Posez votre question Format imprimable Liste des forums Aidez-les Statistiques Rechercher Charte Forum Virus-Sécurité

Problème avec Total Security version 4.52

Dernière réponse le 2 oct 2009 à 10:35:43 Tim, le 24 aoû 2009 à 20:03:57

Signaler ce message aux modérateurs

Bonjour,
J'ai aussi attrapé Total Security version 4.52, peux-t-on m'aider?? en lisant qqles discussions du site j'ai téléchargé List_Killem voici sa réponse en mode recherche:

List'em by g3n-h@ckm@n 1.0.2.8

updated on 23.08.2009 ::::: 13.00

Microsoft Windows XP [version 5.1.2600]

24/08/2009 19:59:16,84

Infections :
==========

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

"C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
"C:\WINDOWS\services.exe"
"C:\Documents and Settings\Timoth‚\Application Data\wiaserva.log"
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\ose00000.exe
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\setup_wm.exe
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\TMP13.tmp
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\TMP15.tmp
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\TMP25.tmp
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\TMP2B.tmp

¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

HKLM\Software\Microsoft\Windows\CurrentVersion\Run "PromoReg"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "Services"
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\SYSTEM\CurrentControlSet\Services\mchInjDrv

¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

12201094.EXE-014AF205.pf
ACRORD32.EXE-356875A2.pf
ADOBEUPDATER.EXE-3658C422.pf
AVCENTER.EXE-058B10AA.pf
AVCONFIG.EXE-0157B89D.pf
AVGNT.EXE-11EBE658.pf
AVNOTIFY.EXE-32FAE179.pf
AVSCAN.EXE-181AB66D.pf
AVWSC.EXE-347FCF75.pf
CMD.EXE-087B4001.pf
DEFRAG.EXE-273F131E.pf
DFRGNTFS.EXE-269967DF.pf
DLLHOST.EXE-205D880D.pf
EXPORTCONTROLLER.EXE-0303443A.pf
FIREFOX.EXE-28641590.pf
GUARDGUI.EXE-2C20A958.pf
HELPSVC.EXE-2878DDA2.pf
IMAPI.EXE-0BF740A4.pf
INSTALL.EXE-0155ED35.pf
Layout.ini
LIST_KILLEM.EXE-2BE67415.pf
LOGON.SCR-151EFAEA.pf
LOGONUI.EXE-0AF22957.pf
MMC.EXE-06C90BC7.pf
MODE.COM-31685BAE.pf
NCLINSTALLER.EXE-35BFFB75.pf
NETSH.EXE-085CFFDE.pf
NOTEPAD.EXE-336351A9.pf
NTOSBOOT-B00DFAAD.pf
PDFUPD.EXE-00F6EF06.pf
PING.EXE-31216D26.pf
PREUPD.EXE-0C5BC219.pf
QUICKTIMEPLAYER.EXE-280B4828.pf
REG.EXE-0D2A95F7.pf
REGSVR32.EXE-25EEFE2F.pf
RUNDLL32.EXE-119FC5ED.pf
RUNDLL32.EXE-1857459C.pf
RUNDLL32.EXE-29ACD517.pf
RUNDLL32.EXE-4489B61B.pf
RUNDLL32.EXE-451FC2C0.pf
RUNDLL32.EXE-483E13BB.pf
RUNDLL32.EXE-4BD19A5C.pf
SERVICES.EXE-2B0DDD57.pf
SETUP_WM.EXE-3135CBD6.pf
SNDVOL32.EXE-383480B7.pf
SOFTWAREUPDATE.EXE-1415D1B8.pf
SVCHOST.EXE-3530F672.pf
SYSOCMGR.EXE-31169C54.pf
UNSECAPP.EXE-1A95A33B.pf
UPDATE.EXE-264167D5.pf
UTORRENT.EXE-34C48AEF.pf
UTORRENT.EXE-3888D1B0.pf
VLC.EXE-22DF01AA.pf
WINWORD.EXE-07381162.pf
WMIADAP.EXE-2DF425B2.pf
WMIPRVSE.EXE-28F301A9.pf
WMPLAYER.EXE-18DDEF9C.pf
WMPLAYER.EXE-18DDEF9D.pf
WMPLAYER.EXE-18DDEF9F.pf
WMPLAYER.EXE-18DDEFA2.pf
WMPLAYER.EXE-18DDEFA3.pf
WMPLAYER.EXE-18DDEFA5.pf
WPV351250826839.EXE-17A6FA79.pf
WPV901250998894.EXE-31D34616.pf
WPV961251033318.EXE-3B7BD062.pf
WUAUCLT.EXE-399A8E72.pf
_EX-08.EXE-2630CB5F.pf
_EX-68.EXE-08054179.pf

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

merci d'avance

Configuration: Windows XP
Firefox 3.0.13

Posez votre question Répondre

ric025, le 24 aoû 2009 à 20:32:13

Salut.

Relance List KillEm, fais l'option 2.

