voilà ce que conbofix me dit
ComboFix 11-04-10.04 - CHEVALIER 11/04/2011 18:36:46.1.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.2047.1614 [GMT 2:00]
Lancé depuis: c:\documents and settings\CHEVALIER\Mes documents\Téléchargements\ComboFix.exe
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\CHEVALIER\Application Data\PriceGong
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\1.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\a.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\b.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\c.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\d.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\e.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\f.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\g.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\h.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\i.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\J.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\k.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\l.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\m.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\n.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\o.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\p.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\q.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\r.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\s.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\t.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\u.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\v.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\w.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\x.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\y.xml
c:\documents and settings\CHEVALIER\Application Data\PriceGong\Data\z.xml
c:\windows\system32\winlogon.bak
D:\AUTORUN.INF
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-03-11 au 2011-04-11 ))))))))))))))))))))))))))))))))))))
.
.
2011-04-11 15:06 . 2011-04-11 15:06 -------- d-----w- c:\program files\TightVNC
2011-04-11 15:04 . 2011-04-11 15:04 -------- d-----w- c:\documents and settings\Invité\Local Settings\Application Data\Google
2011-04-10 17:05 . 2011-04-10 17:05 -------- d-----w- C:\NVIDIA
2011-04-10 15:22 . 2011-04-10 15:22 -------- d-----w- c:\documents and settings\CHEVALIER\Application Data\TeamViewer
2011-04-10 15:22 . 2011-04-10 15:22 -------- d-----w- c:\program files\TeamViewer
2011-04-10 15:00 . 2011-04-11
15:06 -------- d-----w- c:\windows\NV19881984.TMP
2011-04-10 15:00 . 2007-03-22
10:52 356352 ----a-w- c:\windows\system32\NVUNINST
.EXE
2011-04-10 14:56 . 2007-03-22
02:50 356352 ----a-w- c:\windows\system32\nvudisp.
exe
2011-04-01 20:15 . 2011-04-11
15:06 -------- d-----w- c:\windows\NV36683520.TMP
2011-03-31 18:57 . 2005-05-03 10:43 69632 ------r- c:\windows\Alcmtr.exe
2011-03-31 18:09 . 2011-04-11
15:05 -------- d-----w- c:\windows\NV12121164.TMP
2011-03-31 11:33 . 2011-04-10 15:02 -------- d-----w- c:\windows\nview
2011-03-30 16:18 . 2011-04-11
15:05 -------- d-----w- c:\windows\NV34963952.TMP
2011-03-30 16:07 . 2011-04-11
15:05 -------- d-----w- c:\windows\NV27882796.TMP
2011-03-30 16:07 . 2007-03-22
02:50 928096 ----a-w- c:\windows\system32\nvucode.
bin
2011-03-30 16:02 . 2011-04-11
15:05 -------- d-----w- c:\windows\NV28883840.TMP
2011-03-30 16:01 . 2011-01-08
03:27 6397824 -c--a-w- c:\windows\system32\dllcach
e\nv4_disp.dll
2011-03-30 16:01 . 2011-01-08
03:27 9888672 -c--a-w- c:\windows\system32\dllcach
e\nv4_mini.sys
2011-03-30 12:56 . 2006-07-01
20:42 43520 ----a-w- c:\windows\system32\drivers\A
mdK8.sys
2011-03-29 20:13 . 2007-03-15
13:40 39936 ----a-w- c:\windows\system32\ATKOGL32.
dll
2011-03-29 20:13 . 2007-03-15
13:40 5421568 ----a-w- c:\windows\system32\ATKOSDX
32.dll
2011-03-29 20:13 . 2005-08-31
12:16 46080 ----a-w- c:\windows\system32\aseng.dll
2011-03-29 20:13 . 2005-08-31
12:16 45568 ----a-w- c:\windows\system32\ASCHT.dll
2011-03-29 20:13 . 2005-08-31
12:16 45568 ----a-w- c:\windows\system32\aschs.dll
2011-03-29 20:13 . 2005-04-03 21:02 69714 ----a-w- c:\program files\Fichiers
communs\InstallShield\Professional\RunTime\11\00\I
ntel32\ctor.dll
2011-03-29 20:13 . 2005-04-03 21:01 274432 ----a-w- c:\program files\Fichiers
communs\InstallShield\Professional\RunTime\11\00\I
ntel32\iscript.dll
2011-03-29 20:13 . 2005-04-03 21:00 184320 ----a-w- c:\program files\Fichiers
communs\InstallShield\Professional\RunTime\11\00\I
ntel32\iuser.dll
2011-03-29 20:13 . 2005-04-03 20:59 5632 ----a-w- c:\program files\Fichiers
communs\InstallShield\Professional\RunTime\11\00\I
ntel32\DotNetInstaller.exe
2011-03-29 20:13 . 2011-03-29 20:13 200836 ----a-w- c:\program files\Fichiers
communs\InstallShield\Professional\RunTime\11\00\I
ntel32\iGdi.dll
2011-03-29 20:13 . 2005-04-03 21:02 753664 ----a-w- c:\program files\Fichiers
communs\InstallShield\Professional\RunTime\11\00\I
ntel32\iKernel.dll
2011-03-29 20:13 . 2011-03-29 20:13 331908 ----a-w- c:\program files\Fichiers
communs\InstallShield\Professional\RunTime\11\00\I
ntel32\setup.dll
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-09 13:54 . 2008-04-18
12:00 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:54 . 2008-04-18
12:00 186880 ----a-w- c:\windows\system32\encdec.d
ll
2011-02-04 11:50 . 2011-02-04
11:50 20747 ----a-w- c:\windows\system32\drivers\A
egisP.sys
2011-02-03 19:25 . 2011-02-03
19:25 107888 ----a-w- c:\windows\system32\CmdLineE
xt.dll
2011-02-02 07:59 . 2010-11-28
16:26 2067456 ----a-w- c:\windows\system32\mstscax
.dll
2011-01-29 13:26 . 2011-01-29 13:26 737280 ----a-w- c:\windows\iun6002.exe
2011-01-27 11:57 . 2010-11-28
16:26 677888 ----a-w- c:\windows\system32\mstsc.ex
e
2011-01-25 12:45 . 2008-04-18
12:00 12528 ----a-w- c:\windows\system32\drivers\s
ecdrv.sys
2011-01-21 14:44 . 2008-04-18
12:00 441344 ----a-w- c:\windows\system32\shimgvw.
