تقرير الادات الأولى
ComboFix 08-06-12.2 - Administrateur 2008-06-14 19:54:15.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1256.212.1036.18.78 [GMT 0:00]
Endroit: C:\Documents and Settings\Administrateur\Mes documents\Downloads\Programs\ComboFix.exe
* Création d'un nouveau point de restauration
* Resident AV is active
AVERTISSEMENT - LA CONSOLE DE RةCUPةRATION N'EST PAS INSTALLةE SUR CETTE MACHINE !!
.
/wow section - STAGE 38
pv: No matching processes found
La syntaxe de la commande est incorrecte.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\ActivationManager
C:\Program Files\ActivationManager\Uninstall.exe
C:\WINDOWS\Fonts\CALIBRIB.TTF
C:\WINDOWS\system32\agsaame.dll
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\winitn.dll
.
((((((((((((((((((((((((((((( Fichiers créés 2008-05-14 to 2008-06-14 ))))))))))))))))))))))))))))))))))))
.
2008-06-14 03:23 . 2008-06-14 03:23 <REP> d-------- C:\Program Files\TechSmith
2008-06-14 03:23 . 2008-06-14 03:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TechSmith
2008-06-14 03:11 . 2004-09-30 13:42 159,744 --a------ C:\WINDOWS\system32\igfxres.dll
2008-06-14 02:41 . 2008-06-14 03:36 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-06-14 02:41 . 2008-06-14 03:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-13 01:48 . 2008-06-13 01:48 62 --a------ C:\WINDOWS\MyProg.ini
2008-06-13 01:47 . 2008-06-13 01:49 <REP> d-------- C:\Program Files\Easy-Hide-IP
2008-06-13 01:21 . 2008-06-13 01:22 <REP> d-------- C:\Program Files\SpeederXP
2008-06-12 22:21 . 2008-06-12 22:22 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Globe7
2008-06-12 22:20 . 2008-06-13 16:03 <REP> d-------- C:\Program Files\Globe7
2008-06-12 02:52 . 2008-06-12 02:52 <REP> d-------- C:\Program Files\TrueTransparency
2008-06-11 15:01 . 2008-06-11 15:01 <REP> d-------- C:\Program Files\UEFA Euro 08
2008-06-10 15:25 . 2008-06-10 15:25 45,008 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-06-10 04:28 . 2008-06-10 04:28 <REP> d-------- C:\Program Files\Safari
2008-06-10 04:27 . 2008-06-10 04:27 <REP> d-------- C:\Program Files\Apple Software Update
2008-06-10 04:27 . 2008-06-10 04:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-06-10 03:42 . 2008-06-10 03:42 <REP> d-------- C:\Program Files\BurstCopy
2008-06-10 03:42 . 2008-06-10 03:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\BurstCopy Labs
2008-06-10 01:54 . 2008-06-10 01:54 <REP> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-06-10 01:12 . 2008-06-10 01:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-06-10 01:12 . 2008-06-10 01:12 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-06-10 01:12 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-06-10 01:11 . 2008-06-10 01:12 <REP> d-------- C:\Program Files\TuneUp Utilities 2008
2008-06-07 20:53 . 2008-06-07 20:53 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2008-06-07 02:15 . 2008-06-07 04:45 <REP> d-------- C:\Program Files\RogueRemover PRO
2008-06-07 02:15 . 2008-06-07 02:15 2,015 -r-h----- C:\WINDOWS\system32\drivers\hosts
2008-06-06 21:36 . 2008-06-08 14:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-06-06 16:03 . 2008-06-06 16:03 <REP> d-------- C:\Program Files\%temp&
2008-06-06 16:01 . 2008-06-06 16:01 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\ESET
2008-06-05 02:50 . 2008-06-13 01:30 <REP> d-------- C:\Program Files\Flash Slideshow Maker Professional
2008-06-04 02:55 . 2008-06-07 21:14 626,688 --a------ C:\WINDOWS\system32\agsaamh.dll
2008-06-04 02:55 . 2008-06-07 21:13 495,104 --a------ C:\WINDOWS\system32\ALOVideoCoreM.dll
2008-06-04 02:55 . 2008-06-07 21:13 403,968 --a------ C:\WINDOWS\system32\ALOWMAFile2.dll
2008-06-04 02:55 . 2008-06-07 21:13 215,552 --a------ C:\WINDOWS\system32\ALOWMVFile.dll
2008-06-04 02:55 . 2008-06-07 21:13 188,416 --a------ C:\WINDOWS\system32\ALOVideoFile.dll
2008-06-04 02:54 . 2008-06-07 21:13 780,288 --a------ C:\WINDOWS\system32\ALOVideoCompress.dll
2008-06-04 02:54 . 2008-06-07 21:14 544,256 --a------ C:\WINDOWS\system32\agsaamd.dll
2008-06-04 02:54 . 2008-06-07 21:13 249,856 --a------ C:\WINDOWS\system32\ALOQuickTimeFile.dll
