Redemarrage ! Cause l'antivirus ? sur le forum Informatique - 11-11-2007 16:00:13 - page 3

Dark2391

Niveau 10

11 novembre 2007 à 16:00:13

stp !

wiwi77

Niveau 10

11 novembre 2007 à 16:07:48

Je t´explique :

- Là, tu es en mode normal, tu as donc internet, télécharge SDfix, MSNFix.zip, Flash_Disinfecto et CCleaner
- Mets toute la procédure avec les étapes dans un fichier bloc-notes
- Tu redémarres et au démarrage du PC, tu tapotes sur F8 avant que Windows démarre et tu sélectionnes Mode sans échec
- Tu vas dans la session que tu utilises normalement
- Tu es en mode sans échec donc pas d´internet
- Tu ouvres ton bloc-notes et tu suis la procédure avec les fichiers que tu as téléchargé en mode normal
- Une fois fini, tu redémarres et ça se remettra en mode normal donc avec internet
- Tu nous mets ici les rapports demandés

Dark2391

Niveau 10

11 novembre 2007 à 16:47:18

MSNFix 1.574

C:\Documents and Settings\Compaq_Propri‚taire\Bureau\MSNFix\MSNFix
Fix exécuté le 11/11/2007 - 16:27:59,82 By Compaq_Propri‚taire
mode sans échec

- ********************* Recherche les fichiers présents

... C:\WINDOWS\svchost

- ********************* MSNCHK ***** /!\ beta test /!\

- ********************* Recherche les dossiers présents

Aucun dossier trouvé

- ********************* Suppression des fichiers

.. OK ... C:\WINDOWS\svchost

- ********************* Nettoyage du registre

- ********************* Fichiers suspects

Aucun Fichier trouvé

Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 11112007_16294145.zip

--------------------------------------------------
----------------------
Auteur : !a ur3n7 Contact:
http://changelog.fr

--------------------------------------------------
----------------------

--------------------------------------------- END ---------------------------------------------

Dark2391

Niveau 10

11 novembre 2007 à 16:48:18

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:47:36, on 11/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program
Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program
Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe

C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program
Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

C:\Program
Files\CyberLink\PowerCinema\Kernel\CLML_NTService\
CLMLServer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program
Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PRESARIO&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.aol.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=63&bd=PRESARIO&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=63&bd=PRESARIO&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL (file missing)
O4 - HKLM\..\Run: [cafwc] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [cafw] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ´SERVICE LOCAL´)
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ´SERVICE RÉSEAU´)
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User ´SYSTEM´)
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User ´Default user´)
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User ´Default user´)
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xporter vers Microsoft Excel -
res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Ouvrir dans un nouvel onglet d´arrière-plan - res://C:\Program Files\Windows Live
Toolbar\Components\fr-fr\msntabres.dll.mui/229?6fc
61ba7c0bf4297a5199e1bac34fee4
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live
Toolbar\Components\fr-fr\msntabres.dll.mui/230?6fc
61ba7c0bf4297a5199e1bac34fee4
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra ´Tools´ menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra ´Tools´ menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} -
C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Pac
kard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra ´Tools´ menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} -
C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Pac
kard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra ´Tools´ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ´Tools´ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) -
http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {03B39B10-9AB9-4DBB-8189-7F76E0CE5F3F} (FavImport Class) -
https://favorites.live.com/cab/ImportAx.cab?v=13,0,1609,00
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -
http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.5.107.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) -
http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) -
http://www.systemrequiremirementslab.com/sysreqlab2.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} -
http://www.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection.cab?version=
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) -
http://caebmm.imgag.com/imgag/cp/install/crusher-cae.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) -
http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) -
http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
O20 - Winlogon Notify: winpdc32 - winpdc32.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASWLSVC - Unknown owner - C:\WINDOWS\system32\ASWLSVC.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program
Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program
Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program
Files\CyberLink\PowerCinema\Kernel\CLML_NTService\
CLMLServer.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l´iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program
Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe

O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program
Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe

O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O24 - Desktop Component 1: (no name) -
http://gamercard.xbox.com/Dark%202391.card

