Mon ordinateur n'a pas redémarré, voilà le rapport:
ComboFix 08-11-30.02 - Propriétaire 2008-12-01 19:45:00.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.202 [GMT 1:00]
Lancé depuis: c:\documents and settings\Propriétaire\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Propriétaire\Mes documents\CFScript.txt
* Un nouveau point de restauration a été créé
FILE ::
C:\ous.exe
C:\sqmdata11.sqm
C:\sqmdata12.sqm
C:\sqmnoopt11.sqm
C:\sqmnoopt12.sqm
C:\wnxx.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\ous.exe
C:\sqmdata11.sqm
C:\sqmdata12.sqm
C:\sqmnoopt11.sqm
C:\sqmnoopt12.sqm
C:\wnxx.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-01 au 2008-12-01 ))))))))))))))))))))))))))))))))))))
.
2008-11-30 21:44 . 2008-11-30 21:44 95 --a------ c:\windows\wininit.ini
2008-11-30 21:23 . 2008-11-30 21:29 <REP> d-------- c:\program files\Spybot - Search & Destroy
2008-11-30 21:23 . 2008-12-01 18:26 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-30 18:33 . 2008-11-30 18:33 <REP> d--h----- c:\windows\PIF
2008-11-25 21:04 . 2008-11-25 21:04 <REP> d-------- c:\windows\system32\LogFiles
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-01 18:19 --------- d-----w c:\program files\Mozilla Firefox 3 Beta 2
2008-11-29 08:08 --------- d-----w c:\documents and settings\Propriétaire\Application Data\OpenOffice.org2
2008-11-29 08:08 --------- d-----w c:\documents and settings\Propriétaire\Application Data\OpenOffice.org2
2008-11-29 08:08 --------- d-----w c:\documents and settings\Propriétaire\Application Data\OpenOffice.org2
2008-11-27 20:24 --------- d-----w c:\documents and settings\Propriétaire\Application Data\LimeWire
2008-11-27 20:24 --------- d-----w c:\documents and settings\Propriétaire\Application Data\LimeWire
2008-11-27 20:24 --------- d-----w c:\documents and settings\Propriétaire\Application Data\LimeWire
2008-11-27 20:16 --------- d-----w c:\program files\Microsoft Picture It! 9
2008-10-28 10:35 --------- d-----w c:\program files\LimeWire
2008-10-26 13:59 --------- d-----w c:\program files\Zylom Games
2008-10-26 13:58 --------- d-----w c:\program files\Google
2008-10-26 13:58 --------- d-----w c:\documents and settings\All Users\Application Data\agi
2008-10-25 16:56 --------- d-----w c:\documents and settings\LocalService\Application Data\agi
2008-10-25 16:54 339,968 ----a-w c:\windows\system32\pythoncom25.dll
2008-10-25 16:54 2,117,632 ----a-w c:\windows\system32\python25.dll
2008-10-25 16:54 114,688 ----a-w c:\windows\system32\pywintypes25.dll
2008-10-15 11:36 --------- d-----w c:\documents and settings\All Users\Application Data\Zylom
2008-10-12 16:05 --------- d-----w c:\documents and settings\Propriétaire\Application Data\Apple Computer
2008-10-12 16:05 --------- d-----w c:\documents and settings\Propriétaire\Application Data\Apple Computer
2008-10-12 16:05 --------- d-----w c:\documents and settings\Propriétaire\Application Data\Apple Computer
2008-10-01 18:36 --------- d-----w c:\program files\iTunes
2008-10-01 18:36 --------- d-----w c:\program files\iPod
2008-10-01 18:36 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-01 18:35 --------- d-----w c:\program files\QuickTime
2008-10-01 18:35 --------- d-----w c:\program files\Bonjour
2008-10-01 18:34 --------- d-----w c:\program files\Fichiers communs\Apple
2008-10-01 16:38 --------- d-----w c:\program files\Apple Software Update
2008-09-16 16:26 1,332,197 ----a-w c:\windows\system32\pythondll.zip
2008-08-18 18:32 842 ----a-w c:\program files\ravaudet.txt
2008-07-31 14:08 9 ----a-w c:\program files\nomutil.txt
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\windows\PIF ----
---- Directory of c:\windows\system32\LogFiles ----
2008-11-25 21:04 326 --a------ c:\windows\system32\LogFiles\HTTPERR\httperr1.log
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2008-07-03 190024]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2005-09-25 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-10-29 4620288]
"Microsoft Works Update Detection"="c:\program files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 50688]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-04-05 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 28672]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.3.lnk]
path=c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.3.lnk
backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-09-10 16:40 289576 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2004-10-29 15:50 4620288 c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2004-10-29 15:50 86016 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 00:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2004-10-29 15:50 921600 c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-ra------ 2003-02-27 13:29 47104 c:\windows\SOUNDMAN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Documents and Settings\\Propriétaire\\Bureau\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-01 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-01 20560]
R3 P0630VID;Creative WebCam Live!;c:\windows\system32\DRIVERS\P0630Vid.sys [2008-07-09 91830]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);c:\windows\system32\DRIVERS\ss_bus.sys [2008-08-04 83592]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;c:\windows\system32\DRIVERS\ss_mdfl.sys [2008-08-04 15112]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;c:\windows\system32\DRIVERS\ss_mdm.sys [2008-08-04 109704]
.
Contenu du dossier 'Tâches planifiées'
2008-11-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2008-10-15 c:\windows\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1215865457.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 23:52]
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-01 19:46:23
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-12-01 19:47:00
ComboFix-quarantined-files.txt 2008-12-01 18:46:52
ComboFix2.txt 2008-12-01 17:52:08
Avant-CF: 59 873 464 320 octets libres
Après-CF: 59,865,210,880 octets libres
151
