J'ai reussie a aller en mode sans echec puit j'ai lancer combi fix il ses finie mets il dit qui va envoyer un raport le chkdsk ses remis en route ecran bleu le volume et impropre puit genre sa se reparer car j'avait un message avant qu'il etait endommager ou ilisible je pense que sa reparer le fichier et log que j'attend le raport
le voila:
ComboFix 09-09-01.07 - UPR9002 02/09/2009 20:33.1.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1534.1182 [GMT 2:00]
Running from: c:\documents and settings\UPR9002\Mes documents\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning disabled* (Outdated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: BitDefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\UPR9002\Application Data\inst.exe
c:\windows\Installer\10639ac7.msi
c:\windows\Installer\16a5d.msi
c:\windows\Installer\1c770fa.msi
c:\windows\Installer\350aec.msi
c:\windows\Installer\44a58be.msi
c:\windows\Installer\486cc.msi
c:\windows\Installer\713298.msi
c:\windows\Installer\a4a2300.msi
c:\windows\Installer\b843f.msi
c:\windows\msb.exe
c:\windows\msn_display.exe
c:\windows\system32\AutoRun.inf
c:\windows\system32\c5eb5511-aed1-e74e-7b10-065a8fa0572b.exe
c:\windows\system32\Cache
c:\windows\system32\drivers\kbiwkmoibljnix.sys
c:\windows\system32\drivers\UACkmpwhqtfrb.sys
c:\windows\system32\kbiwkmagfbgrte.dll
c:\windows\system32\kbiwkmbuxxrmrs.dat
c:\windows\system32\kbiwkmibitnwev.dll
c:\windows\system32\kbiwkmipfypuxy.dll
c:\windows\system32\kbiwkmorvthvuc.dll
c:\windows\system32\kbiwkmpfdxlbdr.dat
c:\windows\system32\kbiwkmpkopavym.dat
c:\windows\system32\kbiwkmqiemxfra.dat
c:\windows\system32\logs
c:\windows\system32\mdm.exe
c:\windows\system32\UACcntddqlqdw.dat
c:\windows\system32\UACdqguffblym.db
c:\windows\system32\UACflgqjkvgch.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACkyafncfxta.dll
c:\windows\system32\UACmdqodyvsal.dll
c:\windows\system32\UACndjkcbuetn.dll
c:\windows\system32\UACxnnsjoiifs.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_UACd.sys
-------\Legacy_UACd.sys
-------\Legacy_IPRIP
-------\Legacy_NWCWORKSTATION
-------\Service_kbiwkmjawnbpox
((((((((((((((((((((((((( Files Created from 2009-08-02 to 2009-09-02 )))))))))))))))))))))))))))))))
.
2009-09-02 17:51 . 2009-09-02 17:51 -------- d-----w- C:\Yoog_Fix
2009-09-02 17:28 . 2009-09-02 17:28 -------- d-----w- C:\UsbFix
2009-09-02 17:02 . 2009-09-02 17:11 -------- d-----w- C:\GenProc
2009-09-02 16:15 . 2009-09-02 16:15 -------- d-----w- c:\program files\BitDefender
2009-09-02 16:01 . 2009-09-02 16:01 38 ----a-w- C:\BdUninstallTool2009.09.02-06.01.49.reg
2009-09-02 15:33 . 2009-09-02 15:33 -------- d-----w- c:\program files\Nero
2009-09-02 13:44 . 2009-09-02 14:08 -------- d-----w- c:\program files\Ad-remover
2009-09-02 13:24 . 2009-09-02 13:24 -------- d-----w- C:\Rooter$
2009-09-02 13:05 . 2009-09-02 13:06 -------- d-----w- c:\documents and settings\UPR9002\Application Data\Nero
2009-09-02 12:46 . 2009-09-02 13:05 -------- d-----w- C:\ToolBar SD
2009-09-02 12:00 . 2009-09-02 12:00 -------- d-----w- c:\documents and settings\UPR9002\Local Settings\Application Data\ESET
2009-09-02 10:59 . 2009-09-02 10:59 -------- d-----w- c:\windows\BDOSCAN8
2009-09-02 09:47 . 2009-09-02 12:34 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-09-02 09:43 . 2009-09-02 13:21 -------- d-----w- c:\program files\Fichiers communs\Nero
2009-08-31 16:34 . 2009-08-31 16:34 -------- d-----w- c:\program files\Power IE
2009-08-31 14:36 . 2009-09-02 13:38 -------- d-----w- c:\program files\Navilog1
2009-08-30 21:15 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-30 21:15 . 2009-09-02 13:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-30 21:15 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-30 17:59 . 2009-09-02 09:31 -------- d-----w- c:\program files\Lavasoft
2009-08-30 15:24 . 2009-07-28 14:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-30 15:24 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-08-30 15:24 . 2009-08-30 15:24 -------- d-----w- c:\program files\Avira
2009-08-30 02:40 . 2009-08-30 02:40 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-08-30 02:33 . 2009-08-30 02:42 -------- d-----w- c:\documents and settings\UPR9002\Application Data\DAEMON Tools Lite
2009-08-29 23:26 . 2009-08-29 23:26 -------- d-----w- c:\program files\Full Pack Codecs
