Je n'y arrive pas, j'aides attaques de chevalRésolu/Fermé

Question

Bonjour à tous,
Depuis quelques jours j'ai mon Anti virus eset security nod 32 qui me met sans arrêt tous les 5 minutes un message comme quoi il bloque l'attaque d'un cheval de troie.
J'ai voulu essayer de nettoyer avec spyboot et malarbytes et hijackthis mais rien n'y fait.
J'ai l'impression que j'ai un fichier surement installé sur mon PC qui demande aux attaquant de pénétrer.
Je baisse les bras car à force c'est pénible donc si vous pouvez m'aider, merci
Cordialement Daniel
sConfiguration: Windows XP / Firefox 3.6.3

TwoDolls44 · Answer

Tu as juste eset security nod 32 qui détecte un cheval de trois ? Ou alors toutes tes procédures on détecté des cheval de trois ? Si il y à Juste Nod32 c'est qu'il plante !

dbourgeo · Answer

Merci twodolls apparemment seul nod 32 détecte ça je vais le désinstaller et essayer autre chose on verra bien. Je te tiens au courant.
Encore merci et bonne soirée

TwoDolls44 · Answer

Prends Microsoft Security essentials, et mes résolu à ton problème :)

moment de grace · Answer

bonjour

* Télécharge Random's System Information Tool (RSIT) de Random/Random. 

(outil de diagnostic)

http://images.malwareremoval.com/random/RSIT.exe 

* Enregistre le sur ton Bureau. 

* Double clique sur RSIT.exe pour lancer l'outil. 

* Clique sur "Continue" à l'écran Disclaimer. 

* Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu s'il te le demande) 

et tu devras accepter la licence. 

* Une fois le scan terminé, deux rapports vont apparaître : poste les (par "j'ai une réponse") dans deux messages séparés stp

Les rapports se trouvent à cet endroit: 
C:\rsit\info.txt 
C:\rsit\log.txt

dbourgeo · Answer

Bonjour à tous,
Bon je n'étais pas là ce matin donc je n'ai rien fait.
J'ai par contre mis la dernière version de nod 32 à jour et maintenant j'ai des attaques sans arrêt.
J'ai deux messages essentiels :
1)- Objet :
C:\WINDOWS\system32\drivers\Imapi.sys
Menace:
Win32/Olmarick.XG cheval de troie

2)- Objet :
http://188.40.50.214/inst_n105.exe
Menace:
Win32/Trojan clicker.Delf.NJE cheval de troie.

Voila donc je fais la manipulation de moment de grace et je poste les fichiers.
Merci Daniel

dbourgeo · Answer

Je n'arrive pas  à poster les fichiers log.txt et info.txt avec le lien" j'ai une réponse" ça mouline mais les fichier n'apparaissent pas dans le sujet.
Comment faire ?
Daniel

dbourgeo · Answer

Fichier info.txt.

info.txt logfile of random's system information tool 1.06 2010-04-22 13:05:37

======Uninstall list======

-->"C:\Program Files\InstallShield Installation Information\{BB8AE808-F003-4C7F-B56B-8C80EEAFFE23}\setup.exe" --u:{BB8AE808-F003-4C7F-B56B-8C80EEAFFE23}
-->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->MsiExec.exe /I{D7E0F184-E85E-41D3-85D6-59A2F5CF6D73}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware Email Scanner for Outlook-->MsiExec.exe /I{338F08AB-C262-42C7-B000-34DE1A475273}
Ad-Aware-->"C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
Adobe Acrobat 9 Pro Extended - English, Français, Deutsch-->msiexec /I {AC76BA86-1033-F400-7761-000000000004}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Ad-Remover By C_XX-->"C:\Ad-Remover\Un-ADR.exe"
AM-DeadLink 4.0-->"C:\Program Files\AM-DeadLink\unins000.exe"
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ArcSoft PhotoStudio 5.5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85309D89-7BE9-4094-BB17-24999C6118FC}\SETUP.EXE" -l0x40c 
Assistant de connexion Windows Live ID-->MsiExec.exe /X{10A44844-4465-456E-8C97-80BDD4F68845}
Audacity 1.2.6-->"E:\XP\Program Files\Audacity\unins000.exe"
AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
BitTorrent 5.0.9-->"C:\Program Files\BitTorrent\uninstall.exe"
Canon MP Navigator 3.0-->"C:\Program Files\Canon\MP Navigator 3.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 3.0\uninst.ini
Canon MP600-->"C:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP600\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP600 /L0x000c
Canon Utilities Easy-PhotoPrint-->C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
CartoExploreur 3D 1.09-->"C:\Program Files\Bayo\Setup\CartoExploreur 3D 1.09\unins000.exe"
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
CD-LabelPrint-->"C:\Program Files\Canon\CD-LabelPrint\Uninstal.exe" Canon.CDLabelPrint.Application
ClickImpôts plus SCI 2010.1.065-->MsiExec.exe /I{344EFE25-B7F4-46E2-967D-EC7385C2C9B7}
Corel VideoStudio 12-->C:\Program Files\InstallShield Installation Information\{F0FDF9C9-1DDC-401F-B638-36F1CAE8A875}\setup.exe -runfromtemp -l0x040c
Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
CPUID CPU-Z 1.52.2-->"I:\CPU-Z\unins000.exe"
Dialogys-->E:\XP\Program Files\Dialogys\_uninst\uninstaller.exe
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Easy CD-DA Extractor 12-->"C:\WINDOWS\Easy CD-DA Extractor 11.9.9 build 668\uninstall.exe" "/U:E:\XP\Program Files\Easy CD-DA Extractor 12\irunin.xml"
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Enregistrement utilisateur de Canon MP600-->C:\Program Files\Canon\IJEREG\MP600\UNINST.EXE
eReg-->MsiExec.exe /I{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}
erLT-->MsiExec.exe /I{A498D9EB-927B-459B-85D6-DD6EF8C2C564}
FastStone Capture 5.6-->C:\Program Files\FastStone Capture\uninst.exe
FileHippo.com Update Checker-->"C:\Program Files\FileHippo.com\uninstall.exe"
FreeCommander 2009.02-->"E:\XP\Program Files\FreeCommander\unins000.exe"
FTP Expert 3-->"C:\Program Files\Visicom Media\FTP Expert 3\uninst-ftp.exe"
Galerie de photos Windows Live-->MsiExec.exe /X{B131E59D-202C-43C6-84C9-68F0C37541F1}
GoldWave v5.51-->"E:\XP\Program Files\GoldWave\unstall.exe" "GoldWave v5.51" "E:\XP\Program Files\GoldWave\unstall.log"
GoldWave v5.54-->"E:\XP\Program Files\GoldWave\unstall.exe" "GoldWave v5.54" "E:\XP\Program Files\GoldWave\unstall.log"
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{08C0729E-3E50-11DF-9D81-005056806466}
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
HiJackThis-->MsiExec.exe /X{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}
Hotfix for Microsoft .NET Framework 3.0 (KB932471)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {ECD292A0-0347-4244-8C24-5DBCE990FB40} /package {BAF78226-3200-4DB4-BE33-4D922A799840}
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Impotwin-->C:\impotwin\uninstal.exe
Incomedia WebSite X5 Evolution-->C:\WINDOWS\system32\iwpsetup.exe Uninst /Evolution /FR /C:\Program Files\WebSite X5 Evolution
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
IZArc 4.1-->"C:\Program Files\IZArc\unins004.exe"
Java(TM) 6 Update 16-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216016FF}
Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
KhalInstallWrapper-->MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}
Kyodai Mahjongg-->"C:\Program Files\Kyodai Mahjongg\unins000.exe"
Labtec WebCam-->MsiExec.exe /X{995BF1A7-30E5-49E5-A0E4-AD3213D9E330}
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Logiciel d'archivage WinRAR-->E:\XP\Program Files\Winrar\uninstall.exe
Logitech Audio Echo Cancellation Component-->MsiExec.exe /X{BEF726DD-4037-4214-8C6A-E625C02D2870}
Logitech Desktop Messenger-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\SETUP.EXE" -l0x40c UNINSTALL
Logitech SetPoint 6.0-->C:\Program Files\Fichiers communs\LogiShrd\SP6_Uninstall\setup.exe
Logitech Video Enumerator-->MsiExec.exe /X{EA516024-D84D-41F1-814F-83175A6188F2}
MainConcept DTV Decoder Standard-->MsiExec.exe /I{059A00AC-1205-423C-91C7-7E6168D804DA}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MFCDLL Shared Library - Retail Version-->MsiExec.exe /I{51D569E2-8A28-11D2-B962-006097C4DE24}
Micro Application - 9 DICOS Indispensables-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Micro Application\9 DICOS Indispensables\Uninst.isu"
Microsoft (R) C Runtime Library-->MsiExec.exe /I{51D569E0-8A28-11D2-B962-006097C4DE24}
Microsoft (R) C++ Runtime Library-->MsiExec.exe /I{51D569E3-8A28-11D2-B962-006097C4DE24}
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{72AD53CC-CCC0-3757-8480-9EE176866A7C}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{0BD83598-C2EF-3343-847B-7D2E84599128}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft ActiveSync 4.0-->MsiExec.exe /I{B208806F-A231-4FA0-AB3F-5C1B8979223E}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Money-->C:\Program Files\Microsoft Money 2005\MNYCoreFiles\Setup\uninst.exe /s:120
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Sites publics français-->MsiExec.exe /I{B72B0ECE-F41E-4EC4-AA37-1A00640680BF}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB972260)-->"C:\WINDOWS\ie7updates\KB972260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB976325)-->"C:\WINDOWS\ie8updates\KB976325-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB978207)-->"C:\WINDOWS\ie8updates\KB978207-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB981332)-->"C:\WINDOWS\ie8updates\KB981332-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour pour Windows Internet Explorer 8 (KB972636)-->"C:\WINDOWS\ie8updates\KB972636-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB975364)-->"C:\WINDOWS\ie8updates\KB975364-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB976662)-->"C:\WINDOWS\ie8updates\KB976662-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB976749)-->"C:\WINDOWS\ie8updates\KB976749-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB978506)-->"C:\WINDOWS\ie8updates\KB978506-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB980182)-->"C:\WINDOWS\ie8updates\KB980182-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB980302)-->"C:\WINDOWS\ie8updates\KB980302-IE8\spuninst\spuninst.exe"
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.6.3)-->E:\XP\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 3.0-->MsiExec.exe /I{930E3A4D-70B7-4D0D-AF8D-0B351A9B55BE}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
Multimedia Keyboard Driver 1.0-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F09CFF49-CF9F-11D8-86F6-0050BF6C9337}\Setup.exe" 
MVision-->MsiExec.exe /I{35725FBC-A136-4A46-9F29-091759D9BB93}
Nero 7 Ultra Edition-->MsiExec.exe /X{F90D6825-8F1F-4E3A-9E42-A9C8A9DD1036}
Nero Mega Plugin Pack-->MsiExec.exe /I{EF901A4B-A25A-4962-83C6-C6691D062ED9}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Norton PartitionMagic 8.0-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{21DBBDD6-93A5-4326-9A04-C9A5C9148502} 
NVIDIA Drivers-->C:\WINDOWS\system32
vuninst.exe UninstallGUI
NVIDIA nView Desktop Manager-->C:\Program Files\NVIDIA Corporation
View
ViewSetup.exe -uninstall
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Pando-->MsiExec.exe /I{C0B0FA55-D4E9-4374-9871-BBFBF2AEF0D1}
PoiEdit-->C:\PROGRA~1\DNOTES~1\POIEDI~1\UNWISE.EXE C:\PROGRA~1\DNOTES~1\POIEDI~1\INSTALL.LOG
Programme de gestion Camera de Labtec®-->"C:\Program Files\Fichiers communs\Labtec\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c  -removeonly
Réseau France Bayo 0013-Q0-->"C:\Program Files\Bayo\Setup\Réseau France Bayo 0013-Q0\unins000.exe"
Réseau France BdAlti 2006-Q2-->"C:\Program Files\Bayo\Setup\Réseau France BdAlti 2006-Q2\unins000.exe"
Réseau France BdNyme 2004-Q4-->"C:\Program Files\Bayo\Setup\Réseau France BdNyme 2004-Q4\unins000.exe"
Réseau France NavTeq 2006-Q1-->"C:\Program Files\Bayo\Setup\Réseau France NavTeq 2006-Q1\unins000.exe"
Réseau France POI 2006-Q1-->"C:\Program Files\Bayo\Setup\Réseau France POI 2006-Q1\unins000.exe"
Réseau France TopoNyme 2004-Q4-->"C:\Program Files\Bayo\Setup\Réseau France TopoNyme 2004-Q4\unins000.exe"
ROUTE 66 Route Europe 2005-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9443D8A5-0CC2-43E2-9C30-76D17BCD7FAB}\setup.exe" -l0x40c 
Satsuki Decoder Pack 4000-->C:\Program Files\Satsuki Decoder Pack\Uninstall.exe
ScanSoft OmniPage SE 4.0-->MsiExec.exe /I{C1E693A4-B1D5-4DCD-B68D-2087835B7184}
SDFormatter-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5A347920-4AFC-11D5-9FB0-800649886934}\setup.exe" 
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB978380)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {667A88D1-0369-4070-A62A-70672D68A9BF}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft Office Excel 2007 (KB978382)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {6DE3DABF-0203-426B-B330-7287D1003E86}
Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office Publisher 2007 (KB980470)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {34573F17-DADE-4D0D-835F-A54A1DE8AC1F}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
SmartTRAK-->E:\XP\PROGRA~1\SMARTT~1\UNWISE.EXE E:\XP\PROGRA~1\SMARTT~1\INSTALL.LOG
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SUPER © Version 2009.bld.36 (June 10, 2009)-->E:\XP\PROGRA~1\ERIGHT~1\SUPER\Setup.exe /remove /q0
Super Ad Blocker-->MsiExec.exe /X{F8BA8B13-856D-4DFB-A28F-7EC868142453}
ThiWeb Live 2.2-->C:\Program Files\ThiWeb Live 2\uninst.exe
TomTom HOME 2.7.3.1894-->F:\TomTom HOME 2\Uninstall TomTom HOME.exe
TomTom HOME Visual Studio Merge Modules-->MsiExec.exe /I{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}
Trojan Killer-->C:\Program Files\Trojan Killer\Uninstall.exe
Unlocker 1.8.8-->E:\XP\Program Files\Unlocker\uninst.exe
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for 2007 Microsoft Office System (KB981715)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {661B3F32-FFE4-4606-AE3A-DFA11DCC0D79}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft Office InfoPath 2007 (KB976416)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {432C5EE4-8096-4FF1-95E1-65219365DFF7}
Update for Outlook 2007 Junk Email Filter (kb981433)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5A6859A6-042D-4DF7-84E2-79F8DEFB5D48}
Usenet.nl-->"E:\XP\Program Files\Usenet.nl\unins000.exe"
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VIA Gestionnaire de périphériques de plate-forme-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169} 
Video Converter 3-->E:\XP\Program Files\Micro Application\Video Convertisseur\Uninstall.exe
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
VLC media player 1.0.5-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Weather Watcher-->"C:\Program Files\Weather Watcher\unins000.exe"
Web Acappella-->"C:\Program Files\Intuisphere\Web Acappella\unins000.exe"
Windows Driver Package - FTDI CDM Driver Package (06/27/2007 2.02.04)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInstx86.exe /u C:\WINDOWS\system32\DRVSTORE\ftdibus_1EFE8ACE84BF7FF75302177777293E12CA62079A\ftdibus.inf
Windows Driver Package - FTDI CDM Driver Package (06/27/2007 2.02.04)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInstx86.exe /u C:\WINDOWS\system32\DRVSTORE\ftdiport_E3FE268552211CE3257EFBEE0E69543753506151\ftdiport.inf
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live FolderShare-->MsiExec.exe /X{2075CB0A-D26F-4DAA-B424-5079296B43BA}
Windows Live Mail-->MsiExec.exe /I{5DD76286-9BE7-4894-A990-E905E91AC818}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
WinZip 12.0-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B7}
yDGpatch 1.2-->"C:\Program Files\yDGpatch\unins000.exe"

======Hosts File======

127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com

======Security center information======

AV: BitDefender Internet Security v10 (disabled)
AV: ESET Smart Security 4.2
FW: BitDefender Internet Security v10 (disabled)
FW: Pare-feu personnel d'ESET

======System event log======

Computer Name: SERVEUR
Event Code: 45
Message: Le système n'a pas pu charger le pilote du fichier de vidage sur incident.

Record Number: 5085
Source Name: Ftdisk
Time Written: 20100414080616.000000+120
Event Type: erreur
User: 

Computer Name: SERVEUR
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 5084
Source Name: EventLog
Time Written: 20100414080555.000000+120
Event Type: Informations
User: 

Computer Name: SERVEUR
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Multiprocessor Free.

Record Number: 5083
Source Name: EventLog
Time Written: 20100414080555.000000+120
Event Type: Informations
User: 

Computer Name: SERVEUR
Event Code: 6006
Message: Le service d'Enregistrement d'événement a été arrêté.

Record Number: 5082
Source Name: EventLog
Time Written: 20100414080415.000000+120
Event Type: Informations
User: 

Computer Name: SERVEUR
Event Code: 7036
Message: Le service Gestionnaire de connexions d'accès distant est entré dans l'état : en cours d'exécution.

