Ecran bleu, pas de message, plus de bureauRésolu/Fermé

Question

Bonjour à tous, j'ai attrapé je ne sais comment des virus sur mon pc, avast les reconnaissait mais lorsque je les supprimais un nouveau arrivait sans cesse ! 
Bref j'ai décidé de passer en mode sans echec et d'utiliser Smitfraudfix. Une fois l'opération terminé, j'ai redémarrer mon pc en mode normal et depuis, un écran bleu apparait après l'écriture "démarrage" de mon Packard Bell. J'entends la musique de windows du démarrage mais le bureau n'apparait pas! Je suis obligé de travailler en mode sans echec depuis car aucun moyen de réparer le problème. Si quelqu'un peu m'aider se serait vraiment gentil !

Voici mon scan hijackthis (normalement il n'y a rien d'anormal) :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:00:00, on 13/04/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [STDSB] C:\WINDOWS\system32\drivers\STDSB.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [lxdfmon.exe] "C:\Program Files\Lexmark 6500 Series\lxdfmon.exe"
O4 - HKLM\..\Run: [lxdfamon] "C:\Program Files\Lexmark 6500 Series\lxdfamon.exe"
O4 - HKLM\..\Run: [Lexmark 6500 Series Fax Server] "C:\Program Files\Lexmark 6500 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\microsoft office\office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: lxdfCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdfserv.exe
O23 - Service: lxdf_device -   - C:\WINDOWS\system32\lxdfcoms.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

benurrr · Answer

bonjour,

l'ecran bleu c'est normal avec smithfraudfix car il vire le fond d'écran mais que tu bureau n'apparaisse pas c'est pas normal

pour faire apparaitre ton bureau

CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"

Tape explorer.exe et valide. Cela fera re-apparaître le Bureau

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

 Télécharge et installe List&Kill'em et enregistre le sur ton bureau

http://sd-1.archive-host.com/...

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis l'option Search

un icone blanc et noir va s'afficher sur le bureau , il te servira à relancer le programme par la suite.
un autre rouge et noir te servira a desinstaller le prog a la fin de la desinfection.

? laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

? Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

Milkman21 · Answer

Salut Benurr, merci de m'avoir répondu ! Le problème c'est que lorsque je fais Ctrl Alt Sup rien ne se passe !  Le gestionnaire des tâches ne s'ouvre pas ... Bref je pense qu'au final je vais formater de nouveau mon pc ... A moins que je puisse faire cette manipulation avec list&kill'em en mode sans echec ? 

Cordialement 
MM

Milkman21 · Answer

Bref, j'ai quand même fait le scan de list&kill'em en mode sans echec lol ! Par contre je n'ai pas réussi à désactiver avast car je ne l'ai pas trouvé... mais j'ai désactivé le par-feu windows. Voici le scan : List'em by g3n-h@ckm@n 1.7.1.0 User : pierre grygiel (Administrateurs) Update on 13/04/2010 by g3n-h@ckm@n ::::: 17.10 Start at: 09:09:54 | 14/04/2010 Intel(R) Pentium(R) M processor 1.60GHz Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2 Internet Explorer 7.0.5730.13 Windows Firewall Status : Disabled AV : avast! antivirus 4.8.1368 [VPS 100413-1] 4.8.1368 [ Enabled | Updated ] C:\ -> Disque fixe local | 74,52 Go (44,42 Go free) [HDD] | NTFS D:\ -> Disque CD-ROM Boot: Safeboot ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\List_Kill'em\List_Kill'em.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\List_Kill'em\pv.exe ====================== Keys "Run" ====================== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe uTorrent REG_SZ "C:\Program Files\uTorrent\uTorrent.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] IMJPMIG8.1 REG_SZ "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 PHIME2002ASync REG_SZ C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC PHIME2002A REG_SZ C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName IgfxTray REG_SZ C:\WINDOWS\system32\igfxtray.exe STDSB REG_SZ C:\WINDOWS\system32\drivers\STDSB.exe SynTPLpr REG_SZ C:\Program Files\Synaptics\SynTP\SynTPLpr.exe SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe" SoundMan REG_SZ SOUNDMAN.EXE PCMService REG_SZ "c:\Apps\Powercinema\PCMService.exe" IntelZeroConfig REG_SZ "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe" IntelWireless REG_SZ "C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe lxdfmon.exe REG_SZ "C:\Program Files\Lexmark 6500 Series\lxdfmon.exe" lxdfamon REG_SZ "C:\Program Files\Lexmark 6500 Series\lxdfamon.exe" Lexmark 6500 Series Fax Server REG_SZ "C:\Program Files\Lexmark 6500 Series\fm3032.exe" /s RealTray REG_SZ C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER QuickTime Task REG_SZ "C:\Program Files\QuickTime\QTTask.exe" -atboottime iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe" LogMeIn GUI REG_SZ "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] ===================== Other Keys ===================== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] dontdisplaylastusername REG_DWORD 0 (0x0) legalnoticecaption REG_SZ legalnoticetext REG_SZ shutdownwithoutlogon REG_DWORD 1 (0x1) undockwithoutlogon REG_DWORD 1 (0x1) =============== [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] NoDriveTypeAutoRun REG_DWORD 145 (0x91) =============== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] HonorAutoRunSetting REG_DWORD 1 (0x1) =============== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLS REG_SZ =============== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] AutoRestartShell REG_DWORD 1 (0x1) DefaultDomainName REG_SZ SN281505730238 DefaultUserName REG_SZ pierre grygiel LegalNoticeCaption REG_SZ LegalNoticeText REG_SZ PowerdownAfterShutdown REG_SZ 0 ReportBootOk REG_SZ 1 Shell REG_SZ Explorer.exe ShutdownWithoutLogon REG_SZ 0 System REG_SZ Userinit REG_SZ C:\WINDOWS\system32\userinit.exe, VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl" SfcQuota REG_DWORD -1 (0xffffffff) allocatecdroms REG_SZ 0 allocatedasd REG_SZ 0 allocatefloppies REG_SZ 0 cachedlogonscount REG_SZ 10 forceunlocklogon REG_DWORD 0 (0x0) passwordexpirywarning REG_DWORD 14 (0xe) scremoveoption REG_SZ 0 AllowMultipleTSSessions REG_DWORD 1 (0x1) UIHost REG_EXPAND_SZ logonui.exe LogonType REG_DWORD 1 (0x1) Background REG_SZ 0 0 0 DebugServerCommand REG_SZ no SFCDisable REG_DWORD 0 (0x0) WinStationsDisabled REG_SZ 0 HibernationPreviouslyEnabled REG_DWORD 1 (0x1) ShowLogonOptions REG_DWORD 0 (0x0) AltDefaultUserName REG_SZ pierre grygiel AltDefaultDomainName REG_SZ SN281505730238 =============== [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\crypt32chain] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cryptnet] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cscdll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\igfxcui] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\LMIinit] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ScCertProp] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\Schedule] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\sclgntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\SensLogn] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify ermsrv] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\wlballoon] =============== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ =============== [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) C:\Documents and Settings\pierre grygiel\Local Settings\Temp\7zS1.tmp\SymNRT.exe REG_SZ C:\Documents and Settings\pierre grygiel\Local Settings\Temp\7zS1.tmp\SymNRT.exe:*:Enabled:Norton Removal Tool C:\Program Files\Lexmark 6500 Series\lxdfamon.exe REG_SZ C:\Program Files\Lexmark 6500 Series\lxdfamon.exe:*:Enabled:Lexmark Device Monitor C:\Program Files\Lexmark 6500 Series\frun.exe REG_SZ C:\Program Files\Lexmark 6500 Series\frun.exe:*:Enabled:Lexmark Productivity Studio C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe REG_SZ C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:*:Enabled:ABBYY FineReader C:\Program Files\Lexmark 6500 Series\lxdfmon.exe REG_SZ C:\Program Files\Lexmark 6500 Series\lxdfmon.exe:*:Enabled:Printer Device Monitor C:\WINDOWS\system32\lxdfcfg.exe REG_SZ C:\WINDOWS\system32\lxdfcfg.exe:*:Enabled:Printer Communication System C:\WINDOWS\system32\lxdfcoms.exe REG_SZ C:\WINDOWS\system32\lxdfcoms.exe:*:Enabled:Lexmark Communications System C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfpswx.exe REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfpswx.exe:*:Enabled:Printer Status Window Interface C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdftime.exe REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdftime.exe:*:Enabled:Lexmark Connect Time Executable C:\Program Files\Lexmark 6500 Series\LXDFFax.exe REG_SZ C:\Program Files\Lexmark 6500 Series\LXDFFax.exe:*:Enabled:Fax Solutions Software C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfjswx.exe REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfjswx.exe:*:Enabled:Job Status Window Interface C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfwbgw.exe REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfwbgw.exe:*:Enabled:Lexmark Web Gateway C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger C:\Program Files\uTorrent\uTorrent.exe REG_SZ C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 =============== ActivX controls =============== [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{41564D57-9980-0010-8000-00AA00389B71}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}] =============== [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{03F998B2-0E00-11D3-A498-00104B6EB52E}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{166B1BCA-3F9C-11CF-8075-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] ============== BHO : ====== [ REG_SZ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] === DNS === HKLM\SYSTEM\CCS\Services\Tcpip\..\{4857E14D-E1AA-4E4D-BC04-0435CBED10E8}: NameServer=139.165.12.5,139.165.40.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{4857E14D-E1AA-4E4D-BC04-0435CBED10E8}: NameServer=139.165.12.5,139.165.40.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{4857E14D-E1AA-4E4D-BC04-0435CBED10E8}: DhcpNameServer=139.165.32.13 139.165.6.20 139.165.12.5 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=139.165.32.13 139.165.6.20 139.165.12.5 ================ Internet Explorer : ================ [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home Local Page REG_SZ C:\windows\system32\blank.htm Default_Search_URL REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Default_Page_URL REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Local Page REG_SZ C:\windows\system32\blank.htm Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ======== Services ======== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] Ndisuio : 0x3 ( OK = 3 ) SharedAccess : 0x2 ( OK = 2 ) wuauserv : 0x2 ( OK = 2 ) ======== Safemode ======== "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot" : OK !! "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal" : OK !! "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network" : OK !! ========= Atapi.sys ========= C:\WINDOWS\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\atapi.sys : MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674] SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\WINDOWS\system32\drivers\atapi.sys : MD5 :: [cdfe4411a69c224bd1d11b2da92dac51] SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d] Référence : ========== Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867 Win XP_32b : a64013e98426e1877cb653685c5c0009 Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51 Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674 Vista_32b : e03e8c99d15d0381e02743c36afc7c6f Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9 Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4 Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e ======= Drive : ======= D'fragmenteur de disque Windows Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc. Rapport d'analyse 74,52 Go total, 44,42 Go libre (59%), 16% fragment' (fragmentation du fichier 32%) Vous devriez d'fragmenter ce volume. ¤¤¤¤¤¤¤¤¤¤ Files/folders : Present !! : C:\documents and settings\NetworkService\Application Data buwzv.dat Present !! : C:\WINDOWS\System32\404Fix.exe Present !! : C:\WINDOWS\System32\config\systemprofile\Application Data buwzv.dat" Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn Present !! : C:\WINDOWS\System32\dumphive.exe" Present !! : C:\WINDOWS\System32\IEDFix.exe Present !! : C:\WINDOWS\System32\MabryObj.dll Present !! : C:\WINDOWS\System32\Process.exe Present !! : C:\WINDOWS\System32\SET*.tmp Present !! : C:\WINDOWS\System32\SrchSTS.exe Present !! : C:\WINDOWS\System32 mp.reg" Present !! : C:\WINDOWS\System32\VACFix.exe Present !! : C:\WINDOWS\System32\VCCLSID.exe Present !! : C:\WINDOWS\System32\WS2Fix.exe Present !! : C:\WINDOWS\Temp\sig6.tmp Present !! : C:\Documents and Settings\pierre grygiel\Application Data\GDIPFONTCACHEV1.DAT Present !! : C:\Documents and Settings\pierre grygiel\Application Data buwzv.dat Present !! : C:\Documents and Settings\pierre grygiel\Application Data\GDIPFONTCACHEV1.DAT Present !! : C:\Documents and Settings\pierre grygiel\Application Data buwzv.dat ¤¤¤¤¤¤¤¤¤¤ Keys : Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe" Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe" ============ catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-04-14 09:15:56 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS kernel: MBR read successfully user & kernel MBR OK [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] FirstRunDisabled REG_DWORD 1 (0x1) AntiVirusDisableNotify REG_DWORD 0 (0x0) FirewallDisableNotify REG_DWORD 0 (0x0) UpdatesDisableNotify REG_DWORD 0 (0x0) AntiVirusOverride REG_DWORD 0 (0x0) FirewallOverride REG_DWORD 0 (0x0) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ End of scan : 9:15:57,29 Merci pour tout encore ! MM