2009-08-29 16:19 . 2009-09-02 09:15 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-29 16:19 . 2009-09-02 09:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-29 10:04 . 2009-08-29 10:04 -------- d-----w- c:\documents and settings\All Users\Application Data\SITEguard
2009-08-29 10:03 . 2009-08-29 10:03 -------- d-----w- c:\program files\Fichiers communs\iS3
2009-08-29 02:19 . 2009-08-29 02:19 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-08-29 00:28 . 2009-08-29 00:28 -------- d-----w- c:\documents and settings\UPR9002\Application Data\Logs
2009-08-25 22:53 . 2009-09-02 18:33 -------- d-----w- c:\windows\system32\CatRoot2
2009-08-25 22:32 . 2009-08-25 22:32 -------- d-----w- c:\documents and settings\UPR9002\Local Settings\Application Data\Microsoft Corporation
2009-08-25 22:32 . 2009-08-25 22:48 -------- d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-08-17 13:04 . 2009-08-17 15:38 -------- d-----w- c:\program files\Fichiers communs\Uninstall
2009-08-12 12:16 . 2009-08-12 12:21 -------- d-----w- c:\documents and settings\UPR9002\Application Data\PhotoFiltre Studio X
2009-08-12 12:15 . 2009-08-12 12:19 -------- d-----w- c:\program files\PhotoFiltre Studio X
2009-08-12 05:23 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
2009-08-11 23:41 . 2009-08-11 23:43 -------- d-----w- C:\Xenofex 2
2009-08-11 21:25 . 2004-05-19 08:02 49152 ----a-w- c:\windows\system32\Xsusie.dll
2009-08-11 21:25 . 2004-05-19 08:02 225280 ----a-w- c:\windows\system32\Xjp2.dll
2009-08-11 21:25 . 2004-05-19 08:02 114688 ----a-w- c:\windows\system32\Xjpegls.dll
2009-08-11 21:25 . 2004-05-19 08:01 81920 ----a-w- c:\windows\system32\Xjbig.dll
2009-08-11 21:25 . 2004-05-19 08:01 49152 ----a-w- c:\windows\system32\Xjng.dll
2009-08-11 21:25 . 2004-05-27 14:46 872448 ----a-w- c:\windows\system32\libgfl211.dll
2009-08-11 21:25 . 2004-05-19 08:01 364544 ----a-w- c:\windows\system32\Xfpx.dll
2009-08-11 21:25 . 2004-02-04 04:33 307200 ----a-w- c:\windows\system32\libmng.dll
2009-08-11 19:39 . 2009-08-11 19:39 -------- d-----w- c:\program files\UnFREEz
2009-08-09 01:13 . 2009-08-09 01:15 -------- d-----w- c:\program files\PhotoFiltre
2009-08-09 00:54 . 2009-08-09 00:54 -------- d-----w- c:\program files\MSN Messenger
2009-08-05 09:00 . 2009-08-05 09:00 205312 ------w- c:\windows\system32\dllcache\mswebdvd.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-02 18:53 . 2009-02-04 22:09 -------- d-----w- c:\documents and settings\UPR9002\Application Data\Skype
2009-09-02 18:52 . 2009-06-17 16:02 -------- d-----w- c:\program files\Steam
2009-09-02 16:19 . 2009-02-04 22:11 -------- d-----w- c:\documents and settings\UPR9002\Application Data\skypePM
2009-09-02 16:15 . 2009-07-10 13:27 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender
2009-09-02 16:11 . 2009-03-26 17:20 -------- d-----w- c:\documents and settings\UPR9002\Application Data\uTorrent
2009-09-02 15:33 . 2008-11-08 09:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-09-02 09:31 . 2008-02-06 18:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-08-31 14:56 . 2009-07-12 13:03 -------- d-----w- c:\program files\Trend Micro
2009-08-30 02:33 . 2009-02-25 21:00 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-08-30 01:46 . 2006-02-03 16:39 -------- d-----w- c:\program files\Windows Media Connect 2
2009-08-29 16:55 . 2009-07-06 22:32 -------- d-----w- c:\program files\Common Files
2009-08-29 10:20 . 2009-08-29 10:07 3256 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-08-29 10:12 . 2009-08-29 10:08 792 ----a-w- c:\windows\system32\drivers\kgpfr2.cfg
2009-08-29 02:40 . 2009-08-29 02:40 285704 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys.upd
2009-08-29 02:40 . 2009-05-26 11:47 110472 ----a-w- c:\windows\system32\drivers\bdfndisf.sys
2009-08-23 21:53 . 2009-03-26 17:20 -------- d-----w- c:\program files\uTorrent
2009-08-23 16:59 . 2009-07-11 23:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Downloaded Installations
2009-08-19 16:52 . 2009-07-09 18:36 249856 ------w- c:\windows\Setup1.exe
2009-08-19 16:52 . 2009-07-09 18:36 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-08-14 00:37 . 2009-07-15 17:01 -------- d-----w- c:\program files\URUSoft
2009-08-11 14:36 . 2009-07-20 09:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-08-05 09:00 . 2004-08-19 13:03 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-31 17:51 . 2009-04-17 16:36 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-30 14:55 . 2009-07-30 14:49 -------- d-----w- c:\program files\Uniblue