Poste le rapport obtenu.

Fais ceci ensuite :

▶ Télécharge Malwarebytes Anti-Malware (MBAM):

MBAM

▶ Installe-le en vérifiant que la case de mise à jour soit bien cochée en fin d'installation.

▶ Après la mise à jour, lance-le et coche "Examen Complet". Puis "Rechercher".

▶ Si MBAM trouve quelque chose: fais "Voir les résultats" puis "Supprimer la sélection".

▶ Poste le rapport généré.

++ ~~ XÞ SÞ3 ~~ ƒireƒØX + WØT + ÅßÞ + ÑS + Åthéñå ©SM ~~ Åvirå + MßÅM + Þ© TØØLS ~~

Répondre à ric025

Tim, le 24 aoû 2009 à 20:36:16

Merci de me répondre le scan en mode destruction est en cours

Répondre à Tim

Tim, le 24 aoû 2009 à 20:37:04

Voici le rapport:

Infections :
==========

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

HKLM\Software\Microsoft\Windows\CurrentVersion\Run "PromoReg"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "Services"
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\SYSTEM\CurrentControlSet\Services\mchInjDrv

¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

Layout.ini
NTOSBOOT-B00DFAAD.pf
REG.EXE-0D2A95F7.pf

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Répondre à Tim

Tim, le 24 aoû 2009 à 20:38:20

Kill'em by g3n-h@ckm@n 1.0.2.8

updated on 23.08.2009 ::::: 13.00

Microsoft Windows XP [version 5.1.2600]

24/08/2009 20:34:20,45

Fichiers analysés :
=================

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

"C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
"C:\WINDOWS\services.exe"
"C:\Documents and Settings\Timoth‚\Application Data\wiaserva.log"
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\ose00000.exe
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\setup_wm.exe
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\TMP13.tmp
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\TMP15.tmp
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\TMP17.tmp
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\TMP25.tmp
C:\Documents and Settings\Timoth‚\LOCAL Settings\Temp\TMP2B.tmp

¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers :

Quarantaine :

ose00000.exe.Kill'em
qmgr0.dat.Kill'em
qmgr1.dat.Kill'em
services.exe.Kill'em
setup_wm.exe.Kill'em
TMP13.tmp.Kill'em
TMP15.tmp.Kill'em
TMP17.tmp.Kill'em
TMP25.tmp.Kill'em
TMP2B.tmp.Kill'em
wiaserva.log.Kill'em
{3276BE95_AF08_429F_A64F_CA64CB79BCF6}.Kill'em

¤¤¤¤¤¤¤¤¤¤ Verification :

Infections :
==========

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

HKLM\Software\Microsoft\Windows\CurrentVersion\Run "PromoReg"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "Services"
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\SYSTEM\CurrentControlSet\Services\mchInjDrv

¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

Layout.ini
NTOSBOOT-B00DFAAD.pf
REG.EXE-0D2A95F7.pf

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Répondre à Tim

Tim, le 24 aoû 2009 à 21:02:34

Voici le rapport de de malwarebytes':

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2690
Windows 5.1.2600 Service Pack 2

24/08/2009 21:01:27
mbam-log-2009-08-24 (21-01-27).txt

Type de recherche: Examen complet (C:\|E:\|G:\|)
Eléments examinés: 131655
Temps écoulé: 20 minute(s), 26 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 7
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 8

Processus mémoire infecté(s):
C:\Documents and Settings\All Users\Application Data\12201094\12201094.exe (Rogue.Multiple.H) -> Unloaded process successfully.
C:\WINDOWS\Temp\_ex-08.exe (Trojan.Dropper) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12201094 (Rogue.Multiple.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\promoreg (Trojan.Dropper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\host (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\id (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services (Trojan.SpamBot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Services\del (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RList (Malware.Trace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\12201094 (Rogue.Multiple.H) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\12201094\12201094 (Rogue.Multiple.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\12201094\12201094.exe (Rogue.Multiple.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\12201094\pc12201094ins (Rogue.Multiple.H) -> Quarantined and deleted successfully.
C:\Program Files\Steinberg\Nuendo 3\UNWISE.EXE (Malware.Packer.Morphine) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\_ex-08.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\wpv351250826839.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\wpv961251033318.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Timothé\Menu Démarrer\Programmes\Démarrage\ikowin32.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Répondre à Tim

Tim, le 24 aoû 2009 à 21:03:39

Le programme me demande de redémarrer j'accepte??

Répondre à Tim

ric025, le 24 aoû 2009 à 21:49:45

Oui ! ;) ~~ XÞ SÞ3 ~~ ƒireƒØX + WØT + ÅßÞ + ÑS + Åthéñå ©SM ~~ Åvirå + MßÅM + Þ© TØØLS ~~

Répondre à ric025

Tim, le 24 aoû 2009 à 21:53:49

ça gère total security ne s'affiche plus!!! merci bcp mon ordi n'est dc plus infecté??
j'ai une petite question supplémentaire: je veux supprimer mon anti virus faute d'abonnement = plus de mise à jour existe-t-il un anti virus gratuit dispo sur le net??