benurrr · Answer

Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau. 
mais cette fois-ci : 

 choisis l'Option Clean 

ton PC va redémarrer, 

laisse travailler l'outil. 

en fin de scan la fenêtre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau , 

colle le contenu dans ta réponse

Milkman21 · Answer

Quand le pc redémarre après avoir appuyé sur "clean " en mode sans echec, il n'y a aucun travaille de la part du logiciel. Cependant quand je l'ai laissé redémarrer en mode normal sans rien toucher j'ai obtenu ce message :


Stop process : wuaucldt.ex
'Proc-end' n'est pas reconnu en tant que commande interne ou externe, etc...

Que dois je faire ?

benurrr · Answer

trojan qui tourne en arriere plan en va faire sdfix même s'il n'est plus mit a jour  

il a l'avantage de tourner en mode sans echec  

1) Télécharge SDFix d' AndyManchesta   

http://www.bleepingcomputer.com/resources/link252.html sur ton Bureau.   

Double clique sur SDFix.exe et choisis Install. L'outil sera extrait à la racine du lecteur système (généralement le C:\)   
N y touche pas pour l instant.   

2) Redémarre en mode sans échec (Pour cela, tu tapotes la touche F8 dès le début de l'allumage du PC sans t'arrêter)  

Ne jamais démarrer en mode sans échec via msconfig  

3) SDFix   
* Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.   
* Appuie sur Y pour commencer le processus de nettoyage.   
* Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.   
* Appuie sur une touche pour redémarrer le PC.   
* Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.   
* Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.   
* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.   
· Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.   
Par Manque De Curiosité On Risque De Mourir Ignorant;Tu es libre de penser que tu es C..,  
Mais C.. de penser que ­tu es libre...Merci a australe13

Milkman21 · Answer

Alors, lorsque j'ai redémarré en mode normal ça à prit très longtemps... et j'ai obtenu au final ce message :

Le fichier spécifié est introuvable
Unable to open the file "C\window	emp\sdfix_filecheck\setup

Bref le Bureau est tout de même apparut par la suite mais un message est alors survenu lorsque j'ai voulu éteindre le PC :

L'application n'a pas réussi à ... (0xc00000142) 

Puis j'ai alors refait la même chose avec un redémarrage en mode sans échec et là j'ai obtenu le rapport :


[b]SDFix: Version 1.240 [/b]
Run by pierre grygiel on 14/04/2010 at 22:05

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-14 22:11:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\flpydisk]
"EventMessageFile"=str(2):"%SystemRoot%\System32\IoLogMsg.dll;%SystemRoot%\System32\Drivers\flpydisk.sys"
"TypesSupported"=dword:00000007
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Flpydisk]
"ErrorControl"=dword:00000000
"Group"="Primary disk"
"Start"=dword:00000001
"Tag"=dword:00000002
"Type"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\System\flpydisk]
"EventMessageFile"=str(2):"%SystemRoot%\System32\IoLogMsg.dll;%SystemRoot%\System32\Drivers\flpydisk.sys"
"TypesSupported"=dword:00000007
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Flpydisk]
"ErrorControl"=dword:00000000
"Group"="Primary disk"
"Start"=dword:00000001
"Tag"=dword:00000002
"Type"=dword:00000001

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7C46D94F-7970-9117-8477-C83974EFCF63}]
"iadmgcjchpnhmmckjd"=hex:6a,61,67,6e,62,70,65,61,64,6f,62,6a,6e,67,67,6d,6f,61,65,6a,00,..
"hajlmblilomhgnla"=hex:69,61,6f,6d,69,62,64,69,6e,6d,6f,65,64,66,6a,6f,67,67,00,00