2009-07-30 14:50 . 2008-03-11 22:23 -------- d-----w- c:\documents and settings\UPR9002\Application Data\Uniblue
2009-07-24 10:26 . 2009-07-24 10:26 285704 ----a-w- c:\windows\system32\drivers\TBMB.tmp
2009-07-23 09:59 . 2009-05-31 10:20 -------- d-----w- c:\program files\TimeAdjuster
2009-07-20 23:47 . 2009-07-12 14:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-07-19 19:49 . 2009-07-19 19:49 -------- d-----w- c:\program files\Messenger Plus! Live
2009-07-19 19:36 . 2004-08-19 13:03 570236 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-19 19:36 . 2004-08-19 13:03 107672 ----a-w- c:\windows\system32\perfc00C.dat
2009-07-19 06:07 . 2006-02-06 13:15 71920 ----a-w- c:\documents and settings\UPR9002\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-19 06:07 . 2009-07-19 06:06 -------- d-----w- c:\documents and settings\UPR9002\Application Data\ViStart
2009-07-19 05:30 . 2009-07-19 05:30 -------- d-----w- c:\documents and settings\UPR9002\Application Data\ViSplore
2009-07-19 05:26 . 2009-07-19 05:26 -------- d-----w- c:\program files\TrueTransparency
2009-07-17 19:03 . 2004-08-19 13:03 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-15 17:22 . 2009-07-15 17:22 -------- d-----w- c:\program files\SubSync
2009-07-13 21:43 . 2004-08-19 13:04 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-13 00:54 . 2009-07-09 22:32 -------- d-----w- c:\documents and settings\All Users\Application Data\INTERNET SPAM SUPPORT AUDIO
2009-07-12 14:20 . 2009-07-12 14:20 -------- d-----w- c:\program files\CCleaner
2009-07-12 14:20 . 2009-07-12 14:20 -------- d-----w- c:\documents and settings\UPR9002\Application Data\Yahoo!
2009-07-12 01:24 . 2009-07-12 01:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-07-11 17:30 . 2009-06-17 21:29 -------- d-----w- c:\documents and settings\UPR9002\Application Data\Desktopicon
2009-07-10 14:35 . 2009-07-10 14:35 105736 ----a-w- c:\windows\system32\drivers\bdhv.sys
2009-07-10 14:35 . 2009-05-25 17:05 152328 ----a-w- c:\windows\system32\drivers\bdfm.sys
2009-07-10 14:34 . 2009-07-10 14:34 279176 ----a-w- c:\windows\system32\drivers\TBMD.tmp
2009-07-10 14:34 . 2009-05-08 14:39 279176 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys
2009-07-10 13:29 . 2009-07-10 13:29 -------- d-----w- c:\documents and settings\UPR9002\Application Data\BitDefender
2009-07-10 13:28 . 2009-07-10 13:26 -------- d-----w- c:\program files\Fichiers communs\BitDefender
2009-07-07 19:04 . 2009-07-07 19:04 -------- d-----w- c:\program files\Bonjour
2009-07-07 19:04 . 2006-02-01 13:28 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-07-07 18:27 . 2007-12-09 17:48 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-07 18:15 . 2009-07-07 18:15 -------- d-----w- c:\program files\Fichiers communs\Macrovision Shared
2009-07-06 22:21 . 2009-07-06 22:21 -------- d-----w- c:\documents and settings\UPR9002\Application Data\Autodesk
2009-07-06 22:21 . 2009-07-06 22:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk
2009-07-06 22:00 . 2009-07-06 22:00 -------- d-----w- c:\program files\MSBuild
2009-07-06 21:59 . 2009-07-06 21:59 -------- d-----w- c:\program files\Reference Assemblies
2009-07-06 19:58 . 2006-02-01 08:47 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-03 16:57 . 2004-08-19 13:03 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-25 08:26 . 2004-08-19 13:03 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2004-08-19 13:03 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2004-08-19 13:03 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2004-08-19 13:03 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2004-08-19 13:03 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2004-08-19 13:03 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2004-08-19 13:03 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-17 15:53 . 2008-06-26 15:18 81984 ----a-w- c:\windows\system32\bdod.bin
2009-06-16 14:40 . 2004-08-19 13:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2004-08-19 13:03 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 10:44 . 2004-08-19 13:03 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:44 . 2004-08-19 13:03 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:14 . 2004-08-19 13:03 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2004-08-19 13:14 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2004-08-19 13:03 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-05-26 11:18 . 2009-07-10 13:35 45056 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