Répondre à Tim

Tim, le 24 aoû 2009 à 21:55:34

Ah oui aussi! es-ce que je peux désinstaller et supprimer les programmes??

Répondre à Tim

ric025, le 24 aoû 2009 à 21:57:46

Il y a tout ça, oui. Mais tu n'es pas encore désinfecté. ;)

Vide la quarantaine de MBAM. Pour cela, ouvre-le, va sur l'onglet "Quarantaine" et supprime tout.

Puis fais ceci :

▶ Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

http://images.malwareremoval.com/random/RSIT.exe

▶ Double-clique sur RSIT.exe.

▶ Clique sur Continue à l'écran Disclaimer.

▶ Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

▶ Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

▶ A noter: Les rapports se trouvent également ici: C:\rsit.

++

~~ XÞ SÞ3 ~~ ƒireƒØX + WØT + ÅßÞ + ÑS + Åthéñå ©SM ~~ Åvirå + MßÅM + Þ© TØØLS ~~

Répondre à ric025

Tim, le 24 aoû 2009 à 22:09:27

Alors voici le log:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Timothé at 2009-08-24 22:07:52
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 18 GB (24%) free of 76 GB
Total RAM: 1023 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:08:15, on 24/08/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\Timothé\Bureau\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\Timothé.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
End of file - 5961 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}]
PDFCreator Toolbar Helper - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2009-04-14 806912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - PDFCreator Toolbar - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2009-04-14 806912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\HDAShCut.exe [2004-10-27 61952]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.5.0\bin\jusched.exe [2008-08-08 36972]
"avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-02-12 262401]
"VirtualCloneDrive"=C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [2006-04-29 94208]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2007-05-11 40048]
"H2O"=C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe [2005-10-23 385024]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2005-03-23 90112]
"AlcWzrd"=C:\WINDOWS\ALCWZRD.EXE [2005-03-23 2803712]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-03-23 69632]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-27 7405568]
"nwiz"=nwiz.exe /install []
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"PCSuiteTrayApplication"=C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [2007-06-18 271360]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-01-06 290088]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-05 15360]
"SuperCopier2.exe"=C:\Program Files\SuperCopier2\SuperCopier2.exe [2006-07-07 1052672]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2009-08-24 288048]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16f8f7cc-0e25-11de-8f5b-0013cea25cba}]
shell\Auto\command - AdobeR.exe e
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b7ce73a-9bd0-11dd-8e8b-0013cea25cba}]
shell\Auto\command - AdobeR.exe e
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91a185f6-0c87-11de-8f54-0013cea25cba}]
shell\Auto\command - AdobeR.exe e
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{abd9b2f0-fe76-11dd-8f2a-0013cea25cba}]
shell\AutoRun\command - WD_Windows_Tools\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b5f71798-367d-11de-8f98-0013cea25cba}]
shell\AutoRun\command - F:\LaunchU3.exe -a

======File associations======

.scr - open - "C:\WINDOWS\notepad.exe" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2009-08-24 22:07:53 ----D---- C:\Program Files\trend micro
2009-08-24 22:07:52 ----D---- C:\rsit
2009-08-24 20:39:18 ----D---- C:\Documents and Settings\Timothé\Application Data\Malwarebytes
2009-08-24 20:39:13 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-08-24 20:39:13 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-08-24 20:37:37 ----A---- C:\List'em mode destruction.txt
2009-08-24 20:34:20 ----D---- C:\Kill'em
2009-08-24 20:34:20 ----A---- C:\Kill'em.txt
2009-08-24 20:29:30 ----A---- C:\WINDOWS\ntbtlog.txt
2009-08-24 04:40:27 ----A---- C:\List'em.txt
2009-08-24 04:11:06 ----D---- C:\Program Files\uTorrent

======List of files/folders modified in the last 1 months======

2009-08-24 22:08:03 ----D---- C:\WINDOWS\Prefetch
2009-08-24 22:07:53 ----RD---- C:\Program Files
2009-08-24 21:59:50 ----D---- C:\Documents and Settings\Timothé\Application Data\uTorrent
2009-08-24 21:53:40 ----D---- C:\WINDOWS\system32
2009-08-24 21:53:39 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-08-24 21:50:08 ----D---- C:\Program Files\Mozilla Firefox
2009-08-24 21:49:49 ----D---- C:\WINDOWS\Temp
2009-08-24 21:49:11 ----D---- C:\WINDOWS\system32\drivers
2009-08-24 21:48:49 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-08-24 20:34:37 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-08-24 20:34:37 ----D---- C:\WINDOWS
2009-08-24 20:32:55 ----D---- C:\WINDOWS\system32\CatRoot2
2009-08-24 04:25:20 ----A---- C:\WINDOWS\NeroDigital.ini
2009-08-21 23:12:38 ----D---- C:\Documents and Settings\Timothé\Application Data\dvdcss

