[Résolu]Infection+gros ralentissement

Section d'analyse de rapports et de désinfection : malwares en tous genre et autres indésirables. Demandes de nettoyage uniquement. Prise en charge restreinte : équipe spécialisée.

Modérateur: Modérateurs

Règles du forum :arrow: Les désinfections sont prises en charge par un groupe spécifique, tout le monde ne peut pas intervenir pour désinfecter les machines (règles).
:arrow: Les procédures sont sur-mesure, ne faites pas la même chose chez vous (explications).
:arrow: Un topic par machine, chacun crée le sien. ;)

Re: Infection+gros ralentissement

Messagepar pitchalou » 13 Sep 2009 17:29

c'est bon pour le mrngse, mais pas pour le .exe meme message d'erreur
pitchalou
Libellulien
Libellulien
 
Messages: 63
Inscription: 12 Sep 2009 16:41

Re: Infection+gros ralentissement

Messagepar Falkra » 13 Sep 2009 17:34

Hum, pas normal ça.

Le logiciel qui suit n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.
Ne pas utiliser en dehors de ce cas de figure ou seul : dangereux.

Télécharge combofix.exe de sUBs et sauvegarde le sur ton bureau (et pas ailleurs).
  • Assure toi que tous les programmes sont fermés avant de commencer.
  • Désactive l'antivirus, sinon combofix va te mettre un message (sinon, dis ok au message).
  • Double-clique combofix.exe afin de l'exécuter.
  • Clique sur "Oui" au message de Limitation de Garantie qui s'affiche.
  • Si on te propose de redémarrer parc qu'un rootkit a été trouvé, fais-le.
  • On va te proposer de télécharger et installer la console de récupération, clique sur "Oui" au message, autorise le téléchargement dans ton firewall si demandé, puis accepte le message de contrat utilisateur final.
  • Le bureau disparaît, c'est normal, et il va revenir.
  • Ne ferme pas la fenêtre qui s'ouvre, tu te retrouverais avec un bureau vide.
  • Lorsque l'analyse sera terminée, un rapport apparaîtra.
  • Copie-colle ce rapport dans ta prochaine réponse.
    Le rapport se trouve dans : C:\Combofix.txt (si jamais).
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 25882
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1

Re: Infection+gros ralentissement

Messagepar pitchalou » 13 Sep 2009 18:09

me revoila :)


ComboFix 09-09-12.A0 - client 09/13/2009 18:48.2.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1023.593 [GMT 2:00]
Lancé depuis: c:\documents and settings\client\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\bdcore.dll
c:\windows\Downloaded Program Files\libfn.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MYWEBSEARCHSERVICE


((((((((((((((((((((((((((((( Fichiers créés du 2009-08-13 au 2009-09-13 ))))))))))))))))))))))))))))))))))))
.

2009-09-13 15:33 . 2009-09-13 15:46 -------- d-----w- C:\ToolBar SD
2009-09-13 15:16 . 2009-09-13 15:16 -------- d-----w- c:\program files\trend micro
2009-09-13 15:15 . 2009-09-13 15:16 -------- d-----w- C:\rsit
2009-09-13 10:03 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-13 10:03 . 2009-09-13 10:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-13 10:03 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-12 16:14 . 2009-09-12 16:14 68872 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-09-12 16:13 . 2009-09-12 16:13 -------- d-----w- C:\07aea9a43b14945c8230ffb0c0f4e4d5
2009-09-12 16:00 . 2009-09-12 16:00 -------- d-----w- c:\program files\Eidos
2009-09-09 06:35 . 2009-06-21 21:47 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-09-06 18:44 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-06 18:44 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-09-06 18:44 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-09-06 18:44 . 2009-09-06 18:44 -------- d-----w- c:\program files\Avira
2009-09-06 18:44 . 2009-09-06 18:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-09-06 18:23 . 2009-09-06 18:47 -------- d-----w- c:\program files\VS Revo Group
2009-09-06 08:04 . 2009-09-06 08:04 -------- d-----w- c:\windows\system32\wbem\Repository
2009-09-06 08:04 . 2009-09-06 08:04 -------- d-----w- c:\program files\Antivir
2009-09-06 07:55 . 2009-09-06 08:04 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-09-06 07:14 . 2009-09-06 08:04 -------- d-----w- c:\windows\system32\sytes
2009-09-05 07:10 . 2009-09-06 08:04 -------- d-----w- c:\program files\MappySynchro
2009-09-03 18:07 . 2009-09-03 18:07 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-09-03 15:21 . 2009-09-07 15:05 -------- d-----w- c:\documents and settings\client\Application Data\IDM
2009-09-03 15:21 . 2009-09-07 14:34 -------- d-----w- c:\documents and settings\client\Application Data\DMCache
2009-09-03 15:21 . 2009-09-07 16:01 -------- d-----w- c:\program files\Internet Download Manager
2009-09-03 11:26 . 2009-09-03 11:26 -------- d-----w- c:\windows\Watson
2009-09-02 15:20 . 2009-09-02 15:20 -------- d-----w- c:\documents and settings\client\Application Data\VitySoft
2009-09-02 15:18 . 2009-09-02 15:18 39936 ----a-w- c:\windows\system32\mrngse.exe
2009-09-01 18:32 . 2009-09-12 11:21 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-09-01 18:32 . 2009-09-01 18:32 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-09-01 18:31 . 2009-09-01 18:31 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-01 18:23 . 2009-09-01 18:23 -------- d-----w- c:\program files\K!
2009-08-30 10:45 . 2009-08-30 10:45 -------- d-----w- c:\program files\directx
2009-08-30 10:31 . 2009-09-12 12:36 -------- d-----w- c:\program files\Hooligans
2009-08-29 17:58 . 2009-08-29 17:59 -------- d-----w- c:\documents and settings\client\Application Data\DeepBurner
2009-08-29 17:57 . 2009-08-29 17:57 -------- d-----w- c:\program files\Astonsoft
2009-08-25 15:33 . 2009-08-25 15:33 -------- d-----w- c:\documents and settings\client\Application Data\Canneverbe_Limited
2009-08-25 15:33 . 2009-08-25 15:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Canneverbe Limited
2009-08-23 08:42 . 2009-09-12 11:54 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-23 08:42 . 2009-09-12 11:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-22 16:49 . 2009-09-12 15:29 -------- d-----w- c:\documents and settings\client\Application Data\vlc
2009-08-22 16:45 . 2009-09-12 11:43 -------- d-----w- c:\program files\VLC
2009-08-22 11:47 . 2009-08-22 12:23 -------- d-----w- C:\Download
2009-08-22 11:47 . 2009-08-22 11:47 -------- d-----w- c:\documents and settings\client\Local Settings\Application Data\Kamuse
2009-08-21 20:13 . 2009-09-12 16:13 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-21 20:13 . 2009-08-21 20:13 -------- d-----w- c:\program files\MSBuild
2009-08-21 20:13 . 2009-08-21 20:13 -------- d-----w- c:\program files\Reference Assemblies
2009-08-21 20:13 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-21 20:13 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-21 20:13 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-21 20:13 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-21 20:13 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-21 20:13 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-21 20:13 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-21 20:13 . 2009-08-21 20:13 -------- d-----w- C:\824179fe599733104d09e3
2009-08-17 22:11 . 2009-08-18 09:21 -------- d-----w- c:\documents and settings\client\Application Data\Ubisoft
2009-08-17 22:08 . 2009-08-18 09:21 -------- d-----w- c:\documents and settings\client\Application Data\MysteryStudio
2009-08-17 16:53 . 2009-08-17 16:53 -------- d-----w- c:\documents and settings\client\Local Settings\Application Data\Glowria
2009-08-17 16:53 . 2009-08-17 16:55 -------- d-----w- c:\program files\Fnac
2009-08-15 16:39 . 2008-09-03 12:35 53248 ----a-w- c:\windows\iPInst5x.dll
2009-08-15 16:39 . 2009-08-15 16:39 -------- d-----w- c:\program files\iPassion
2009-08-15 16:39 . 2008-09-06 05:29 98304 ----a-w- c:\windows\iPScan5x.exe
2009-08-15 16:37 . 2009-08-15 16:37 -------- d-----w- c:\program files\DIFX