2008-08-09 11:51 . 2007-12-01 20:43 67696 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-08-09 11:51 . 2007-12-01 20:43 54376 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-08-09 11:51 . 2008-02-14 11:07 34952 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-08-09 11:51 . 2008-02-14 11:07 46720 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-08-09 11:51 . 2007-12-01 20:43 172144 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-03-26 14:22 . 2009-03-26 14:22 23 --sha-w- c:\windows\system32\fbdad2_d.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfre1.dll" [2009-05-21 2094616]
"{DD02A4EB-4AFD-4D60-99D8-E67F964CA813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2009-05-30 2094616]
"{26639A45-65D8-4E33-90C2-123FADA08DCD}"= "c:\program files\Reload_Paradise\tbRelo.dll" [2009-06-08 2124824]
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
[HKEY_CLASSES_ROOT\clsid\{26639a45-65d8-4e33-90c2-123fada08dcd}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{26639a45-65d8-4e33-90c2-123fada08dcd}]
2009-06-08 07:55 2124824 ----a-w- c:\program files\Reload_Paradise\tbRelo.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
2009-05-30 18:09 2094616 ----a-w- c:\program files\PHPNukeEN\tbPHP0.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2009-05-21 12:23 2094616 ----a-w- c:\program files\free-downloads.net\tbfre1.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfre1.dll" [2009-05-21 2094616]
"{DD02A4EB-4AFD-4D60-99D8-E67F964CA813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2009-05-30 2094616]
"{26639A45-65D8-4E33-90C2-123FADA08DCD}"= "c:\program files\Reload_Paradise\tbRelo.dll" [2009-06-08 2124824]
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
[HKEY_CLASSES_ROOT\clsid\{26639a45-65d8-4e33-90c2-123fada08dcd}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-07 68856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-02-02 23975720]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2009-02-24 20480]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]
"Steam"="c:\program files\Steam\Steam.exe" [2009-06-17 1217784]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WireLessMouse"="c:\program files\Multimedia Mouse Driver\V5\StartAutorun.exe" [2005-11-30 94208]
"Athan"="c:\program files\Athan\Athan.exe" [2009-01-18 1081344]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2009-2-24 450560]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKLM\~\startupfolder\C:^Documents and Settings^UPR9002^Menu Démarrer^Programmes^Démarrage^FreeBot.lnk]
backup=c:\windows\pss\FreeBot.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Name of App
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
"LogitechVideoTray"=c:\program files\Logitech\Video\LogiTray.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Documents and Settings\\UPR9002\\Mes documents\\Downloads\\utorrent.exe"=
"c:\\Documents and Settings\\UPR9002\\Mes documents\\Downloads\\utorrent (1).exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"c:\\Program Files\\Steam\\steamapps\\chorba67\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7834:TCP"= 7834:TCP:bit torrent
"7635:TCP"= 7635:TCP:bit torrent
"6881:TCP"= 6881:TCP:bit torrent
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"33196:TCP"= 33196:TCP:*:Disabled:utorrent
"33196:UDP"= 33196:UDP:*:Disabled:utorrent
"3074:TCP"= 3074:TCP:*:Disabled:u torrent
"3074:UDP"= 3074:UDP:*:Disabled:u torrent
"49700:UDP"= 49700:UDP:*:Disabled:u torrent
"7634:TCP"= 7634:TCP:*:Disabled:u torrent
"7634:UDP"= 7634:UDP:*:Disabled:u torrent
"7635:UDP"= 7635:UDP:*:Disabled:u torrent
"6882:TCP"= 6882:TCP:*:Disabled:u torrent
"6882:UDP"= 6882:UDP:*:Disabled:u torrent
"86:TCP"= 86:TCP:BroadCam Web Server
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)
R2 NwSapAgent;Agent SAP;c:\windows\system32\svchost.exe -k netsvcs [19/08/2004 15:03 14336]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [26/05/2009 13:47 110472]
S2 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]
S2 BDVEDISK;BDVEDISK;\??\c:\program files\BitDefender\BitDefender 2010\bdvedisk.sys --> c:\program files\BitDefender\BitDefender 2010\bdvedisk.sys [?]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [29/08/2009 04:40 176128]
S3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [25/05/2009 19:05 152328]
S3 DoradoPC;Polaroid PDC 301 VGA Camera;c:\windows\system32\drivers\drdvid40.sys [30/07/2006 16:55 106816]