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-03-04 79424]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2007-08-07 25160]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-05 40320]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R1 VClone;VClone; C:\WINDOWS\system32\DRIVERS\VClone.sys [2008-03-29 25344]
R1 WmiAcpi;Interface de gestion Microsoft Windows pour ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-03 8832]
R2 CdaC15BA;CdaC15BA; \??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS []
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-05 60800]
R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys []
R3 CLEDX;Team H2O CLEDX service; C:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 33792]
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-04 14080]
R3 ElbyDelay;ElbyDelay; C:\WINDOWS\System32\Drivers\ElbyDelay.sys [2007-02-16 11984]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-10-27 138240]
R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-03-23 2547008]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-05 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-27 3640928]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 w29n51;Pilote de carte de connexion réseau Intel(R) PRO/Wireless 2200BG pour Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2005-09-12 3298432]
S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
S2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [2001-06-22 73728]
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-10-27 145920]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2007-02-22 137216]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2007-02-22 8320]
S3 nmwcdcj;Nokia USB Port; C:\WINDOWS\system32\drivers\nmwcdcj.sys [2007-02-22 12288]
S3 nmwcdcm;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2007-02-22 12288]
S3 U2SP;USB to Serial Converter Driver(Philips); C:\WINDOWS\system32\DRIVERS\u2s2kxp.sys [2003-05-14 23948]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-10-01 32000]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2004-08-11 18944]
S4 mchinjdrv;mchinjdrv; \??\C:\DOCUME~1\TIMOTH~1\LOCALS~1\Temp\mc21.tmp []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;Avira AntiVir Personal – Free Antivirus Scheduler; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-03-07 68865]
R2 AntiVirService;Avira AntiVir Personal – Free Antivirus Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-03-26 147201]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 C-DillaCdaC11BA;C-DillaCdaC11BA; C:\WINDOWS\system32\drivers\CDAC11BA.EXE [2009-02-20 54784]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-27 143428]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-01-06 536872]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-06-15 300544]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2003-02-20 32768]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

Répondre à Tim

Tim, le 24 aoû 2009 à 22:10:10

Et l'info:

info.txt logfile of random's system information tool 1.06 2009-08-24 22:08:17

======Uninstall list======

-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.58 beta-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.0 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81000000003}
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
AutoCAD 2004-->MsiExec.exe /I{5783F2D7-0201-040C-0002-0060B0CE6BBA}
Autodesk Express Viewer-->C:\PROGRA~1\Autodesk\AUTODE~1\Setup.exe /remove
Avira AntiVir Personal – Free Antivirus-->C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
Covadis Topo 2004-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Géomédia\Covadis Topo 2004\UnCova16.isu"
Diablo II-->C:\WINDOWS\DIIUnin.exe C:\WINDOWS\DIIUnin.dat
foobar2000-->"C:\Program Files\foobar2000\uninstall.exe"
Fx-Interface 1.9.6-->"C:\Program Files\CASIO\Fx-Interface\unins000.exe"
Guitar Pro 5.0-->"C:\Program Files\Guitar Pro 5\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
iTunes-->MsiExec.exe /I{F5C63795-2708-4D15-BF18-5ABBFF7DFFC8}
J2SE Runtime Environment 5.0-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150000}
Le Centre de Contrôle de Licences de Syncrosoft-->C:\PROGRA~1\SYNCRO~1\UNWISE.EXE C:\PROGRA~1\SYNCRO~1\INSTALL.LOG
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Mozilla Firefox (3.0.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Nero Suite-->C:\Program Files\Fichiers communs\Nero\Uninstall\Setupx.exe /uninstall ExtraUninstallID=""
Nokia Connectivity Cable Driver-->MsiExec.exe /X{11964613-805F-432D-A12B-169554B793E7}
Nokia PC Suite-->C:\Documents and Settings\All Users\Application Data\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Nokia_PC_Suite_6_84_10_3_EA.exe
Nokia PC Suite-->MsiExec.exe /I{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}
NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Package de pilotes Windows - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccswpddri_044C8712DB44F83D9DE6C376991EE9254E0A69E4\pccswpddriver.inf
Package de pilotes Windows - Nokia Modem (02/15/2007 3.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccs_bluet_8B37DC72918CCD58A6EC20373AF6242B037A293B\pccs_bluetooth.inf
Package de pilotes Windows - Nokia Modem (02/15/2007 3.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccs_bluet_F12A08B6F776984A95553486F64C541356F86E38\pccs_bluetooth.inf
Package de pilotes Windows - Nokia Modem (05/24/2007 6.84.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_5E1541AFF1E1EA3554CE566743CCAD323ED1C108\nokbtmdm.inf
PC Connectivity Solution-->MsiExec.exe /I{99A40651-0BC2-4095-8F9A-A40FAB224FEF}
PDFCreator Toolbar-->"C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_2312.exe" _?=C:\Program Files\PDFCreator Toolbar
PDFCreator-->C:\Program Files\PDFCreator\unins000.exe
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" REMOVE
SafeCast Shared Components-->C:\Program Files\Fichiers communs\Macrovision Shared\SafeCast\Install\CDAC13BA.EXE /uninstall
Sentinel System Driver-->C:\WINDOWS\SYSTEM32\RNBOSENT\SETUPX86.EXE /U /q
Steinberg Nuendo v3.1.1.944-->C:\PROGRA~1\STEINB~1\NUENDO~1\UNWISE.EXE C:\PROGRA~1\STEINB~1\NUENDO~1\INSTALL.LOG
SuperCopier2-->"C:\Program Files\SuperCopier2\SC2Uninst.exe"
SyncroSoft Emu (Remove only)-->C:\Program Files\SyncroSoft\Pos\H2O\Uninst.exe
VideoLAN VLC media player 0.8.6d-->C:\Program Files\VideoLAN\VLC\uninstall.exe
VirtualCloneDrive-->"C:\Program Files\Elaborate Bytes\VirtualCloneDrive\vcd-uninst.exe" /D="C:\Program Files\Elaborate Bytes\VirtualCloneDrive"
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll

======Security center information======

AV: Avira AntiVir PersonalEdition (outdated)

======System event log======

Computer Name: TIM
Event Code: 7036
Message: Le service ServiceLayer est entré dans l'état : en cours d'exécution.

Record Number: 12822
Source Name: Service Control Manager
Time Written: 20090721193948.000000+120
Event Type: Informations
User:

Computer Name: TIM
Event Code: 7036
Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : arrêté.

Record Number: 12821
Source Name: Service Control Manager
Time Written: 20090721193948.000000+120
Event Type: Informations
User:

Computer Name: TIM
Event Code: 7036
Message: Le service Service de l’iPod est entré dans l'état : en cours d'exécution.

Record Number: 12820
Source Name: Service Control Manager
Time Written: 20090721193948.000000+120
Event Type: Informations
User:

Computer Name: TIM
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service de l’iPod.

Record Number: 12819
Source Name: Service Control Manager
Time Written: 20090721193948.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: TIM
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service ServiceLayer.

Record Number: 12818
Source Name: Service Control Manager
Time Written: 20090721193948.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Fichiers communs\Autodesk Shared\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0d08
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.5.0\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.5.0\lib\ext\QTJava.zip

-----------------EOF-----------------

Répondre à Tim

ric025, le 24 aoû 2009 à 22:23:53

Une belle infection par Disques Amovibles ! ;)

UsbFix XP

Option 1 : recherche

▶ Télécharge UsbFix de C_XX & Chiquitine29
▶ Tutoriel d'installation
▶ Tutoriel recherche

▶ Lance l'installation avec les paramètres par défaut
▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptibles d'avoir été infectées sans les ouvrir
▶ Double clique sur le raccourci UsbFix sur ton bureau
▶ Choisis l'option 1 (recherche)
▶ Laisse travailler l'outil
▶ Ensuite poste le rapport UsbFix.txt qui apparaîtra

* Note : le rapport UsbFix.txt est sauvegardé a la racine du disque

* Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus

++ ~~ XÞ SÞ3 ~~ ƒireƒØX + WØT + ÅßÞ + ÑS + Åthéñå ©SM ~~ Åvirå + MßÅM + Þ© TØØLS ~~

Répondre à ric025

Tim, le 24 aoû 2009 à 22:33:19

Voici le rapport :

############################## | UsbFix V6.022 |

User : Timothé (Administrateurs) # TIM
Update on 24/08/09 by Chiquitine29
Start at: 22:31:37 | 24/08/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

Intel(R) Pentium(R) M processor 1.86GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Enabled
AV : Avira AntiVir PersonalEdition 8.0.1.15 [ Enabled | (!) Outdated ]

C:\ -> Disque fixe local # 74,53 Go (17,55 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque fixe local # 74,53 Go (9,17 Go free) [Tim] # NTFS
F:\ -> Disque amovible # 1,89 Go (784,63 Mo free) # FAT32
G:\ -> Disque CD-ROM
H:\ -> Disque amovible # 1,89 Go (798,91 Mo free) # FAT
I:\ -> Disque amovible # 3,72 Go (962,04 Mo free) # FAT32
J:\ -> Disque fixe local # 232,83 Go (9,68 Go free) [IOMEGA HDD] # FAT32
K:\ -> Disque fixe local # 232,83 Go (37,2 Go free) [TIM] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |

################## | Suspect ! ... | http://www.virustotal.com |

################## | Registre # Clés Run infectieuses |

Présent ! HKLM\software\microsoft\security center "FirewallOverride" ( 0x1 )

################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{16f8f7cc-0e25-11de-8f5b-0013cea25cba}
Shell\Auto\command =AdobeR.exe e
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