dll
.
.
------- Sigcheck -------
.
[-] 2010-12-16 . 8D71F28DEB37CC9C2E344095D8BFE1EE . 512000 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
- Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{4daac69c-cba7-45e2-9bc8-1044483d3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-10-18 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-
1044483d3352}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
2010-10-18 11:26 3908192 ----a-w- c:\program files\Softonic_France\tbSoft.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{4daac69c-cba7-45e2-9bc8-1044483d3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-10-18 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-
1044483d3352}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{4DAAC69C-CBA7-45E2-9BC8-1044483D3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-10-18 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-
1044483d3352}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curr
entVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-26 15026056]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur
rentVersion\Run]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2010-12-14 274608]
"GamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-02-14 380928]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 16062464]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll"
[2011-01-07 111208]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-01-07 13880424]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-11-04 1753192]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cu
rrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-18 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ------r- c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-18
12:00 15360 ----a-w- c:\windows\system32\ctfmon.ex
e
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4400 Series]
2007-03-01
06:01 180736 ----a-w- c:\windows\system32\spool\dr
ivers\w32x86\3\E_FATICAE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GamerOSD]
2007-02-14 07:42 380928 ----a-w- c:\program files\ASUS\GamerOSD\GamerOSD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 16:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 18:34 1695232 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2011-01-07
17:58 13880424 ----a-w- c:\windows\system32\nvcpl.
dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2011-01-07
17:58 111208 ----a-w- c:\windows\system32\nvmctray
.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-12-19 03:12 16062464 ------r- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 10:04 2879488 ------r- c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NSCService"=3 (0x3)
"navapsvc"=2 (0x2)
"avast! Antivirus"=2 (0x2)
"Symantec Core LC"=3 (0x3)
"SPBBCSvc"=3 (0x3)
"SNDSrvc"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccProxy"=2 (0x2)
"ccISPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallp
olicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=
"c:\\Program
Files\\TeamViewer\\Version6\\TeamViewer_Service.ex
e"=
.
[HKLM\~\services\sharedaccess\parameters\firewallp
olicy\standardprofile\GloballyOpenPorts\List]
"56548:TCP"= 56548:TCP:Pando Media Booster
"56548:UDP"= 56548:UDP:Pando Media Booster
.
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [03/02/2011 22:51 135664]
S3
XDva383;XDva383;\??\c:\windows\system32\XDva383.sy
s --> c:\windows\system32\XDva383.sys [?]
.
--- Autres Services/Pilotes en mémoire ---
.
.
Contenu du dossier 'Tâches planifiées'
.
2011-04-11
c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1060
284298-1757981266-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 10:33]
.
2011-04-11
c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-
1060284298-1757981266-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 10:33]
.
.
------- Examen supplémentaire -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\CHEVALIER\Application Data\Mozilla\Firefox\Profiles\o962vzjt.default\
FF - prefs.js: browser.search.defaulturl -
hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2
542115&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla
Firefox\extensions\{972ce4c6-7e08-4474-a285-320819
8ce6fd}
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: Softonic_France Community Toolbar: {4daac69c-cba7-45e2-9bc8-1044483d3352} -
%profile%\extensions\{4daac69c-cba7-45e2-9bc8-1044
483d3352}
FF - Ext: vShare: vshare@toolbar - %profile%\extensions\vshare@toolbar
FF - Ext: ALOT Toolbar: toolbar@alot.com - %profile%\extensions\toolbar@alot.com
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application
Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\E
xt
.
- - - - ORPHELINS SUPPRIMES - - - -
.
MSConfigStartUp-ASUS SmartDoctor - c:\program files\ASUS\SmartDoctor\SmartDoctor.exe
MSConfigStartUp-avast5 - c:\program files\Alwil Software\Avast5\avastUI.exe
MSConfigStartUp-ccApp - c:\program files\Fichiers communs\Symantec Shared\ccApp.exe
MSConfigStartUp-DriverScanner - c:\program files\Uniblue\DriverScanner\launcher.exe
MSConfigStartUp-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
MSConfigStartUp-IS CfgWiz - c:\program files\Norton Internet Security\cfgwiz.exe
MSConfigStartUp-nwiz - nwiz.exe
MSConfigStartUp-SSC_UserPrompt - c:\program files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
.
.
.
- ***********************************************
- *********************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-11 18:39
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
- ***********************************************
- *********************
.
Heure de fin: 2011-04-11 18:40:18
ComboFix-quarantined-files.txt 2011-04-11 16:40
.
Avant-CF: 63 008 669 696 octets libres
Après-CF: 64 961 802 240 octets libres
.
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW
S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro
soft Windows XP dition familiale" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - FA669F0C3C28A0C8F27699A06509CACD