2008-06-04 02:52 . 2006-11-06 15:30 262,144 --a------ C:\WINDOWS\system32\lame_enc.dll
2008-06-04 02:52 . 2006-07-29 01:22 51,712 --a------ C:\WINDOWS\system32\coodest.dll
2008-06-04 02:51 . 2005-05-19 14:42 1,458,176 --a------ C:\WINDOWS\system32\osenxpsuite2005.ocx
2008-06-04 02:51 . 2002-01-05 06:48 974,848 --a------ C:\WINDOWS\system32\mfc70.dll
2008-06-04 02:51 . 2002-01-05 05:40 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll
2008-06-04 02:51 . 2002-01-05 11:37 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
2008-06-04 02:51 . 2005-05-16 16:27 53,248 --a------ C:\WINDOWS\system32\AloFrame.ocx
2008-06-04 02:51 . 2005-05-19 03:17 40,960 --a------ C:\WINDOWS\system32\osenxpsuite2005.dll
2008-06-04 02:49 . 2008-06-04 02:50 <REP> d-------- C:\WINDOWS\system32\RMBin
2008-06-04 02:49 . 2008-06-04 02:49 <REP> d-------- C:\Program Files\Ozone
2008-05-31 19:57 . 2008-05-31 19:57 <REP> d-------- C:\Program Files\OllyICE
2008-05-30 22:08 . 2007-10-29 03:38 375,394 --a------ C:\WINDOWS\system32\Untitled_0000.ico
2008-05-30 21:44 . 2008-05-30 21:44 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-05-28 21:54 . 2008-06-11 02:30 <REP> d-------- C:\Program Files\Dart Karaoke Studio
2008-05-28 21:54 . 2003-03-19 06:19 1,060,864 --a------ C:\WINDOWS\system32\MFC71.DLL
2008-05-28 21:54 . 2003-03-19 06:12 1,047,552 --a------ C:\WINDOWS\system32\MFC71U.DLL
2008-05-28 21:54 . 2003-03-19 04:05 89,088 --a------ C:\WINDOWS\system32\ATL71.DLL
2008-05-27 21:57 . 2008-06-06 15:56 <REP> d-------- C:\Program Files\ESET
2008-05-27 21:57 . 2008-06-06 15:56 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-05-27 21:43 . 2008-05-27 21:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-05-27 21:22 . 2008-05-27 21:22 <REP> d--h----- C:\$AVG8.VAULT$
2008-05-27 21:11 . 2008-05-27 21:11 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\AVGTOOLBAR
2008-05-27 21:10 . 2008-05-27 21:10 <REP> d-------- C:\Program Files\AVG
2008-05-27 17:17 . 2008-05-27 20:29 <REP> d--h----- C:\WINDOWS\msdownld.tmp
2008-05-27 17:17 . 2008-05-27 20:29 <REP> d-------- C:\temp\ext48948
2008-05-27 17:17 . 2008-05-27 17:17 <REP> d-------- C:\temp
2008-05-27 17:17 . 2008-05-27 20:28 <REP> d-------- C:\Program Files\Microsoft FrontPage Express
2008-05-27 17:17 . 2008-05-27 20:29 91 --a------ C:\WINDOWS\fpxpress.ini
2008-05-26 04:08 . 2008-05-26 04:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\GRETECH
2008-05-26 04:07 . 2008-05-26 04:07 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\GRETECH
2008-05-26 04:06 . 2008-05-26 04:06 <REP> d-------- C:\Program Files\GRETECH
2008-05-21 03:14 . 2008-05-28 03:52 <REP> d-------- C:\Program Files\intocartoonpro
2008-05-21 03:00 . 2008-05-21 03:00 <REP> d-------- C:\Program Files\CoffeeCup Software
2008-05-21 03:00 . 2008-05-21 03:00 13 --a------ C:\WINDOWS\system32\WinSys16.crc
2008-05-21 02:29 . 2008-06-06 22:02 <REP> d-------- C:\Program Files\Mobile Connect
2008-05-21 02:29 . 2008-05-21 02:29 <REP> d--h----- C:\Program Files\InstallShield Installation Information
2008-05-21 02:29 . 2008-05-21 02:29 <REP> d-------- C:\Program Files\Fichiers communs\InstallShield
2008-05-20 21:37 . 2008-06-06 03:37 <REP> d-------- C:\Program Files\Folder Lock
2008-05-20 21:37 . 2004-05-10 12:42 110,592 --a------ C:\WINDOWS\system32\suppdll.dll
2008-05-20 21:37 . 2007-02-07 19:50 77,824 --a------ C:\WINDOWS\system32\FLKill.exe
2008-05-20 21:37 . 2008-05-20 21:37 35,363 --a------ C:\WINDOWS\system32\windrvNT.sys
2008-05-20 21:27 . 2007-04-09 11:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll
2008-05-20 21:27 . 2008-05-20 21:27 379 --a------ C:\WINDOWS\ODBC.INI
2008-05-20 21:23 . 2008-05-20 21:23 <REP> d-------- C:\Program Files\Microsoft.NET
2008-05-20 21:22 . 2008-05-20 21:22 <REP> d-------- C:\Program Files\Microsoft ActiveSync
2008-05-20 21:20 . 2008-05-20 21:23 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-05-19 22:06 . 2008-05-19 22:13 <REP> d-------- C:\Program Files\Star Defender 4
2008-05-19 22:06 . 2008-05-19 22:06 <REP> d-------- C:\Program Files\ReflexiveArcade
2008-05-19 03:29 . 2008-05-19 03:29 2,322,816 --a------ C:\WINDOWS\system32\TUKernel.exe