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-13 15:44 . 2009-02-28 21:27 -------- d-----w- c:\program files\Azureus
2009-09-12 17:01 . 2009-02-27 17:58 15328 ----a-w- c:\documents and settings\client\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-12 16:13 . 2002-08-30 12:00 85104 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-12 16:13 . 2002-08-30 12:00 510250 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-12 16:00 . 2009-02-28 13:38 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-12 15:48 . 2009-04-24 10:00 -------- d-----w- c:\program files\eMule
2009-09-12 14:58 . 2009-03-06 20:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Sports Interactive
2009-09-12 13:01 . 2009-02-28 21:17 -------- d-----w- c:\documents and settings\client\Application Data\Azureus
2009-09-12 06:17 . 2009-04-25 15:19 -------- d-----w- c:\documents and settings\client\Application Data\dvdcss
2009-09-11 18:49 . 2009-02-28 17:24 -------- d-----w- c:\documents and settings\client\Application Data\Xfire
2009-09-11 18:35 . 2009-02-28 18:57 139904 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-09-11 18:35 . 2009-02-28 18:57 189744 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-09-10 16:38 . 2009-02-28 17:24 -------- d-----w- c:\program files\Xfire
2009-09-10 07:10 . 2009-06-26 11:47 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-06 18:40 . 2009-03-18 14:31 -------- d-----w- c:\program files\Google
2009-09-03 14:35 . 2009-05-27 21:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-09-03 11:26 . 2009-06-05 10:10 -------- d-----w- c:\program files\Microsoft Games
2009-09-03 03:28 . 2009-02-28 17:32 -------- d-----w- c:\program files\Mumble
2009-09-03 03:28 . 2009-04-09 14:19 -------- d-----w- c:\program files\Pando Networks
2009-09-03 03:27 . 2009-06-10 06:58 -------- d-----w- c:\program files\PeerTV
2009-08-22 15:34 . 2009-02-27 17:57 -------- d-----w- c:\program files\Yahoo!
2009-08-12 17:52 . 2009-03-14 11:17 -------- d-----w- c:\documents and settings\client\Application Data\mIRC
2009-08-12 15:37 . 2009-05-08 08:54 -------- d-----w- c:\program files\JoWooD
2009-08-07 17:38 . 2009-08-07 17:38 -------- d-----w- c:\program files\SFR
2009-08-07 17:26 . 2009-02-28 13:43 -------- d-----w- c:\program files\ma-config.com
2009-08-07 17:26 . 2009-02-28 13:43 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2009-08-07 17:25 . 2009-06-23 17:44 -------- d-----w- c:\program files\Versailles
2009-08-05 09:00 . 2004-08-19 14:09 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-28 14:33 . 2009-05-21 18:14 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-17 19:03 . 2004-08-19 14:09 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-19 14:09 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2004-08-19 14:09 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-30 18:17 . 2009-02-28 18:57 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-25 08:26 . 2004-08-19 14:09 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2004-08-19 14:09 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2004-08-19 14:09 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2004-08-19 14:09 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2004-08-19 14:09 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2004-08-19 14:09 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2004-08-03 20:59 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:40 . 2004-08-19 14:09 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2002-08-30 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2009-04-21 955712]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-03 61440]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-03-30 262144]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-19 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"iPScan5x"="c:\windows\iPScan5x.EXE" [2008-09-06 98304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"mrngse.exe"="c:\windows\system32\mrngse.exe" [2009-09-02 39936]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2007-04-16 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\client\Menu D‚marrer\Programmes\D‚marrage\
Notification de cadeaux MSN.lnk - c:\documents and settings\client\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2009-6-26 135680]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2009-2-28 565248]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\NGM\\NGM.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonEU\\NGM\\NGM.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Zattoo\\zattood.exe"=
"c:\\WINDOWS\\system32\\[Emoticons-plus.com] Winkaa 2.0.exe"=
"c:\\Documents and Settings\\client\\Local Settings\\Application Data\\Kamuse\\KCSTrayDownloader\\KCSTrayDownloaderEngine.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2/28/2009 15:38 77312]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [9/6/2009 20:44 108289]
S3 cmudau32;C-Media USB UDA Sound Interface;c:\windows\system32\drivers\cmudaxu.sys [3/10/2009 13:11 1419840]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [3/25/2009 16:31 33176]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys --> c:\windows\system32\DRIVERS\ManyCam.sys [?]
S3 vtany;vtany;\??\c:\windows\vtany.sys --> c:\windows\vtany.sys [?]
S3 xhunter1;xhunter1;\??\c:\windows\xhunter1.sys --> c:\windows\xhunter1.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F174FD31-8366-30BE-2641-D7CE7A606959}]
c:\windows\system32\mrngse.exe
.
Contenu du dossier 'Tâches planifiées'

2009-08-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-09-13 c:\windows\Tasks\User_Feed_Synchronization-{CED843E9-CA7E-46E6-991A-BB6E33ED41A4}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr
mWindow Title =
uSearchURL,(Default) = hxxp://fr.gdark.com
Trusted Zone: chat-land.org
Trusted Zone: fnac.com\vod
Trusted Zone: forumactif.fr\mouvement-ultra
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab
FF - ProfilePath - c:\documents and settings\client\Application Data\Mozilla\Firefox\Profiles\ymelc5xh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/result ... EF&v=18&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.tattoodle.com?tid={9D7582DB-7B63-FD5E-F868-EB8E8924043E}
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/result ... &v=18&tid={9D7582DB-7B63-FD5E-F868-EB8E8924043E}&q=
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-CmUsbSound - cmcnfgu.cpl