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Documents and Settings\pierre grygiel\Local Settings\Temp\7zS1.tmp\SymNRT.exe"="C:\Documents and Settings\pierre grygiel\Local Settings\Temp\7zS1.tmp\SymNRT.exe:*:Enabled:Norton Removal Tool"
"C:\Program Files\Lexmark 6500 Series\lxdfamon.exe"="C:\Program Files\Lexmark 6500 Series\lxdfamon.exe:*:Enabled:Lexmark Device Monitor"
"C:\Program Files\Lexmark 6500 Series\frun.exe"="C:\Program Files\Lexmark 6500 Series\frun.exe:*:Enabled:Lexmark Productivity Studio"
"C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe"="C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:*:Enabled:ABBYY FineReader"
"C:\Program Files\Lexmark 6500 Series\lxdfmon.exe"="C:\Program Files\Lexmark 6500 Series\lxdfmon.exe:*:Enabled:Printer Device Monitor"
"C:\WINDOWS\system32\lxdfcfg.exe"="C:\WINDOWS\system32\lxdfcfg.exe:*:Enabled:Printer Communication System"
"C:\WINDOWS\system32\lxdfcoms.exe"="C:\WINDOWS\system32\lxdfcoms.exe:*:Enabled:Lexmark Communications System"
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfpswx.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfpswx.exe:*:Enabled:Printer Status Window Interface"
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdftime.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdftime.exe:*:Enabled:Lexmark Connect Time Executable"
"C:\Program Files\Lexmark 6500 Series\LXDFFax.exe"="C:\Program Files\Lexmark 6500 Series\LXDFFax.exe:*:Enabled:Fax Solutions Software"
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfjswx.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfjswx.exe:*:Enabled:Job Status Window Interface"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfwbgw.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfwbgw.exe:*:Enabled:Lexmark Web Gateway"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:æTorrent"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Sat 22 Aug 2009           215 A.SHR --- "C:\BOOT.BAK"
Fri 12 Mar 2004        54,384 A..H. --- "C:\Program Files\AOL 9.0\aolphx.exe"
Fri 12 Mar 2004       156,784 A..H. --- "C:\Program Files\AOL 9.0\aoltray.exe"
Fri 12 Mar 2004        31,344 A..H. --- "C:\Program Files\AOL 9.0\RBM.exe"
Wed  3 May 2006       163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
Wed 21 Feb 2007        31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
Sun 16 Mar 2008       216,064 ..SHR --- "C:\WINDOWS\system32
bDX.dll"
Sun 26 Jun 2005       616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
Tue 21 Jun 2005        45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
Mon 28 Sep 2009        90,624 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
Sun 19 Oct 2008        16,447 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
Thu 17 Sep 2009             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Tue  4 Jun 2002        84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
Tue  4 Jun 2002        44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
Tue 10 Dec 2002        73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
Tue 10 Dec 2002        65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
Sun  9 Jun 2002        36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
Tue  4 Jun 2002        20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
Tue 10 Dec 2002       102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
Tue 10 Dec 2002       176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
Tue 10 Dec 2002       208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
Tue 10 Dec 2002       217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
Sun  9 Jun 2002        40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
Sun  4 Nov 2001       225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
Tue 10 Apr 2001       225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
Fri 20 Feb 2004       232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoderaac.dll"
Sun  9 Jun 2002       525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencodernco3260.dll"
Tue 10 Dec 2002       245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencodernlt3260.dll"
Tue 10 Dec 2002        45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoderv103260.dll"
Tue 10 Dec 2002        98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoderv203260.dll"
Tue 10 Dec 2002        94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoderv303260.dll"
Tue 10 Dec 2002        90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoderv403260.dll"
Tue 10 Dec 2002       102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
Sun  9 Jun 2002        49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder	okr3260.dll"
Thu 20 Mar 2008         5,632 ..SHR --- "C:\Program Files\eRightSoft\SUPER\spk\1stRun.exe"
Fri 12 Mar 2004       106,496 A..H. --- "C:\Program Files\Fichiers communs\aolshare\shell\fr\shellext.dll"

[b]Finished![/b]

benurrr · Answer

Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-> Double clique combofix.exe. 
-> Tape sur la touche 1 (Yes) pour démarrer le scan. 
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt 

Avant d'utiliser ComboFix : 

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours. 

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. 

Une fois fait, sur ton bureau double-clic sur Combofix.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

-Attention  Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. risque de figer l'ordi 

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message. 

!\ Ne touche à rien tant que le scan n'est pas terminé. /!\ : risque de figer l'ordi (plantage complet) 

::Si combofix détecte quelque chose et de demande a redémarrer tu accepte

Milkman21 · Answer

Voici le scan combofix :

AV: avast! antivirus 4.8.1368 [VPS 100414-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\drivers\secdrv.sys
c:\windows\system32\drivers\usbaapl.sys
c:\windows\system32\drivers\w22n51.sys
c:\windows\system32\drivers\wudfpf.sys
c:\windows\system32\drivers\wudfrd.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32	mp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

c:\windows\system32\drivers\asyncmac.sys était absent 
Copie restaurée à partir de - c:\windows\system32\dllcache\asyncmac.sys

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_USBAAPL
-------\Legacy_w22n51
-------\Service_USBAAPL
-------\Service_w22n51


(((((((((((((((((((((((((((((   Fichiers créés du 2010-03-14 au 2010-04-14  ))))))))))))))))))))))))))))))))))))
.

2010-04-14 19:53 . 2010-04-14 20:00	--------	d-----w-	c:\windows\LastGood
2010-04-14 19:46 . 2010-04-14 19:46	578048	----a-w-	c:\windows\system32\dllcache\user32.dll
2010-04-14 19:44 . 2010-04-14 19:44	--------	d-----w-	c:\windows\ERUNT
2010-04-14 19:41 . 2010-04-14 20:14	--------	d-----w-	C:\SDFix
2010-04-14 07:09 . 2010-04-14 07:09	--------	d-----w-	C:\Kill'em
2010-04-14 07:09 . 2010-04-14 07:15	--------	d-----w-	c:\program files\List_Kill'em
2010-04-13 19:01 . 2010-04-13 19:01	664	----a-w-	c:\windows\system32\d3d9caps.dat
2010-04-13 16:58 . 2010-04-13 16:58	--------	d-----w-	c:\program files\Trend Micro
2010-04-09 08:35 . 2010-04-09 08:35	--------	d-----r-	c:\documents and settings\LocalService\Favoris
2010-03-26 09:22 . 2010-03-26 09:24	--------	d-----w-	c:\windows\ShellNew

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-14 21:05 . 2004-08-03 20:59	802304	----a-w-	c:\windows\system32\drivers\Flpydisk.sys
2010-04-14 19:54 . 2004-08-16 15:41	85312	----a-w-	c:\windows\system32\perfc00C.dat
2010-04-14 19:54 . 2004-08-16 15:41	511312	----a-w-	c:\windows\system32\perfh00C.dat
2010-04-14 19:06 . 2009-11-19 22:11	--------	d-----w-	c:\program files\LogMeIn
2010-04-13 17:38 . 2009-09-03 11:27	--------	d-----w-	c:\documents and settings\pierre grygiel\Application Data\vlc
2010-04-13 16:52 . 2009-10-13 17:47	--------	d-----w-	c:\documents and settings\pierre grygiel\Application Data\uTorrent
2010-03-28 21:43 . 2009-08-22 12:22	53944	----a-w-	c:\documents and settings\pierre grygiel\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-26 08:46 . 2010-02-17 11:12	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2010-03-17 10:09 . 2009-09-25 13:54	1	----a-w-	c:\documents and settings\pierre grygiel\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-03-11 12:34 . 2004-08-16 15:41	832512	----a-w-	c:\windows\system32\wininet.dll
2010-03-11 12:34 . 2004-08-16 15:40	78336	----a-w-	c:\windows\system32\ieencode.dll
2010-03-11 12:34 . 2004-08-16 15:40	17408	------w-	c:\windows\system32\corpol.dll
2010-03-09 08:13 . 2010-03-02 08:12	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-03-02 08:12 . 2010-03-02 08:12	--------	d-----w-	c:\documents and settings\pierre grygiel\Application Data\Malwarebytes
2010-03-02 08:12 . 2010-03-02 08:12	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-01 22:36 . 2010-03-01 22:36	16	----a-w-	c:\documents and settings\pierre grygiel\Application Databuwzv.dat
2010-03-01 22:23 . 2010-03-01 22:23	16	----a-w-	c:\windows\system32\config\systemprofile\Application Databuwzv.dat
2010-03-01 21:56 . 2010-03-01 21:56	16	----a-w-	c:\documents and settings\NetworkService\Application Databuwzv.dat
2010-02-23 20:14 . 2009-10-09 10:02	--------	d-----w-	c:\program files\Windows Live Safety Center
2010-02-15 09:50 . 2009-10-13 17:48	--------	d-----w-	c:\program files\uTorrent
2010-02-14 16:46 . 2009-09-07 10:38	--------	d-----w-	c:\documents and settings\pierre grygiel\Application Data\Apple Computer
2010-02-12 10:03 . 2010-02-24 17:05	293376	------w-	c:\windows\system32\browserchoice.exe
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2006-05-03 09:06 . 2009-09-28 19:55	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-09-28 19:55	31232	--sh--r-	c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-09-28 19:55	216064	--sh--r-	c:\windows\system32
bDX.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-02-14 319280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-10-02 155648]
"STDSB"="c:\windows\system32\drivers\STDSB.exe" [2003-12-17 28672]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-03-27 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-03-27 634880]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-25 149280]
"SoundMan"="SOUNDMAN.EXE" [2003-03-27 53248]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2004-10-08 81920]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-05-21 1372160]
"IntelWireless"="c:\program files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" [2009-05-21 1202448]
"lxdfmon.exe"="c:\program files\Lexmark 6500 Series\lxdfmon.exe" [2007-06-12 455600]
"lxdfamon"="c:\program files\Lexmark 6500 Series\lxdfamon.exe" [2007-06-01 20480]
"Lexmark 6500 Series Fax Server"="c:\program files\Lexmark 6500 Series\fm3032.exe" [2007-06-12 308144]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2009-08-22 26112]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\pierre grygiel\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Microsoft Office.lnk - c:\program files\microsoft office\office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LMIinit]
2009-09-28 18:34	87352	----a-w-	c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Lexmark 6500 Series\lxdfamon.exe"=
"c:\Program Files\Lexmark 6500 Series\frun.exe"=
"c:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe"=
"c:\Program Files\Lexmark 6500 Series\lxdfmon.exe"=
"c:\WINDOWS\system32\lxdfcfg.exe"=
"c:\WINDOWS\system32\lxdfcoms.exe"=
"c:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfpswx.exe"=
"c:\WINDOWS\system32\spool\drivers\w32x86\3\lxdftime.exe"=
"c:\Program Files\Lexmark 6500 Series\LXDFFax.exe"=
"c:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfjswx.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfwbgw.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\uTorrent\uTorrent.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800