Record Number: 5081
Source Name: Service Control Manager
Time Written: 20100414075014.000000+120
Event Type: Informations
User: 

=====Application event log=====

Computer Name: SERVEUR
Event Code: 301
Message: Windows (3424) Windows: Le moteur de base de données commence la relecture du fichier journal C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS06A1A.log.

Record Number: 24368
Source Name: ESENT
Time Written: 20100414154710.000000+120
Event Type: Informations
User: 

Computer Name: SERVEUR
Event Code: 301
Message: Windows (3424) Windows: Le moteur de base de données commence la relecture du fichier journal C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS06A19.log.

Record Number: 24367
Source Name: ESENT
Time Written: 20100414154710.000000+120
Event Type: Informations
User: 

Computer Name: SERVEUR
Event Code: 301
Message: Windows (3424) Windows: Le moteur de base de données commence la relecture du fichier journal C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS06A18.log.

Record Number: 24366
Source Name: ESENT
Time Written: 20100414154709.000000+120
Event Type: Informations
User: 

Computer Name: SERVEUR
Event Code: 301
Message: Windows (3424) Windows: Le moteur de base de données commence la relecture du fichier journal C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS06A17.log.

Record Number: 24365
Source Name: ESENT
Time Written: 20100414154709.000000+120
Event Type: Informations
User: 

Computer Name: SERVEUR
Event Code: 301
Message: Windows (3424) Windows: Le moteur de base de données commence la relecture du fichier journal C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS06A16.log.

Record Number: 24364
Source Name: ESENT
Time Written: 20100414154709.000000+120
Event Type: Informations
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%CommonProgramFiles%\Microsoft Shared\Windows Live;%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Fichiers communs\GIS\Tools;C:\Program Files\QuickTime\QTSystem;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\QuickTime\QTSystem\;C:\WINDOWS\system32\WindowsPowerShell\v1.0
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=0f06
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.PSC1
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

dbourgeo · Answer

Fichier log.txt partie 1

Logfile of random's system information tool 1.06 (written by random/random)
Run by Dany at 2010-04-22 13:05:20
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 27 GB (38%) free of 72 GB
Total RAM: 2047 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:05:36, on 22/04/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Keyboard Driver\OEMDriver.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Weather Watcher\ww.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Fichiers communs\LogiShrd\KHAL3\KHALMNPR.EXE
C:\PROGRA~1\MICROS~2apimgr.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PrintCtrl.exe
C:\WINDOWS\srntservice.exe
E:\XP\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
F:\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\Dany\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dany\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dany\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dany\Bureau\RSIT.exe
C:\Program Files	rend micro\Dany.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {5C887690-4044-418A-8A28-8BEBC3F9EF75} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Super Ad Blocker Toolbar - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\sabtb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [KBDriver] "C:\Program Files\Keyboard Driver\OEMDriver.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WeatherWatcher] "C:\Program Files\Weather Watcher\ww.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe
O4 - HKUS\S-1-5-19\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Display Driver] C:\WINDOWS\TEMP\dispdrv.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Display Driver] C:\WINDOWS\TEMP\dispdrv.exe (User 'Default user')
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format PDF - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.asf.fr/AxisCamControl.ocx
O16 - DPF: {A364AF35-0CDF-41E8-8F3B-E0E55E15EBA1} (Zenturi Active Programs Control) - http://www.programchecker.com/dll/nixon.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E9D081D-EAA5-4C2C-ABA7-6BA4EE5C7653}: NameServer = 212.27.54.252,213.228.0.23
O20 - AppInit_DLLs: acaptuser32.dll
O20 - Winlogon Notify: !SABWinLogon - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c989c0d9b3d5dc) (gupdate1c989c0d9b3d5dc) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Printer Control - ActMask Co.,Ltd - https://www.all2pdf.com/ - C:\WINDOWS\system32\PrintCtrl.exe
O23 - Service: RegServ - Unknown owner - C:\WINDOWS\srntservice.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - SuperAdBlocker.com - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\XP\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TomTomHOMEService - TomTom - F:\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

dbourgeo · Answer

Fichier log. txt partie 2

======List of files/folders created in the last 1 months======

2010-04-22 13:05:20 ----D---- C:sit
2010-04-22 13:05:20 ----D---- C:\Program Files	rend micro
2010-04-22 12:28:05 ----D---- C:\WINDOWS\LastGood
2010-04-22 11:46:43 ----D---- C:\Program Files\ESET
2010-04-22 09:52:25 ----A---- C:\Ad-Report-SCAN[4].txt
2010-04-19 18:26:09 ----A---- C:\WINDOWS\Asde_SusX70p3.ini
2010-04-19 18:26:09 ----A---- C:\WINDOWS\Asde_Renault.ini
2010-04-19 18:26:09 ----A---- C:\WINDOWS\Asde_InjX83P2.ini
2010-04-19 18:26:09 ----A---- C:\WINDOWS\Asde_InjX70P3.ini
2010-04-19 18:26:09 ----A---- C:\WINDOWS\Asde_Dacia.ini
2010-04-19 18:26:09 ----A---- C:\WINDOWS\5800Hard.ini
2010-04-19 18:12:42 ----D---- C:\Program Files\TomTom International B.V
2010-04-18 11:39:13 ----D---- C:\Program Files\Microsoft ActiveSync
2010-04-18 09:46:38 ----D---- C:\Program Files\Microsoft Visual Studio
2010-04-18 09:46:28 ----D---- C:\Program Files\Microsoft.NET
2010-04-18 09:43:32 ----D---- C:\WINDOWS\SHELLNEW
2010-04-18 09:42:58 ----RHD---- C:\MSOCache
2010-04-17 23:46:35 ----D---- C:\Documents and Settings\All Users\Application Data\Logishrd
2010-04-17 21:10:54 ----D---- C:\Documents and Settings\Dany\Application Data\Logishrd
2010-04-16 20:00:50 ----D---- C:\Program Files\TrendMicro
2010-04-14 07:15:35 ----D---- C:\Program Files\Trojan Killer
2010-04-13 08:36:15 ----D---- C:\Ad-Remover
2010-04-13 08:04:34 ----A---- C:\WINDOWS\DCEBoot.exe
2010-04-12 12:37:58 ----A---- C:\WINDOWS\is-5NVC6.exe
2010-04-02 16:30:47 ----D---- C:\Program Files\DIFX

======List of files/folders modified in the last 1 months======

2010-04-22 13:05:34 ----D---- C:\WINDOWS\system32\drivers
2010-04-22 13:05:33 ----D---- C:\WINDOWS\Temp
2010-04-22 13:05:21 ----D---- C:\WINDOWS\Prefetch
2010-04-22 13:05:20 ----D---- C:\Program Files
2010-04-22 12:28:05 ----D---- C:\WINDOWS
2010-04-22 12:27:59 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-22 12:01:37 ----D---- C:\WINDOWS\system32
2010-04-22 12:01:37 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-04-22 11:55:46 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-22 11:47:05 ----SHD---- C:\Config.Msi
2010-04-22 11:47:04 ----SHD---- C:\WINDOWS\Installer
2010-04-22 11:47:01 ----HD---- C:\WINDOWS\inf
2010-04-22 11:39:35 ----D---- C:\WINDOWS\Debug
2010-04-22 11:36:54 ----D---- C:\WINDOWS\ServicePackFiles
2010-04-22 10:54:30 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-22 10:54:22 ----D---- C:\WINDOWS\system32\LogFiles
2010-04-22 09:51:30 ----SD---- C:\WINDOWS\Tasks
2010-04-21 00:54:52 ----D---- C:\Documents and Settings\Dany\Application Data\WeatherWatcher
2010-04-20 23:37:38 ----A---- C:\WINDOWS\wininit.ini
2010-04-20 11:41:02 ----D---- C:\WINDOWS\pss
2010-04-20 06:26:10 ----D---- C:\WINDOWS\system32\Restore
2010-04-19 18:46:19 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2010-04-19 18:45:50 ----RSD---- C:\WINDOWS\assembly
2010-04-19 18:39:23 ----HD---- C:\Program Files\InstallShield Installation Information
2010-04-19 18:39:23 ----D---- C:\Program Files\TechniSat DVB
2010-04-19 18:38:50 ----D---- C:\Documents and Settings
2010-04-19 18:38:28 ----D---- C:\Program Files\Smartione
2010-04-19 18:37:49 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-04-19 18:37:48 ----D---- C:\Program Files\Fichiers communs
2010-04-19 18:37:07 ----D---- C:\Program Files\ProgFinder
2010-04-19 18:36:33 ----D---- C:\Program Files\Panda Security
2010-04-19 18:34:12 ----D---- C:\Program Files\DVBViewerTE
2010-04-19 18:26:13 ----A---- C:\Trace.ini
2010-04-19 18:26:11 ----D---- C:\HELP
2010-04-19 18:26:11 ----A---- C:\WINDOWS\ODBC.INI
2010-04-19 18:22:51 ----D---- C:\Documents and Settings\All Users\Application Data\Autodesk
2010-04-19 18:22:48 ----D---- C:\WINDOWS\Help
2010-04-19 18:22:46 ----RSD---- C:\WINDOWS\Fonts
2010-04-19 18:06:18 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2010-04-19 18:05:17 ----A---- C:\WINDOWS\win.ini
2010-04-19 18:05:16 ----D---- C:\Program Files\Fichiers communs\System
2010-04-19 07:06:00 ----D---- C:\WINDOWS
etwork diagnostic
2010-04-18 11:41:54 ----SD---- C:\Documents and Settings\Dany\Application Data\Microsoft
2010-04-18 09:49:56 ----D---- C:\WINDOWS\system32\wbem
2010-04-18 09:46:40 ----D---- C:\Program Files\Microsoft Office
2010-04-18 09:46:38 ----D---- C:\Program Files\Fichiers communs\DESIGNER
2010-04-18 09:20:40 ----D---- C:\WINDOWS\WinSxS
2010-04-17 23:47:29 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-17 23:47:28 ----D---- C:\Program Files\Fichiers communs\Logishrd
2010-04-17 21:27:35 ----D---- C:\WINDOWS\system32\config
2010-04-17 21:27:19 ----D---- C:\WINDOWS\Registration
2010-04-17 21:15:34 ----D---- C:\Program Files\Logitech
2010-04-17 21:14:48 ----D---- C:\Program Files\Fichiers communs\Logitech
2010-04-17 15:48:39 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-04-17 06:32:13 ----SHD---- C:\System Volume Information
2010-04-16 16:12:31 ----D---- C:\Documents and Settings\Dany\Application Data\vlc
2010-04-15 17:49:59 ----D---- C:\Program Files\Google
2010-04-15 07:07:49 ----D---- C:\WINDOWS\system32\CatRoot
2010-04-14 07:09:30 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-14 07:07:30 ----D---- C:\WINDOWS\ie8updates
2010-04-13 08:03:38 ----D---- C:\ADCDA2
2010-04-12 12:40:13 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-04-12 09:29:39 ----D---- C:\Program Files\BitTorrent_DNA
2010-04-09 14:41:08 ----A---- C:\WINDOWS\xgicode.ini
2010-04-08 12:10:00 ----D---- C:\Program Files\FastStone Capture
2010-04-06 19:52:54 ----A---- C:\WINDOWS\system32\MRT.exe
2010-04-05 18:57:01 ----D---- C:\WINDOWS\Minidump
2010-04-04 20:01:33 ----AC---- C:\WINDOWS\ODBCINST.INI
2010-04-02 16:42:01 ----D---- C:\Documents and Settings\Dany\Application Data\Mozilla
2010-03-30 23:03:01 ----D---- C:\Program Files\Internet Explorer
2010-03-29 21:36:11 ----D---- C:\Program Files\CCleaner

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-04-07 114984]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2010-04-07 55232]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
R1 PQNTDrv;PQNTDrv; C:\WINDOWS\system32\drivers\PQNTDrv.sys [2004-05-06 4228]
R1 SABDIFSV;SABDIFSV; \??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABDIFSV.SYS []
R1 SABKUTIL;SABKUTIL; \??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.sys []
R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032]
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [2002-07-17 16877]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-04-07 139192]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2010-04-07 134488]
R2 irda;Protocole IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R3 adatadrv;Autodata Protection Service; C:\WINDOWS\system32\DRIVERS\adatadrv.sys [2009-07-01 762112]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-04-07 32584]
R3 FETNDISB;VIA Rhine Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5b.sys [2003-11-11 41984]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-11-01 4620288]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2009-11-10 20240]
R3 L8042mou;SetPoint PS/2 Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\L8042mou.Sys [2009-11-10 63248]
R3 LMouKE;SetPoint Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2009-11-10 79504]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\LVUSBSta.sys [2007-03-06 41376]
R3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS
v4_mini.sys [2010-01-12 10276768]
R3 pepifilter;Volume Adapter; C:\WINDOWS\system32\DRIVERS\lv302af.sys [2007-03-06 14240]
R3 PID_PEPI;Logitech QuickCam IM(PID_PEPI); C:\WINDOWS\system32\DRIVERS\LV302V32.SYS [2007-03-06 1273504]
R3 Rasirda;Miniport réseau étendu (IrDA); C:\WINDOWS\system32\DRIVERSasirda.sys [2001-08-17 19584]
R3 SKYNET;TechniSat DVB-PC TV Star PCI; C:\WINDOWS\system32\DRIVERS\SkyNET.SYS [2008-09-24 510992]
R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 Ad-Watch Connect Filter;Ad-Watch Connect Kernel Filter; \??\C:\WINDOWS\system32\drivers\NSDriver.sys []
S3 aqde0ejz;aqde0ejz; C:\WINDOWS\system32\drivers\aqde0ejz.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 FTDIBUS;USB Serial Converter Driver; C:\WINDOWS\system32\drivers\ftdibus.sys [2007-06-27 53184]
S3 FTSER2K;USB Serial Port Driver; C:\WINDOWS\system32\drivers\ftser2k.sys [2007-06-27 71488]
S3 irsir;Pilote série infrarouge Microsoft; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
S3 LVcKap;Logitech AEC Driver; C:\WINDOWS\system32\DRIVERS\LVcKap.sys [2007-03-06 1669664]
S3 LVMVDrv;Logitech Machine Vision Engine Loader; C:\WINDOWS\system32\DRIVERS\LVMVDrv.sys [2007-03-06 2261792]
S3 MosIrUsb;MosIrUsb.sys; C:\WINDOWS\system32\DRIVERS\MosIrUsb.sys [2004-04-14 20736]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NTSIM;NTSIM; \??\C:\WINDOWS\system32
tsim.sys []
S3 ParadigmVScanner;USB Scanner Still Image Device Service; C:\WINDOWS\system32\drivers\usbscan.sys [2008-04-13 15104]
S3 PID_08A0;Labtec WebCam(PID_08A0); C:\WINDOWS\system32\DRIVERS\LV302AV.SYS [2005-12-08 913408]
S3 SABProcEnum;SABProcEnum; \??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABProcEnum.sys []
S3 se59bus;Sony Ericsson Device 089 driver (WDM); C:\WINDOWS\system32\DRIVERS\se59bus.sys [2006-09-05 61536]
S3 se59mdfl;Sony Ericsson Device 089 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\se59mdfl.sys [2006-09-05 9360]
S3 se59mdm;Sony Ericsson Device 089 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\se59mdm.sys [2006-09-05 97088]
S3 se59obex;Sony Ericsson Device 089 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\se59obex.sys [2006-09-05 86432]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SNTNLUSB;SafeNet USB SuperPro/UltraPro/HardwareKey; C:\WINDOWS\system32\DRIVERS\SNTNLUSB.SYS [2008-07-11 37088]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 TVICHW32;TVICHW32; \??\C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS []
S3 usb_rndisx;Carte ISDN USB; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2006-04-10 104576]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2010-04-07 810120]
R2 Irmon;Moniteur infrarouge; C:\WINDOWS\system32\svchost.exe [2004-08-05 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-08-14 153376]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-03-30 303952]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32
vsvc32.exe [2010-01-11 154216]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 Printer Control;Printer Control; C:\WINDOWS\system32\PrintCtrl.exe [2009-06-16 77824]
R2 RegServ;RegServ; C:\WINDOWS\srntservice.exe [2009-11-12 69632]
R2 SABSVC;Super Ad Blocker Service; C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE [2005-08-31 65536]
R2 StarWindServiceAE;StarWind AE Service; E:\XP\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 TomTomHOMEService;TomTomHOMEService; F:\TomTom HOME 2\TomTomHOMEService.exe [2009-11-13 92008]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe [2008-06-09 53392]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-03-30 1533808]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-05 14336]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe [2008-01-22 275752]
S2 gupdate1c989c0d9b3d5dc;Google Update Service (gupdate1c989c0d9b3d5dc); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-02-08 133104]
S2 LVSrvLauncher;LVSrvLauncher; C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe [2007-03-06 105248]
S2 NOD32FiXTemDono;Eset Nod32 Boot; C:\WINDOWS\system32egedt32.exe [2004-08-05 3584]
S2 tqavcdyu;Logitech AEC Helper; C:\WINDOWS\System32\svchost.exe [2004-08-05 14336]
S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2010-04-07 33560]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-11-24 651720]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-04-09 1265264]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Fichiers communs\LogiShrd\Bluetooth\lbtserv.exe [2010-01-29 292944]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2008-04-08 800040]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

moment de grace · Answer

ok

Rends toi sur ce site : 

https://www.virustotal.com/gui/ 

Clique sur parcourir et cherche ce fichier : 


C:\WINDOWS\srntservice.exe


Clique sur Send File. 