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-13 19:02
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
mrngse.exe = c:\windows\system32\mrngse.exe????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="884B472A3CDC2707AB21BCB75B869A4D0DA40FCE0AB84E162A6B38CADD5CAF2C734FB9833E64546FD8B4405BC2C4A6D3EEA5DB1CA1AF279CA137C7A1A3A536F572C6BDD8B256F859517C5C0D74D2C03FFBA7237DF18C90A5EEE771D3D424A5E4EA2323D9B00F19D384CCB4865E028FBBCA86765C65B6F29AF37B591874F6C5BEA526C12673027F24C450ECF6143CFC2A55EDEC1585ABF89B74C42696A6CDA380D06A6F55563539414782B001CC7AB6A07D6020F5047B917A196B046B34EE0ED77ED809725DC216D9A7B32D3D62CCAEE905B4B144B3C9EF3D6DE922FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808BA7FD869164D67945D575E7D6A3B9808CCFC02821CD73B7A335148ABACE3A89ACA19FDCBEAC9B1F7C56A4B949D0EC16D44E4CDBB9B507CFE6EDF8E7252456067E3A15C7618AF472A73A9633252792A3BAB0D266A6856B735B75FB5F908F0422086AEC823BDB2F3494E0C186FD116D9A7D3A7921984043AD20A7B590F0ECABE8B7B05137FF5226E4E8B0F8E78B2B86EFB7D0C2D1625D82715D505A9BFD61D2074800E23F811AE4133D554823EC31CD907E1B5A772B3397237FD6FEADF08917EABC5576F4693EC4FFB4BA1C07683DE5E97A942C284CE6BE6FDDCD276867BBA4985701008DD32D6CAAB7E61AC1AA603188575F5D6E7469C2230BCEB388EC08BC3561A8F0C7BDB49BA4AF3A13BE5166FF0AA58B5CF7920D91698DD9830969ADD847D4FCB30212D867BE6A694785C6FED2B63D70F2CDC17180884F45DF104FDECF4D81164C012FBB33D8E830F81C081AC5B12F02E7FF417AE13C6A9E326FA98D8D5CCD41819564EDA04D9EE0B889DD2406A1D1268EFEF42D723B698F50A6945A7394083CDA939DF6726DD3CA7D440981C146C1DB33A39EEB4FAAFCF056D7B1940061F790D794D212C513A372540B8C21CEA6E6A2AAD03A5C7AF8E55A334A759EFF6D88883A0E4B45F048D9D6B395DF07FD115440CAC452478ACB7200B56A281661BE175014C18F11812FC210340C5F56682566A3B2E395B122E909D16E1683FB8D3B0F87BBFC36556A3B1671AEDD05CD909AA0F3FBF5C72444784AC44F4B875DE5942408BCD074E7AB3D88A016B1EE0C1C711D942FDF141225C81A03BC4153A353616ECEDE0471F4814211AB0F714716EF10AE4141D7FD62427FAC3421A47D8FBC82E130376AC016B664196C1E4DB3512929BC0A6654FF2A3B667CF444FD6CF59C4943CD020A24E70A370F6711861834283D06F9131EF8C61EC41F552D69650D22FD2E50102D996C817EBA4228D576979F5356790EE32CD02FD87D91F35974356E37980DD55C59DC9E075FCD9D1312796F0DA9580242E910A74BB148401314135121CF15A681FDB"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1384)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\oodag.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
.
**************************************************************************
.
Heure de fin: 2009-09-13 19:07 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-09-13 17:07

Avant-CF: 151,524,548,608 octets libres
Après-CF: 151,543,640,064 octets libres

265 --- E O F --- 2009-09-10 03:23
pitchalou
Libellulien
Libellulien
 
Messages: 63
Inscription: 12 Sep 2009 16:41

Re: Infection+gros ralentissement

Messagepar Falkra » 13 Sep 2009 21:28

Je pense qu'on a mis le doigt sur une bestiole récente.

Ce qui suit n'est que pour cette machine, et cette machine seulement.
Ne surtout pas utiliser sur une autre machine : dangereux.


Combofix va zipper des fichiers infectieux, s'il propose de les envoyer automatiquement, dis-lui oui, autorise tout.

  • Télécharge le fichier CFscript.txt depuis ce site :
    http://senduit.com/2dfbe6
  • Place-le sur le bureau, près de l'icône de combofix.
  • Fais un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe comme sur cet exemple
Image
  • Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
  • Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
  • Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 25882
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1

Re: Infection+gros ralentissement

Messagepar pitchalou » 14 Sep 2009 11:53

Bonjour voila qui est fait :) :

ComboFix 09-09-13.05 - client 09/14/2009 12:17.3.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1023.610 [GMT 2:00]
Lancé depuis: c:\documents and settings\client\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\client\Bureau\CFscript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

file zipped: c:\windows\system32\mrngse
file zipped: c:\windows\system32\mrngse.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\mrngse
c:\windows\system32\mrngse.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_VTANY
-------\Legacy_XHUNTER1
-------\Service_vtany
-------\Service_xhunter1


((((((((((((((((((((((((((((( Fichiers créés du 2009-08-14 au 2009-09-14 ))))))))))))))))))))))))))))))))))))
.