2008-05-18 21:50 . 2008-05-25 02:37 17 --a------ C:\WINDOWS\popcinfo.dat
2008-05-18 20:32 . 2008-05-18 20:32 <REP> d-------- C:\WINDOWS\gldirect
2008-05-18 20:32 . 2008-05-18 20:32 <REP> d-------- C:\Program Files\GLDirect
2008-05-18 20:32 . 2003-09-18 17:01 48,672 --a------ C:\WINDOWS\system32\drivers\pmhelp.sys
2008-05-18 20:32 . 2003-09-18 17:01 10,112 --a------ C:\WINDOWS\system32\drivers\pmfilt.sys
2008-05-14 21:21 . 2008-05-14 21:24 5,376 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-14 19:51 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\DMCache
2008-06-13 01:28 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-06-11 02:29 --------- d-----w C:\Program Files\Error Repair Professional
2008-06-10 04:29 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Apple Computer
2008-06-07 21:14 90,112 ----a-w C:\WINDOWS\system32\agsaami.dll
2008-06-07 21:14 753,664 ----a-w C:\WINDOWS\system32\agsaamg.dll
2008-06-07 21:14 538,624 ----a-w C:\WINDOWS\system32\agsaamb.dll
2008-06-07 21:14 372,736 ----a-w C:\WINDOWS\system32\agsaamc.dll
2008-06-07 21:14 331,776 ----a-w C:\WINDOWS\system32\agsaama.dll
2008-06-07 21:14 2,846,720 ----a-w C:\WINDOWS\system32\agsaamj.dll
2008-06-07 21:13 90,112 ----a-w C:\WINDOWS\system32\ALOAudioFormatSettings3.dll
2008-06-07 21:13 877,568 ----a-w C:\WINDOWS\system32\ALOAudioFile2.dll
2008-06-07 21:13 778,240 ----a-w C:\WINDOWS\system32\ALOAudioCompress2.dll
2008-06-07 21:13 382,464 ----a-w C:\WINDOWS\system32\ALOAVIFile.dll
2008-06-07 21:13 2,846,720 ----a-w C:\WINDOWS\system32\ALOAudioCompress3.dll
2008-06-07 21:13 1,245,184 ----a-w C:\WINDOWS\system32\bkll.dll
2008-06-07 14:51 --------- d-----w C:\Program Files\INAC
2008-06-06 22:02 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-06-06 22:02 --------- d-----w C:\Program Files\Sleepy
2008-06-04 02:53 344,064 ----a-w C:\WINDOWS\system32\dkll.dll
2008-06-04 02:53 196,608 ----a-w C:\WINDOWS\system32\maag.dll
2008-06-04 02:53 1,986,560 ----a-w C:\WINDOWS\system32\akll.dll
2008-06-04 02:53 1,212,416 ----a-w C:\WINDOWS\system32\ckll.dll
2008-05-31 15:03 --------- d-----w C:\Program Files\Internet Download Manager
2008-05-31 04:02 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-30 21:44 --------- d-----w C:\Program Files\Fichiers communs\Real
2008-05-30 21:43 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-05-30 21:43 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-05-27 20:56 85,724 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-27 20:56 5,696,800 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-27 20:56 344,096 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-27 20:56 26,144 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-27 20:52 --------- d-----w C:\Program Files\Kaspersky Lab
2008-05-27 20:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-21 02:34 67,645 ----a-w C:\WINDOWS\system32\drivers\pshook11.sys
2008-05-17 02:12 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\IDM
2008-05-14 21:24 71,634 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-05-14 21:24 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-05-14 20:25 --------- d-----w C:\Program Files\JetAudio
2008-05-12 04:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-12 03:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\INAC
2008-05-12 03:22 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\INAC
2008-05-11 16:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-05-11 06:38 --------- d-----w C:\Program Files\Real
2008-05-06 16:21 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Diino
2008-05-05 03:38 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-05-05 03:23 --------- d-----w C:\Program Files\Windows Live
2008-05-05 03:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-01 00:14 --------- d-----w C:\Program Files\File Recover
2008-04-29 18:04 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\COWON
2008-04-28 18:51 --------- d-----w C:\Program Files\IObit
2008-04-27 20:37 --------- d-----w C:\Program Files\Nmedia
2008-04-26 12:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