R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [22/08/2009 13:58 11264]
R2 MTC0003_STDSB;Scroll Bar Driver;c:\windows\system32\drivers\stdsb.sys [22/08/2009 13:46 11279]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [15/11/2009 18:01 28672]
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [30/08/2009 11:25 114768]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswfsblk.sys [30/08/2009 11:25 20560]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86ainfo.sys [11/08/2008 13:41 12856]
S2 lxdf_device;lxdf_device;c:\windows\system32\lxdfcoms.exe -service --> c:\windows\system32\lxdfcoms.exe -service [?]
S2 lxdfCATSCustConnectService;lxdfCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdfserv.exe [31/08/2009 19:29 99248]
S2 STDSB;STDSB;c:\windows\system32\drivers\stdsb.sys [22/08/2009 13:46 11279]
S2 vnccom;vnccom;c:\windows\system32\drivers\vnccom.sys [19/11/2009 22:20 6016]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - ASYNCMAC
*NewlyCreated* - DMUSIC
*NewlyCreated* - PCIDUMP
*Deregistered* - Flpydisk
.
Contenu du dossier 'Tâches planifiées'

2010-04-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\pierre grygiel\Application Data\Mozilla\Firefox\Profiles\q4ey4fan.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - plugin: c:\program files\Microsoft\Office Live
pOLW.dll
FF - plugin: c:\program files\QuickTime\Plugins
pqtplugin8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology
pViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

MSConfigStartUp-79036227 - c:\docume~1\ALLUSE~1\APPLIC~1\79036227\79036227.exe
AddRemove-Steinberg Cubase SX v2.01 - c:\progra~1\STEINB~1\CUBASE~1\UNWISE.EXE



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-14 23:02
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySqlInventime]
"ImagePath"="c:\mysql\bin\mysqld-max-nt MySqlInventime"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Flpydisk]

.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1914707272-2930039326-2041744200-1008\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7C46D94F-7970-9117-8477-C83974EFCF63}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iadmgcjchpnhmmckjd"=hex:6a,61,67,6e,62,70,65,61,64,6f,62,6a,6e,67,67,6d,6f,61,
   65,6a,00,91
"hajlmblilomhgnla"=hex:69,61,6f,6d,69,62,64,69,6e,6d,6f,65,64,66,6a,6f,67,67,
   00,00
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(580)
c:\windows\system32\LMIinit.dll
c:\windows\system32
etprovcredman.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Heure de fin: 2010-04-14  23:07:52 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-04-14 21:07

Avant-CF: 49 121 353 728 octets libres
Après-CF: 49 182 851 072 octets libres

- - End Of File - - 11D8FFDD1193EEDEA28D43B2DDE4F244

Milkman21 · Answer

Merci Benurrr, mon pc redémarre en mode normal ;) ! Il met tjrs beaucoup beaucoup de temps pour ce lancer mais le bureau est bien là !

benurrr · Answer

**************************************************** 

/!\ Manip crée spécialement pour cet utilisateur , ne pas reproduire chez soi ... /!\ 

Ouvre le Bloc-Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.) 

Copie ce texte ( en gras )d'une traite ( CTRL+C pour copier ) puis colle-le ( CTRL+V dans le bloc-note ) 

File::
c:\documents and settings\pierre grygiel\Application Data\rbuwzv.dat 
c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat 
c:\documents and settings\NetworkService\Application Data\rbuwzv.dat 


Sauvegarde ce fichier sur ton bureau sous le nom de CFScript.txt. 


Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous : 

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif 

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide. 

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal! 

Ne touche à rien tant que le scan n'est pas terminé. 

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis. 

S'il n'y a pas de redémarrage, poste quand même les rapports. 

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Milkman21 · Answer

Voici le rapport combofix:

AV: avast! antivirus 4.8.1368 [VPS 100414-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
 * Un nouveau point de restauration a été créé

FILE ::
"c:\documents and settings\NetworkService\Application Databuwzv.dat"
"c:\documents and settings\pierre grygiel\Application Databuwzv.dat"
"c:\windows\system32\config\systemprofile\Application Databuwzv.dat"
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\NetworkService\Application Databuwzv.dat
c:\documents and settings\pierre grygiel\Application Databuwzv.dat
c:\windows\system32\config\systemprofile\Application Databuwzv.dat

.
(((((((((((((((((((((((((((((   Fichiers créés du 2010-03-14 au 2010-04-14  ))))))))))))))))))))))))))))))))))))
.

2010-04-14 21:31 . 2010-04-14 22:06	--------	d-----w-	c:\windows\LastGood
2010-04-14 21:00 . 2004-08-05 12:00	14336	----a-w-	c:\windows\system32\drivers\asyncmac.sys
2010-04-14 21:00 . 2004-08-05 12:00	14336	----a-w-	c:\windows\system32\dllcache\asyncmac.sys
2010-04-14 19:46 . 2010-04-14 19:46	578048	----a-w-	c:\windows\system32\dllcache\user32.dll
2010-04-14 19:44 . 2010-04-14 19:44	--------	d-----w-	c:\windows\ERUNT
2010-04-14 19:41 . 2010-04-14 20:14	--------	d-----w-	C:\SDFix
2010-04-14 07:09 . 2010-04-14 07:09	--------	d-----w-	C:\Kill'em
2010-04-14 07:09 . 2010-04-14 07:15	--------	d-----w-	c:\program files\List_Kill'em
2010-04-13 19:01 . 2010-04-13 19:01	664	----a-w-	c:\windows\system32\d3d9caps.dat
2010-04-13 16:58 . 2010-04-13 16:58	--------	d-----w-	c:\program files\Trend Micro
2010-04-09 08:35 . 2010-04-09 08:35	--------	d-----r-	c:\documents and settings\LocalService\Favoris
2010-03-26 09:22 . 2010-03-26 09:24	--------	d-----w-	c:\windows\ShellNew

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-14 22:07 . 2004-08-03 20:59	802304	----a-w-	c:\windows\system32\drivers\Flpydisk.sys
2010-04-14 22:02 . 2009-10-13 17:47	--------	d-----w-	c:\documents and settings\pierre grygiel\Application Data\uTorrent
2010-04-14 22:01 . 2009-11-19 22:11	--------	d-----w-	c:\program files\LogMeIn
2010-04-14 19:54 . 2004-08-16 15:41	85312	----a-w-	c:\windows\system32\perfc00C.dat
2010-04-14 19:54 . 2004-08-16 15:41	511312	----a-w-	c:\windows\system32\perfh00C.dat
2010-04-13 17:38 . 2009-09-03 11:27	--------	d-----w-	c:\documents and settings\pierre grygiel\Application Data\vlc
2010-03-28 21:43 . 2009-08-22 12:22	53944	----a-w-	c:\documents and settings\pierre grygiel\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-26 08:46 . 2010-02-17 11:12	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2010-03-17 10:09 . 2009-09-25 13:54	1	----a-w-	c:\documents and settings\pierre grygiel\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-03-11 12:34 . 2004-08-16 15:41	832512	------w-	c:\windows\system32\wininet.dll
2010-03-11 12:34 . 2004-08-16 15:40	78336	----a-w-	c:\windows\system32\ieencode.dll
2010-03-11 12:34 . 2004-08-16 15:40	17408	------w-	c:\windows\system32\corpol.dll
2010-03-09 08:13 . 2010-03-02 08:12	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-03-02 08:12 . 2010-03-02 08:12	--------	d-----w-	c:\documents and settings\pierre grygiel\Application Data\Malwarebytes
2010-03-02 08:12 . 2010-03-02 08:12	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-23 20:14 . 2009-10-09 10:02	--------	d-----w-	c:\program files\Windows Live Safety Center
2010-02-15 09:50 . 2009-10-13 17:48	--------	d-----w-	c:\program files\uTorrent
2010-02-14 16:46 . 2009-09-07 10:38	--------	d-----w-	c:\documents and settings\pierre grygiel\Application Data\Apple Computer
2010-02-12 10:03 . 2010-02-24 17:05	293376	------w-	c:\windows\system32\browserchoice.exe
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2006-05-03 09:06 . 2009-09-28 19:55	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-09-28 19:55	31232	--sh--r-	c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-09-28 19:55	216064	--sh--r-	c:\windows\system32
bDX.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-02-14 319280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-10-02 155648]
"STDSB"="c:\windows\system32\drivers\STDSB.exe" [2003-12-17 28672]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-03-27 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-03-27 634880]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-25 149280]
"SoundMan"="SOUNDMAN.EXE" [2003-03-27 53248]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2004-10-08 81920]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-05-21 1372160]
"IntelWireless"="c:\program files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" [2009-05-21 1202448]
"lxdfmon.exe"="c:\program files\Lexmark 6500 Series\lxdfmon.exe" [2007-06-12 455600]
"lxdfamon"="c:\program files\Lexmark 6500 Series\lxdfamon.exe" [2007-06-01 20480]
"Lexmark 6500 Series Fax Server"="c:\program files\Lexmark 6500 Series\fm3032.exe" [2007-06-12 308144]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2009-08-22 26112]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\pierre grygiel\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Microsoft Office.lnk - c:\program files\microsoft office\office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LMIinit]
2009-09-28 18:34	87352	----a-w-	c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Lexmark 6500 Series\lxdfamon.exe"=
"c:\Program Files\Lexmark 6500 Series\frun.exe"=
"c:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe"=
"c:\Program Files\Lexmark 6500 Series\lxdfmon.exe"=
"c:\WINDOWS\system32\lxdfcfg.exe"=
"c:\WINDOWS\system32\lxdfcoms.exe"=
"c:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfpswx.exe"=
"c:\WINDOWS\system32\spool\drivers\w32x86\3\lxdftime.exe"=
"c:\Program Files\Lexmark 6500 Series\LXDFFax.exe"=
"c:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfjswx.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\WINDOWS\system32\spool\drivers\w32x86\3\lxdfwbgw.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\uTorrent\uTorrent.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800