2009-09-13 15:33 . 2009-09-13 15:46 -------- d-----w- C:\ToolBar SD
2009-09-13 15:16 . 2009-09-13 15:16 -------- d-----w- c:\program files\trend micro
2009-09-13 15:15 . 2009-09-13 15:16 -------- d-----w- C:\rsit
2009-09-13 10:03 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-13 10:03 . 2009-09-13 10:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-13 10:03 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-12 16:14 . 2009-09-12 16:14 68872 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-09-12 16:13 . 2009-09-12 16:13 -------- d-----w- C:\07aea9a43b14945c8230ffb0c0f4e4d5
2009-09-12 16:00 . 2009-09-12 16:00 -------- d-----w- c:\program files\Eidos
2009-09-09 06:35 . 2009-06-21 21:47 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-09-06 18:44 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-06 18:44 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-09-06 18:44 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-09-06 18:44 . 2009-09-06 18:44 -------- d-----w- c:\program files\Avira
2009-09-06 18:44 . 2009-09-06 18:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-09-06 18:23 . 2009-09-06 18:47 -------- d-----w- c:\program files\VS Revo Group
2009-09-06 08:04 . 2009-09-06 08:04 -------- d-----w- c:\windows\system32\wbem\Repository
2009-09-06 08:04 . 2009-09-06 08:04 -------- d-----w- c:\program files\Antivir
2009-09-06 07:55 . 2009-09-06 08:04 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-09-06 07:14 . 2009-09-06 08:04 -------- d-----w- c:\windows\system32\sytes
2009-09-05 07:10 . 2009-09-06 08:04 -------- d-----w- c:\program files\MappySynchro
2009-09-03 18:07 . 2009-09-03 18:07 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-09-03 15:21 . 2009-09-07 15:05 -------- d-----w- c:\documents and settings\client\Application Data\IDM
2009-09-03 15:21 . 2009-09-07 14:34 -------- d-----w- c:\documents and settings\client\Application Data\DMCache
2009-09-03 15:21 . 2009-09-07 16:01 -------- d-----w- c:\program files\Internet Download Manager
2009-09-03 11:26 . 2009-09-03 11:26 -------- d-----w- c:\windows\Watson
2009-09-02 15:20 . 2009-09-02 15:20 -------- d-----w- c:\documents and settings\client\Application Data\VitySoft
2009-09-01 18:32 . 2009-09-12 11:21 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-09-01 18:32 . 2009-09-01 18:32 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-09-01 18:31 . 2009-09-01 18:31 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-01 18:23 . 2009-09-01 18:23 -------- d-----w- c:\program files\K!
2009-08-30 10:45 . 2009-08-30 10:45 -------- d-----w- c:\program files\directx
2009-08-30 10:31 . 2009-09-12 12:36 -------- d-----w- c:\program files\Hooligans
2009-08-29 17:58 . 2009-08-29 17:59 -------- d-----w- c:\documents and settings\client\Application Data\DeepBurner
2009-08-29 17:57 . 2009-08-29 17:57 -------- d-----w- c:\program files\Astonsoft
2009-08-25 15:33 . 2009-08-25 15:33 -------- d-----w- c:\documents and settings\client\Application Data\Canneverbe_Limited
2009-08-25 15:33 . 2009-08-25 15:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Canneverbe Limited
2009-08-23 08:42 . 2009-09-12 11:54 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-23 08:42 . 2009-09-12 11:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-22 16:49 . 2009-09-13 20:26 -------- d-----w- c:\documents and settings\client\Application Data\vlc
2009-08-22 16:45 . 2009-09-12 11:43 -------- d-----w- c:\program files\VLC
2009-08-22 11:47 . 2009-08-22 12:23 -------- d-----w- C:\Download
2009-08-22 11:47 . 2009-08-22 11:47 -------- d-----w- c:\documents and settings\client\Local Settings\Application Data\Kamuse
2009-08-21 20:13 . 2009-09-12 16:13 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-21 20:13 . 2009-08-21 20:13 -------- d-----w- c:\program files\MSBuild
2009-08-21 20:13 . 2009-08-21 20:13 -------- d-----w- c:\program files\Reference Assemblies
2009-08-21 20:13 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-21 20:13 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-21 20:13 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-21 20:13 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-21 20:13 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-21 20:13 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-21 20:13 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-21 20:13 . 2009-08-21 20:13 -------- d-----w- C:\824179fe599733104d09e3
2009-08-17 22:11 . 2009-08-18 09:21 -------- d-----w- c:\documents and settings\client\Application Data\Ubisoft
2009-08-17 22:08 . 2009-08-18 09:21 -------- d-----w- c:\documents and settings\client\Application Data\MysteryStudio
2009-08-17 16:53 . 2009-08-17 16:53 -------- d-----w- c:\documents and settings\client\Local Settings\Application Data\Glowria
2009-08-17 16:53 . 2009-08-17 16:55 -------- d-----w- c:\program files\Fnac
2009-08-15 16:39 . 2008-09-03 12:35 53248 ----a-w- c:\windows\iPInst5x.dll
2009-08-15 16:39 . 2009-08-15 16:39 -------- d-----w- c:\program files\iPassion
2009-08-15 16:39 . 2008-09-06 05:29 98304 ----a-w- c:\windows\iPScan5x.exe
2009-08-15 16:37 . 2009-08-15 16:37 -------- d-----w- c:\program files\DIFX

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-13 18:10 . 2009-02-28 17:24 -------- d-----w- c:\documents and settings\client\Application Data\Xfire
2009-09-13 18:07 . 2009-02-28 18:57 139904 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-09-13 18:07 . 2009-02-28 18:57 189744 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-09-13 15:44 . 2009-02-28 21:27 -------- d-----w- c:\program files\Azureus
2009-09-12 17:01 . 2009-02-27 17:58 15328 ----a-w- c:\documents and settings\client\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-12 16:13 . 2002-08-30 12:00 85104 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-12 16:13 . 2002-08-30 12:00 510250 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-12 16:00 . 2009-02-28 13:38 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-12 15:48 . 2009-04-24 10:00 -------- d-----w- c:\program files\eMule
2009-09-12 14:58 . 2009-03-06 20:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Sports Interactive
2009-09-12 13:01 . 2009-02-28 21:17 -------- d-----w- c:\documents and settings\client\Application Data\Azureus
2009-09-12 06:17 . 2009-04-25 15:19 -------- d-----w- c:\documents and settings\client\Application Data\dvdcss
2009-09-10 16:38 . 2009-02-28 17:24 -------- d-----w- c:\program files\Xfire
2009-09-10 07:10 . 2009-06-26 11:47 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-06 18:40 . 2009-03-18 14:31 -------- d-----w- c:\program files\Google
2009-09-03 14:35 . 2009-05-27 21:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-09-03 11:26 . 2009-06-05 10:10 -------- d-----w- c:\program files\Microsoft Games
2009-09-03 03:28 . 2009-02-28 17:32 -------- d-----w- c:\program files\Mumble
2009-09-03 03:28 . 2009-04-09 14:19 -------- d-----w- c:\program files\Pando Networks
2009-09-03 03:27 . 2009-06-10 06:58 -------- d-----w- c:\program files\PeerTV
2009-08-22 15:34 . 2009-02-27 17:57 -------- d-----w- c:\program files\Yahoo!
2009-08-12 17:52 . 2009-03-14 11:17 -------- d-----w- c:\documents and settings\client\Application Data\mIRC
2009-08-12 15:37 . 2009-05-08 08:54 -------- d-----w- c:\program files\JoWooD
2009-08-07 17:38 . 2009-08-07 17:38 -------- d-----w- c:\program files\SFR
2009-08-07 17:26 . 2009-02-28 13:43 -------- d-----w- c:\program files\ma-config.com
2009-08-07 17:26 . 2009-02-28 13:43 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2009-08-07 17:25 . 2009-06-23 17:44 -------- d-----w- c:\program files\Versailles
2009-08-05 09:00 . 2004-08-19 14:09 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-28 14:33 . 2009-05-21 18:14 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-17 19:03 . 2004-08-19 14:09 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-19 14:09 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2004-08-19 14:09 915456 ------w- c:\windows\system32\wininet.dll
2009-06-30 18:17 . 2009-02-28 18:57 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-25 08:26 . 2004-08-19 14:09 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2004-08-19 14:09 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2004-08-19 14:09 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2004-08-19 14:09 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2004-08-19 14:09 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2004-08-19 14:09 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2004-08-03 20:59 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:40 . 2004-08-19 14:09 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2002-08-30 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\07aea9a43b14945c8230ffb0c0f4e4d5 ----