HKCU\..\..\Explorer\MountPoints2\{1b7ce73a-9bd0-11dd-8e8b-0013cea25cba}
Shell\Auto\command =AdobeR.exe e
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

HKCU\..\..\Explorer\MountPoints2\{91a185f6-0c87-11de-8f54-0013cea25cba}
Shell\Auto\command =AdobeR.exe e
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

HKCU\..\..\Explorer\MountPoints2\{abd9b2f0-fe76-11dd-8f2a-0013cea25cba}
Shell\AutoRun\command =WD_Windows_Tools\Setup.exe

HKCU\..\..\Explorer\MountPoints2\{b5f71798-367d-11de-8f98-0013cea25cba}
Shell\AutoRun\command =F:\LaunchU3.exe -a

################## | Cracks / Keygens / Serials |

################## | ! Fin du rapport # UsbFix V6.022 ! |

Répondre à Tim

ric025, le 25 aoû 2009 à 02:34:08

Re,

UsbFix XP

Option 2 : suppression

Tutoriel nettoyage
▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectés sans les ouvrir
▶ Double clique sur le raccourci UsbFix présent sur ton bureau
▶ Choisis l'option 2 ( Suppression )
▶ Ton bureau disparaîtra et le pc redémarrera .
▶ Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.
▶ Ensuite poste le rapport UsbFix.txt qui apparaîtra avec le bureau .

* Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

/!\ UsbFix te proposera d'uploader un dossier compressé à cette adresse : http://forum-aide-contre-virus.be/usbfix/choix_fichier.php

▶ Ce dossier a été créé par UsbFix et est enregistré sur ton bureau.
▶ Merci de l'envoyer à l'adresse indiquée afin d'aider l'auteur de UsbFix dans ses recherches.
▶ Merci d'avance pour ta contribution !!

++

~~ XÞ SÞ3 ~~ ƒireƒØX + WØT + ÅßÞ + ÑS + Åthéñå ©SM ~~ Åvirå + MßÅM + Þ© TØØLS ~~

Répondre à ric025

Tim, le 25 aoû 2009 à 12:30:24

Bonjour!

voici donc le rapport:

############################## | UsbFix V6.022 |

User : Timothé (Administrateurs) # TIM
Update on 24/08/09 by Chiquitine29
Start at: 12:24:05 | 25/08/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

Intel(R) Pentium(R) M processor 1.86GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Enabled
AV : Avira AntiVir PersonalEdition 8.0.1.15 [ Enabled | (!) Outdated ]

C:\ -> Disque fixe local # 74,53 Go (17,52 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque fixe local # 74,53 Go (9,17 Go free) [Tim] # NTFS
F:\ -> Disque amovible # 1,89 Go (784,63 Mo free) # FAT32
G:\ -> Disque CD-ROM
H:\ -> Disque amovible # 1,89 Go (798,91 Mo free) # FAT
I:\ -> Disque amovible # 3,72 Go (962,04 Mo free) # FAT32
J:\ -> Disque fixe local # 232,83 Go (9,68 Go free) [IOMEGA HDD] # FAT32
K:\ -> Disque fixe local # 232,83 Go (37,2 Go free) [TIM] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |

################## | Autres |

################## | Suspect ! ... | http://www.virustotal.com |

################## | Registre # Clés Run infectieuses |

# HKLM\software\microsoft\security center "FirewallOverride" # -> Reset sucessfully !

################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{16f8f7cc-0e25-11de-8f5b-0013cea25cba}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{1b7ce73a-9bd0-11dd-8e8b-0013cea25cba}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{91a185f6-0c87-11de-8f54-0013cea25cba}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{abd9b2f0-fe76-11dd-8f2a-0013cea25cba}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{b5f71798-367d-11de-8f98-0013cea25cba}\Shell\AutoRun\Command

