
[HKLM~\startupfolder\C:^Documents and Settings^Chido^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=c:\documents and settings\Chido\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
“EnableFirewall”= 0 (0x0)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“%windir%\Network Diagnostic\xpnetdiag.exe”=
“d:\Program Files\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe”=
“d:\Program Files\CAPCOM\STREETFIGHTERIV\StreetFighterIV.exe”=
“c:\Program Files\Windows Live\Messenger\wlcsdk.exe”=
“c:\Program Files\uTorrent\uTorrent.exe”=
“d:\Program Files\Codemasters\Overlord II\Overlord2.exe”=
“c:\Program Files\eChanblard\emule.exe”=
“c:\Program Files\Messenger\msmsgs.exe”=
“d:\Program Files\Activision\Call of Duty - World at War\CoDWaW_LANFixed.exe”=
“d:\Program Files\Codemasters\GRID\GRID.exe”=
“d:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat”=
“c:\Program Files\FlashGet\flashget.exe”=
“c:\Program Files\Windows Live\Messenger\msnmsgr.exe”=
“c:\Program Files\Skype\Phone\Skype.exe”=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [15/07/2009 01:36 114768]
R1 bbcap;bbcap;c:\windows\system32\drivers\bbcap.sys [21/08/2009 21:36 2944]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [15/07/2009 01:36 20560]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S4 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [09/10/2009 08:53 1078664]
— Autres Services/Pilotes en mémoire —
NewlyCreated - TMCOMM
.
.
------- Examen supplémentaire -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Télécharger avec FlashGet - c:\program files\FlashGet\jc_link.htm
IE: Télécharger tout avec FlashGet - c:\program files\FlashGet\jc_all.htm
FF - ProfilePath - c:\documents and settings\Chido\Application Data\Mozilla\Firefox\Profiles\0sapudc2.default
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
AddRemove-Cities XL - c:\program files\Monte Cristo\Cities XL\uninst.exe
AddRemove-Prototype_is1 - c:\program files\Prototype\Uninstall\unins000.exe
AddRemove-{A8E2EF8F-73EF-4DD8-BB38-31FCCAF50103} - c:\documents and settings\Chido\Application Data\InstallShield Installation Information{A8E2EF8F-73EF-4DD8-BB38-31FCCAF50103}\setup.exe
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, www.gmer.net…
Rootkit scan 2009-10-19 19:07
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés …
Recherche d’éléments en démarrage automatique cachés …
Recherche de fichiers cachés …
Scan terminé avec succès
Fichiers cachés: 0
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\audstub]
“ImagePath”=hex(402):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,\
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\audstub]
“ImagePath”=hex(402):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,\
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
“ImagePath”=“c:\windows\system32\GameMon.des -service”
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-1229272821-162531612-839522115-1003\Software\SecuROM\License information*]
“datasecu”=hex:03,58,8e,2e,5c,03,5c,63,ba,09,40,e7,a2,2a,05,5b,19,ae,96,b0,ae,
cb,bd,12,c9,bb,9e,b2,5d,2c,ff,36,02,79,b4,ff,6b,b4,b3,25,65,22,c7,42,72,f7,
“rkeysecu”=hex:81,f8,2f,e6,1e,0a,7a,be,a7,7f,2d,ad,04,2b,1e,3e
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
“OODEFRAG11.00.00.01WORKSTATION”=“B302616639F3DB14B4E21B8B07240A9A6C5496E46103C392AC612A0649D4D8A3A4900E6ADCA028E50003F03BF63AF2D391F0196C6AA2C70C16E598A24AB102DD015B8B6A3A92CFADDA9A70C1D98F4C242F70867339B3312C8D353FB962B1044A949CC73EE99FEDB292DE125B1A881045B4297E3929476D44C2E289327EB0E66CEF4694138891C6CEB9BE309925FA5707532305FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407A6A0AC4980AC7933A6A0AC4980AC7933B2D977D95EEA4B55BE0CDE6DD4B80D6BEAC9C057CEF658DD64064CE6BB3A446F4CA2F17CECC6E5BBC55B2F21C102801DC6B628352BED0F9EC48D1AA579BA15FDAE2710BE02E2C43EAFD577FA085B7149CE3776F904D0582753F299F0B1F72FB77A19D3B96F678E8D8700C86EEE0FA2CC94C1E41337AB319CC13ED3CAF5DDEC2C2934B32C9B439A4328E5249251AA88E67752270FB34CCB0898F8C65EEA9B5DCB86B218770127F6D7421381219D81CDB92F67DDA27E4711D531356277C828C46C31D56021AE07E2AADC9ACC79D8294D4E4382A3A52F7319553B840D885EB99AC69EE25D54C41DD2FCCE11E39F99FA9B0E13AB8293F06BB23C39001DA48CCB8A7815A2565DFBE56FF5C68F99B80B96FD4A4F6C7B0D078D62A202C362864920748331E005B09DA3169FC2B636916CDC6BB4FE540356C27E5C833F6D1C0A1DBAEACC62EE966107DA56681AA5F31812F414E6FAF580D58FA50C41F0A201AEA4E2B59E6DA0AE2A2B54F524F28181DDE0C7D7DA71E64F9866AC901FE909B81C12255024E8CFE16A111D6B074DF5039BD584CDEF6442414DD984BB46504EE01AAA51EA7040D73AA2D207E42C77AF0E2C809D3EE9292819C90CDE144220A08A1547FB68F9349AB7781EA743131760AE0E8348A6EF6AB80F0538B3530427B43A1E56FC6097D87CC9B6B456199C25BCE2E3167FB88D241DCF9928BC6A5F8741E86A58F01F881565D74BED3230906E019FF48380DAB1297E7A49BC7A798DB88204526138236D25C13CC6B31C869893674AABAACDA5B09F8B23776BB059AA06B8ECD31CF59F4C188444E00538494288353F1700AD67410177522C3BE491B60E26788EC512FD0ED29FB172F26F5F0217ADCA6A8AAA207E1BF703924963E2164393EF48AF3A57008C8D3A7924EF60ACDB1A347DE41308E90FC927FAC43BBF926BCB8E6ABD5E7E54D04A0A18D22B1A7D47C9AE493EF785E35429A15972BE4ED6239F87006B32731E80553D95CE550C121F0E67EC5B2FB8B633DACAC52B8568F458E07F3BC4AC6FD94D35E6D8F6E76A6D7ABBFBAD9154718A49A2ED7BDAEA1DDECD690E71EA0C5E64C1728BF045201E7547AD80EE4DC5B5F188CE4BDB028EAFEF9A93C11A93”
.