Un rapport va s'élaborer ligne à ligne. 

Attends la fin. Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copie le dans ta réponse.

Si tu ne trouves pas le fichier alors

Affiche tous les fichiers et dossiers : 

Pour cela : 
Clique sur démarrer/panneau de configuration/option des dossiers/affichage 

Cocher afficher les dossiers cachés

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" 

Décocher masquer les extensions dont le type est connu 

Puis fais «appliquer» pour valider les changements. 

Et OK

dbourgeo · Answer

Fichier SRNTService.exe reçu le 2010.04.06 07:25:46 (UTC)
Situation actuelle: terminé 
Résultat: 0/38 (0.00%)
  Formaté
Impression des résultats 
Antivirus	Version	Dernière mise à jour	Résultat
a-squared	4.5.0.50	2010.04.06	-
AhnLab-V3	5.0.0.2	2010.04.05	-
AntiVir	7.10.6.25	2010.04.05	-
Antiy-AVL	2.0.3.7	2010.04.06	-
Authentium	5.2.0.5	2010.04.06	-
Avast	4.8.1351.0	2010.04.05	-
Avast5	5.0.332.0	2010.04.05	-
AVG	9.0.0.787	2010.04.05	-
BitDefender	7.2	2010.04.06	-
CAT-QuickHeal	10.00	2010.04.06	-
ClamAV	0.96.0.3-git	2010.04.06	-
Comodo	4514	2010.04.06	-
DrWeb	5.0.2.03300	2010.04.06	-
eTrust-Vet	35.2.7410	2010.04.06	-
F-Prot	4.5.1.85	2010.04.05	-
F-Secure	9.0.15370.0	2010.04.06	-
Fortinet	4.0.14.0	2010.04.04	-
GData	19	2010.04.06	-
Ikarus	T3.1.1.80.0	2010.04.06	-
Jiangmin	13.0.900	2010.04.06	-
Kaspersky	7.0.0.125	2010.04.06	-
McAfee-GW-Edition	6.8.5	2010.04.05	-
Microsoft	1.5605	2010.04.06	-
NOD32	5002	2010.04.05	-
Norman	6.04.10	2010.04.05	-
nProtect	2009.1.8.0	2010.04.05	-
Panda	10.0.2.2	2010.04.05	-
PCTools	7.0.3.5	2010.04.06	-
Prevx	3.0	2010.04.06	-
Rising	22.42.01.03	2010.04.06	-
Sophos	4.52.0	2010.04.06	-
Sunbelt	6142	2010.04.06	-
Symantec	20091.2.0.41	2010.04.06	-
TheHacker	6.5.2.0.256	2010.04.06	-
TrendMicro	9.120.0.1004	2010.04.06	-
VBA32	3.12.12.4	2010.04.05	-
ViRobot	2010.4.6.2262	2010.04.06	-
VirusBuster	5.0.27.0	2010.04.05	-
Information additionnelle
File size: 69632 bytes
MD5   : 5343b60fd4faeee13fefbf393dca2b9d
SHA1  : 4a0fa3d3b3882f2aaf956528af1054655180edc7
SHA256: d6b4a446d4f725b3ca77cbc1f24d2c0644e82230e90dc6df32f8b7e67f7c6884
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x3C02
timedatestamp.....: 0x49088A93 (Wed Oct 29 17:08:51 2008)
machinetype.......: 0x14C (Intel I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9936 0xA000 6.48 59f7ccb5f188927121429a0445816baa
.rdata 0xB000 0x1462 0x2000 3.66 7ecef97cf2ab8b8790eda9b94949906f
.data 0xD000 0x5970 0x4000 1.26 e4d5ca620c1f78681d9292a7260a96b8

( 3 imports )

> advapi32.dll: RegOpenKeyExA, StartServiceCtrlDispatcherA, CreateServiceA, DeleteService, RegisterServiceCtrlHandlerA, SetServiceStatus, StartServiceA, OpenSCManagerA, OpenServiceA, CloseServiceHandle, RegSetValueExA, RegCreateKeyExA, RegDeleteValueA, RegEnumKeyExA, ControlService
> kernel32.dll: GetOEMCP, GetProcAddress, LoadLibraryA, SetEndOfFile, ReadFile, CloseHandle, HeapAlloc, HeapFree, InitializeCriticalSection, GetModuleFileNameA, DeleteCriticalSection, GetExitCodeProcess, GetLastError, Sleep, TerminateProcess, EnterCriticalSection, GetLocalTime, LeaveCriticalSection, RtlUnwind, ResumeThread, CreateThread, TlsSetValue, TlsGetValue, ExitThread, GetCommandLineA, GetVersion, ExitProcess, RaiseException, GetCurrentThreadId, TlsAlloc, SetLastError, GetCurrentProcess, UnhandledExceptionFilter, InterlockedDecrement, InterlockedIncrement, HeapReAlloc, HeapSize, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleHandleA, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, WriteFile, VirtualAlloc, IsBadWritePtr, SetUnhandledExceptionFilter, SetStdHandle, FlushFileBuffers, CreateFileA, IsBadReadPtr, IsBadCodePtr, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, SetFilePointer, GetCPInfo, LCMapStringA, LCMapStringW, GetACP
> user32.dll: PostThreadMessageA

( 0 exports )
TrID  : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: -
sigcheck: publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEiD  : Armadillo v1.71
RDS   : NSRL Reference Data Set
-

moment de grace · Answer

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection) 

Télécharge et installe List&Kill'em et enregistre le sur ton bureau 

http://sd-1.archive-host.com/...



double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation 

coche la case "creer une icone sur le bureau" 

une fois terminée , clic sur "terminer" et le programme se lancer seul 

choisis la langue puis choisis l'option SEARCH

 laisse travailler l'outil 

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué. 

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini. 

Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED" 

tu peux supprimer le rapport catchme.log de ton bureau maintenant.

dbourgeo · Answer

Bon apparemment je n'ai plus d'attaque tout c'est calmé je souffle un peu je te mets le fichier de List&Kill'em

dbourgeo · Answer

List'em by g3n-h@ckm@n 1.7.2.1

Partie 1


User : Dany (Administrateurs) 
Update on 22/04/2010 by g3n-h@ckm@n ::::: 16.15
Start at: 18:36:27 | 22/04/2010

Intel(R) Core(TM)2 CPU         X6800  @ 2.93GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : BitDefender Internet Security v10 7.2 [ (!) Disabled | Updated ]
AV : ESET Smart Security 4.2 4.2 [ (!) Disabled | Updated ]
FW : BitDefender Internet Security v10[ (!) Disabled ]7.2
FW : Pare-feu personnel d'ESET[ (!) Disabled ]4.2.40.10

C:\ -> Disque fixe local | 69,86 Go (27,09 Go free) [Win XP] | NTFS
D:\ -> Disque fixe local | 69,87 Go (40,27 Go free) [Win Vista] | NTFS
E:\ -> Disque fixe local | 97,65 Go (81,65 Go free) [Logiciels] | NTFS
F:\ -> Disque fixe local | 97,65 Go (34,29 Go free) [Divers] | NTFS
G:\ -> Disque fixe local | 102,78 Go (14,3 Go free) [Sauvegarde] | NTFS
I:\ -> Disque amovible
J:\ -> Disque amovible
K:\ -> Disque amovible
L:\ -> Disque amovible
M:\ -> Disque amovible
N:\ -> Disque amovible
O:\ -> Disque fixe local | 195,31 Go (195,22 Go free) [Nouveau nom] | NTFS
P:\ -> Disque fixe local | 195,31 Go (195,22 Go free) [Nouveau nom] | NTFS
Q:\ -> Disque fixe local | 390,63 Go (390,53 Go free) [Nouveau nom] | NTFS
R:\ -> Disque fixe local | 150,27 Go (121,43 Go free) [Win Seven] | NTFS
S:\ -> Disque amovible
T:\ -> Disque amovible
U:\ -> Disque amovible
 
Boot: Normal 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Keyboard Driver\OEMDriver.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Weather Watcher\ww.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Fichiers communs\LogiShrd\KHAL3\KHALMNPR.EXE
C:\PROGRA~1\MICROS~2apimgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PrintCtrl.exe
C:\WINDOWS\srntservice.exe
E:\XP\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
F:\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\alg.exe
C:\Documents and Settings\Dany\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dany\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run" 
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}	REG_SZ         	"C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
WeatherWatcher	REG_SZ         	"C:\Program Files\Weather Watcher\ww.exe"
ctfmon.exe	REG_SZ         	C:\WINDOWS\system32\ctfmon.exe
LDM	REG_SZ         	C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
H/PC Connection Agent	REG_SZ         	"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
RSRWin.exe	REG_SZ         	C:\Windows\RSRWin.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
KBDriver	REG_SZ         	"C:\Program Files\Keyboard Driver\OEMDriver.exe" 
NeroFilterCheck	REG_SZ         	C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe 
Adobe Acrobat Speed Launcher	REG_SZ         	"C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" 
<NO NAME>	REG_SZ         	 
Acrobat Assistant 8.0	REG_SZ         	"C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" 
QuickTime Task	REG_SZ         	"C:\Program Files\QuickTime\qttask.exe" -atboottime 
LogitechCommunicationsManager	REG_SZ         	"C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" 
NvMediaCenter	REG_SZ         	RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit 
NvCplDaemon	REG_SZ         	RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup 
EvtMgr6	REG_SZ         	C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming 
egui	REG_SZ         	"C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice 
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\Disabled 
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] 
dontdisplaylastusername	REG_DWORD      	0 (0x0) 
legalnoticecaption	REG_SZ         	 
legalnoticetext	REG_SZ         	 
shutdownwithoutlogon	REG_DWORD      	1 (0x1) 
undockwithoutlogon	REG_DWORD      	1 (0x1) 
DisableRegistryTools	REG_DWORD      	0 (0x0) 

===============

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveTypeAutoRun	REG_DWORD      	323 (0x143) 
NoDriveAutoRun	REG_DWORD      	67108863 (0x3ffffff) 
NoDrives	REG_DWORD      	0 (0x0) 

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
HonorAutoRunSetting	REG_DWORD      	1 (0x1) 
NoDriveAutoRun	REG_DWORD      	67108863 (0x3ffffff) 
NoDriveTypeAutoRun	REG_DWORD      	323 (0x143) 
NoDrives	REG_DWORD      	0 (0x0) 

===============
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS	REG_SZ         	acaptuser32.dll

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 
 AutoRestartShell	REG_DWORD      	1 (0x1) 
 DefaultDomainName	REG_SZ         	SERVEUR 
 DefaultUserName	REG_SZ         	Dany 
 LegalNoticeCaption	REG_SZ         	 
 LegalNoticeText	REG_SZ         	 
 PowerdownAfterShutdown	REG_SZ         	0 
 ReportBootOk	REG_SZ         	1 
 Shell	REG_SZ         	Explorer.exe 
 ShutdownWithoutLogon	REG_SZ         	0 
 Userinit	REG_SZ         	C:\WINDOWS\system32\userinit.exe, 
 VmApplet	REG_SZ         	rundll32 shell32,Control_RunDLL "sysdm.cpl" 
 SfcQuota	REG_DWORD      	-1 (0xffffffff) 
 allocatecdroms	REG_SZ         	0 
 allocatedasd	REG_SZ         	0 
 allocatefloppies	REG_SZ         	0 
 cachedlogonscount	REG_SZ         	10 
 forceunlocklogon	REG_DWORD      	0 (0x0) 
 passwordexpirywarning	REG_DWORD      	14 (0xe) 
 scremoveoption	REG_SZ         	0 
 AllowMultipleTSSessions	REG_DWORD      	0 (0x0) 
 UIHost	REG_EXPAND_SZ  	logonui.exe 
 LogonType	REG_DWORD      	1 (0x1) 
 DebugServerCommand	REG_SZ         	no 
 SFCDisable	REG_DWORD      	0 (0x0) 
 WinStationsDisabled	REG_SZ         	0 
 HibernationPreviouslyEnabled	REG_DWORD      	1 (0x1) 
 ShowLogonOptions	REG_DWORD      	0 (0x0) 
 AltDefaultUserName	REG_SZ         	Dany 
 AltDefaultDomainName	REG_SZ         	SERVEUR 
 Background	REG_SZ         	0 0 0 
 System	REG_SZ         	 
 ChangePasswordUseKerberos	REG_DWORD      	1 (0x1) 

===============

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\!SABWinLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LBTWlgn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify	ermsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\wlballoon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\WRNotifier]

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972}	REG_SZ         	 
{5AE067D3-9AFB-48E0-853A-EBB7F4A000D7}	REG_SZ         	 
{56F9679E-7826-4C84-81F3-532071A8BCC5}	REG_SZ         	 

===============

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\eMule\emule.exe	REG_SZ         	C:\Program Files\eMule\emule.exe:*:Enabled:eMule
C:\Program Files\BitTorrent\bittorrent.exe	REG_SZ         	C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
C:\Program Files\Pando Networks\Pando\pando.exe	REG_SZ         	C:\Program Files\Pando Networks\Pando\pando.exe:*:Enabled:pando
C:\Program Files\Fichiers communs\Ahead\Nero Web\SetupX.exe	REG_SZ         	C:\Program Files\Fichiers communs\Ahead\Nero Web\SetupX.exe:*:Enabled:Nero ProductSetup
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe	REG_SZ         	C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe:*:Enabled:Logitech Desktop Messenger
C:\Program Files\Messenger\msmsgs.exe	REG_SZ         	C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
C:\Program Files\VideoLAN\VLC\vlc.exe	REG_SZ         	C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player
C:\Program Files\Kyodai Mahjongg\kmj.exe	REG_SZ         	C:\Program Files\Kyodai Mahjongg\kmj.exe:*:Enabled:kmj
C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe	REG_SZ         	C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime
C:\Program Files\Windows Live\Messenger\wlcsdk.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Java\jre1.6.0_01\launch4j-tmp\JDownloader.exe	REG_SZ         	C:\Program Files\Java\jre1.6.0_01\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary
C:\WINDOWS\system32\java.exe	REG_SZ         	C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary
C:\Program Files\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe	REG_SZ         	C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE	REG_SZ         	C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
C:\Program Files\Microsoft ActiveSyncapimgr.exe	REG_SZ         	C:\Program Files\Microsoft ActiveSyncapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
C:\Program Files\Microsoft ActiveSync\wcescomm.exe	REG_SZ         	C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe	REG_SZ         	C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
C:\WINDOWS\Temp\dispdrv.exe	REG_SZ         	C:\WINDOWS\Temp\dispdrv.exe:*:Enabled:Windows Updates