################## | Listing des fichiers présent |

[08/08/2008 05:34|--a------|0] -> C:\AUTOEXEC.BAT
[09/08/2008 00:32|-r-hs----|216] -> C:\boot.ini
[05/08/2004 14:00|-rahs----|4952] -> C:\Bootfont.bin
[09/08/2008 00:32|-r-hs----|0] -> C:\config.sys
[17/12/2003 12:17|--a------|602112] -> C:\Cov2004Srv.arx
[08/08/2008 05:34|-rahs----|0] -> C:\IO.SYS
[24/08/2009 20:37|--a------|2069] -> C:\Kill'em.txt
[24/08/2009 20:37|--a------|589] -> C:\List'em mode destruction.txt
[24/08/2009 20:36|--a------|589] -> C:\List'em.txt
[08/08/2008 05:34|-rahs----|0] -> C:\MSDOS.SYS
[05/08/2004 14:00|-rahs----|47564] -> C:\NTDETECT.COM
[05/08/2004 14:00|-rahs----|251712] -> C:\ntldr
[?|?|?] -> C:\pagefile.sys
[25/08/2009 12:26|--a------|3516] -> C:\UsbFix.txt
[28/12/2005 22:26|--a------|0] -> E:\AUTOEXEC.BAT
[09/08/2008 00:32|-r-hs----|234] -> E:\boot.ini
[05/08/2004 14:00|-rahs----|4952] -> E:\Bootfont.bin
[09/08/2008 00:32|-r-hs----|0] -> E:\config.sys
[28/12/2005 22:26|-rahs----|0] -> E:\IO.SYS
[28/12/2005 22:26|-rahs----|0] -> E:\MSDOS.SYS
[05/08/2004 14:00|-rahs----|47564] -> E:\NTDETECT.COM
[28/12/2005 22:43|-rahs----|252240] -> E:\ntldr
[08/08/2008 04:10|--ahs----|1610612736] -> E:\pagefile.sys
[11/09/2008 11:14|--a------|138] -> F:\Fiche m‚tier dans l'h“tellerie et la restauration.url
[14/10/2008 16:19|--a------|34] -> F:\bouquins.txt
[20/02/2009 16:45|--a------|1785539] -> F:\plan mesnil 3 ac symboles clot.dwg
[23/03/2009 16:52|--a------|3873792] -> F:\Rapport de projet 97.doc
[10/06/2009 18:23|--a------|296] -> F:\WMPInfo.xml
[07/06/2008 11:10|--a------|733966336] -> F:\King.Of.California.FRENCH.DVDRiP.XViD-NTK._dvdphoenix.fr.st_.avi
[20/06/2009 18:26|--a------|196717818] -> I:\[DB-FR]_One_Piece_403_subfrench_[D79B2344].avi
[20/06/2009 17:00|--a------|193693696] -> I:\Les Simpsons - Saison 13 Nø17 - Fr - Tout Sur Homer.avi
[26/06/2009 19:54|--a------|188983136] -> I:\One Piece 404 Subfrench [b91803e8].avi
[03/07/2009 15:23|--a------|238184563] -> I:\One Piece 404 Vostfr By Mdl [720P] [01e6b751].avi
[09/07/2009 15:06|--a------|237335473] -> I:\One Piece 405 Vostfr By Mdl [720P] [511520Fb].avi
[24/06/2009 19:54|--a------|185298944] -> I:\One Piece 405 Vostfr By Midou Tn.avi
[07/07/2009 22:07|--a------|309045090] -> I:\One Piece 406 Vostfr Mdl' [720P] [Ed180156].avi
[09/07/2009 19:02|--a------|200036762] -> I:\One Piece Eps 407 Ld Xvid Mp3 Vostfr.avi
[21/06/2009 18:38|--a------|210296832] -> I:\One_Piece 403 vostfr manga-online.fr.avi
[21/06/2009 17:14|--a------|143005623] -> I:\One_Piece_403_vostfr_by_mdL'_[704x396]_[DDED3EED].avi
[09/04/2009 20:49|--ahs----|1470464] -> I:\SIV3.tmp
[02/05/2009 18:00|--a------|700344320] -> J:\Walt Disney-Aladdin 1-Fr-Divx.avi
[14/05/2009 21:05|--ahs----|128512] -> J:\Thumbs.db
[04/03/2009 21:35|---hs----|348160] -> J:\msvcr71.dll
[01/08/2006 10:42|--ah-----|4096] -> K:\._.Trashes
[09/03/2007 19:41|--ah-----|6148] -> K:\.DS_Store
[13/09/2007 18:52|---hs----|348160] -> K:\msvcr71.dll
[25/09/2007 12:34|--a------|5] -> K:\RavMonLog

################## | Cracks / Keygens / Serials |

################## | ! Fin du rapport # UsbFix V6.022 ! |

Répondre à Tim

Tim, le 25 aoû 2009 à 12:33:15

Par contre quel est le fichier que je dois envoyer à l'adresse indiquée?? le rapport??

Répondre à Tim

ric025, le 25 aoû 2009 à 13:05:38

Salut.

Tu n'as pas un fichier compressé sur le bureau ?

Tu pourras me refaire un rapport RSIt et me poster le log.txt ?

++ ~~ XÞ SÞ3 ~~ ƒireƒØX + WØT + ÅßÞ + ÑS + Åthéñå ©SM ~~ Åvirå + MßÅM + Þ© TØØLS ~~

Répondre à ric025

Tim, le 25 aoû 2009 à 13:35:16

Non, pas de fichier compressé...