--
End of file - 12244 bytes

Dark2391

Niveau 10

11 novembre 2007 à 16:50:24

SDFix: Version 1.114

Run by Compaq_Propri‚taire on 11/11/2007 at 16:14

Microsoft Windows XP [version 5.1.2600]

Running From: C:\DOCUME~1\COMPAQ~1\Bureau\SDFix\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Trojan Files Found:

C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\Jeux\Counter Strike\GLF1A.tmp.exe - Deleted
C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\Jeux\Counter Strike\GLF1B.tmp.exe - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF1A.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF22.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF2A.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF33.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF3B.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF43.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF4B.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF53.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF5C.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF64.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF6C.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF74.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF7C.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF8C.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF98.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLFC.tmp.dll - Deleted
C:\WINDOWS\svchost.exe - Deleted
C:\WINDOWS\windows.exe - Deleted
C:\WINDOWS\wr.txt - Deleted

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-11-11 16:33:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application
Data\Microsoft\Messenger\Dwaynethekiller@hotmail.f
r\SharingMetadata\nirvana-power@hotmail.fr\DFSR\St
aging\CS{6E3238A9-C569-45EE-4F18-7EB18A8498DE}\01\
11-{6E3238A9-C569-45EE-4F18-7EB18A8498DE}-v1-{E2C5
F8F5-F853-427D-AE28-BCE8D86D3BA5}-v11-Downloaded.f
rx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application
Data\Microsoft\Messenger\Dwaynethekiller@hotmail.f
r\SharingMetadata\nirvana-power@hotmail.fr\DFSR\St
aging\CS{6E3238A9-C569-45EE-4F18-7EB18A8498DE}\14\
157-{E2C5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v14-{42
978D08-0ED4-4837-83DB-5868166404A6}-v157-Downloade
d.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
22476 bytes hidden from API
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application
Data\Microsoft\Messenger\Dwaynethekiller@hotmail.f
r\SharingMetadata\nirvana-power@hotmail.fr\DFSR\St
aging\CS{6E3238A9-C569-45EE-4F18-7EB18A8498DE}\14\
157-{E2C5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v14-{42
978D08-0ED4-4837-83DB-5868166404A6}-v157-Downloade
d.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRES
S 2496 bytes hidden from API
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application
Data\Microsoft\Messenger\Dwaynethekiller@hotmail.f
r\SharingMetadata\nirvana-power@hotmail.fr\DFSR\St
aging\CS{6E3238A9-C569-45EE-4F18-7EB18A8498DE}\15\
165-{E2C5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v15-{42
978D08-0ED4-4837-83DB-5868166404A6}-v165-Downloade
d.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
18570 bytes hidden from API
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application
Data\Microsoft\Messenger\Dwaynethekiller@hotmail.f
r\SharingMetadata\nirvana-power@hotmail.fr\DFSR\St
aging\CS{6E3238A9-C569-45EE-4F18-7EB18A8498DE}\15\
165-{E2C5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v15-{42
978D08-0ED4-4837-83DB-5868166404A6}-v165-Downloade
d.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRES
S 2072 bytes hidden from API
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application
Data\Microsoft\Messenger\Dwaynethekiller@hotmail.f
r\SharingMetadata\nirvana-power@hotmail.fr\DFSR\St
aging\CS{6E3238A9-C569-45EE-4F18-7EB18A8498DE}\16\
16-{E2C5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v16-{E2C
5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v16-Downloaded.
frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 22206 bytes hidden from API
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application
Data\Microsoft\Messenger\Dwaynethekiller@hotmail.f
r\SharingMetadata\nirvana-power@hotmail.fr\DFSR\St
aging\CS{6E3238A9-C569-45EE-4F18-7EB18A8498DE}\16\
16-{E2C5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v16-{E2C
5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v16-Downloaded.
frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 1614 bytes hidden from API
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application
Data\Microsoft\Messenger\Dwaynethekiller@hotmail.f
r\SharingMetadata\nirvana-power@hotmail.fr\DFSR\St
aging\CS{6E3238A9-C569-45EE-4F18-7EB18A8498DE}\16\
16-{E2C5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v16-{E2C
5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v16-Downloaded.
frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2456 bytes hidden from API
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application
Data\Microsoft\Messenger\Dwaynethekiller@hotmail.f
r\SharingMetadata\nirvana-power@hotmail.fr\DFSR\St
aging\CS{6E3238A9-C569-45EE-4F18-7EB18A8498DE}\17\
17-{E2C5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v17-{E2C
5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v17-Downloaded.
frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 21756 bytes hidden from API
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application
Data\Microsoft\Messenger\Dwaynethekiller@hotmail.f
r\SharingMetadata\nirvana-power@hotmail.fr\DFSR\St
aging\CS{6E3238A9-C569-45EE-4F18-7EB18A8498DE}\17\
17-{E2C5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v17-{E2C
5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v17-Downloaded.
frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 1596 bytes hidden from API
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application
Data\Microsoft\Messenger\Dwaynethekiller@hotmail.f
r\SharingMetadata\nirvana-power@hotmail.fr\DFSR\St
aging\CS{6E3238A9-C569-45EE-4F18-7EB18A8498DE}\17\
17-{E2C5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v17-{E2C
5F8F5-F853-427D-AE28-BCE8D86D3BA5}-v17-Downloaded.
frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2384 bytes hidden from API
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application