S3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\drivers\fbxusb32.sys [20/10/2004 15:23 21344]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
bdx REG_MULTI_SZ scan
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Fichiers communs\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
2009-09-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3979984330-2063461283-4077185267-1007Core.job
- c:\documents and settings\UPR9002\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-23 12:44]
2009-09-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3979984330-2063461283-4077185267-1007UA.job
- c:\documents and settings\UPR9002\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-23 12:44]
2009-09-02 c:\windows\Tasks\User_Feed_Synchronization-{6F4838DA-3945-47CF-A1B8-46366746BA4C}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
2009-09-02 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]
2009-09-02 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-12 20:18]
.
- - - - ORPHANS REMOVED - - - -
BHO-{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\myBabylon_English\tbmyBa.dll
Toolbar-{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\myBabylon_English\tbmyBa.dll
Toolbar-SITEguard - (no file)
WebBrowser-{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} - c:\program files\myBabylon_English\tbmyBa.dll
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://google.com/
mWindow Title =
uInternet Settings,ProxyServer = microsoft.com:80
uInternet Settings,ProxyOverride = <local>;localhost;*.local
TCP: {5C4E4DB4-4C50-4483-BD1D-96F07018907A} = 212.27.53.252,212.27.54.252
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\documents and settings\UPR9002\Application Data\Mozilla\Firefox\Profiles\gzy04u72.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www17.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search
FF - prefs.js: browser.startup.homepage - hxxp://www.daemon-search.com/startpage|http://fr.msn.com/
FF - prefs.js: keyword.URL - hxxp://www17.yoog.com/search.php?q=
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}\components\FFAlert.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
FF - user.js: google.toolbar.linkdoctor.enabled - false
FF - user.js: browser.search.defaultenginename - Yoog Search
FF - user.js: browser.search.defaulturl - hxxp://www17.yoog.com/search.php?q=
FF - user.js: browser.search.selectedEngine - Yoog Search
FF - user.js: keyword.URL - hxxp://www17.yoog.com/search.php?q=
FF - user.js: keyword.enabled - true
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-02 20:52
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\kbiwkmjawnbpox]
"imagepath"="\systemroot\system32\drivers\kbiwkmoibljnix.sys"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-3979984330-2063461283-4077185267-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\software\Ulead Systems\Ulead COOL 360]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Ulead Systems\Ulead Photo Explorer]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Ulead Systems\Ulead Photo Express My Custom Edition]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Ulead Systems\UserInfo]
@DACL=(02 0000)
"UserName"="nc"
"UserEmail"=""
"CompanyName"=""
"ClientID"="2391966"
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\kbiwkmjawnbpox]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\\systemroot\\system32\\drivers\\kbiwkmoibljnix.sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3580)
c:\docume~1\UPR9002\LOCALS~1\Temp\IadHide4.dll
c:\program files\Fichiers communs\Ahead\Lib\NeroSearchBar.dll
c:\program files\Fichiers communs\Ahead\Lib\MFC71U.DLL
c:\program files\Fichiers communs\Ahead\Lib\BCGCBPRO860un71.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\system32\snmp.exe
c:\program files\Multimedia Mouse Driver\V5\MouseDrv.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wscntfy.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\Windows Live\Messenger\usnsvc.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\program files\Internet Explorer\IEXPLORE.EXE
.
**************************************************************************
.
Completion time: 2009-09-02 21:00 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-02 19:00
Pre-Run: 3 197 882 368 octets libres
Post-Run: 3 971 751 936 octets libres
Current=3 Default=3 Failed=4 LastKnownGood=5 Sets=1,2,3,4,5
428 --- E O F --- 2009-08-30 01:01
Correction yeux rouges en ligne