2009-09-12 16:13 . 2008-06-19 05:33 2204 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\msxpsdrv.inf
2009-09-12 16:13 . 2008-06-19 09:03 73 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\msxpsinc.gpd
2009-09-12 16:13 . 2008-06-19 05:33 72 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\msxpsinc.ppd
2009-09-12 16:13 . 2008-06-19 05:33 72 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\msxpsinc.ppd
2009-09-12 16:13 . 2008-06-19 05:33 2204 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\msxpsdrv.inf
2009-09-12 16:13 . 2008-07-06 12:06 10929 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\msxpsdrv.cat
2009-09-12 16:13 . 2008-07-06 12:06 10929 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\msxpsdrv.cat
2009-09-12 16:13 . 2008-07-06 12:06 147456 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\filterpipelineprintproc.dll
2009-09-12 16:13 . 2008-07-06 12:06 89088 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\filterpipelineprintproc.dll
2009-09-12 16:13 . 2008-07-06 12:06 765440 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\mxdwdrv.dll
2009-09-12 16:13 . 2008-07-06 12:06 1676288 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\xpssvcs.dll
2009-09-12 16:13 . 2008-07-06 12:06 748032 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\mxdwdrv.dll
2008-07-06 15:36 . 2008-07-06 15:36 2936832 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\xpssvcs.dll
2008-06-19 09:03 . 2008-06-19 09:03 73 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\msxpsinc.gpd

---- Directory of C:\824179fe599733104d09e3 ----

2009-08-21 20:13 . 2008-06-19 05:33 2204 ------w- c:\824179fe599733104d09e3\amd64\msxpsdrv.inf
2009-08-21 20:13 . 2008-06-19 05:33 72 ------w- c:\824179fe599733104d09e3\amd64\msxpsinc.ppd
2009-08-21 20:13 . 2008-06-19 05:33 2204 ------w- c:\824179fe599733104d09e3\i386\msxpsdrv.inf
2009-08-21 20:13 . 2008-06-19 09:03 73 ------w- c:\824179fe599733104d09e3\i386\msxpsinc.gpd
2009-08-21 20:13 . 2008-06-19 05:33 72 ------w- c:\824179fe599733104d09e3\i386\msxpsinc.ppd
2009-08-21 20:13 . 2008-07-06 12:06 10929 ------w- c:\824179fe599733104d09e3\amd64\msxpsdrv.cat
2009-08-21 20:13 . 2008-07-06 12:06 10929 ------w- c:\824179fe599733104d09e3\i386\msxpsdrv.cat
2009-08-21 20:13 . 2008-07-06 12:06 147456 ------w- c:\824179fe599733104d09e3\amd64\filterpipelineprintproc.dll
2009-08-21 20:13 . 2008-07-06 12:06 89088 ------w- c:\824179fe599733104d09e3\i386\filterpipelineprintproc.dll
2009-08-21 20:13 . 2008-07-06 12:06 765440 ------w- c:\824179fe599733104d09e3\i386\mxdwdrv.dll
2009-08-21 20:13 . 2008-07-06 12:06 1676288 ------w- c:\824179fe599733104d09e3\i386\xpssvcs.dll
2009-08-21 20:13 . 2008-07-06 12:06 748032 ------w- c:\824179fe599733104d09e3\amd64\mxdwdrv.dll
2008-07-06 15:36 . 2008-07-06 15:36 2936832 ------w- c:\824179fe599733104d09e3\amd64\xpssvcs.dll
2008-06-19 09:03 . 2008-06-19 09:03 73 ------w- c:\824179fe599733104d09e3\amd64\msxpsinc.gpd


((((((((((((((((((((((((((((( SnapShot@2009-09-13_17.03.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-14 10:24 . 2009-09-14 10:25 16384 c:\windows\temp\Perflib_Perfdata_760.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2009-04-21 955712]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-03 61440]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-03-30 262144]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-19 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"iPScan5x"="c:\windows\iPScan5x.EXE" [2008-09-06 98304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2007-04-16 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\client\Menu D‚marrer\Programmes\D‚marrage\
Notification de cadeaux MSN.lnk - c:\documents and settings\client\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2009-6-26 135680]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2009-2-28 565248]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\NGM\\NGM.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonEU\\NGM\\NGM.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Zattoo\\zattood.exe"=
"c:\\WINDOWS\\system32\\[Emoticons-plus.com] Winkaa 2.0.exe"=
"c:\\Documents and Settings\\client\\Local Settings\\Application Data\\Kamuse\\KCSTrayDownloader\\KCSTrayDownloaderEngine.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2/28/2009 15:38 77312]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [9/6/2009 20:44 108289]
S3 cmudau32;C-Media USB UDA Sound Interface;c:\windows\system32\drivers\cmudaxu.sys [3/10/2009 13:11 1419840]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [3/25/2009 16:31 33176]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys --> c:\windows\system32\DRIVERS\ManyCam.sys [?]
.
Contenu du dossier 'Tâches planifiées'