R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [22/08/2009 13:58 11264]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [30/08/2009 11:25 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswfsblk.sys [30/08/2009 11:25 20560]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86ainfo.sys [11/08/2008 13:41 12856]
R2 lxdf_device;lxdf_device;c:\windows\system32\lxdfcoms.exe -service --> c:\windows\system32\lxdfcoms.exe -service [?]
R2 lxdfCATSCustConnectService;lxdfCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdfserv.exe [31/08/2009 19:29 99248]
R2 MTC0003_STDSB;Scroll Bar Driver;c:\windows\system32\drivers\stdsb.sys [22/08/2009 13:46 11279]
R2 vnccom;vnccom;c:\windows\system32\drivers\vnccom.sys [19/11/2009 22:20 6016]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [15/11/2009 18:01 28672]
S2 STDSB;STDSB;c:\windows\system32\drivers\stdsb.sys [22/08/2009 13:46 11279]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - Flpydisk
.
Contenu du dossier 'Tâches planifiées'

2010-04-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\pierre grygiel\Application Data\Mozilla\Firefox\Profiles\q4ey4fan.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - plugin: c:\program files\Microsoft\Office Live
pOLW.dll
FF - plugin: c:\program files\QuickTime\Plugins
pqtplugin8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology
pViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-15 00:07
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySqlInventime]
"ImagePath"="c:\mysql\bin\mysqld-max-nt MySqlInventime"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Flpydisk]

.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1914707272-2930039326-2041744200-1008\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7C46D94F-7970-9117-8477-C83974EFCF63}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iadmgcjchpnhmmckjd"=hex:6a,61,67,6e,62,70,65,61,64,6f,62,6a,6e,67,67,6d,6f,61,
   65,6a,00,91
"hajlmblilomhgnla"=hex:69,61,6f,6d,69,62,64,69,6e,6d,6f,65,64,66,6a,6f,67,67,
   00,00
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(620)
c:\windows\system32\LMIinit.dll
c:\windows\system32
etprovcredman.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Heure de fin: 2010-04-15  00:09:18
ComboFix-quarantined-files.txt  2010-04-14 22:09
ComboFix2.txt  2010-04-14 21:07

Avant-CF: 49 056 649 216 octets libres
Après-CF: 49 029 263 360 octets libres

- - End Of File - - 8505C2C9BD0CFE9261B3599FBFE7D226
 













et maintenant le rapport de hijackthis :




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:11:25, on 15/04/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdfserv.exe
C:\WINDOWS\system32\lxdfcoms.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Lexmark 6500 Series\lxdfmon.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32
otepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [STDSB] C:\WINDOWS\system32\drivers\STDSB.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [lxdfmon.exe] "C:\Program Files\Lexmark 6500 Series\lxdfmon.exe"
O4 - HKLM\..\Run: [lxdfamon] "C:\Program Files\Lexmark 6500 Series\lxdfamon.exe"
O4 - HKLM\..\Run: [Lexmark 6500 Series Fax Server] "C:\Program Files\Lexmark 6500 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\microsoft office\office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: lxdfCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdfserv.exe
O23 - Service: lxdf_device -   - C:\WINDOWS\system32\lxdfcoms.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