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Messenger\wlcsdk.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe	REG_SZ         	C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\Program Files\Microsoft ActiveSyncapimgr.exe	REG_SZ         	C:\Program Files\Microsoft ActiveSyncapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
C:\Program Files\Microsoft ActiveSync\wcescomm.exe	REG_SZ         	C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe	REG_SZ         	C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

dbourgeo · Answer

Partie 2 =============== ActivX controls =============== [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\Microsoft XML Parser for Java] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{0E8D0700-75DF-11D3-8B4A-0008C7450C4A}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{406B5949-7190-4245-91A9-30A17DE16AD0}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6414512B-B978-451D-A0D8-FCFDF33E833C}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6E32070A-766D-4EE6-879C-DC1FA91D2FC3}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{917623D1-D8E5-11D2-BE8B-00104B06BDE3}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{A364AF35-0CDF-41E8-8F3B-E0E55E15EBA1}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{BB21F850-63F4-4EC9-BF9D-565BD30C9AE9}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E8F628B5-259A-4734-97EE-BA914D7BE941}] =============== [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{CB58DED6-4AF3-4080-9DF1-DEE72075169F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Base Smart Card Crypto Provider Package] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0A1F8287-41EA-6860-A9A4-8F026A7D1077}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0e8d0700-75df-11d3-8b4a-0008c7450c4a}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3F7924B9-D148-3141-87B1-68F36043A940}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5056b317-8d4c-43ee-8543-b9d1e234b8f4}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{72AD53CC-CCC0-3757-8480-9EE176866A7C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7ECA2BD3-36F0-117E-8B6E-B4557E1DA7A4}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{913502DC-BF94-3618-39C0-2712442194AC}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CCDDDCA0-62B2-E617-2C72-25577A4B2B0B}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ECD292A0-0347-4244-8C24-5DBCE990FB40}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EF289A85-8E57-408d-BE47-73B55609861A}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F515B196-F47B-C2B4-0A69-B528F0051BC2}] ============== BHO : ====== [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{00000000-6C30-11D8-9363-000AE6309654}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C887690-4044-418A-8A28-8BEBC3F9EF75}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AE7CD045-E861-484f-8273-0445EE161910}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}] === DNS === HKLM\SYSTEM\CCS\Services\Tcpip\..\{9E9D081D-EAA5-4C2C-ABA7-6BA4EE5C7653}: NameServer=212.27.54.252,213.228.0.23 HKLM\SYSTEM\CS2\Services\Tcpip\..\{9E9D081D-EAA5-4C2C-ABA7-6BA4EE5C7653}: NameServer=212.27.54.252,213.228.0.23 HKLM\SYSTEM\CS3\Services\Tcpip\..\{9E9D081D-EAA5-4C2C-ABA7-6BA4EE5C7653}: NameServer=212.27.54.252,213.228.0.23 ================ Internet Explorer : ================ [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] Start Page REG_SZ https://www.msn.com/fr-fr Local Page REG_SZ C:\WINDOWS\system32\blank.htm Default_Search_URL REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Default_Page_URL REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Start Page REG_SZ https://fr.yahoo.com/ ======== Services ======== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] Ndisuio : 0x3 ( OK = 3 ) EapHost : 0x3 ( OK = 2 ) SharedAccess : 0x2 ( OK = 2 ) wuauserv : 0x2 ( OK = 2 ) ======== Safemode ======== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !! ========= Atapi.sys ========= C:\WINDOWS\ServicePackFiles\i386\atapi.sys : MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674] SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\atapi.sys : MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674] SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\WINDOWS\system32\drivers\atapi.sys : MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674] SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\WINDOWS\system32\ReinstallBackups\0020\DriverFiles\i386\atapi.sys : MD5 :: [cdfe4411a69c224bd1d11b2da92dac51] SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d] Référence : ========== Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867 Win XP_32b : a64013e98426e1877cb653685c5c0009 Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51 Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674 Vista_32b : e03e8c99d15d0381e02743c36afc7c6f Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9 Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4 Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e ======= Drive : ======= D'fragmenteur de disque Windows Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc. Rapport d'analyse 69,86 Go total, 27,10 Go libre (38%), 7% fragment' (fragmentation du fichier 15%) Il ne vous est pas n'cessaire de d'fragmenter ce volume. ¤¤¤¤¤¤¤¤¤¤ Files/folders : Present !! : C:\WINDOWS\DCEBoot.exe Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn Present !! : C:\WINDOWS\System32\Drivers\SKYNET*.* Present !! : C:\WINDOWS\System32\drivers\wudfpf.sys Present !! : C:\WINDOWS\System32\drivers\wudfrd.sys" Present !! : C:\WINDOWS\System32\ESQUL*.* Present !! : C:\WINDOWS\System32\MSWINSCK.OCX Present !! : C:\WINDOWS\System32\SET*.tmp Present !! : C:\Documents and Settings\Dany\LOCAL Settings\Temp\GoRC.exe Present !! : C:\Documents and Settings\Dany\LOCAL Settings\Temp\ResHacker.exe Present !! : C:\Documents and Settings\Dany\LOCAL Settings\Temp\svchost.exe Present !! : C:\Documents and Settings\Dany\LOCAL Settings\Temp\hqgsvduw.dat Present !! : C:\Documents and Settings\Dany\LOCAL Settings\Temp\IadHide4.dll ¤¤¤¤¤¤¤¤¤¤ Keys : Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives Present !! : HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File execution Options\egui.exe" Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File execution Options\ekrn.exe" Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe" Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe" Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_Irmon Present !! : HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys Present !! : HKLM\SYSTEM\ControlSet001\Services\Irmon Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_Irmon Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_SSHNAS Present !! : HKLM\SYSTEM\ControlSet002\Services\Irmon Present !! : HKLM\SYSTEM\ControlSet004\Enum\Root\Legacy_Irmon Present !! : HKLM\SYSTEM\ControlSet004\Enum\Root\Legacy_SSHNAS Present !! : HKLM\SYSTEM\ControlSet004\Services\Irmon Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_Irmon Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SSHNAS Present !! : HKLM\SYSTEM\CurrentControlSet\Services\Irmon ============ catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-04-22 18:43:43 Windows 5.1.2600 Service Pack 3 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = acaptuser32.dll??? scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spfa.sys >>UNKNOWN [0x8ABFF938]<< kernel: MBR read successfully user & kernel MBR OK [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] FirstRunDisabled REG_DWORD 1 (0x1) AntiVirusDisableNotify REG_DWORD 0 (0x0) FirewallDisableNotify REG_DWORD 0 (0x0) UpdatesDisableNotify REG_DWORD 0 (0x0) AntiVirusOverride REG_DWORD 0 (0x0) FirewallOverride REG_DWORD 0 (0x0) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ End of scan : 18:43:45,23

moment de grace · Answer

ok

1)

Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau. 
mais cette fois-ci : 

choisis l'option CLEAN
ton PC va redemarrer, 

laisse travailler l'outil. 

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau , 

colle le contenu dans ta reponse

Tu peux le désinstaller ensuite

.....................

2)

Télécharge ZHPDiag ( de Nicolas coolman ). 
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html 

(outil de diagnostic)

 Double clique sur le fichier d'installation, puis installe le avec les paramètres par défaut ( N'oublie pas de cocher " Créer une icône sur le bureau " )
 
Lance ZHPDiag en double cliquant sur l'icône présente sur ton bureau (Clique droit -> Executer en tant qu'admin pour vista ) 

Clique sur la loupe en haut à gauche, puis laisse l'outil scanner. 

Une fois le scan terminé, clique sur l'icône en forme de disquette et enregistre le fichier sur ton bureau. 

Rend toi sur Cjoint : http://www.cijoint.fr/ 

Clique sur "Parcourir " dans la partie " Joindre un fichier[...] " 

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau 

Clique ensuite sur "Cliquez ici pour déposer le fichier " et copie/colle le lien dans ton prochain message


si soucis avec ci joint. fr => utiliser https://www.cjoint.com/

dbourgeo · Answer

Kill'em by g3n-h@ckm@n 1.7.2.1 
 
User : Dany (Administrateurs) 
Update on 22/04/2010 by g3n-h@ckm@n ::::: 16.15
Start at: 20:20:41 | 22/04/2010

Intel(R) Core(TM)2 CPU         X6800  @ 2.93GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : BitDefender Internet Security v10 7.2 [ (!) Disabled | Updated ]
AV : ESET Smart Security 4.2 4.2 [ Enabled | Updated ]
FW : BitDefender Internet Security v10[ (!) Disabled ]7.2
FW : Pare-feu personnel d'ESET[ Enabled ]4.2.40.10

C:\ -> Disque fixe local | 69,86 Go (26,96 Go free) [Win XP] | NTFS
D:\ -> Disque fixe local | 69,87 Go (40,27 Go free) [Win Vista] | NTFS
E:\ -> Disque fixe local | 97,65 Go (81,65 Go free) [Logiciels] | NTFS
F:\ -> Disque fixe local | 97,65 Go (34,29 Go free) [Divers] | NTFS
G:\ -> Disque fixe local | 102,78 Go (14,3 Go free) [Sauvegarde] | NTFS
J:\ -> Disque amovible
K:\ -> Disque amovible
L:\ -> Disque amovible
M:\ -> Disque amovible
N:\ -> Disque amovible
O:\ -> Disque fixe local | 195,31 Go (195,22 Go free) [Nouveau nom] | NTFS
P:\ -> Disque fixe local | 195,31 Go (195,22 Go free) [Nouveau nom] | NTFS
Q:\ -> Disque fixe local | 390,63 Go (390,53 Go free) [Nouveau nom] | NTFS
R:\ -> Disque fixe local | 150,27 Go (121,43 Go free) [Win Seven] | NTFS
S:\ -> Disque amovible
T:\ -> Disque amovible
U:\ -> Disque amovible
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PrintCtrl.exe
C:\WINDOWS\srntservice.exe
E:\XP\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
F:\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe
 
¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\WINDOWS\DCEBoot.exe 
 
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn 
Quarantined & Deleted !! : C:\WINDOWS\System32\Drivers\SkyNET.sys 
Quarantined & Deleted !! : C:\WINDOWS\system32\drivers\wudfpf.sys 
Quarantined & Deleted !! : C:\WINDOWS\system32\drivers\wudfrd.sys 
Quarantined & Deleted !! : C:\WINDOWS\System32\ESQULzxspectrum 
Quarantined & Deleted !! : C:\WINDOWS\system32\MSWINSCK.OCX 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETDE.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Dany\LOCAL Settings\Temp\GoRC.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Dany\LOCAL Settings\Temp\ResHacker.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Dany\LOCAL Settings\Temp\svchost.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Dany\LOCAL Settings\Temp\hqgsvduw.dat 
Quarantined & Deleted !! : C:\Documents and Settings\Dany\LOCAL Settings\Temp\IadHide4.dll 
 
==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}  
Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  
Deleted : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}  
Deleted : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}  
Deleted : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}  
Deleted : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}  
Deleted : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}  
Deleted : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_Irmon  
Deleted : HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys  
Deleted : HKLM\SYSTEM\ControlSet001\Services\Irmon  
Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_Irmon  
Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_SSHNAS  
Deleted : HKLM\SYSTEM\ControlSet002\Services\Irmon  
Deleted : HKLM\SYSTEM\ControlSet004\Enum\Root\Legacy_Irmon  
Deleted : HKLM\SYSTEM\ControlSet004\Enum\Root\Legacy_SSHNAS  
Deleted : HKLM\SYSTEM\ControlSet004\Services\Irmon  
=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp
Local Page	REG_SZ         	C:\WINDOWS\system32\blank.htm
Default_Search_URL	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp
Search Page	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.google.com/?gws_rd=ssl
Local Page	REG_SZ         	C:\WINDOWS\system32\blank.htm
Search Page	REG_SZ         	http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] 
FirstRunDisabled	REG_DWORD      	1 (0x1) 
AntiVirusDisableNotify	REG_DWORD      	0 (0x0) 
FirewallDisableNotify	REG_DWORD      	0 (0x0) 
UpdatesDisableNotify	REG_DWORD      	0 (0x0) 
AntiVirusOverride	REG_DWORD      	1 (0x1) 
FirewallOverride	REG_DWORD      	1 (0x1) 
 
========
Services
=========

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Ip6Fw : Start = 2   
 SharedAccess : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

============
Disk Cleaned
anti-ver blaster : OK 
Prefetch cleaned 
================
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

moment de grace · Answer

vu

=> ZHP

dbourgeo · Answer

Voila le lien du fichier ZHPDiag.txt


http://www.cijoint.fr/cjlink.php?file=cj201004/cij8M10ndw.txt

Merci pour tout ce que tu fais.
Daniel

moment de grace · Answer

(sourire)

il en reste

Attention, avant de commencer, lit attentivement la procédure, et imprime la 

Aide à l'utilisation
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix



Télécharge ComboFix de sUBs  sur ton Bureau : 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

/!\ Déconnecte-toi du net et DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\ 

---> Double-clique sur ComboFix.exe 
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter 

SURTOUT INSTALLES LA CONSOLE DE RECUPERATION 
(si il te propose de l'installer remets provisoirement internet)

---> Mets-le en langue française F 
Tape sur la touche 1 (Yes) pour démarrer le scan. 

Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC 

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire. 

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu 

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\ 

Note : Le rapport se trouve également là : C:\ComboFix.txt

dbourgeo · Answer

Partie 1


ComboFix 10-04-21.01 - Dany 22/04/2010  21:47:35.3.2 - x86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.2047.1487 [GMT 2:00]
Lancé depuis: c:\documents and settings\Dany\Bureau\ComboFix.exe
AV: BitDefender Internet Security v10 *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: ESET Smart Security 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: BitDefender Internet Security v10 *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
FW: Pare-feu personnel d'ESET *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
 * Un antivirus résident est actif

.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-3602737474-2172167897-2797940940-1000
c:\$recycle.bin\S-1-5-21-4200881234-2146675543-2877990657-1000
c:\windows\system32\drivers\kthblled.sys
c:\windows\system32\drivers\wgteicji.sys
c:\windows\system32\SHELLLNK.TLB
c:\windows\system32\winsys.exe

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_wgteicji
-------\Service_wgteicji


(((((((((((((((((((((((((((((   Fichiers créés du 2010-03-22 au 2010-04-22  ))))))))))))))))))))))))))))))))))))
.

2010-04-22 18:56 . 2010-04-22 19:00	--------	d-----w-	c:\program files\ZHPDiag
2010-04-22 16:36 . 2010-04-22 18:20	--------	d-----w-	C:\Kill'em
2010-04-22 16:35 . 2010-04-22 18:29	--------	d-----w-	c:\program files\List_Kill'em
2010-04-22 11:05 . 2010-04-22 11:05	--------	d-----w-	C:sit
2010-04-22 11:05 . 2010-04-22 11:05	--------	d-----w-	c:\program files	rend micro
2010-04-22 09:46 . 2010-04-22 09:46	--------	d-----w-	c:\program files\ESET
2010-04-19 16:12 . 2010-04-19 16:12	--------	d-----w-	c:\program files\TomTom International B.V
2010-04-18 09:39 . 2010-04-18 09:39	--------	d-----w-	c:\program files\Microsoft ActiveSync
2010-04-18 09:23 . 2010-04-18 09:23	--------	d-sh--w-	c:\documents and settings\Default User\IETldCache
2010-04-18 07:46 . 2010-04-18 07:46	--------	d-----w-	c:\program files\Microsoft.NET
2010-04-18 07:43 . 2010-04-18 07:43	--------	d-----w-	c:\windows\SHELLNEW
2010-04-18 07:42 . 2010-04-18 07:42	--------	d-----r-	C:\MSOCache
2010-04-17 21:46 . 2010-04-17 21:46	--------	d-----w-	c:\documents and settings\All Users\Application Data\Logishrd
2010-04-17 19:27 . 2010-04-17 19:27	--------	d-----w-	c:\windows\system32\wbem\Repository
2010-04-17 19:16 . 2010-04-17 19:16	--------	d-----w-	c:\documents and settings\Dany\Local Settings\Application Data\Logishrd
2010-04-17 19:10 . 2010-04-17 19:11	--------	d-----w-	c:\documents and settings\Dany\Application Data\Logishrd
2010-04-16 18:00 . 2010-04-16 18:00	--------	d-----w-	c:\program files\TrendMicro
2010-04-14 05:15 . 2010-04-14 05:53	--------	d-----w-	c:\program files\Trojan Killer
2010-04-13 06:36 . 2010-04-22 07:57	--------	d-----w-	C:\Ad-Remover
2010-04-12 23:11 . 2009-05-07 07:04	157712	----a-w-	c:\windows\system32\drivers	mcomm.sys
2010-04-12 11:57 . 2010-04-12 19:51	--------	d-----w-	c:\documents and settings\Dany\Local Settings\Application Data\Google
2010-04-12 10:37 . 2010-04-12 10:37	699904	----a-w-	c:\windows\is-5NVC6.exe
2010-04-12 08:59 . 2010-04-12 08:59	140288	----a-w-	c:\windows\system32\drivers\ethsrmex.sys
2010-04-07 19:08 . 2010-04-07 19:08	55232	----a-w-	c:\windows\system32\drivers\epfwtdi.sys
2010-04-07 19:08 . 2010-04-07 19:08	32584	----a-w-	c:\windows\system32\drivers\epfwndis.sys
2010-04-07 19:08 . 2010-04-07 19:08	134488	----a-w-	c:\windows\system32\drivers\epfw.sys
2010-04-07 19:07 . 2010-04-07 19:07	114984	----a-w-	c:\windows\system32\drivers\ehdrv.sys
2010-04-07 19:03 . 2010-04-07 19:03	139192	----a-w-	c:\windows\system32\drivers\eamon.sys
2010-04-02 14:30 . 2010-04-02 14:30	--------	d-----w-	c:\program files\DIFX
2010-04-02 14:30 . 2006-12-21 22:11	40576	------w-	c:\windows\system32\drivers\VCommUSB.sys