2009-08-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-09-14 c:\windows\Tasks\User_Feed_Synchronization-{CED843E9-CA7E-46E6-991A-BB6E33ED41A4}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr
mWindow Title =
uSearchURL,(Default) = hxxp://fr.gdark.com
Trusted Zone: chat-land.org
Trusted Zone: fnac.com\vod
Trusted Zone: forumactif.fr\mouvement-ultra
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab
FF - ProfilePath - c:\documents and settings\client\Application Data\Mozilla\Firefox\Profiles\ymelc5xh.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-14 12:46
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="884B472A3CDC2707AB21BCB75B869A4D0DA40FCE0AB84E162A6B38CADD5CAF2C734FB9833E64546FD8B4405BC2C4A6D3EEA5DB1CA1AF279CA137C7A1A3A536F572C6BDD8B256F859517C5C0D74D2C03FFBA7237DF18C90A5EEE771D3D424A5E4EA2323D9B00F19D384CCB4865E028FBBCA86765C65B6F29AF37B591874F6C5BEA526C12673027F24C450ECF6143CFC2A55EDEC1585ABF89B74C42696A6CDA380D06A6F55563539414782B001CC7AB6A07D6020F5047B917A196B046B34EE0ED77ED809725DC216D9A7B32D3D62CCAEE905B4B144B3C9EF3D6DE922FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808BA7FD869164D67945D575E7D6A3B9808CCFC02821CD73B7A335148ABACE3A89ACA19FDCBEAC9B1F7C56A4B949D0EC16D44E4CDBB9B507CFE6EDF8E7252456067E3A15C7618AF472A73A9633252792A3BAB0D266A6856B735B75FB5F908F0422086AEC823BDB2F3494E0C186FD116D9A7D3A7921984043AD20A7B590F0ECABE8B7B05137FF5226E4E8B0F8E78B2B86EFB7D0C2D1625D82715D505A9BFD61D2074800E23F811AE4133D554823EC31CD907E1B5A772B3397237FD6FEADF08917EABC5576F4693EC4FFB4BA1C07683DE5E97A942C284CE6BE6FDDCD276867BBA4985701008DD32D6CAAB7E61AC1AA603188575F5D6E7469C2230BCEB388EC08BC3561A8F0C7BDB49BA4AF3A13BE5166FF0AA58B5CF7920D91698DD9830969ADD847D4FCB30212D867BE6A694785C6FED2B63D70F2CDC17180884F45DF104FDECF4D81164C012FBB33D8E830F81C081AC5B12F02E7FF417AE13C6A9E326FA98D8D5CCD41819564EDA04D9EE0B889DD2406A1D1268EFEF42D723B698F50A6945A7394083CDA939DF6726DD3CA7D440981C146C1DB33A39EEB4FAAFCF056D7B1940061F790D794D212C513A372540B8C21CEA6E6A2AAD03A5C7AF8E55A334A759EFF6D88883A0E4B45F048D9D6B395DF07FD115440CAC452478ACB7200B56A281661BE175014C18F11812FC210340C5F56682566A3B2E395B122E909D16E1683FB8D3B0F87BBFC36556A3B1671AEDD05CD909AA0F3FBF5C72444784AC44F4B875DE5942408BCD074E7AB3D88A016B1EE0C1C711D942FDF141225C81A03BC4153A353616ECEDE0471F4814211AB0F714716EF10AE4141D7FD62427FAC3421A47D8FBC82E130376AC016B664196C1E4DB3512929BC0A6654FF2A3B667CF444FD6CF59C4943CD020A24E70A370F6711861834283D06F9131EF8C61EC41F552D69650D22FD2E50102D996C817EBA4228D576979F5356790EE32CD02FD87D91F35974356E37980DD55C59DC9E075FCD9D1312796F0DA9580242E910A74BB148401314135121CF15A681FDB"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3476)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\oodag.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\system32\HPZipm12.exe
.
**************************************************************************
.
Heure de fin: 2009-09-14 12:52 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-09-14 10:52
ComboFix2.txt 2009-09-13 17:07

Avant-CF: 151,884,226,560 octets libres
Après-CF: 151,855,726,592 octets libres

292 --- E O F --- 2009-09-10 03:23
pitchalou
Libellulien
Libellulien
 
Messages: 63
Inscription: 12 Sep 2009 16:41

Re: Infection+gros ralentissement

Messagepar Falkra » 14 Sep 2009 17:25

Ok, là c'est beaucoup mieux. :supers:

La machine tourne mieux ?
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 25882
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1

Re: Infection+gros ralentissement

Messagepar pitchalou » 14 Sep 2009 17:27

Ia du mieux merci mais toujours ce probleme de bouton arret :-D
pitchalou
Libellulien
Libellulien
 
Messages: 63
Inscription: 12 Sep 2009 16:41

Re: Infection+gros ralentissement

Messagepar Falkra » 14 Sep 2009 17:31

J'ai isolé deux fichiers infectieux mal détectés, que j'ai fait zipper, ils sont dans c:\quarantine, est-ce que tu vois les zip ?
Ce serait pour les récupérer et les envoyer aux éditeurs, ces fichiers ne contiennent pas de données personnelles, bien sûr.
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 25882
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1

Re: Infection+gros ralentissement

Messagepar pitchalou » 14 Sep 2009 17:34

non désolé :(
pitchalou
Libellulien
Libellulien
 
Messages: 63
Inscription: 12 Sep 2009 16:41

Re: Infection+gros ralentissement

Messagepar Falkra » 14 Sep 2009 17:39

Et dans un sous dossier de c:\quarantine peut-être, jette un oeil on ne sait jamais. ;)
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 25882
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1

Re: Infection+gros ralentissement

Messagepar pitchalou » 14 Sep 2009 17:42

ok je viens de voir le zip : c'etais dans c: Qoobox et ensuite quarantine :)
pitchalou
Libellulien
Libellulien
 
Messages: 63
Inscription: 12 Sep 2009 16:41

Re: Infection+gros ralentissement

Messagepar Falkra » 14 Sep 2009 20:57

Je te poste un MP pour me les faire parvenir.
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 25882
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1

Re: Infection+gros ralentissement

Messagepar pitchalou » 14 Sep 2009 21:06

répondu :)

La suite ? c'est dans une autre partie du forum ?
pitchalou
Libellulien
Libellulien
 
Messages: 63
Inscription: 12 Sep 2009 16:41

Re: Infection+gros ralentissement

Messagepar Falkra » 14 Sep 2009 21:45

Je te prépare ça, je le posterai sans doute demain, mais a priori côté infection on est ok là.
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 25882
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1

Re: Infection+gros ralentissement

Messagepar pitchalou » 15 Sep 2009 04:25

merci beaucoup :supers:
pitchalou
Libellulien
Libellulien
 
Messages: 63
Inscription: 12 Sep 2009 16:41

Re: Infection+gros ralentissement

Messagepar Falkra » 15 Sep 2009 22:20

J'envoie les fichiers pour analyse. Je te tiens au courant.

On va faire le point, poste un nouveau rapport RSIT stp, cette fois il n'en fera qu'un, c'est normal. :-D
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 25882
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1

Re: Infection+gros ralentissement

Messagepar pitchalou » 16 Sep 2009 04:25

Voila qui est fait :D

Logfile of random's system information tool 1.06 (written by random/random)
Run by client at 2009-09-16 05:24:33
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 142 GB (73%) free of 194 GB
Total RAM: 1023 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:24:43, on 9/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\iPScan5x.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SFR\Kit\9props.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Documents and Settings\client\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\client\Bureau\RSIT.exe
C:\Documents and Settings\client\Bureau\client.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.gdark.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [iPScan5x] C:\WINDOWS\iPScan5x.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Connexion SFR 9props.exe] "C:\Program Files\SFR\Kit\9props.exe" /trayicon
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\client\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.chat-land.org
O15 - Trusted Zone: http://mouvement-ultra.forumactif.fr
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net ... plugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/sr ... ab_srl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-U ... E_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 5832499046
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zone.msn.com/EN-US/a-L ... uncher.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://fichiers.touslesdrivers.com/fich ... _1_1_0.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZI ... b56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Ba ... b57213.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://kiw.imgag.com/imgag/cp/install/crusher-kiwen.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cab
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 9694 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{CED843E9-CA7E-46E6-991A-BB6E33ED41A4}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-04-19 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-04-19 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-02-03 61440]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536]
"tsnpstd3"=C:\WINDOWS\tsnpstd3.exe [2007-03-30 262144]
"snpstd3"=C:\WINDOWS\vsnpstd3.exe [2006-09-19 827392]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-01-05 413696]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2004-02-12 49152]
"HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2004-05-12 241664]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-04-19 148888]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 342312]
"iPScan5x"=C:\WINDOWS\iPScan5x.EXE [2008-09-06 98304]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
"Connexion SFR 9props.exe"=C:\Program Files\SFR\Kit\9props.exe [2009-04-21 955712]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-11-03 204288]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Démarrage rapide du logiciel HP Image Zone.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe

C:\Documents and Settings\client\Menu Démarrer\Programmes\Démarrage
Notification de cadeaux MSN.lnk - C:\Documents and Settings\client\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-02-04 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-06 267304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Xfire\Xfire.exe"="C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Wolfenstein - Enemy Territory\ET.exe"="C:\Program Files\Wolfenstein - Enemy Territory\ET.exe:*:Enabled:ET"
"C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe"="C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\NGM\NGM.exe"="C:\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\Documents and Settings\All Users\Application Data\NexonEU\NGM\NGM.exe"="C:\Documents and Settings\All Users\Application Data\NexonEU\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Zattoo\zattood.exe"="C:\Program Files\Zattoo\zattood.exe:*:Enabled:zattood"
"C:\WINDOWS\system32\[Emoticons-plus.com] Winkaa 2.0.exe"="C:\WINDOWS\system32\[Emoticons-plus.com] Winkaa 2.0.exe:*:Enabled:[Emoticons-plus.com] Winkaa 2.0"
"C:\Documents and Settings\client\Local Settings\Application Data\Kamuse\KCSTrayDownloader\KCSTrayDownloaderEngine.exe"="C:\Documents and Settings\client\Local Settings\Application Data\Kamuse\KCSTrayDownloader\KCSTrayDownloaderEngine.exe:*:Enabled:KCSTrayDownloaderEngine"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Nexon\Combat Arms\CombatArms.exe"="C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\Nexon\Combat Arms\Engine.exe"="C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe"
"C:\Nexon\Combat Arms EU\CombatArms.exe"="C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\Nexon\Combat Arms EU\Engine.exe"="C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe"

======List of files/folders created in the last 1 months======

2009-09-14 14:02:58 ----SHD---- C:\RECYCLER
2009-09-14 12:52:06 ----A---- C:\ComboFix.txt
2009-09-14 12:22:47 ----D---- C:\WINDOWS\temp
2009-09-13 18:39:49 ----A---- C:\Boot.bak
2009-09-13 18:39:44 ----RASHD---- C:\cmdcons
2009-09-13 18:38:45 ----A---- C:\WINDOWS\zip.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\SWSC.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\SWREG.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\sed.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\PEV.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\NIRCMD.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\grep.exe
2009-09-13 18:38:39 ----D---- C:\WINDOWS\ERDNT
2009-09-13 18:37:57 ----D---- C:\Qoobox
2009-09-13 17:34:02 ----A---- C:\TB.txt
2009-09-13 17:33:37 ----D---- C:\ToolBar SD
2009-09-13 17:16:00 ----D---- C:\Program Files\trend micro
2009-09-13 17:15:59 ----D---- C:\rsit
2009-09-13 12:03:23 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-09-12 18:13:16 ----D---- C:\07aea9a43b14945c8230ffb0c0f4e4d5
2009-09-12 18:00:45 ----D---- C:\Program Files\Eidos
2009-09-10 05:21:53 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-09-10 05:21:47 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2009-09-06 20:44:25 ----D---- C:\Program Files\Avira
2009-09-06 20:44:25 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2009-09-06 20:23:30 ----D---- C:\Program Files\VS Revo Group
2009-09-06 10:04:28 ----D---- C:\Program Files\Antivir
2009-09-06 09:55:04 ----D---- C:\Program Files\Microsoft ActiveSync
2009-09-06 09:14:00 ----D---- C:\WINDOWS\system32\sytes
2009-09-05 09:10:49 ----D---- C:\Program Files\MappySynchro
2009-09-03 20:07:10 ----A---- C:\WINDOWS\system32\xfcodec.dll
2009-09-03 17:21:42 ----D---- C:\Documents and Settings\client\Application Data\IDM
2009-09-03 17:21:42 ----D---- C:\Documents and Settings\client\Application Data\DMCache
2009-09-03 17:21:39 ----D---- C:\Program Files\Internet Download Manager
2009-09-03 13:26:35 ----D---- C:\WINDOWS\Watson
2009-09-02 17:20:40 ----D---- C:\Documents and Settings\client\Application Data\VitySoft
2009-09-01 20:32:14 ----D---- C:\Program Files\TuneUp Utilities 2009
2009-09-01 20:32:14 ----D---- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2009-09-01 20:31:59 ----SHD---- C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-01 20:23:59 ----D---- C:\Program Files\K!
2009-08-30 12:45:21 ----D---- C:\Program Files\directx
2009-08-30 12:31:43 ----D---- C:\Program Files\Hooligans
2009-08-29 19:58:03 ----D---- C:\Documents and Settings\client\Application Data\DeepBurner
2009-08-29 19:57:56 ----D---- C:\Program Files\Astonsoft
2009-08-26 08:22:26 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-08-25 17:33:19 ----D---- C:\Documents and Settings\client\Application Data\Canneverbe_Limited
2009-08-25 17:33:17 ----D---- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
2009-08-23 10:59:21 ----A---- C:\WINDOWS\wininit.ini
2009-08-23 10:42:30 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-08-23 10:42:30 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-22 18:49:01 ----D---- C:\Documents and Settings\client\Application Data\vlc
2009-08-22 18:45:58 ----D---- C:\Program Files\VLC
2009-08-22 13:47:55 ----D---- C:\Download
2009-08-22 08:25:55 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-08-21 22:13:52 ----D---- C:\WINDOWS\system32\XPSViewer
2009-08-21 22:13:48 ----D---- C:\Program Files\MSBuild
2009-08-21 22:13:46 ----D---- C:\WINDOWS\system32\en-US
2009-08-21 22:13:38 ----D---- C:\Program Files\Reference Assemblies
2009-08-21 22:13:07 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-08-21 22:13:07 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-08-21 22:13:07 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-08-21 22:13:06 ----D---- C:\824179fe599733104d09e3
2009-08-18 00:11:20 ----D---- C:\Documents and Settings\client\Application Data\Ubisoft
2009-08-18 00:08:28 ----D---- C:\Documents and Settings\client\Application Data\MysteryStudio
2009-08-17 18:53:41 ----D---- C:\Program Files\Fnac