Milkman21 · Answer

Salut, voici les rapports pour chacun des fichiers: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Pour c:\windows\system32\drivers\asyncmac.sys Fichier asyncmac.sys reçu le 2010.03.30 18:02:19 (UTC) Situation actuelle: terminé Résultat: 0/42 (0.00%) Formaté Formaté Impression des résultats Impression des résultats Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.50 2010.03.30 - AhnLab-V3 5.0.0.2 2010.03.30 - AntiVir 7.10.6.5 2010.03.30 - Antiy-AVL 2.0.3.7 2010.03.30 - Authentium 5.2.0.5 2010.03.30 - Avast 4.8.1351.0 2010.03.30 - Avast5 5.0.332.0 2010.03.30 - AVG 9.0.0.787 2010.03.29 - BitDefender 7.2 2010.03.30 - CAT-QuickHeal 10.00 2010.03.30 - ClamAV 0.96.0.0-git 2010.03.30 - Comodo 4439 2010.03.30 - DrWeb 5.0.2.03300 2010.03.30 - eSafe 7.0.17.0 2010.03.28 - eTrust-Vet 35.2.7396 2010.03.30 - F-Prot 4.5.1.85 2010.03.30 - F-Secure 9.0.15370.0 2010.03.30 - Fortinet 4.0.14.0 2010.03.30 - GData 19 2010.03.30 - Ikarus T3.1.1.80.0 2010.03.30 - Jiangmin 13.0.900 2010.03.30 - K7AntiVirus 7.10.1004 2010.03.22 - Kaspersky 7.0.0.125 2010.03.30 - McAfee 5936 2010.03.30 - McAfee+Artemis 5936 2010.03.30 - McAfee-GW-Edition 6.8.5 2010.03.30 - Microsoft 1.5605 2010.03.30 - NOD32 4985 2010.03.30 - Norman 6.04.10 2010.03.30 - nProtect 2009.1.8.0 2010.03.30 - Panda 10.0.2.2 2010.03.30 - PCTools 7.0.3.5 2010.03.30 - Prevx 3.0 2010.03.30 - Rising 22.41.01.03 2010.03.30 - Sophos 4.52.0 2010.03.30 - Sunbelt 6116 2010.03.30 - Symantec 20091.2.0.41 2010.03.30 - TheHacker 6.5.2.0.248 2010.03.30 - TrendMicro 9.120.0.1004 2010.03.30 - VBA32 3.12.12.2 2010.03.30 - ViRobot 2010.3.30.2252 2010.03.30 - VirusBuster 5.0.27.0 2010.03.30 - Information additionnelle File size: 14336 bytes MD5 : 02000abf34af4c218c35d257024807d6 SHA1 : 4bd208abcab95b6e14e966eab395bcde461b839e SHA256: fde21f7fcb198a44a6f2bcaf5eb11c9d90a094b4a2f8c307244a7655848954da PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x12C05 timedatestamp.....: 0x41107C8E (Wed Aug 4 08:05:02 2004) machinetype.......: 0x14C (Intel I386) ( 6 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x300 0x23FF 0x2400 6.35 4e9e2cc490d6e8fb3f9ac234779d0d90 .rdata 0x2700 0xF1 0x100 3.64 c168bbeab5d307f73902b47609963e9f .data 0x2800 0x3D0 0x400 5.60 c765abad220cff07c947b8902908e630 INIT 0x2C00 0x4C0 0x500 5.18 08d0354b2915f77dc7ff9b058b2095c2 .rsrc 0x3100 0x420 0x480 3.23 f4b56d6eee6a0ef1357604bfade593fd .reloc 0x3580 0x26E 0x280 5.66 9551110ef0eddd33d30bffe982e1eca5 ( 0 imports ) ( 0 exports ) TrID : File type identification Generic Win/DOS Executable (49.9%) DOS Executable Generic (49.8%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) ssdeep: 384:+g2yb/4M1XV5D7vKwBc/FdVai1BzdWZ8oFW:+gdZ3VTbe5aYFo sigcheck: publisher....: Microsoft Corporation copyright....: (c) Microsoft Corporation. All rights reserved. product......: Microsoft_ Windows_ Operating System description..: MS Remote Access serial network driver original name: ASYNCMAC.SYS internal name: ASYNCMAC.SYS file version.: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) comments.....: n/a signers......: - signing date.: - verified.....: Unsigned PEiD : - packers (Kaspersky): PE_Patch RDS : NSRL Reference Data Set ( Gateway ) Gateway Operating System Windows XP Pro Edition SP2: asyncmac.sys ( Microsoft ) Disc 2438.5: asyncmac.sysMSDN Disc 2428.4: asyncmac.sysMSDN Disc 2428.5: asyncmac.sysMSDN Disc 2428.8: asyncmac.sysMSDN Disc 2438.7: asyncmac.sysMSDN Disc 2438.8: asyncmac.sysMSDN Disc 2439.6: asyncmac.sysMSDN Disc 2439.7: asyncmac.sysMSDN Disc 2439.8: asyncmac.sysMSDN Disc 2440.3: asyncmac.sysMSDN Disc 2440.4: asyncmac.sysMSDN Disc 2440.5: asyncmac.sysMSDN Disc 2441.5: asyncmac.sysMSDN Disc 2441.6: asyncmac.sysMSDN Disc 2441.7: asyncmac.sysMSDN Disc 2442.4: asyncmac.sysMSDN Disc 2442.6: asyncmac.sysMSDN Disc 2443.2: asyncmac.sysMSDN Disc 2443.4: asyncmac.sysMSDN Disc 2444.3: asyncmac.sysMSDN Disc 2444.3: asyncmac.sysMSDN Disc 2444.4: asyncmac.sysMSDN Disc 2444.6: asyncmac.sysMSDN Disc 2455.6: asyncmac.sysMSDN Disc 2464.5: asyncmac.sysMSDN Disc 2465.4: asyncmac.sysMSDN Disc 2465.5: asyncmac.sysMSDN Disc 2466.2: asyncmac.sysMSDN Disc 2466.4: asyncmac.sysMSDN Disc 2476.2: asyncmac.sysMSDN Disc 2476.4: asyncmac.sysMSDN Disc 2477.2: asyncmac.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: asyncmac.sysVirtual PC for Mac Windows XP Home Edition: asyncmac.sysVirtual PC for Mac Windows XP Professional Edition: asyncmac.sys POur >>>>>>>>>>>>>>>>>>>>>>>>>> c:\windows\system32\dllcache\asyncmac.sys Fichier asyncmac.sys reçu le 2010.03.30 18:02:19 (UTC) Situation actuelle: terminé Résultat: 0/42 (0.00%) Formaté Formaté Impression des résultats Impression des résultats Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.50 2010.03.30 - AhnLab-V3 5.0.0.2 2010.03.30 - AntiVir 7.10.6.5 2010.03.30 - Antiy-AVL 2.0.3.7 2010.03.30 - Authentium 5.2.0.5 2010.03.30 - Avast 4.8.1351.0 2010.03.30 - Avast5 5.0.332.0 2010.03.30 - AVG 9.0.0.787 2010.03.29 - BitDefender 7.2 2010.03.30 - CAT-QuickHeal 10.00 2010.03.30 - ClamAV 0.96.0.0-git 2010.03.30 - Comodo 4439 2010.03.30 - DrWeb 5.0.2.03300 2010.03.30 - eSafe 7.0.17.0 2010.03.28 - eTrust-Vet 35.2.7396 2010.03.30 - F-Prot 4.5.1.85 2010.03.30 - F-Secure 9.0.15370.0 2010.03.30 - Fortinet 4.0.14.0 2010.03.30 - GData 19 2010.03.30 - Ikarus T3.1.1.80.0 2010.03.30 - Jiangmin 13.0.900 2010.03.30 - K7AntiVirus 7.10.1004 2010.03.22 - Kaspersky 7.0.0.125 2010.03.30 - McAfee 5936 2010.03.30 - McAfee+Artemis 5936 2010.03.30 - McAfee-GW-Edition 6.8.5 2010.03.30 - Microsoft 1.5605 2010.03.30 - NOD32 4985 2010.03.30 - Norman 6.04.10 2010.03.30 - nProtect 2009.1.8.0 2010.03.30 - Panda 10.0.2.2 2010.03.30 - PCTools 7.0.3.5 2010.03.30 - Prevx 3.0 2010.03.30 - Rising 22.41.01.03 2010.03.30 - Sophos 4.52.0 2010.03.30 - Sunbelt 6116 2010.03.30 - Symantec 20091.2.0.41 2010.03.30 - TheHacker 6.5.2.0.248 2010.03.30 - TrendMicro 9.120.0.1004 2010.03.30 - VBA32 3.12.12.2 2010.03.30 - ViRobot 2010.3.30.2252 2010.03.30 - VirusBuster 5.0.27.0 2010.03.30 - Information additionnelle File size: 14336 bytes MD5 : 02000abf34af4c218c35d257024807d6 SHA1 : 4bd208abcab95b6e14e966eab395bcde461b839e SHA256: fde21f7fcb198a44a6f2bcaf5eb11c9d90a094b4a2f8c307244a7655848954da PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x12C05 timedatestamp.....: 0x41107C8E (Wed Aug 4 08:05:02 2004) machinetype.......: 0x14C (Intel I386) ( 6 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x300 0x23FF 0x2400 6.35 4e9e2cc490d6e8fb3f9ac234779d0d90 .rdata 0x2700 0xF1 0x100 3.64 c168bbeab5d307f73902b47609963e9f .data 0x2800 0x3D0 0x400 5.60 c765abad220cff07c947b8902908e630 INIT 0x2C00 0x4C0 0x500 5.18 08d0354b2915f77dc7ff9b058b2095c2 .rsrc 0x3100 0x420 0x480 3.23 f4b56d6eee6a0ef1357604bfade593fd .reloc 0x3580 0x26E 0x280 5.66 9551110ef0eddd33d30bffe982e1eca5 ( 0 imports ) ( 0 exports ) TrID : File type identification Generic Win/DOS Executable (49.9%) DOS Executable Generic (49.8%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) ssdeep: 384:+g2yb/4M1XV5D7vKwBc/FdVai1BzdWZ8oFW:+gdZ3VTbe5aYFo sigcheck: publisher....: Microsoft Corporation copyright....: (c) Microsoft Corporation. All rights reserved. product......: Microsoft_ Windows_ Operating System description..: MS Remote Access serial network driver original name: ASYNCMAC.SYS internal name: ASYNCMAC.SYS file version.: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) comments.....: n/a signers......: - signing date.: - verified.....: Unsigned PEiD : - packers (Kaspersky): PE_Patch RDS : NSRL Reference Data Set ( Gateway ) Gateway Operating System Windows XP Pro Edition SP2: asyncmac.sys ( Microsoft ) Disc 2438.5: asyncmac.sysMSDN Disc 2428.4: asyncmac.sysMSDN Disc 2428.5: asyncmac.sysMSDN Disc 2428.8: asyncmac.sysMSDN Disc 2438.7: asyncmac.sysMSDN Disc 2438.8: asyncmac.sysMSDN Disc 2439.6: asyncmac.sysMSDN Disc 2439.7: asyncmac.sysMSDN Disc 2439.8: asyncmac.sysMSDN Disc 2440.3: asyncmac.sysMSDN Disc 2440.4: asyncmac.sysMSDN Disc 2440.5: asyncmac.sysMSDN Disc 2441.5: asyncmac.sysMSDN Disc 2441.6: asyncmac.sysMSDN Disc 2441.7: asyncmac.sysMSDN Disc 2442.4: asyncmac.sysMSDN Disc 2442.6: asyncmac.sysMSDN Disc 2443.2: asyncmac.sysMSDN Disc 2443.4: asyncmac.sysMSDN Disc 2444.3: asyncmac.sysMSDN Disc 2444.3: asyncmac.sysMSDN Disc 2444.4: asyncmac.sysMSDN Disc 2444.6: asyncmac.sysMSDN Disc 2455.6: asyncmac.sysMSDN Disc 2464.5: asyncmac.sysMSDN Disc 2465.4: asyncmac.sysMSDN Disc 2465.5: asyncmac.sysMSDN Disc 2466.2: asyncmac.sysMSDN Disc 2466.4: asyncmac.sysMSDN Disc 2476.2: asyncmac.sysMSDN Disc 2476.4: asyncmac.sysMSDN Disc 2477.2: asyncmac.