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-22 18:49 . 2004-08-05 12:00	546120	----a-w-	c:\windows\system32\perfh00C.dat
2010-04-22 18:49 . 2004-08-05 12:00	99178	----a-w-	c:\windows\system32\perfc00C.dat
2010-04-22 12:08 . 2009-03-07 14:21	--------	d-----w-	c:\documents and settings\Dany\Application Data\WeatherWatcher
2010-04-22 12:02 . 2004-08-05 12:00	42112	----a-w-	c:\windows\system32\drivers\Imapi.sys
2010-04-22 08:54 . 2007-03-20 12:39	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-21 11:07 . 2010-04-21 11:07	388096	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-19 16:58 . 2007-03-19 16:56	58136	----a-w-	c:\documents and settings\Dany\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-19 16:46 . 2007-03-19 17:03	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-19 16:43 . 2007-03-20 13:02	117248	----a-w-	c:\windows\system32\drivers\SSIDRV.sys
2010-04-19 16:39 . 2007-03-21 13:35	--------	d-----w-	c:\program files\TechniSat DVB
2010-04-19 16:39 . 2007-03-19 12:26	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-04-19 16:38 . 2007-03-19 16:12	--------	d-----w-	c:\program files\Smartione
2010-04-19 16:37 . 2009-09-26 15:12	--------	d-----w-	c:\program files\ProgFinder
2010-04-19 16:36 . 2009-08-12 11:06	--------	d-----w-	c:\program files\Panda Security
2010-04-19 16:34 . 2007-03-21 13:35	--------	d-----w-	c:\program files\DVBViewerTE
2010-04-19 16:22 . 2007-04-05 21:51	--------	d-----w-	c:\documents and settings\All Users\Application Data\Autodesk
2010-04-19 15:46 . 2009-09-19 17:52	4945232	----a-w-	c:\documents and settings\Dany\Application Data\TomTom\HOME\Profiles\w3c08jqu.default\extensions\Navcore.8.413.1237@tomtom.com\8-413-1237-1.dll
2010-04-17 21:47 . 2010-04-17 19:17	53248	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-04-17 21:47 . 2007-12-10 07:36	--------	d-----w-	c:\program files\Fichiers communs\Logishrd
2010-04-17 19:15 . 2007-03-19 14:55	--------	d-----w-	c:\program files\Logitech
2010-04-17 19:14 . 2007-03-19 14:55	--------	d-----w-	c:\program files\Fichiers communs\Logitech
2010-04-16 14:12 . 2010-02-20 21:16	--------	d-----w-	c:\documents and settings\Dany\Application Data\vlc
2010-04-15 15:49 . 2009-02-08 07:42	--------	d-----w-	c:\program files\Google
2010-04-12 10:40 . 2008-10-01 13:10	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-04-12 10:37 . 2008-10-01 13:10	5918776	----a-w-	c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-12 07:29 . 2007-04-30 20:15	--------	d-----w-	c:\program files\BitTorrent_DNA
2010-04-09 09:29 . 2010-03-19 10:27	966104	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-04-09 09:29 . 2010-03-19 10:27	1265264	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-04-08 10:10 . 2007-05-18 12:30	--------	d-----w-	c:\program files\FastStone Capture
2010-04-02 14:42 . 2008-06-18 10:05	335	-c--a-w-	c:\windows
sreg.dat
2010-03-29 22:46 . 2008-10-01 13:10	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 22:45 . 2008-10-01 13:10	20824	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-03-29 19:36 . 2007-03-20 12:36	--------	d-----w-	c:\program files\CCleaner
2010-03-23 09:27 . 2010-03-19 10:27	3749200	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\vcore.dll
2010-03-20 16:00 . 2007-06-23 13:34	--------	d-----w-	c:\documents and settings\Dany\Application Data\Canon
2010-03-19 10:27 . 2010-03-19 10:27	95024	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\SBREDrv.sys
2010-03-10 06:16 . 2004-08-05 12:00	420352	----a-w-	c:\windows\system32\vbscript.dll
2010-03-08 13:51 . 2008-12-19 06:37	--------	d-----w-	c:\documents and settings\Dany\Application Data\dvdcss
2010-03-03 09:23 . 2007-03-19 15:54	--------	d-----w-	c:\program files\IZArc
2010-02-25 20:47 . 2007-03-19 16:26	--------	d-----w-	c:\documents and settings\Dany\Application Data\HARVEST S.A
2010-02-25 20:46 . 2010-02-25 20:46	--------	d-----w-	c:\program files\ClickImpots plus SCI 2010
2010-02-25 18:11 . 2007-05-04 20:42	--------	d-----w-	c:\program files\AM-DeadLink
2010-02-25 06:17 . 2004-08-05 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2004-08-05 12:00	455680	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2010-02-23 07:23 . 2010-03-19 10:27	283984	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libEmail.dll
2010-02-16 19:06 . 2004-08-05 12:00	2148352	----a-w-	c:\windows\system32
toskrnl.exe
2010-02-16 19:06 . 2004-08-04 00:49	2026496	----a-w-	c:\windows\system32
tkrnlpa.exe
2010-02-16 11:01 . 2010-03-19 10:27	259408	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extendedemediation.dll
2010-02-16 11:00 . 2010-03-19 10:27	226640	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libZip.dll
2010-02-16 11:00 . 2010-03-19 10:27	390480	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libVvs.dll
2010-02-16 11:00 . 2010-03-19 10:27	173392	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libtd.dll
2010-02-16 11:00 . 2010-03-19 10:27	296272	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libRar.dll
2010-02-16 11:00 . 2010-03-19 10:27	345424	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libOleA.dll
2010-02-16 11:00 . 2010-03-19 10:27	206160	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libNSIS.dll
2010-02-16 11:00 . 2010-03-19 10:27	177488	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libMsi.dll
2010-02-16 11:00 . 2010-03-19 10:27	206160	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libCHM.dll
2010-02-12 10:03 . 2010-02-24 22:13	293376	------w-	c:\windows\system32\browserchoice.exe
2010-02-12 04:34 . 2004-08-05 12:00	100864	----a-w-	c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-05 12:00	226880	----a-w-	c:\windows\system32\drivers	cpip6.sys
2010-02-04 15:53 . 2010-03-19 10:16	2954656	-c--a-w-	c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-02-04 15:53 . 2010-03-19 10:27	64288	----a-w-	c:\windows\system32\drivers\Lbd.sys
2010-02-01 09:45 . 2010-02-01 09:45	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe
2010-02-01 09:45 . 2010-02-01 09:45	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe
2010-02-01 09:44 . 2010-02-01 09:44	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe
2006-05-03 09:06 . 2009-10-09 15:07	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-10-09 15:07	31232	--sh--r-	c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-10-09 15:07	216064	--sh--r-	c:\windows\system32
bDX.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"WeatherWatcher"="c:\program files\Weather Watcher\ww.exe" [2008-11-18 1081344]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-06-07 20480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KBDriver"="c:\program files\Keyboard Driver\OEMDriver.exe" [2004-08-25 151552]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-03-06 488984]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-11 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-11 13666408]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-01-27 1312848]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-04-07 2145000]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000D7}"= "c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABSEHB.DLL" [2006-11-07 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\!SABWinLogon]
2007-02-27 09:24	159744	----a-w-	c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LBTWlgn]
2010-01-29 21:17	64592	----a-w-	c:\program files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\acaptuser32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Acrobat.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Server4PC.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Dany^Menu Démarrer^Programmes^Démarrage^Logitech . Enregistrement du produit.lnk]
path=c:\documents and settings\Dany\Menu Démarrer\Programmes\Démarrage\Logitech . Enregistrement du produit.lnk
backup=c:\windows\pss\Logitech . Enregistrement du produit.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-03-29 22:46	437584	----a-w-	c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrintDisp]
2009-08-21 10:36	878080	----a-w-	c:\windows\system32\PrintDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 15:18	413696	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\eMule\emule.exe"=
"c:\Program Files\BitTorrent\bittorrent.exe"=
"c:\Program Files\Pando Networks\Pando\pando.exe"=
"c:\Program Files\Fichiers communs\Ahead\Nero Web\SetupX.exe"=
"c:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\VideoLAN\VLC\vlc.exe"=
"c:\Program Files\Kyodai Mahjongg\kmj.exe"=
"c:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Java\jre1.6.0_01\launch4j-tmp\JDownloader.exe"=
"c:\WINDOWS\system32\java.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\program files\Microsoft ActiveSyncapimgr.exe"= c:\program files\Microsoft ActiveSyncapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [19/03/2010 12:27 64288]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14/10/2007 19:37 717296]
R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [26/03/2007 16:26 16896]
R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [26/03/2007 16:26 52224]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [07/04/2010 21:07 114984]
R1 SABDIFSV;SABDIFSV;c:\program files\SuperAdBlocker.com\Super Ad Blocker\sabdifsv.sys [21/09/2005 10:17 5632]
R1 SABKUTIL;SABKUTIL;c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.SYS [20/02/2007 15:02 32256]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [07/04/2010 21:07 810120]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [01/10/2008 15:10 303952]
R2 Printer Control;Printer Control;c:\windows\system32\PrintCtrl.exe [16/11/2009 14:52 77824]
R2 RegServ;RegServ;c:\windows\SRNTService.exe [12/11/2009 12:14 69632]
R2 TomTomHOMEService;TomTomHOMEService;f:	omtom home 2\TomTomHOMEService.exe [13/11/2009 13:31 92008]
R3 adatadrv;Autodata Protection Service;c:\windows\system32\drivers\adatadrv.sys [02/11/2009 10:32 762112]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [01/10/2008 15:10 20824]
S2 gupdate1c989c0d9b3d5dc;Google Update Service (gupdate1c989c0d9b3d5dc);c:\program files\Google\Update\GoogleUpdate.exe [08/02/2009 09:42 133104]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32egedt32.exe [05/08/2004 14:00 3584]
S2 tqavcdyu;Logitech AEC Helper;c:\windows\System32\svchost.exe -k netsvcs [05/08/2004 14:00 14336]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [04/02/2010 17:52 1265264]
S3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\drivers\MosIrUsb.sys [14/04/2004 14:52 20736]
S3 ParadigmVScanner;USB Scanner Still Image Device Service;c:\windows\system32\drivers\usbscan.sys [19/03/2007 17:32 15104]
S3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\DRIVERS\SkyNET.SYS --> c:\windows\system32\DRIVERS\SkyNET.SYS [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
tqavcdyu
.
Contenu du dossier 'Tâches planifiées'

2010-04-22 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 09:29]

2010-04-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 07:42]

2010-04-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 07:42]

2010-04-22 c:\windows\Tasks\User_Feed_Synchronization-{B4010896-F085-4E90-8706-E2D3865DFB9B}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.

dbourgeo · Answer

Partie 2 ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = localhost IE: Ajouter au fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir au format PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en Adobe PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html Trusted Zone: secuser.com\www TCP: {9E9D081D-EAA5-4C2C-ABA7-6BA4EE5C7653} = 212.27.54.252,213.228.0.23 DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab DPF: {A364AF35-0CDF-41E8-8F3B-E0E55E15EBA1} - hxxp://www.programchecker.com/dll/nixon.cab FF - ProfilePath - c:\documents and settings\Dany\Application Data\Mozilla\Firefox\Profiles\6ndeje8e.default\ FF - prefs.js: browser.startup.homepage - hxxp://fr.my.yahoo.com/ FF - plugin: c:\program files\Google\Google Earth\plugin pgeplugin.dll FF - plugin: c:\program files\Google\Update\1.2.183.23 pGoogleOneClick8.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- PARAMETRES FIREFOX ---- e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com"); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - ORPHELINS SUPPRIMES - - - - BHO-{5C887690-4044-418A-8A28-8BEBC3F9EF75} - (no file) Toolbar-Locked - (no file) ShellIconOverlayIdentifiers-{5C887690-4044-418A-8A28-8BEBC3F9EF75} - (no file) HKCU-Run-RSRWin.exe - c:\windows\RSRWin.exe HKU-Default-Run-RSRWin.exe - c:\windows\RSRWin.exe MSConfigStartUp-nwiz - nwiz.exe MSConfigStartUp-QZAIB7KITK - c:\windows\Nhegea.exe AddRemove-CPUID CPU-Z_is1 - i:\cpu-z\unins000.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-04-22 21:55 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... c:\windows\TEMP\NODE.tmp 872448 bytes Scan terminé avec succès Fichiers cachés: 1 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spvb.sys >>UNKNOWN [0x8ABE2938]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0xf765bf28 \Driver\ACPI -> ACPI.sys @ 0xf7495cb8 \Driver\atapi -> atapi.sys @ 0xf7978b40 IoDeviceObjectType -> SecurityProcedure -> ntoskrnl.exe @ 0x805df529 \Device\Harddisk0\DR0 -> SecurityProcedure -> ntoskrnl.exe @ 0x805df529 NDIS: VIA Rhine II Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xb8672bb0 PacketIndicateHandler -> NDIS.sys @ 0xb867fa21 SendHandler -> NDIS.sys @ 0xb865d87b user & kernel MBR OK ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A017AF56-B493-BA8F-B78A-ABAC1F958DAB}*] "faigafmkfagb"=hex:6d,62,6e,67,67,6a,6f,63,66,6b,62,6b,67,6a,6f,6d,6d,62,61,6b, 64,65,65,69,6a,69,6b,6b,63,6f,63,6a,6f,6a,66,6d,68,62,6e,70,68,68,65,66,64,\ "gajeimeomgllde"=hex:63,61,6b,66,66,68,00,00 "gaiennfajdkfje"=hex:63,61,6b,66,66,68,00,00 [HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "??"=hex:c9,8a,a1,d3,ea,6c,33,6c,1a,e7,0d,94,b3,e1,f4,f7,96,79,6f,5e,d5,25,6e, 08,a3,e8,1e,f3,1a,70,7e,89,36,32,94,d1,a6,5a,6b,3e,40,01,54,44,f7,21,de,8b,\ "??"=hex:6b,17,e5,79,7b,28,33,4c,05,ba,2a,9e,a9,42,7d,26 [HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info] @Denied: (2) (LocalSystem) "AppDataDir"="c:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\" "DataDir"="ESET\ESET Smart Security\" "EditionName"=" " "InstallDir"="c:\Program Files\ESET\ESET Smart Security\" "LanguageId"=dword:0000040c "PackageTag"=dword:6090e758 "ProductBase"=dword:00000001 "ProductCode"="{B91B907B-3542-4DDB-84FA-55EDE3F13969}" "ProductName"="ESET Smart Security" "ProductType"="ess" "ProductVersion"="4.2.40.10" "UniqueId"="0007876D4BD01B15" "ScannerBuild"=dword:00001aeb "ScannerVersionId"=dword:00001390 "ScannerVersion"="Open window for status." [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODI04.00.00.01PRO"="9D8A793893C67688BABF2127E6827D4EDA27D0B11FE83A54D5B0D036F379505986151D5064A59CBDED6A2809C6A9A2B32649710525FAD4FDAAF876CF66BE1FBE69B863305159C752A70E9D905181A2C6BAA61FF21A7210CD84CF997A8EA3CA554F74747F000E9024F0AE12363A1108833BEF6AE6E052890245AD6FB21AC02A417AA7CBEA8A9820D3FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407C038D530D6EB3452BA7FD869164D67945902353A9A01F6341CC2B6562780CCDEFA4EC48EE171B24A9828A0D10040AB7F217F0D4C04C8847EE2F78CC3B75F30A22FF2687BF86AF80E8E7E07AE568C832C493B1511FCE11C3838687F68F248D965E9703A3525380C85188F5A6542B37FCBEB03FD9CEA3E891B924E820A2A64EBE1200992D0C3DE040A46C8F77C4F31CCFA578D4907A7EF2EA19D465F71A4839C9379621FE8A8038B3B5EF712FD7D252C988FF1CD6BFEB2800DB852306A1B15373D5408DF1A1BF1627A5A522DF9BFD2F147492CB7E9B2E008E17857E445BC301962BF682987D5985AEDE7ED2503002385EE6F9E04A6F77DE3E6A39F41582A8F35CD01D5A5D4078BDD8067C5252E992063B9210C0748F6ACC3A936575EFA7A8F118C8F85D0AD5281E45FEEBA31965BFB9C97311D667B4D37EDF85E12260A3833486E1992FABECFD380FB490F1EDC8A88D3BAA4DE9D6E8B09BBE901C2D9665F9F080A7E7CC9B90903538E72EA15205FBFC39BB6C07B56B7B41A5436448CF3E39F123752A336D47E3194909DD8950B853C36F45718216ACAEE895447D2261D2BA03D14DED08C48A12590BE2E496F449C3D0DC5279C87E5301021CAB591E24C8FB47401A0ACEC535A4A259DBE8EC97E39A83C51FDEA7808CA1688DAB38451F35E11B5A346454E36032F46F09CE19E6963054C9DE40313956E9F7D6C2A9457085A9093E5B60FF6B7EB07FBC4C9DBB93C967ED8F79B4AC8D564F251ADB3112A023830B27309DE0521D6285F667BFDBF33C2E4126D9589E2146AF8E90C202A56DB2492CFBE8AEEE8C0FB0FA2E71BABA38A4C2CBC5277EAF920B03F3F3E73753D1A3AFC377BBBDEE6668458071FC6AA31060C6C31BE1C81FDCEDB75E0BAE26C123E8ED9CBA4CF3099E9914964274FA8856D4D62DB8B12BE31F40771EDBDDDEBDAD125B6837530496BA3B546265E3AB2138A4FEBBCD81DFD2BF03D2B1B480036746378C6E9707A749E71F55C4B66423E9DAB470E670BB17AD4A17FC0B41E9F708F8076DD9BD97DE0C73550B8E7A35322C1A2DCF105C6FC53EE6AC4F0164743242FC082F6CBBBBF21CF5532AFA1438F18EAC7ACE0D17ADA8E0BB2F3A3AF8FA53E2AB971B04163F62A72B9FD38B4B14DC1DBF545CC1E515F9411E6EADF8888" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(1072) c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll - - - - - - - > 'explorer.exe'(2316) c:\docume~1\Dany\LOCALS~1\Temp\IadHide4.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\windows\system32\eappprxy.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32 vsvc32.exe c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE c:\program files\Java\jre6\bin\jqs.exe c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe c:\windows\system32\IoctlSvc.exe e:\xp\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\windows\system32\SearchIndexer.exe c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\windows\system32\RUNDLL32.EXE c:\program files\Microsoft ActiveSync\wcescomm.exe c:\progra~1\MICROS~2 apimgr.exe c:\program files\Fichiers communs\LogiShrd\KHAL3\KHALMNPR.EXE c:\program files\Fichiers communs\Ahead\Lib\NMIndexingService.exe c:\program files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe c:\windows\system32\SearchProtocolHost.exe c:\windows\system32\SearchFilterHost.exe . ************************************************************************** . Heure de fin: 2010-04-22 22:02:05 - La machine a redémarré ComboFix-quarantined-files.txt 2010-04-22 20:02 Avant-CF: 28 787 978 240 octets libres Après-CF: 28 639 907 840 octets libres WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe ; ;Warning: Boot.ini is used on Windows XP and earlier operating systems. ;Warning: Use BCDEDIT.exe to modify Windows Vista boot options. ; [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /NOEXECUTE=OPTIN /FASTDETECT Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4 - - End Of File - - 7459F36E88C8F3771724B9D3EFCF7941

moment de grace · Answer

ok 

/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour dbourgeo, il n'est pas transposable sur un autre ordinateur ! 

crées un sur ton bureau un nouveau fichier bloc note que tu nommeras CFScrip 
Copies y ce texte dedans et enregistres le 

KillAll:: 

Driver:: 

SKYNET 


* Désactive tes logiciels de protection 
* Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe (comme le lien suivant) 
http://apu.mabul.org/up/apu/2008/09/06/img-2258535my8h.gif 
* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé. 
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu. 
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt 

Je cherche beaucoup...et maintenant je trouve !  
(sourire)

dbourgeo · Answer

Partie 1


ComboFix 10-04-21.01 - Dany 23/04/2010   6:25.4.2 - x86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.2047.1498 [GMT 2:00]
Lancé depuis: c:\documents and settings\Dany\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Dany\Bureau\CFScript.txt
AV: BitDefender Internet Security v10 *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: ESET Smart Security 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: BitDefender Internet Security v10 *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
FW: Pare-feu personnel d'ESET *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-3602737474-2172167897-2797940940-1000
c:\$recycle.bin\S-1-5-21-4200881234-2146675543-2877990657-1000

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SKYNET


(((((((((((((((((((((((((((((   Fichiers créés du 2010-03-23 au 2010-04-23  ))))))))))))))))))))))))))))))))))))
.