======List of files/folders modified in the last 1 months======

2009-09-16 05:24:41 ----D---- C:\WINDOWS\Prefetch
2009-09-16 05:14:44 ----D---- C:\WINDOWS
2009-09-16 04:59:57 ----D---- C:\WINDOWS\system32\CatRoot2
2009-09-16 00:14:19 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-09-15 20:46:31 ----D---- C:\Documents and Settings\client\Application Data\Xfire
2009-09-15 20:32:10 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2009-09-15 18:51:39 ----D---- C:\WINDOWS\network diagnostic
2009-09-14 12:52:08 ----D---- C:\WINDOWS\system32\drivers
2009-09-14 12:52:08 ----D---- C:\WINDOWS\system32
2009-09-14 12:47:02 ----A---- C:\WINDOWS\system.ini
2009-09-14 12:23:10 ----D---- C:\WINDOWS\system32\config
2009-09-14 12:21:05 ----D---- C:\WINDOWS\AppPatch
2009-09-14 12:20:52 ----D---- C:\Program Files\Fichiers communs
2009-09-13 18:59:33 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-09-13 18:39:50 ----RASH---- C:\boot.ini
2009-09-13 17:46:08 ----RD---- C:\Program Files
2009-09-13 17:44:14 ----D---- C:\Program Files\Azureus
2009-09-12 19:26:09 ----D---- C:\WINDOWS\Microsoft.NET
2009-09-12 18:15:18 ----D---- C:\WINDOWS\system32\CatRoot
2009-09-12 18:14:35 ----SHD---- C:\WINDOWS\Installer
2009-09-12 18:14:35 ----D---- C:\Config.Msi
2009-09-12 18:13:55 ----RSD---- C:\WINDOWS\Fonts
2009-09-12 18:13:33 ----HD---- C:\WINDOWS\inf
2009-09-12 18:13:02 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-09-12 18:12:52 ----RSD---- C:\WINDOWS\assembly
2009-09-12 18:12:43 ----D---- C:\WINDOWS\WinSxS
2009-09-12 18:08:23 ----D---- C:\WINDOWS\system32\DirectX
2009-09-12 18:00:44 ----HD---- C:\Program Files\InstallShield Installation Information
2009-09-12 17:59:59 ----D---- C:\WINDOWS\system32\oodag
2009-09-12 17:48:05 ----D---- C:\Program Files\eMule
2009-09-12 16:58:33 ----D---- C:\Documents and Settings\All Users\Application Data\Sports Interactive
2009-09-12 16:03:31 ----D---- C:\WINDOWS\Minidump
2009-09-12 15:01:59 ----D---- C:\Documents and Settings\client\Application Data\Azureus
2009-09-12 13:20:16 ----SD---- C:\WINDOWS\Tasks
2009-09-12 08:17:31 ----D---- C:\Documents and Settings\client\Application Data\dvdcss
2009-09-11 13:35:52 ----D---- C:\Documents and Settings
2009-09-11 13:32:51 ----A---- C:\WINDOWS\win.ini
2009-09-10 18:38:15 ----D---- C:\Program Files\Xfire
2009-09-10 09:10:06 ----D---- C:\Program Files\Microsoft Silverlight
2009-09-10 05:22:03 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-09-10 05:21:51 ----A---- C:\WINDOWS\imsins.BAK
2009-09-10 05:21:46 ----HD---- C:\WINDOWS\$hf_mig$
2009-09-09 22:36:02 ----D---- C:\Program Files\Mozilla Firefox
2009-09-07 19:37:03 ----D---- C:\WINDOWS\security
2009-09-06 20:40:27 ----D---- C:\Program Files\Google
2009-09-06 20:40:27 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2009-09-06 10:04:49 ----D---- C:\WINDOWS\system32\wbem
2009-09-06 10:04:48 ----D---- C:\WINDOWS\Registration
2009-09-06 10:04:00 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-09-06 09:55:45 ----SD---- C:\Documents and Settings\client\Application Data\Microsoft
2009-09-06 09:55:05 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2009-09-06 09:55:04 ----D---- C:\WINDOWS\Help
2009-09-03 16:35:37 ----D---- C:\Documents and Settings\All Users\Application Data\Electronic Arts
2009-09-03 13:26:35 ----D---- C:\Program Files\Microsoft Games
2009-09-03 05:28:32 ----D---- C:\Program Files\Mumble
2009-09-03 05:28:21 ----D---- C:\Program Files\Pando Networks
2009-09-03 05:27:55 ----D---- C:\Program Files\PeerTV
2009-08-28 23:38:20 ----A---- C:\WINDOWS\system32\MRT.exe
2009-08-22 17:34:39 ----D---- C:\Program Files\Yahoo!
2009-08-21 22:13:22 ----D---- C:\WINDOWS\system32\spool

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2009-03-24 5632]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-07-28 55656]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-09-24 4122368]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-02-04 3488768]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-06-21 51088]
R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-06-21 16496]
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-10-21 21568]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2002-08-30 12288]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 SNPSTD3;USB PC Camera (SNPSTD3); C:\WINDOWS\system32\DRIVERS\snpstd3.sys [2007-03-27 10252544]
R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\yukonwxp.sys [2003-11-10 174464]
S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
S3 ajo7y8hx;ajo7y8hx; C:\WINDOWS\system32\drivers\ajo7y8hx.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 cmudau32;C-Media USB UDA Sound Interface; C:\WINDOWS\system32\drivers\cmudaxu.sys [2006-08-09 1419840]
S3 DSDrv4;DSDrv4; \??\C:\PROGRA~1\K!\K!TVXP~1\DSDrv4.sys []
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver; C:\WINDOWS\system32\DRIVERS\ManyCam.sys []
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000]
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ssm_bus.sys [2005-08-30 58320]
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys [2005-08-30 8336]
S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ssm_mdm.sys [2005-08-30 94000]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-02-04 602112]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-04-19 152984]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2007-02-15 707344]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-06-30 75064]
R2 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
R3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-03-18 65536]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-02-03 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2009-03-03 33176]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
pitchalou
Libellulien
Libellulien
 
Messages: 63
Inscription: 12 Sep 2009 16:41

Re: Infection+gros ralentissement

Messagepar Falkra » 16 Sep 2009 07:49

C'est ok.

Désinstalle combofix : entre combofix /u dans la boite exécuter du menu démarrer.
=> combofix espace slasht u
Après cela, efface ce dossier s'il existe encore :
C:\QooBox

La machine tourne bien ?
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 25882
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1

Re: Infection+gros ralentissement

Messagepar Falkra » 16 Sep 2009 09:20

Un des fichiers était bien infecté, je l'ai envoyé sur le forum de MalwareBytes, les antivirus le détectent +/- bien actuellement.
On l'a supprimé, c'était à faire. ;)
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 25882
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1

Re: Infection+gros ralentissement

Messagepar pitchalou » 16 Sep 2009 15:33

Ia du mieu du trés mieu meme . Malgrés ca je le trouve toujours un peu lent , Optimisation possible ?
pitchalou
Libellulien
Libellulien
 
Messages: 63
Inscription: 12 Sep 2009 16:41

PrécédenteSuivante

Retourner vers Désinfections et demandes d'analyse

Qui est en ligne

Utilisateurs parcourant ce forum: Google et 0 invités