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: asyncmac.sysVirtual PC for Mac Windows XP Home Edition: asyncmac.sysVirtual PC for Mac Windows XP Professional Edition: asyncmac.sys >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Pour c:\windows\system32\flvDX.dll Fichier flvDX.dll reçu le 2010.04.08 11:04:53 (UTC) Situation actuelle: terminé Résultat: 0/39 (0.00%) Formaté Formaté Impression des résultats Impression des résultats Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.50 2010.04.08 - AhnLab-V3 5.0.0.2 2010.04.07 - AntiVir 7.10.6.47 2010.04.08 - Antiy-AVL 2.0.3.7 2010.04.08 - Authentium 5.2.0.5 2010.04.08 - Avast 4.8.1351.0 2010.04.08 - Avast5 5.0.332.0 2010.04.08 - AVG 9.0.0.787 2010.04.08 - BitDefender 7.2 2010.04.08 - CAT-QuickHeal 10.00 2010.04.08 - ClamAV 0.96.0.3-git 2010.04.08 - Comodo 4537 2010.04.08 - DrWeb 5.0.2.03300 2010.04.08 - eSafe 7.0.17.0 2010.04.07 - eTrust-Vet 35.2.7414 2010.04.08 - F-Prot 4.5.1.85 2010.04.07 - F-Secure 9.0.15370.0 2010.04.08 - Fortinet 4.0.14.0 2010.04.08 - GData 19 2010.04.08 - Ikarus T3.1.1.80.0 2010.04.08 - Jiangmin 13.0.900 2010.04.08 - Kaspersky 7.0.0.125 2010.04.08 - McAfee-GW-Edition 6.8.5 2010.04.08 - Microsoft 1.5605 2010.04.08 - NOD32 5009 2010.04.08 - Norman 6.04.11 2010.04.08 - nProtect 2009.1.8.0 2010.04.06 - Panda 10.0.2.2 2010.04.07 - PCTools 7.0.3.5 2010.04.08 - Prevx 3.0 2010.04.08 - Rising 22.42.03.03 2010.04.08 - Sophos 4.52.0 2010.04.08 - Sunbelt 6151 2010.04.08 - Symantec 20091.2.0.41 2010.04.08 - TheHacker 6.5.2.0.257 2010.04.08 - TrendMicro 9.120.0.1004 2010.04.08 - VBA32 3.12.12.4 2010.04.05 - ViRobot 2010.4.8.2267 2010.04.08 - VirusBuster 5.0.27.0 2010.04.07 - Information additionnelle File size: 163328 bytes MD5 : 8453687a045c926f0291301ebaf50370 SHA1 : 8d756345c945b75ef63314fa8992f1b582067ff3 SHA256: 151afe783864d2fcbe6f954d1aef0cb1a157ae41848e2f0478217cddaad61967 PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x6BF60 timedatestamp.....: 0x445872AE (Wed May 3 11:06:54 2006) machinetype.......: 0x14C (Intel I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 UPX0 0x1000 0x44000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e UPX1 0x45000 0x28000 0x27200 7.92 8c71ecde07c563755798b56de82cfa8b .rsrc 0x6D000 0x1000 0x800 3.27 ea079b662ca468ac3b84ac5ae3533871 ( 0 imports ) ( 0 exports ) TrID : File type identification Win64 Executable Generic (52.5%) UPX compressed Win32 Executable (18.7%) Win32 EXE Yoda's Crypter (16.3%) Win32 Executable Generic (5.2%) Win32 Dynamic Link Library (generic) (4.6%) ThreatExpert: https://www.symantec.com?md5=8453687a045c926f0291301ebaf50370 ssdeep: 3072:91gwAEW0tqtON2BemdVhxcFtNSrL70RU5P7Rv8OYLI1ejvTeDT:9CwvW0tqtONy0t4/7B5+y62 sigcheck: publisher....: Gabest copyright....: Copyright (C) 2005-2006 Gabest product......: FLV Splitter description..: FLV Splitter original name: FLVSplitter.ax internal name: FLV Splitter file version.: 1, 0, 0, 1 comments.....: http://gabest.org/ signers......: - signing date.: - verified.....: Unsigned PEiD : - packers (Kaspersky): PE_Patch.UPX, UPX packers (F-Prot): UPX CWSandbox: http://research.sunbelt-software.com/... RDS : NSRL Reference Data Set - >>>>>>>>>>>>>>>>>>><<>>>>>>>>>>> pour c:\windows\system32\msfDX.dll Fichier msfDX.dll reçu le 2010.04.11 10:20:35 (UTC) Situation actuelle: terminé Résultat: 1/39 (2.56%) Formaté Formaté Impression des résultats Impression des résultats Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.50 2010.04.11 - AhnLab-V3 5.0.0.2 2010.04.10 - AntiVir 7.10.6.55 2010.04.09 - Antiy-AVL 2.0.3.7 2010.04.09 - Authentium 5.2.0.5 2010.04.11 - Avast 4.8.1351.0 2010.04.10 - Avast5 5.0.332.0 2010.04.10 - AVG 9.0.0.787 2010.04.11 - BitDefender 7.2 2010.04.11 - CAT-QuickHeal 10.00 2010.04.10 - ClamAV 0.96.0.3-git 2010.04.11 - Comodo 4565 2010.04.11 - DrWeb 5.0.2.03300 2010.04.11 - eSafe 7.0.17.0 2010.04.08 Suspicious File eTrust-Vet 35.2.7418 2010.04.09 - F-Prot 4.5.1.85 2010.04.11 - F-Secure 9.0.15370.0 2010.04.11 - Fortinet 4.0.14.0 2010.04.10 - GData 19 2010.04.11 - Ikarus T3.1.1.80.0 2010.04.11 - Jiangmin 13.0.900 2010.04.11 - Kaspersky 7.0.0.125 2010.04.11 - McAfee-GW-Edition 6.8.5 2010.04.09 - Microsoft 1.5605 2010.04.11 - NOD32 5016 2010.04.10 - Norman 6.04.11 2010.04.10 - nProtect 2009.1.8.0 2010.04.06 - Panda 10.0.2.2 2010.04.10 - PCTools 7.0.3.5 2010.04.11 - Prevx 3.0 2010.04.11 - Rising 22.42.06.04 2010.04.11 - Sophos 4.52.0 2010.04.11 - Sunbelt 6163 2010.04.11 - Symantec 20091.2.0.41 2010.04.11 - TheHacker 6.5.2.0.259 2010.04.11 - TrendMicro 9.120.0.1004 2010.04.11 - VBA32 3.12.12.4 2010.04.09 - ViRobot 2010.4.10.2270 2010.04.10 - VirusBuster 5.0.27.0 2010.04.10 - Information additionnelle File size: 31232 bytes MD5 : 21d8f42d54598b73c2e1a9571399113b SHA1 : ed711faa61fdd6d53eacc7a99d60d95dd9137a7d SHA256: 992e23bddfa1eaaf66cc7ccbef23596be5d2b47aa6a8272028092b4829bde784 PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x47C0 timedatestamp.....: 0x3F8E4348 (Thu Oct 16 09:05:44 2003) machinetype.......: 0x14C (Intel I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x14000 0x5E00 7.96 2c3b58f66566a8e664c8ea4a5a891296 .rsrc 0x15000 0x2000 0x1600 6.84 345310e90c13175c817748d5d69715bf .reloc 0x17000 0x1000 0x200 0.22 3bea04e909f4f9d16cc848d4a6c601f5 ( 0 imports ) ( 0 exports ) TrID : File type identification Win32 EXE PECompact compressed (v2.x) (48.9%) Win32 EXE PECompact compressed (generic) (34.4%) Win32 Executable Generic (7.0%) Win32 Dynamic Link Library (generic) (6.2%) Generic Win/DOS Executable (1.6%) ThreatExpert: https://www.symantec.com?md5=21d8f42d54598b73c2e1a9571399113b ssdeep: 768:Cn1nHSwfnflO/a7ubx6dIN5OKVfNqW190LwiuO:C5yAf6a7EuKtN990L sigcheck: publisher....: Hans Mayerl copyright....: n/a product......: msfDX.dll description..: msfDX.dll original name: msfDX.dll internal name: msfDX.dll file version.: 2.02.2113 comments.....: MOV Source Filter signers......: - signing date.: - verified.....: Unsigned PEiD : PECompact 2.xx --> BitSum Technologies packers (Kaspersky): PE_Patch.PECompact, PecBundle, PECompact packers (F-Prot): PecBundle, PECompact CWSandbox: http://research.sunbelt-software.com/... RDS : NSRL Reference Data Set >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Pour c:\windows\system32 bDX.dll : Fichier nbDX.dll reçu le 2010.04.13 16:08:48 (UTC) Situation actuelle: terminé Résultat: 1/40 (2.50%) Formaté Formaté Impression des résultats Impression des résultats Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.50 2010.04.13 - AhnLab-V3 5.0.0.2 2010.04.12 - AntiVir 7.10.6.68 2010.04.13 - Antiy-AVL 2.0.3.7 2010.04.13 - Authentium 5.2.0.5 2010.04.13 - Avast 4.8.1351.0 2010.04.13 - Avast5 5.0.332.0 2010.04.13 - AVG 9.0.0.787 2010.04.13 - BitDefender 7.2 2010.04.13 - CAT-QuickHeal 10.00 2010.04.13 - ClamAV 0.96.0.3-git 2010.04.13 - Comodo 4587 2010.04.13 - DrWeb 5.0.2.03300 2010.04.13 - eSafe 7.0.17.0 2010.04.13 Suspicious File eTrust-Vet 35.2.7423 2010.04.13 - F-Prot 4.5.1.85 2010.04.13 - F-Secure 9.0.15370.0 2010.04.13 - Fortinet 4.0.14.0 2010.04.12 - GData 19 2010.04.13 - Ikarus T3.1.1.80.0 2010.04.13 - Jiangmin 13.0.900 2010.04.13 - Kaspersky 7.0.0.125 2010.04.13 - McAfee 5.400.0.1158 2010.04.13 - McAfee-GW-Edition 6.8.5 2010.04.13 - Microsoft 1.5605 2010.04.13 - NOD32 5026 2010.04.13 - Norman 6.04.11 2010.04.13 - nProtect 2009.1.8.0 2010.04.06 - Panda 10.0.2.7 2010.04.13 - PCTools 7.0.3.5 2010.04.13 - Prevx 3.0 2010.04.13 - Rising 22.43.01.01 2010.04.13 - Sophos 4.52.0 2010.04.13 - Sunbelt 6170 2010.04.13 - Symantec 20091.2.0.41 2010.04.13 - TheHacker 6.5.2.0.260 2010.04.13 - TrendMicro 9.120.0.1004 2010.04.13 - VBA32 3.12.12.4 2010.04.09 - ViRobot 2010.4.13.2274 2010.04.13 - VirusBuster 5.0.27.0 2010.04.13 - Information additionnelle File size: 216064 bytes MD5 : e4b6b932b6e5ce386627ceea2a0a0f4c SHA1 : b9bcaae7bb27161148e1301fc8d8cd3f568c6e22 SHA256: a0f6231d8f48d8579be4275b95425f80cc5f703730f5f5e9f5b8748a813282f6 PEInfo: PE Structure information ( base data ) entrypointaddress.: 0xE540 timedatestamp.....: 0x47DD210D (Sun Mar 16 14:30:53 2008) machinetype.......: 0x14C (Intel I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xAB000 0x32E00 8.00 ca6fa635de272e225cfc131d9fe20052 .rsrc 0xAC000 0x2000 0x1800 6.86 446ef74531ed3e33f7b3852a7184e670 .reloc 0xAE000 0x1000 0x200 0.22 8c0a50c2ebb734c97d87d426da67930d ( 0 imports ) ( 0 exports ) TrID : File type identification Win32 EXE PECompact compressed (v2.x) (48.9%) Win32 EXE PECompact compressed (generic) (34.4%) Win32 Executable Generic (7.0%) Win32 Dynamic Link Library (generic) (6.2%) Generic Win/DOS Executable (1.6%) ssdeep: 6144:auoML/fwfGnrNibNILomhkHi0hywYDWfclB:auoY4fGrNJLoC0VYDwcl sigcheck: publisher....: MONOGRAM Multimedia, s.r.o. copyright....: Copyright (C) 2008 product......: MONOGRAM AMR Filter Pack description..: AMR Filter Pack original name: mmamr.ax internal name: mmamr file version.: 1, 0, 1, 0 comments.....: n/a signers......: - signing date.: - verified.....: Unsigned PEiD : PECompact 2.xx --> BitSum Technologies packers (Kaspersky): PE_Patch.PECompact, PecBundle, PECompact packers (F-Prot): PecBundle, PECompact CWSandbox: http://research.sunbelt-software.com/... RDS : NSRL Reference Data Set -