2010-04-22 18:56 . 2010-04-22 19:00	--------	d-----w-	c:\program files\ZHPDiag
2010-04-22 16:36 . 2010-04-22 18:20	--------	d-----w-	C:\Kill'em
2010-04-22 16:35 . 2010-04-22 18:29	--------	d-----w-	c:\program files\List_Kill'em
2010-04-22 11:05 . 2010-04-22 11:05	--------	d-----w-	C:sit
2010-04-22 11:05 . 2010-04-22 11:05	--------	d-----w-	c:\program files	rend micro
2010-04-22 09:46 . 2010-04-22 09:46	--------	d-----w-	c:\program files\ESET
2010-04-21 11:07 . 2010-04-21 11:07	388096	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-19 16:12 . 2010-04-19 16:12	--------	d-----w-	c:\program files\TomTom International B.V
2010-04-18 09:39 . 2010-04-18 09:39	--------	d-----w-	c:\program files\Microsoft ActiveSync
2010-04-18 09:23 . 2010-04-18 09:23	--------	d-sh--w-	c:\documents and settings\Default User\IETldCache
2010-04-18 07:46 . 2010-04-18 07:46	--------	d-----w-	c:\program files\Microsoft.NET
2010-04-18 07:43 . 2010-04-18 07:43	--------	d-----w-	c:\windows\SHELLNEW
2010-04-18 07:42 . 2010-04-18 07:42	--------	d-----r-	C:\MSOCache
2010-04-17 21:46 . 2010-04-17 21:46	--------	d-----w-	c:\documents and settings\All Users\Application Data\Logishrd
2010-04-17 19:27 . 2010-04-17 19:27	--------	d-----w-	c:\windows\system32\wbem\Repository
2010-04-17 19:17 . 2010-04-17 21:47	53248	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-04-17 19:16 . 2010-04-17 19:16	--------	d-----w-	c:\documents and settings\Dany\Local Settings\Application Data\Logishrd
2010-04-17 19:10 . 2010-04-17 19:11	--------	d-----w-	c:\documents and settings\Dany\Application Data\Logishrd
2010-04-16 18:00 . 2010-04-16 18:00	--------	d-----w-	c:\program files\TrendMicro
2010-04-14 05:15 . 2010-04-14 05:53	--------	d-----w-	c:\program files\Trojan Killer
2010-04-13 06:36 . 2010-04-22 07:57	--------	d-----w-	C:\Ad-Remover
2010-04-12 23:11 . 2009-05-07 07:04	157712	----a-w-	c:\windows\system32\drivers	mcomm.sys
2010-04-12 11:57 . 2010-04-12 19:51	--------	d-----w-	c:\documents and settings\Dany\Local Settings\Application Data\Google
2010-04-12 10:37 . 2010-04-12 10:37	699904	----a-w-	c:\windows\is-5NVC6.exe
2010-04-12 08:59 . 2010-04-12 08:59	140288	----a-w-	c:\windows\system32\drivers\ethsrmex.sys
2010-04-07 19:08 . 2010-04-07 19:08	55232	----a-w-	c:\windows\system32\drivers\epfwtdi.sys
2010-04-07 19:08 . 2010-04-07 19:08	32584	----a-w-	c:\windows\system32\drivers\epfwndis.sys
2010-04-07 19:08 . 2010-04-07 19:08	134488	----a-w-	c:\windows\system32\drivers\epfw.sys
2010-04-07 19:07 . 2010-04-07 19:07	114984	----a-w-	c:\windows\system32\drivers\ehdrv.sys
2010-04-07 19:03 . 2010-04-07 19:03	139192	----a-w-	c:\windows\system32\drivers\eamon.sys
2010-04-02 14:30 . 2010-04-02 14:30	--------	d-----w-	c:\program files\DIFX
2010-04-02 14:30 . 2006-12-21 22:11	40576	------w-	c:\windows\system32\drivers\VCommUSB.sys
2010-04-02 09:29 . 2010-04-02 09:29	516480	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\EmailScannerAddin.dll
2010-04-02 09:29 . 2010-04-02 09:29	17632	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\WSCUpdate.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-22 20:21 . 2010-02-20 21:16	--------	d-----w-	c:\documents and settings\Dany\Application Data\vlc
2010-04-22 20:01 . 2009-03-07 14:21	--------	d-----w-	c:\documents and settings\Dany\Application Data\WeatherWatcher
2010-04-22 18:49 . 2004-08-05 12:00	546120	----a-w-	c:\windows\system32\perfh00C.dat
2010-04-22 18:49 . 2004-08-05 12:00	99178	----a-w-	c:\windows\system32\perfc00C.dat
2010-04-22 12:02 . 2004-08-05 12:00	42112	----a-w-	c:\windows\system32\drivers\Imapi.sys
2010-04-22 08:54 . 2007-03-20 12:39	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-19 16:58 . 2007-03-19 16:56	58136	----a-w-	c:\documents and settings\Dany\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-19 16:46 . 2007-03-19 17:03	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-19 16:43 . 2007-03-20 13:02	117248	----a-w-	c:\windows\system32\drivers\SSIDRV.sys
2010-04-19 16:39 . 2007-03-21 13:35	--------	d-----w-	c:\program files\TechniSat DVB
2010-04-19 16:39 . 2007-03-19 12:26	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-04-19 16:38 . 2007-03-19 16:12	--------	d-----w-	c:\program files\Smartione
2010-04-19 16:37 . 2009-09-26 15:12	--------	d-----w-	c:\program files\ProgFinder
2010-04-19 16:36 . 2009-08-12 11:06	--------	d-----w-	c:\program files\Panda Security
2010-04-19 16:34 . 2007-03-21 13:35	--------	d-----w-	c:\program files\DVBViewerTE
2010-04-19 16:22 . 2007-04-05 21:51	--------	d-----w-	c:\documents and settings\All Users\Application Data\Autodesk
2010-04-19 15:46 . 2009-09-19 17:52	4945232	----a-w-	c:\documents and settings\Dany\Application Data\TomTom\HOME\Profiles\w3c08jqu.default\extensions\Navcore.8.413.1237@tomtom.com\8-413-1237-1.dll
2010-04-17 21:47 . 2007-12-10 07:36	--------	d-----w-	c:\program files\Fichiers communs\Logishrd
2010-04-17 19:15 . 2007-03-19 14:55	--------	d-----w-	c:\program files\Logitech
2010-04-17 19:14 . 2007-03-19 14:55	--------	d-----w-	c:\program files\Fichiers communs\Logitech
2010-04-15 15:49 . 2009-02-08 07:42	--------	d-----w-	c:\program files\Google
2010-04-12 10:40 . 2008-10-01 13:10	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-04-12 10:37 . 2008-10-01 13:10	5918776	----a-w-	c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-12 07:29 . 2007-04-30 20:15	--------	d-----w-	c:\program files\BitTorrent_DNA
2010-04-09 09:29 . 2010-03-19 10:27	966104	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-04-09 09:29 . 2010-03-19 10:27	1265264	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-04-08 10:10 . 2007-05-18 12:30	--------	d-----w-	c:\program files\FastStone Capture
2010-04-02 14:42 . 2008-06-18 10:05	335	-c--a-w-	c:\windows
sreg.dat
2010-03-29 22:46 . 2008-10-01 13:10	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 22:45 . 2008-10-01 13:10	20824	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-03-29 19:36 . 2007-03-20 12:36	--------	d-----w-	c:\program files\CCleaner
2010-03-23 09:27 . 2010-03-19 10:27	3749200	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\vcore.dll
2010-03-20 16:00 . 2007-06-23 13:34	--------	d-----w-	c:\documents and settings\Dany\Application Data\Canon
2010-03-19 10:27 . 2010-03-19 10:27	95024	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\SBREDrv.sys
2010-03-10 06:16 . 2004-08-05 12:00	420352	----a-w-	c:\windows\system32\vbscript.dll
2010-03-08 13:51 . 2008-12-19 06:37	--------	d-----w-	c:\documents and settings\Dany\Application Data\dvdcss
2010-03-03 09:23 . 2007-03-19 15:54	--------	d-----w-	c:\program files\IZArc
2010-02-25 20:47 . 2007-03-19 16:26	--------	d-----w-	c:\documents and settings\Dany\Application Data\HARVEST S.A
2010-02-25 20:46 . 2010-02-25 20:46	--------	d-----w-	c:\program files\ClickImpots plus SCI 2010
2010-02-25 18:11 . 2007-05-04 20:42	--------	d-----w-	c:\program files\AM-DeadLink
2010-02-25 06:17 . 2004-08-05 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2004-08-05 12:00	455680	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2010-02-23 07:23 . 2010-03-19 10:27	283984	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libEmail.dll
2010-02-16 19:06 . 2004-08-05 12:00	2148352	----a-w-	c:\windows\system32
toskrnl.exe
2010-02-16 19:06 . 2004-08-04 00:49	2026496	----a-w-	c:\windows\system32
tkrnlpa.exe
2010-02-16 11:01 . 2010-03-19 10:27	259408	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extendedemediation.dll
2010-02-16 11:00 . 2010-03-19 10:27	226640	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libZip.dll
2010-02-16 11:00 . 2010-03-19 10:27	390480	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libVvs.dll
2010-02-16 11:00 . 2010-03-19 10:27	173392	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libtd.dll
2010-02-16 11:00 . 2010-03-19 10:27	296272	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libRar.dll
2010-02-16 11:00 . 2010-03-19 10:27	345424	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libOleA.dll
2010-02-16 11:00 . 2010-03-19 10:27	206160	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libNSIS.dll
2010-02-16 11:00 . 2010-03-19 10:27	177488	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libMsi.dll
2010-02-16 11:00 . 2010-03-19 10:27	206160	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libCHM.dll
2010-02-12 10:03 . 2010-02-24 22:13	293376	------w-	c:\windows\system32\browserchoice.exe
2010-02-12 04:34 . 2004-08-05 12:00	100864	----a-w-	c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-05 12:00	226880	----a-w-	c:\windows\system32\drivers	cpip6.sys
2010-02-04 15:53 . 2010-03-19 10:16	2954656	-c--a-w-	c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-02-04 15:53 . 2010-03-19 10:27	64288	----a-w-	c:\windows\system32\drivers\Lbd.sys
2010-02-01 09:45 . 2010-02-01 09:45	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe
2010-02-01 09:45 . 2010-02-01 09:45	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe
2010-02-01 09:44 . 2010-02-01 09:44	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe
2006-05-03 09:06 . 2009-10-09 15:07	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-10-09 15:07	31232	--sh--r-	c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-10-09 15:07	216064	--sh--r-	c:\windows\system32
bDX.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"WeatherWatcher"="c:\program files\Weather Watcher\ww.exe" [2008-11-18 1081344]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-06-07 20480]
"RSRWin.exe"="c:\windows\RSRWin.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KBDriver"="c:\program files\Keyboard Driver\OEMDriver.exe" [2004-08-25 151552]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-03-06 488984]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-11 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-11 13666408]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-01-27 1312848]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-04-07 2145000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RSRWin.exe"="c:\windows\RSRWin.exe" [BU]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000D7}"= "c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABSEHB.DLL" [2006-11-07 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\!SABWinLogon]
2007-02-27 09:24	159744	----a-w-	c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LBTWlgn]
2010-01-29 21:17	64592	----a-w-	c:\program files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\acaptuser32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Acrobat.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Server4PC.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Dany^Menu Démarrer^Programmes^Démarrage^Logitech . Enregistrement du produit.lnk]
path=c:\documents and settings\Dany\Menu Démarrer\Programmes\Démarrage\Logitech . Enregistrement du produit.lnk
backup=c:\windows\pss\Logitech . Enregistrement du produit.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-03-29 22:46	437584	----a-w-	c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrintDisp]
2009-08-21 10:36	878080	----a-w-	c:\windows\system32\PrintDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 15:18	413696	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\eMule\emule.exe"=
"c:\Program Files\BitTorrent\bittorrent.exe"=
"c:\Program Files\Pando Networks\Pando\pando.exe"=
"c:\Program Files\Fichiers communs\Ahead\Nero Web\SetupX.exe"=
"c:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\VideoLAN\VLC\vlc.exe"=
"c:\Program Files\Kyodai Mahjongg\kmj.exe"=
"c:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Java\jre1.6.0_01\launch4j-tmp\JDownloader.exe"=
"c:\WINDOWS\system32\java.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\program files\Microsoft ActiveSyncapimgr.exe"= c:\program files\Microsoft ActiveSyncapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [19/03/2010 12:27 64288]
R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [26/03/2007 16:26 16896]
R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [26/03/2007 16:26 52224]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [07/04/2010 21:07 114984]
R1 SABDIFSV;SABDIFSV;c:\program files\SuperAdBlocker.com\Super Ad Blocker\sabdifsv.sys [21/09/2005 10:17 5632]
R1 SABKUTIL;SABKUTIL;c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.SYS [20/02/2007 15:02 32256]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [07/04/2010 21:07 810120]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [01/10/2008 15:10 303952]
R2 Printer Control;Printer Control;c:\windows\system32\PrintCtrl.exe [16/11/2009 14:52 77824]
R2 RegServ;RegServ;c:\windows\SRNTService.exe [12/11/2009 12:14 69632]
R2 TomTomHOMEService;TomTomHOMEService;f:	omtom home 2\TomTomHOMEService.exe [13/11/2009 13:31 92008]
R3 adatadrv;Autodata Protection Service;c:\windows\system32\drivers\adatadrv.sys [02/11/2009 10:32 762112]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [01/10/2008 15:10 20824]
S2 gupdate1c989c0d9b3d5dc;Google Update Service (gupdate1c989c0d9b3d5dc);c:\program files\Google\Update\GoogleUpdate.exe [08/02/2009 09:42 133104]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32egedt32.exe [05/08/2004 14:00 3584]
S2 tqavcdyu;Logitech AEC Helper;c:\windows\System32\svchost.exe -k netsvcs [05/08/2004 14:00 14336]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [04/02/2010 17:52 1265264]
S3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\drivers\MosIrUsb.sys [14/04/2004 14:52 20736]
S3 ParadigmVScanner;USB Scanner Still Image Device Service;c:\windows\system32\drivers\usbscan.sys [19/03/2007 17:32 15104]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14/10/2007 19:37 717296]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
tqavcdyu
.
Contenu du dossier 'Tâches planifiées'

2010-04-22 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 09:29]

2010-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 07:42]

2010-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 07:42]

2010-04-22 c:\windows\Tasks\User_Feed_Synchronization-{B4010896-F085-4E90-8706-E2D3865DFB9B}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.

dbourgeo · Answer

Partie 2


------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = localhost
IE: Ajouter au fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
Trusted Zone: secuser.com\www
TCP: {9E9D081D-EAA5-4C2C-ABA7-6BA4EE5C7653} = 212.27.54.252,213.228.0.23
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {A364AF35-0CDF-41E8-8F3B-E0E55E15EBA1} - hxxp://www.programchecker.com/dll/nixon.cab
FF - ProfilePath - c:\documents and settings\Dany\Application Data\Mozilla\Firefox\Profiles\6ndeje8e.default\
FF - prefs.js: browser.startup.homepage - hxxp://fr.my.yahoo.com/
FF - plugin: c:\program files\Google\Google Earth\plugin
pgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23
pGoogleOneClick8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-23 06:35
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A017AF56-B493-BA8F-B78A-ABAC1F958DAB}*]
"faigafmkfagb"=hex:6d,62,6e,67,67,6a,6f,63,66,6b,62,6b,67,6a,6f,6d,6d,62,61,6b,
   64,65,65,69,6a,69,6b,6b,63,6f,63,6a,6f,6a,66,6d,68,62,6e,70,68,68,65,66,64,\
"gajeimeomgllde"=hex:63,61,6b,66,66,68,00,00
"gaiennfajdkfje"=hex:63,61,6b,66,66,68,00,00

[HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:c9,8a,a1,d3,ea,6c,33,6c,1a,e7,0d,94,b3,e1,f4,f7,96,79,6f,5e,d5,25,6e,
   08,a3,e8,1e,f3,1a,70,7e,89,36,32,94,d1,a6,5a,6b,3e,40,01,54,44,f7,21,de,8b,\
"??"=hex:6b,17,e5,79,7b,28,33,4c,05,ba,2a,9e,a9,42,7d,26

[HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info]
@Denied: (2) (LocalSystem)
"AppDataDir"="c:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\"
"DataDir"="ESET\ESET Smart Security\"
"EditionName"=" "
"InstallDir"="c:\Program Files\ESET\ESET Smart Security\"
"LanguageId"=dword:0000040c
"PackageTag"=dword:6090e758
"ProductBase"=dword:00000001
"ProductCode"="{B91B907B-3542-4DDB-84FA-55EDE3F13969}"
"ProductName"="ESET Smart Security"
"ProductType"="ess"
"ProductVersion"="4.2.40.10"
"UniqueId"="0007876D4BD01B15"
"ScannerBuild"=dword:00001aeb
"ScannerVersionId"=dword:00001390
"ScannerVersion"="Open window for status."