wiwi77

Niveau 10

11 novembre 2007 à 16:51:20

Et le rapport SDFix ?

Dark2391

Niveau 10

11 novembre 2007 à 16:52:36

je peux te l´envoyer par msn car c trop long pour que je puisse le mettre sur le topic

wiwi77

Niveau 10

11 novembre 2007 à 16:53:19

OK, SDFix a trouvé des petites bêbêtes et les a supprimé.

wiwi77

Niveau 10

11 novembre 2007 à 16:54:13

Je ne donne pas mon MSN désolé. Coupe-le en plusieurs fois s´il te plaît.

Dark2391

Niveau 10

11 novembre 2007 à 16:56:00

SDFix: Version 1.114

Run by Compaq_Propri‚taire on 11/11/2007 at 16:14

Microsoft Windows XP [version 5.1.2600]

Running From: C:\DOCUME~1\COMPAQ~1\Bureau\SDFix\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Trojan Files Found:

C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\Jeux\Counter Strike\GLF1A.tmp.exe - Deleted
C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\Jeux\Counter Strike\GLF1B.tmp.exe - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF1A.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF22.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF2A.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF33.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF3B.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF43.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF4B.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF53.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF5C.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF64.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF6C.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF74.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF7C.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF8C.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLF98.tmp.dll - Deleted
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GLFC.tmp.dll - Deleted
C:\WINDOWS\svchost.exe - Deleted
C:\WINDOWS\windows.exe - Deleted
C:\WINDOWS\wr.txt - Deleted

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-11-11 16:33:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

Dark2391

Niveau 10

11 novembre 2007 à 16:58:35

dsl j´y arrive pas et moi je peux pas te donner mon msn ?

wiwi77

Niveau 10

11 novembre 2007 à 17:06:46

Si.

Dark2391

Niveau 10

11 novembre 2007 à 17:08:09

kill36@hotmail.fr

wiwi77

Niveau 10

11 novembre 2007 à 17:13:24

Tu peux me l´envoyer maintenant.

Dark2391

Niveau 10

11 novembre 2007 à 17:16:00

C´est fait des que tu l´a regarder dit moi le verdict ici ^^

wiwi77

Niveau 10

11 novembre 2007 à 17:20:38

OK, refais un scan GenProc.

Dark2391

Niveau 10

11 novembre 2007 à 17:22:31

Bah je crois que c´est bon ca met [3] Aucune infection caractéristique trouvée !

wiwi77

Niveau 10

11 novembre 2007 à 17:26:02

C´est cool ça.

wiwi77

Niveau 10

11 novembre 2007 à 17:26:46

Tu l´as acheté ton antivirus ?

Dark2391

Niveau 10

11 novembre 2007 à 17:27:17

Oui on dirait que j´ai tout bien fait alors ! Bon si j´ai encore des redemarrages je le dirai ^^