Heure de fin: 2009-10-19 19:08
ComboFix-quarantined-files.txt 2009-10-19 17:08
Avant-CF: 121 486 233 600 octets libres
Après-CF: 121 506 328 576 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Professionnel” /noexecute=optin /fastdetect
Est-ce que restaurer mon pc a une date anterieur peu remettre mes prog ? je ne pense pas moi ^^
Au passage j’ai supprimé le fichier qui ma foutu la merde, tu veux que je le retelecharge sans le lancer ?
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\PC Inspector File Recovery\Filerecovery.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com…
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com…
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com…
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe” -osboot
O4 - HKLM…\RunOnce: [navilog1] C:\Program Files\Navilog1\Navreb.bat
O4 - HKCU…\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I “C:\Program Files\Fichiers communs\Wise Installation Wizard\WISB83FC356B7C0441F8A4DD71E088E7974_9_09_0428.MSI” TRANSFORMS=“C:\Program Files\Fichiers communs\Wise Installation Wizard\WISB83FC356B7C0441F8A4DD71E088E7974_9_09_0428.MST” WISE_SETUP_EXE_PATH=“c:\nvidia\displaydriver\186.18\international\PhysX_9.09.0428_SystemSoftware.exe”
O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)
O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)
O8 - Extra context menu item: E&xporter vers Microsoft Excel - C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE…
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
–
End of file - 5403 bytes
Fix Navipromo version 4.0.3 commencé le 19/10/2009 19:37:02,48
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 18.10.2009 à 10h00 par IL-MAFIOSO
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel® Core™2 Quad CPU Q6600 @ 2.40GHz )
BIOS : BIOS Date: 04/07/08 12:00:50 Ver: 08.00.12
USER : Chido ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1356 [VPS 091019-0] 4.8.1356 (Not Activated)
C:\ (Local Disk) - NTFS - Total:195 Go (Free:113 Go)
D:\ (Local Disk) - NTFS - Total:736 Go (Free:77 Go)
E:\ (Local Disk) - NTFS - Total:298 Go (Free:41 Go)
F:\ (CD or DVD)
G:\ (CD or DVD)
H:\ (CD or DVD)
Recherche executée en mode normal
Nettoyage exécuté au redémarrage de l’ordinateur
c:\docume~1\alluse~1\applic~1\Games-Attack supprimé !
C:\WINDOWS\prefetch\GAME.DAT-1FE645EB.pf supprimé !
Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Chido\locals~1\Temp effectué !
*** Sauvegarde du Registre vers dossier Safebackup ***
sauvegarde du Registre réalisée avec succès !
*** Nettoyage Registre ***
Nettoyage Registre Ok
*** Scan terminé 19/10/2009 19:51:40,78 ***
Oui on c’est croisé ^^ Je tente Recuva pour récupérer mes fichiers, mais je crois pas que sa ira !
SmitFraudFix v2.424
Rapport fait à 20:14:28,10, 19/10/2009
Executé à partir de C:\Documents and Settings\Chido\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Recuva\recuva.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Documents and Settings\Chido\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chido
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Chido\LOCALS~1\Temp
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chido\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Chido\Favoris
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
“Source”=“About:Home”
“SubscribedURL”=“About:Home”
“FriendlyName”=“Ma page d’accueil”
»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler’s .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
“Userinit”=“C:\WINDOWS\system32\userinit.exe,”
»»»»»»»»»»»»»»»»»»»»»»»» RK
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
“System”=""
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller - Miniport d’ordonnancement de paquets
DNS Server Search Order: 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip…{6D93AEED-E8FA-4342-8ED9-5717D273DAF0}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip…{6D93AEED-E8FA-4342-8ED9-5717D273DAF0}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip…{6D93AEED-E8FA-4342-8ED9-5717D273DAF0}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
Lol pourquoi te faut il tout ces rapports ? Sa peut t’indiquer quoi ? (je m’y connais pas en rapports)
Malwarebytes’ Anti-Malware 1.41
Version de la base de données: 2988
Windows 5.1.2600 Service Pack 3
19/10/2009 20:48:06
mbam-log-2009-10-19 (20-48-03).txt
Type de recherche: Examen rapide
Eléments examinés: 93142
Temps écoulé: 3 minute(s), 14 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Casino Tropez (Adware.Casino) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Casino Tropez (Adware.Casino) -> No action taken.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Oui je l’ai fais tkt ^^