Milkman21 · Answer

Il n'y a plus rien d'anormal ? Mon PC est tjrs lent au démarrage mais ça doit être parcequ'il est vieux !
Merci en tout cas benurrr pour tout se que tu as fait ! Je te connaitrais je te payerai un coup ;) de sur ! 

MM

benurrr · Answer

salut

désinstalle List&Kill'em en double cliquant sur le raccourcie puis option désinstaller ou via ajout suppression de programme

et re télécharge le 

http://sd-1.archive-host.com/...

et lance l'option clean

Milkman21 · Answer

ça y est ! 
Voilà le rapport !

Update on 13/04/2010 by g3n-h@ckm@n ::::: 17.10
Start at: 21:54:15 | 15/04/2010

        Intel(R) Pentium(R) M processor 1.60GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1368 [VPS 100415-1] 4.8.1368 [ Enabled | Updated ]

C:\ -> Disque fixe local | 74,52 Go (45,6 Go free) [HDD] | NTFS
D:\ -> Disque CD-ROM
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdfserv.exe
C:\WINDOWS\system32\lxdfcoms.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe
 
¤¤¤¤¤¤¤¤¤¤ Files/folders : 

 
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn 
Quarantined & Deleted !! : C:\WINDOWS\System32\MabryObj.dll 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET59.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET5B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET5F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET60.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET67.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\pierre grygiel\Application Data\GDIPFONTCACHEV1.DAT 
 
==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}  
Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  
=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp
Local Page	REG_SZ         	C:\WINDOWS\system32\blank.htm
Default_Search_URL	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp
Search Page	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.google.com/?gws_rd=ssl
Local Page	REG_SZ         	C:\WINDOWS\system32\blank.htm
Search Page	REG_SZ         	http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] 
FirstRunDisabled	REG_DWORD      	1 (0x1) 
AntiVirusDisableNotify	REG_DWORD      	0 (0x0) 
FirewallDisableNotify	REG_DWORD      	0 (0x0) 
UpdatesDisableNotify	REG_DWORD      	0 (0x0) 
AntiVirusOverride	REG_DWORD      	1 (0x1) 
FirewallOverride	REG_DWORD      	1 (0x1) 
 
========
Services
=========

 Ndisuio : Start = 3   
 SharedAccess : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

============
Disk Cleaned
============
 
=================
anti-ver blaster : OK !! 
=================

================
Prefetch cleaned 
================
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

benurrr · Answer

cool

dans l'ordre

Double clic sur le raccourci UsbFix présent sur ton bureau

Choisi l option Désinstaller

de même pour List&Kill'em

ensuite

pour nettoyer les fix qui ont servit

Ferme toutes les applications en cours, puis télécharge ToolsCleaner2 sur ton Bureau.
http://pc-system.fr/

Double clique sur ToolsCleaner2.exe >
puis Recherche
et sur Suppression
Note : ton bureau va disparaître, c'est normal. S'il n'apparaît pas à la fin du scan, fais la manip suivante :

CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"

Tape explorer.exe et valide. Cela fera re-apparaître le Bureau

tu poste le rapport générer après suppression


ensuite

tu va télécharger Ccleaner https://www.commentcamarche.net/

ouvre "Ccleaner" vas dans l'onglet "Option" puis "Avancé" puis décoches "Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures."

. Puis vas dans l'onglet "Nettoyeur" fais "Analyse" puis "Lancer le nettoyage".
Puis vas dans l'onglet "Registre" puis fait "Chercher des erreurs" puis "Réparer les erreurs sélectionnée"
. Tu refais tous ca 4-5 fois (le nettoyage et le registre).

Puis reste dans "Ccleaner" puis va dans "Option" puis "Propriété" puis coches "Nettoyer automatiquement l'ordinateur au démarrage".

içi mode d'emploi pour ccleaner

Milkman21 · Answer

ça y est j'ai fait tout se que tu m'as dis ! Par contre je n'ai pas eu de rapport pour ToolsCleaner2... cependant il me disait qu'il avait tout bien supprimé !

Milkman21 · Answer

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\SDFIX: trouvé !
C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\Backups\catchme.zip: trouvé !
C:\Backups\catchme.log: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\pierre grygiel\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\pierre grygiel\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\pierre grygiel\Bureau\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\pierre grygiel\Bureau\SmitFraudfix: trouvé !
C:\Documents and Settings\pierre grygiel\Bureau\Master 2\SdFix.exe: trouvé !
C:\Program Files\List_Kill'em\mbr.log: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\SDFix\catchme.exe: trouvé !
C:\WINDOWS\mbr.exe: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\pierre grygiel\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\pierre grygiel\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\pierre grygiel\Bureau\SmitFraudFix.exe: supprimé !
C:\Documents and Settings\pierre grygiel\Bureau\Master 2\SdFix.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\SDFix\catchme.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\Backups\catchme.zip: supprimé !
C:\Backups\catchme.log: supprimé !
C:\Program Files\List_Kill'em\mbr.log: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\WINDOWS\mbr.exe: supprimé !
C:\SDFIX: supprimé !
C:\Combofix: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\pierre grygiel\Bureau\SmitFraudfix: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Milkman21 · Answer

Encore Merci pour tout benurrr ! Je vais lire ça ; )!

Ecran bleu, pas de message, plus de bureau

20 réponses

Discussions similaires

Newsletters