voici le log.txt de RSIT :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Timothé at 2009-08-25 13:33:11
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 18 GB (24%) free of 76 GB
Total RAM: 1023 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:33:16, on 25/08/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Timothé\Bureau\RSIT.exe
C:\Program Files\trend micro\Timothé.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
End of file - 5084 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}]
PDFCreator Toolbar Helper - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2009-04-14 806912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - PDFCreator Toolbar - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2009-04-14 806912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\HDAShCut.exe [2004-10-27 61952]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.5.0\bin\jusched.exe [2008-08-08 36972]
"avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-02-12 262401]
"VirtualCloneDrive"=C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [2006-04-29 94208]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2007-05-11 40048]
"H2O"=C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe [2005-10-23 385024]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2005-03-23 90112]
"AlcWzrd"=C:\WINDOWS\ALCWZRD.EXE [2005-03-23 2803712]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-03-23 69632]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-27 7405568]
"nwiz"=nwiz.exe /install []
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"PCSuiteTrayApplication"=C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [2007-06-18 271360]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-01-06 290088]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-05 15360]
"SuperCopier2.exe"=C:\Program Files\SuperCopier2\SuperCopier2.exe [2006-07-07 1052672]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2009-08-24 288048]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255
"NoDriveAutoRun"=FFFFFFFF
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.scr - open - "C:\WINDOWS\notepad.exe" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2009-08-25 12:24:02 ----A---- C:\UsbFix.txt
2009-08-24 22:26:38 ----D---- C:\UsbFix
2009-08-24 22:07:53 ----D---- C:\Program Files\trend micro
2009-08-24 22:07:52 ----D---- C:\rsit
2009-08-24 20:39:18 ----D---- C:\Documents and Settings\Timothé\Application Data\Malwarebytes
2009-08-24 20:39:13 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-08-24 20:39:13 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-08-24 20:37:37 ----A---- C:\List'em mode destruction.txt
2009-08-24 20:34:20 ----D---- C:\Kill'em
2009-08-24 20:34:20 ----A---- C:\Kill'em.txt
2009-08-24 20:29:30 ----A---- C:\WINDOWS\ntbtlog.txt
2009-08-24 04:40:27 ----A---- C:\List'em.txt
2009-08-24 04:11:06 ----D---- C:\Program Files\uTorrent

======List of files/folders modified in the last 1 months======

2009-08-25 13:25:43 ----D---- C:\WINDOWS\Prefetch
2009-08-25 12:27:58 ----D---- C:\WINDOWS\system32
2009-08-25 12:27:57 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-08-25 12:26:40 ----D---- C:\Program Files\Mozilla Firefox
2009-08-25 12:26:14 ----D---- C:\WINDOWS\Temp
2009-08-25 12:25:54 ----SHD---- C:\RECYCLER
2009-08-25 12:22:57 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-08-25 12:22:52 ----D---- C:\Documents and Settings\Timothé\Application Data\uTorrent
2009-08-24 22:10:56 ----A---- C:\WINDOWS\NeroDigital.ini
2009-08-24 22:07:53 ----RD---- C:\Program Files
2009-08-24 21:49:11 ----D---- C:\WINDOWS\system32\drivers
2009-08-24 20:34:37 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-08-24 20:34:37 ----D---- C:\WINDOWS
2009-08-24 20:32:55 ----D---- C:\WINDOWS\system32\CatRoot2
2009-08-21 23:12:38 ----D---- C:\Documents and Settings\Timothé\Application Data\dvdcss

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-03-04 79424]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2007-08-07 25160]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-05 40320]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R1 VClone;VClone; C:\WINDOWS\system32\DRIVERS\VClone.sys [2008-03-29 25344]
R1 WmiAcpi;Interface de gestion Microsoft Windows pour ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-03 8832]
R2 CdaC15BA;CdaC15BA; \??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS []
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-05 60800]
R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys []
R3 CLEDX;Team H2O CLEDX service; C:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 33792]
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-04 14080]
R3 ElbyDelay;ElbyDelay; C:\WINDOWS\System32\Drivers\ElbyDelay.sys [2007-02-16 11984]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-10-27 138240]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-03-23 2547008]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-05 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-27 3640928]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 w29n51;Pilote de carte de connexion réseau Intel(R) PRO/Wireless 2200BG pour Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2005-09-12 3298432]
S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
S2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [2001-06-22 73728]
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-10-27 145920]
S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2007-02-22 137216]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2007-02-22 8320]
S3 nmwcdcj;Nokia USB Port; C:\WINDOWS\system32\drivers\nmwcdcj.sys [2007-02-22 12288]
S3 nmwcdcm;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2007-02-22 12288]
S3 U2SP;USB to Serial Converter Driver(Philips); C:\WINDOWS\system32\DRIVERS\u2s2kxp.sys [2003-05-14 23948]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-10-01 32000]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2004-08-11 18944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;Avira AntiVir Personal – Free Antivirus Scheduler; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-03-07 68865]
R2 AntiVirService;Avira AntiVir Personal – Free Antivirus Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-03-26 147201]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 C-DillaCdaC11BA;C-DillaCdaC11BA; C:\WINDOWS\system32\drivers\CDAC11BA.EXE [2009-02-20 54784]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-27 143428]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2003-02-20 32768]
S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-01-06 536872]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-06-15 300544]

-----------------EOF-----------------

Répondre à Tim

61 réponses 12 3 4 Suivant

Posez votre question Répondre