2008-04-26 12:31 --------- d-----w C:\Program Files\MSN Messenger
2008-04-25 01:50 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-04-25 00:49 --------- d-----w C:\Program Files\Samy Soft
2008-04-24 19:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-24 19:04 --------- d-----w C:\Program Files\ESTsoft
2008-04-24 19:04 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\ESTsoft
2008-04-24 01:30 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Media Player Classic
2008-04-24 00:28 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\TuneUp Software
2008-04-23 22:06 --------- d-----w C:\Program Files\myproxy
2008-04-23 19:19 --------- d-----w C:\Program Files\Analog Devices
2008-04-23 18:44 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-23 18:42 --------- d-----w C:\Program Files\Services en ligne
2008-04-23 15:00 71,176 ----a-w C:\WINDOWS\system32\drivers\epfw.sys
2008-04-23 15:00 54,280 ----a-w C:\WINDOWS\system32\drivers\epfwtdi.sys
2008-04-23 15:00 30,728 ----a-w C:\WINDOWS\system32\drivers\epfwndis.sys
2008-04-23 14:53 29,704 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
2008-04-23 14:52 40,456 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\divx.dll
2008-03-28 17:41 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
.
كود:
<pre>
----a-w 1,560,576 2008-04-26 08:16:56 C:\Documents and Settings\Administrateur\Mes documents\Downloads\Compressed\ديك\Sandaly Bouquets TV v 1.1\Sandaly Bouquets TV v 1.1 .exe
</pre>
------- Sigcheck -------
2004-08-19 16:09 694784 848baaf9d7e2a2ce9ca1cd0c2db43833 C:\WINDOWS\system32\wininet.dll
2004-08-19 16:09 694784 848baaf9d7e2a2ce9ca1cd0c2db43833 C:\WINDOWS\system32\dllcache\wininet.dll
2004-08-19 16:09 978432 c2e06cb7cfb5dbd8767ddd5e2e18cf71 C:\WINDOWS\explorer.exe
2007-06-13 13:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:\WINDOWS\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2gdr\explorer.exe
2007-06-13 13:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2qfe\explorer.exe
2004-08-19 16:09 978432 c2e06cb7cfb5dbd8767ddd5e2e18cf71 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 22:05 630784]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-04-23 14:57 1443072]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-09-30 13:41 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-09-30 13:37 126976]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-05-30 21:43 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
C:\Documents and Settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 07:43:08 180224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background
"IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe /onboot
"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
"GLDStart"=C:\Program Files\GLDirect\gldirect.exe -filterstart
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\zyzoom.exe" /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R0 pmfilt;pmfilt;C:\WINDOWS\system32\drivers\pmfilt.sys [2003-09-18 17:01]
R0 pmhelp;pmhelp;C:\WINDOWS\system32\drivers\pmhelp.sys [2003-09-18 17:01]
R2 EasyHideIP;EasyHideIP;C:\Program Files\Easy-Hide-IP\services\EasyHideIp.exe [2007-01-09 14:38]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-19 16:10]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-06-10 01:12]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
*Newly Created Service* - CATCHME
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E4066320-E4AE-11CF-B1B0-00AA00BBAD66}]
rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\fpxpress.inf,PerUserstub
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-06-13 17:18:25 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-06-14 18:53:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-14 19:09:03 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-06-14 19:57:36
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés:
**************************************************************************
.
Temps d'accomplissement: 2008-06-14 19:58:12
ComboFix-quarantined-files.txt 2008-06-14 19:58:09
Pre-Run: 5,866,360,832 octets libres
Post-Run: 5,964,148,736 octets libres
274 --- E O F --- 2008-04-26 20:34:30