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODI04.00.00.01PRO"="9D8A793893C67688BABF2127E6827D4EDA27D0B11FE83A54D5B0D036F379505986151D5064A59CBDED6A2809C6A9A2B32649710525FAD4FDAAF876CF66BE1FBE69B863305159C752A70E9D905181A2C6BAA61FF21A7210CD84CF997A8EA3CA554F74747F000E9024F0AE12363A1108833BEF6AE6E052890245AD6FB21AC02A417AA7CBEA8A9820D3FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407C038D530D6EB3452BA7FD869164D67945902353A9A01F6341CC2B6562780CCDEFA4EC48EE171B24A9828A0D10040AB7F217F0D4C04C8847EE2F78CC3B75F30A22FF2687BF86AF80E8E7E07AE568C832C493B1511FCE11C3838687F68F248D965E9703A3525380C85188F5A6542B37FCBEB03FD9CEA3E891B924E820A2A64EBE1200992D0C3DE040A46C8F77C4F31CCFA578D4907A7EF2EA19D465F71A4839C9379621FE8A8038B3B5EF712FD7D252C988FF1CD6BFEB2800DB852306A1B15373D5408DF1A1BF1627A5A522DF9BFD2F147492CB7E9B2E008E17857E445BC301962BF682987D5985AEDE7ED2503002385EE6F9E04A6F77DE3E6A39F41582A8F35CD01D5A5D4078BDD8067C5252E992063B9210C0748F6ACC3A936575EFA7A8F118C8F85D0AD5281E45FEEBA31965BFB9C97311D667B4D37EDF85E12260A3833486E1992FABECFD380FB490F1EDC8A88D3BAA4DE9D6E8B09BBE901C2D9665F9F080A7E7CC9B90903538E72EA15205FBFC39BB6C07B56B7B41A5436448CF3E39F123752A336D47E3194909DD8950B853C36F45718216ACAEE895447D2261D2BA03D14DED08C48A12590BE2E496F449C3D0DC5279C87E5301021CAB591E24C8FB47401A0ACEC535A4A259DBE8EC97E39A83C51FDEA7808CA1688DAB38451F35E11B5A346454E36032F46F09CE19E6963054C9DE40313956E9F7D6C2A9457085A9093E5B60FF6B7EB07FBC4C9DBB93C967ED8F79B4AC8D564F251ADB3112A023830B27309DE0521D6285F667BFDBF33C2E4126D9589E2146AF8E90C202A56DB2492CFBE8AEEE8C0FB0FA2E71BABA38A4C2CBC5277EAF920B03F3F3E73753D1A3AFC377BBBDEE6668458071FC6AA31060C6C31BE1C81FDCEDB75E0BAE26C123E8ED9CBA4CF3099E9914964274FA8856D4D62DB8B12BE31F40771EDBDDDEBDAD125B6837530496BA3B546265E3AB2138A4FEBBCD81DFD2BF03D2B1B480036746378C6E9707A749E71F55C4B66423E9DAB470E670BB17AD4A17FC0B41E9F708F8076DD9BD97DE0C73550B8E7A35322C1A2DCF105C6FC53EE6AC4F0164743242FC082F6CBBBBF21CF5532AFA1438F18EAC7ACE0D17ADA8E0BB2F3A3AF8FA53E2AB971B04163F62A72B9FD38B4B14DC1DBF545CC1E515F9411E6EADF8888"

[HKEY_LOCAL_MACHINE\software\swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1060)
c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll

- - - - - - - > 'explorer.exe'(3136)
c:\docume~1\Dany\LOCALS~1\Temp\IadHide4.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32
vsvc32.exe
c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\IoctlSvc.exe
e:\xp\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\SearchIndexer.exe
c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MICROS~2apimgr.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Fichiers communs\LogiShrd\KHAL3\KHALMNPR.EXE
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Heure de fin: 2010-04-23  06:41:47 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-04-23 04:41
ComboFix2.txt  2010-04-22 20:02

Avant-CF: 28 628 656 128 octets libres
Après-CF: 28 673 585 152 octets libres

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 7FD5630B2E001D02DF100745F1A40DB2
v

moment de grace · Answer

vu

firefox surement à desinstaller et à réinstaller

faire un nouveau rapport ZHPdiag et poster le lien stp

me dire ensuite comment va le pc...

dbourgeo · Answer

Bonjour moment de grace,

C'est bon je n'ai plus aucune menace et de plus mon PC semble plus fluide.
Par contre au démarrage du PC j'ai un message windows avec une croix rouge:

svchost.exe - Erreur d'application
L'instruction à "0x7c92b21a" emploie l'adresse mémoire "0x00000010". La mémoire ne peut pas être "written".
Cliquez sur OK pour terminer le programme.
Cliquez sur Annuler pour déboguer le programme.
                                OK                   Annuler

Mais ce n'est pas grave un coup de OK et tout marche et plus d'attaque.C'est le principal.

Je te remercie beaucoup pour tout ce que tu as fait et surtout le temps que tu m'as consacré pour résoudre mon problème. C'est vraiment sympa de consacré du temps comme cela et de la disponibilité.
Cordialement Daniel.

moment de grace · Answer

svchost.exe - Erreur d'application 

faudrait pas qu'il le fasse à chaque redémarrage

en attente d'un nouveau ZHP pour finaliser ainsi que ceci

télécharges Hijackthis
https://www.commentcamarche.net/telecharger/securite/11747-hijackthis/
Lancer HijackThis en double-cliquant sur l'icône du logiciel
Au menu principal, cliquer sur Do a system Scan only and Save a Logfile
Un rapport sera alors généré dans un fichier bloc-notes, il sera situé dans le dossier désinfection initialement créé pour l'installation.
Postes le ici

dbourgeo · Answer

Si, si j'ai le message à chaque démarrage mais ce n'est pas grave je fais OK et le message disparait, le principal est de ne plus avoir toutes ces menaces.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:16:42, on 23/04/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PrintCtrl.exe
C:\WINDOWS\srntservice.exe
E:\XP\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
F:\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Keyboard Driver\OEMDriver.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Weather Watcher\ww.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~2apimgr.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Fichiers communs\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
E:\XP\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Super Ad Blocker Toolbar - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\sabtb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [KBDriver] "C:\Program Files\Keyboard Driver\OEMDriver.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WeatherWatcher] "C:\Program Files\Weather Watcher\ww.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe (User 'Default user')
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format PDF - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.asf.fr/AxisCamControl.ocx
O16 - DPF: {A364AF35-0CDF-41E8-8F3B-E0E55E15EBA1} (Zenturi Active Programs Control) - http://www.programchecker.com/dll/nixon.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E9D081D-EAA5-4C2C-ABA7-6BA4EE5C7653}: NameServer = 212.27.54.252,213.228.0.23
O20 - AppInit_DLLs: C:\WINDOWS\system32\acaptuser32.dll
O20 - Winlogon Notify: !SABWinLogon - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c989c0d9b3d5dc) (gupdate1c989c0d9b3d5dc) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Printer Control - ActMask Co.,Ltd - https://www.all2pdf.com/ - C:\WINDOWS\system32\PrintCtrl.exe
O23 - Service: RegServ - Unknown owner - C:\WINDOWS\srntservice.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - SuperAdBlocker.com - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\XP\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TomTomHOMEService - TomTom - F:\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

moment de grace · Answer

depuis quand as tu ce message, est ce depuis une manip ?

de plus

Rends toi sur ce site : 

https://www.virustotal.com/gui/ 

Clique sur parcourir et cherche ce fichier : 

C:\WINDOWS\is-5NVC6.exe   
C:\WINDOWS\System32\drivers\ethsrmex.sys   
C:\WINDOWS\xgicode.ini   
C:\WINDOWS\Nhegea.exe 
C:\WINDOWS\System32\WinSys.exe



Clique sur Send File. 

Un rapport va s'élaborer ligne à ligne. 

Attends la fin. Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copie le dans ta réponse.

Si tu ne trouves pas le fichier alors

Affiche tous les fichiers et dossiers : 

Pour cela : 
Clique sur démarrer/panneau de configuration/option des dossiers/affichage 

Cocher afficher les dossiers cachés

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" 

Décocher masquer les extensions dont le type est connu 

Puis fais «appliquer» pour valider les changements. 

Et OK

dbourgeo · Answer

Fihier c;\Windows\is-5NVC6.exe

Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared 	4.5.0.50 	2010.04.22 	-
AhnLab-V3 	5.0.0.2 	2010.04.22 	-
AntiVir 	8.2.1.220 	2010.04.22 	-
Antiy-AVL 	2.0.3.7 	2010.04.21 	-
Authentium 	5.2.0.5 	2010.04.22 	-
Avast 	4.8.1351.0 	2010.04.22 	-
Avast5 	5.0.332.0 	2010.04.22 	-
AVG 	9.0.0.787 	2010.04.22 	-
BitDefender 	7.2 	2010.04.22 	-
CAT-QuickHeal 	10.00 	2010.04.22 	-
ClamAV 	0.96.0.3-git 	2010.04.22 	-
Comodo 	4665 	2010.04.22 	-
DrWeb 	5.0.2.03300 	2010.04.22 	-
eSafe 	7.0.17.0 	2010.04.22 	-
eTrust-Vet 	35.2.7443 	2010.04.22 	-
F-Prot 	4.5.1.85 	2010.04.21 	-
F-Secure 	9.0.15370.0 	2010.04.22 	-
Fortinet 	4.0.14.0 	2010.04.21 	-
GData 	21 	2010.04.22 	-
Ikarus 	T3.1.1.80.0 	2010.04.22 	-
Jiangmin 	13.0.900 	2010.04.22 	-
Kaspersky 	7.0.0.125 	2010.04.22 	-
McAfee 	5.400.0.1158 	2010.04.22 	-
McAfee-GW-Edition 	6.8.5 	2010.04.22 	-
Microsoft 	1.5703 	2010.04.22 	-
NOD32 	5050 	2010.04.22 	-
Norman 	6.04.11 	2010.04.21 	-
nProtect 	2010-04-22.01 	2010.04.22 	-
Panda 	10.0.2.7 	2010.04.21 	-
PCTools 	7.0.3.5 	2010.04.22 	-
Rising 	22.44.03.04 	2010.04.22 	-
Sophos 	4.53.0 	2010.04.22 	-
Sunbelt 	6207 	2010.04.22 	-
Symantec 	20091.2.0.41 	2010.04.22 	-
TheHacker 	6.5.2.0.267 	2010.04.22 	-
TrendMicro 	9.120.0.1004 	2010.04.22 	-
VBA32 	3.12.12.4 	2010.04.22 	-
ViRobot 	2010.4.21.2288 	2010.04.22 	-
VirusBuster 	5.0.27.0 	2010.04.22 	-
Information additionnelle
File size: 699904 bytes
MD5   : 0637235e56d68e8cdb1d204508434a05
SHA1  : 5f66a8bcd9cbca76b6cbccf5cd798eb3e2c31ea7
SHA256: c99beeab3a4d46deb4cdec5abf18fb4873b6e1194b694c2483980ecc569a8822
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x93D30
timedatestamp.....: 0x2A425E19 (Sat Jun 20 00:22:17 1992)
machinetype.......: 0x14C (Intel I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x92F68 0x93000 6.58 ee865207fd1c9133909c151d2dfb581f
DATA 0x94000 0x1040 0x1200 4.11 b61bff6add72122582dccbd11daba273
BSS 0x96000 0x1494 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0x98000 0x25A4 0x2600 5.03 466bb5755f9b35bcf5c5ea65669d018f
.tls 0x9B000 0x8 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rdata 0x9C000 0x18 0x200 0.20 c69afab126bf434e49f23fb46e4baac7
.reloc 0x9D000 0x87F4 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0xA6000 0x14000 0x14000 4.92 ead6495f7406d336a7511e9bff65f180

( 11 imports )

> advapi32.dll: RegSetValueExA, RegQueryValueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegEnumValueA, RegEnumKeyExA, RegDeleteValueA, RegDeleteKeyA, RegCreateKeyExA, RegCloseKey, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid, AdjustTokenPrivileges
> comctl32.dll: ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Create, InitCommonControls
> comdlg32.dll: GetSaveFileNameA, GetOpenFileNameA
> gdi32.dll: UnrealizeObject, TextOutA, StretchDIBits, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RoundRect, RestoreDC, RemoveFontResourceA, Rectangle, RectVisible, RealizePalette, Polyline, Pie, PatBlt, MoveToEx, LineTo, LineDDA, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetCurrentPositionEx, GetClipBox, GetBitmapBits, ExtFloodFill, ExcludeClipRect, EnumFontsA, Ellipse, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateFontIndirectA, CreateDIBitmap, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, Chord, BitBlt, Arc, AddFontResourceA
> kernel32.dll: DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle, lstrcmpA, WriteProfileStringA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, VirtualFree, VirtualAlloc, UnmapViewOfFile, TransactNamedPipe, TerminateThread, TerminateProcess, Sleep, SizeofResource, SetNamedPipeHandleState, SetLastError, SetFileTime, SetFilePointer, SetFileAttributesA, SetErrorMode, SetEndOfFile, SetCurrentDirectoryA, RemoveDirectoryA, ReleaseMutex, ReadFile, QueryPerformanceCounter, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileExA, MoveFileA, MapViewOfFile, LockResource, LocalFree, LocalFileTimeToFileTime, LoadResource, LoadLibraryExA, LoadLibraryA, IsDBCSLeadByte, IsBadWritePtr, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetWindowsDirectoryA, GetVersionExA, GetVersion, GetUserDefaultLangID, GetTickCount, GetSystemTimeAsFileTime, GetSystemInfo, GetSystemDirectoryA, GetSystemDefaultLCID, GetShortPathNameA, GetProfileStringA, GetProcAddress, GetPrivateProfileStringA, GetOverlappedResult, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetDriveTypeA, GetDiskFreeSpaceA, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetCurrentDirectoryA, GetComputerNameA, GetCommandLineA, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FlushFileBuffers, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, DeviceIoControl, DeleteFileA, CreateThread, CreateProcessA, CreateNamedPipeA, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CompareFileTime, CloseHandle
> mpr.dll: WNetOpenEnumA, WNetGetUniversalNameA, WNetGetConnectionA, WNetEnumResourceA, WNetCloseEnum
> ole32.dll: CoTaskMemFree, CLSIDFromProgID, CoCreateInstance, CoFreeUnusedLibraries, CoUninitialize, CoInitialize, IsEqualGUID, CoDisconnectObject
> oleaut32.dll: SafeArrayPutElement, SafeArrayCreate, VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen, GetActiveObject, RegisterTypeLib, LoadTypeLib, SysFreeString
> shell32.dll: ShellExecuteExA, ShellExecuteA, SHGetFileInfoA, ExtractIconA, SHChangeNotify, SHBrowseForFolder, SHGetPathFromIDList, SHGetMalloc
> user32.dll: MessageBoxA, WindowFromPoint, WinHelpA, WaitMessage, WaitForInputIdle, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowOwnedPopups, ShowCursor, SetWindowRgn, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollPos, SetScrollInfo, SetRectEmpty, SetRect, SetPropA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetCapture, SetActiveWindow, SendNotifyMessageA, SendMessageTimeoutA, SendMessageW, SendMessageA, ScrollWindowEx, ScrollWindow, ScreenToClient, ReplyMessage, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClassA, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharBuffA, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRgn, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetSystemMetrics, GetSystemMenu, GetSysColor, GetSubMenu, GetScrollPos, GetPropA, GetParent, GetWindow, GetMessagePos, GetMessageA, GetMenuStringA, GetMenuState, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassInfoW, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, ExitWindowsEx, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableMenuItem, DrawTextW, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreateWindowExA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcW, CallWindowProcA, CallNextHookEx, BringWindowToTop, BeginPaint, AppendMenuA, CharPrevA, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemBuffA, AdjustWindowRectEx
> version.dll: VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA

( 0 exports )
TrID  : File type identification
Windows OCX File (86.8%)
Win32 Executable Delphi generic (10.3%)
Generic Win/DOS Executable (1.4%)
DOS Executable Generic (1.4%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 12288:m0QfKb+GlrPj37VzHEA6Yd2qKvJ4wyyrNQIRZCGkK3ch/bcXExy4:+fKb+GlrPj37VzHEA6B3vDaCCGkJ/bcQ
sigcheck: publisher....: n/a
copyright....: n/a
product......: n/a
description..: Setup/Uninstall
original name: n/a
internal name: n/a
file version.: 51.51.0.0
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEiD  : -
RDS   : NSRL Reference Data Set
-

dbourgeo · Answer

Fichier c:\Windows\xgicode.ini


Antivirus  	Version  	Dernière mise à jour  	Résultat
a-squared	4.5.0.50	2010.04.23	-
AhnLab-V3	5.0.0.2	2010.04.23	-
AntiVir	8.2.1.220	2010.04.22	-
Antiy-AVL	2.0.3.7	2010.04.21	-
Authentium	5.2.0.5	2010.04.23	-
Avast	4.8.1351.0	2010.04.22	-
Avast5	5.0.332.0	2010.04.22	-
AVG	9.0.0.787	2010.04.22	-
BitDefender	7.2	2010.04.23	-
CAT-QuickHeal	10.00	2010.04.23	-
ClamAV	0.96.0.3-git	2010.04.23	-
Comodo	4669	2010.04.23	-
DrWeb	5.0.2.03300	2010.04.23	-
eSafe	7.0.17.0	2010.04.22	-
eTrust-Vet	35.2.7444	2010.04.22	-
F-Prot	4.5.1.85	2010.04.23	-
F-Secure	9.0.15370.0	2010.04.23	-
Fortinet	4.0.14.0	2010.04.21	-
GData	21	2010.04.23	-
Ikarus	T3.1.1.80.0	2010.04.23	-
Jiangmin	13.0.900	2010.04.23	-
Kaspersky	7.0.0.125	2010.04.23	-
McAfee	5.400.0.1158	2010.04.23	-
McAfee-GW-Edition	6.8.5	2010.04.22	-
Microsoft	1.5703	2010.04.23	-
NOD32	5051	2010.04.22	-
Norman	6.04.11	2010.04.22	-
nProtect	2010-04-22.01	2010.04.22	-
Panda	10.0.2.7	2010.04.22	-
PCTools	7.0.3.5	2010.04.23	-
Prevx	3.0	2010.04.23	-
Rising	22.44.04.03	2010.04.23	-
Sophos	4.53.0	2010.04.23	-
Sunbelt	6211	2010.04.23	-
Symantec	20091.2.0.41	2010.04.23	-
TheHacker	6.5.2.0.267	2010.04.22	-
TrendMicro	9.120.0.1004	2010.04.23	-
TrendMicro-HouseCall	9.120.0.1004	2010.04.23	-
VBA32	3.12.12.4	2010.04.22	-
ViRobot	2010.4.22.2290	2010.04.22	-
VirusBuster	5.0.27.0	2010.04.22	-
Information additionnelle
File size: 18 bytes
MD5...: 116d5fdaddbf211444542b4bda64c596
SHA1..: 2d803bb940860d0b68b0eb862e50ed646ca44310
SHA256: bbcfd7e34c166ce1a1e7302533540abc9f95f0480522bdf01b1e7398a577f83f
ssdeep: 3:SYgM:rgM
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Generic INI configuration (100.0%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

dbourgeo · Answer

Fichier C:\Windows\systeme32\drivers\ethsrmex.sys


Antivirus  	Version  	Dernière mise à jour  	Résultat
a-squared	4.5.0.50	2010.04.23	-
AhnLab-V3	5.0.0.2	2010.04.23	-
AntiVir	8.2.1.220	2010.04.22	TR/Rootkit.Gen
Antiy-AVL	2.0.3.7	2010.04.21	-
Authentium	5.2.0.5	2010.04.23	-
Avast	4.8.1351.0	2010.04.22	-
Avast5	5.0.332.0	2010.04.22	-
AVG	9.0.0.787	2010.04.22	-
BitDefender	7.2	2010.04.23	-
CAT-QuickHeal	10.00	2010.04.23	-
ClamAV	0.96.0.3-git	2010.04.23	-
Comodo	4669	2010.04.23	-
DrWeb	5.0.2.03300	2010.04.23	-
eSafe	7.0.17.0	2010.04.22	-
eTrust-Vet	35.2.7444	2010.04.22	-
F-Prot	4.5.1.85	2010.04.23	-
F-Secure	9.0.15370.0	2010.04.23	-
Fortinet	4.0.14.0	2010.04.21	-
GData	21	2010.04.23	-
Ikarus	T3.1.1.80.0	2010.04.23	-
Jiangmin	13.0.900	2010.04.23	-
Kaspersky	7.0.0.125	2010.04.23	-
McAfee	5.400.0.1158	2010.04.23	-
McAfee-GW-Edition	6.8.5	2010.04.22	Trojan.Rootkit.Gen
Microsoft	1.5703	2010.04.23	-
NOD32	5051	2010.04.22	-
Norman	6.04.11	2010.04.22	-
nProtect	2010-04-22.01	2010.04.22	-
Panda	10.0.2.7	2010.04.22	-
PCTools	7.0.3.5	2010.04.23	-
Prevx	3.0	2010.04.23	-
Rising	22.44.04.03	2010.04.23	-
Sophos	4.53.0	2010.04.23	-
Sunbelt	6211	2010.04.23	-
Symantec	20091.2.0.41	2010.04.23	-
TheHacker	6.5.2.0.267	2010.04.22	-
TrendMicro	9.120.0.1004	2010.04.23	-
TrendMicro-HouseCall	9.120.0.1004	2010.04.23	-
VBA32	3.12.12.4	2010.04.22	-
ViRobot	2010.4.22.2290	2010.04.22	-
VirusBuster	5.0.27.0	2010.04.22	-
Information additionnelle
File size: 140288 bytes
MD5...: 067ec9c052b80677e7858eb2df6942f6
SHA1..: e05b6a0a793696a0e39922c4bc779b5368ea6f8b
SHA256: 8e02e9298a6912e8f1d39076f0a95aca775f321662add9ae6422fe0789da8d3a
ssdeep: 1536:MypbS2JmPyIAWYD9brjv7cXCa91BrZth+qVOYzRl9Jb+unAvdpwHnDX2AyU
Sr7v4:lxakl9L4XN1BrV1VOYtlL7A1pAX2nV
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x4bc2dca1 (Mon Apr 12 08:41:05 2010)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x21250 0x21400 7.84 3d4a7c053d81e8b6b95591f1cf3d9ca6
.data 0x23000 0x80 0x200 1.10 1baac95186969199e246a4df21c9ef14
.rdata 0x24000 0x8 0x200 0.14 32c48ea3b649412e20ffec7c17c058f6
.edata 0x25000 0x4d 0x200 0.93 ebebd773361e7f113e27d909051a7bc4
.idata 0x26000 0x298 0x400 3.54 72a32f02f600eadfc8a5b0e6ea69ee52
.reloc 0x27000 0x74 0x200 1.73 eb299c51152a50c271b27545c9e84720

( 2 imports )
> ntoskrnl.exe: DbgPrint, ExAllocatePoolWithTag, ExFreePoolWithTag, IoGetCurrentProcess, KeBugCheckEx, KeQueryTimeIncrement, KeTickCount, MmMapLockedPagesSpecifyCache, ObReferenceObjectByHandle, ObfReferenceObject, RtlAnsiCharToUnicodeChar, ZwQuerySystemInformation, _except_handler3, strncpy, strstr, wcsncpy
> ntoskrnl.exe: ExAllocatePoolWithTag

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win16/32 Executable Delphi generic (33.9%)
Generic Win/DOS Executable (32.7%)
DOS Executable Generic (32.7%)
VXD Driver (0.5%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
Symantec Reputation Network: Suspicious.Insight https://www.broadcom.com/support/security-center

moment de grace · Answer

vu les trois premiers....

dbourgeo · Answer

Bon désolé je ne trouve pas les fichiers C:\Windows\Nhegea.exe et C:\Windows\systeme32\WinSys.exe
J'ai fait tout le fichier windows et rien.
je vais faire une recherche avec la fonction rechercher.

dbourgeo · Answer

Pour Nhgea.exe n(existe pas sur mon PC
Pour l'autre j'ai: WinSys.exe.vir            C:\Qoobox\Quarantine\WINDOWS\system32
ça se complique j'ai l'impression.
A+

moment de grace · Answer

non on va y arriver

juste pour être sûr

Télécharge SEAF ( de C__XX ) sur ton bureau : 

ici http://pagesperso-orange.fr/NosTools/C_XX/SEAF.exe 


* Double clique sur "SEAF.exe" ( clique droit et "Exécuter en tant qu'administrateur" pour Vista / 7 ) pour lancer l'outil. 

* Dans l'encardré blanc " Entrez ci dessous...." copie/colle ceci : 


Nhegea.exe               



* Au niveau des " options des fichiers ", fait les réglages suivant : 
> A "Calculer le checksum" , choisis : MD5 
> Coche la case devant " Info. supplémentaire ". 
> Coche la case devant " Afficher les ADS " 

* Au niveau des " options du registre " : 
> coche " chercher également dans le registre " 

( ne touche à aucun autre réglage ) 

* Clique sur " Lancer la recherche " et laisse travailler l'outil ... 
( cela peut-être plus ou moins long suivant les cas ). 

--> Une fois terminé, une fenêtre avec un log .txt va s'afficher. Enregistre ce rapport de façon à le retrouver facilement ( sur le bureau par exemple ). Sinon il sera en outre sauvegardé à la racine de ton disque dur ( ici > C:\SEAFLog.txt )

dbourgeo · Answer

Voila le résultat suite à l'analyse.

1. ========================= SEAF 1.0.0.7 - C_XX
2. 
3. Commencé à: 12:40:37 le 23/04/2010
4. 
5. Valeur(s) recherchée(s):
6. 
7. Nhegea.exe
8. 
9. (!) --- Calcul du Hash "MD5"
10. (!) --- Affichage des ADS
11. (!) --- Informations supplémentaires
12. (!) --- Recherche registre
13. 
14. ====== Fichier(s) (TC: Date de création, TM: Date de modification, DA, Dernier accès) ======
15. 
16. Aucun fichier trouvé
17. 
18. ====== Dossier(s) (TC: Date de création, TM: Date de modification, DA, Dernier accès) ======
19. 
20. Aucun dossier trouvé
21. 
22. 
23. ====== Entrée(s) du registre ======
24. 
25. 
26. 
27. [HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603]
28. "000"="Nhegea.exe"
29. 
30. [HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\Software\Microsoft\Search Assistant\ACMru\5603]
31. "000"="Nhegea.exe"
32. 
33. =========================
34. 
35. Fin à: 13:13:11 le 23/04/2010 ( E.O.F )

moment de grace · Answer

/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour dbourgeo, il n'est pas transposable sur un autre ordinateur ! 

crées un sur ton bureau un nouveau fichier bloc note que tu nommeras CFScrip
Copies y ce texte dedans et enregistres le

KillAll::

Rootkit::


C:\Windows\systeme32\drivers\ethsrmex.sys

Registry::

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603] 
"000"=-
[HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\Software\Microsoft\Search Assistant\ACMru\5603] 
"000"=-

SkipFix::



* Désactive tes logiciels de protection 
* Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe (comme le lien suivant) 
http://apu.mabul.org/up/apu/2008/09/06/img-2258535my8h.gif 
* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé. 
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu. 
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt

dbourgeo · Answer

Partie 1


ComboFix 10-04-21.01 - Dany 23/04/2010  15:56:04.5.2 - x86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.2047.1221 [GMT 2:00]
Lancé depuis: c:\documents and settings\Dany\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Dany\Bureau\CFScript.txt
AV: BitDefender Internet Security v10 *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: ESET Smart Security 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: BitDefender Internet Security v10 *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
FW: Pare-feu personnel d'ESET *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
- Mode FONCTIONNALITES REDUITES -
.

(((((((((((((((((((((((((((((   Fichiers créés du 2010-03-23 au 2010-04-23  ))))))))))))))))))))))))))))))))))))
.

2010-04-23 10:39 . 2010-04-23 11:13	--------	d-----w-	c:\program files\SEAF
2010-04-22 18:56 . 2010-04-23 06:05	--------	d-----w-	c:\program files\ZHPDiag
2010-04-22 16:36 . 2010-04-22 18:20	--------	d-----w-	C:\Kill'em
2010-04-22 16:35 . 2010-04-22 18:29	--------	d-----w-	c:\program files\List_Kill'em
2010-04-22 11:05 . 2010-04-23 06:15	--------	d-----w-	c:\program files	rend micro
2010-04-22 11:05 . 2010-04-22 11:05	--------	d-----w-	C:sit
2010-04-22 09:46 . 2010-04-22 09:46	--------	d-----w-	c:\program files\ESET
2010-04-21 11:07 . 2010-04-21 11:07	388096	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-19 16:12 . 2010-04-19 16:12	--------	d-----w-	c:\program files\TomTom International B.V
2010-04-18 09:39 . 2010-04-18 09:39	--------	d-----w-	c:\program files\Microsoft ActiveSync
2010-04-18 09:23 . 2010-04-18 09:23	--------	d-sh--w-	c:\documents and settings\Default User\IETldCache
2010-04-18 07:46 . 2010-04-18 07:46	--------	d-----w-	c:\program files\Microsoft.NET
2010-04-18 07:43 . 2010-04-18 07:43	--------	d-----w-	c:\windows\SHELLNEW
2010-04-18 07:42 . 2010-04-18 07:42	--------	d-----r-	C:\MSOCache
2010-04-17 21:46 . 2010-04-17 21:46	--------	d-----w-	c:\documents and settings\All Users\Application Data\Logishrd
2010-04-17 19:27 . 2010-04-17 19:27	--------	d-----w-	c:\windows\system32\wbem\Repository
2010-04-17 19:17 . 2010-04-17 21:47	53248	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-04-17 19:16 . 2010-04-17 19:16	--------	d-----w-	c:\documents and settings\Dany\Local Settings\Application Data\Logishrd
2010-04-17 19:10 . 2010-04-17 19:11	--------	d-----w-	c:\documents and settings\Dany\Application Data\Logishrd
2010-04-16 18:00 . 2010-04-16 18:00	--------	d-----w-	c:\program files\TrendMicro
2010-04-14 05:15 . 2010-04-14 05:53	--------	d-----w-	c:\program files\Trojan Killer
2010-04-13 12:26 . 2010-04-21 09:01	193872	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\lib7zip.dll
2010-04-13 12:26 . 2010-04-21 09:01	1000784	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\lgpl.dll
2010-04-13 06:36 . 2010-04-22 07:57	--------	d-----w-	C:\Ad-Remover
2010-04-12 23:11 . 2009-05-07 07:04	157712	----a-w-	c:\windows\system32\drivers	mcomm.sys
2010-04-12 11:57 . 2010-04-12 19:51	--------	d-----w-	c:\documents and settings\Dany\Local Settings\Application Data\Google
2010-04-12 10:37 . 2010-04-12 10:37	699904	----a-w-	c:\windows\is-5NVC6.exe
2010-04-12 08:59 . 2010-04-12 08:59	140288	----a-w-	c:\windows\system32\drivers\ethsrmex.sys
2010-04-07 19:08 . 2010-04-07 19:08	55232	----a-w-	c:\windows\system32\drivers\epfwtdi.sys
2010-04-07 19:08 . 2010-04-07 19:08	32584	----a-w-	c:\windows\system32\drivers\epfwndis.sys
2010-04-07 19:08 . 2010-04-07 19:08	134488	----a-w-	c:\windows\system32\drivers\epfw.sys
2010-04-07 19:07 . 2010-04-07 19:07	114984	----a-w-	c:\windows\system32\drivers\ehdrv.sys
2010-04-07 19:03 . 2010-04-07 19:03	139192	----a-w-	c:\windows\system32\drivers\eamon.sys
2010-04-03 17:23 . 2010-04-03 17:23	278120	----a-w-	c:\windows\system32
vmccs.dll
2010-04-03 17:23 . 2010-04-03 17:23	154216	----a-w-	c:\windows\system32
vsvc32.exe
2010-04-03 17:23 . 2010-04-03 17:23	145000	----a-w-	c:\windows\system32
vcolor.exe
2010-04-03 17:23 . 2010-04-03 17:23	13670504	----a-w-	c:\windows\system32
vcpl.dll
2010-04-03 17:23 . 2010-04-03 17:23	110696	----a-w-	c:\windows\system32
vmctray.dll
2010-04-03 17:22 . 2010-04-03 17:22	81920	----a-w-	c:\windows\system32
vwddi.dll
2010-04-02 14:30 . 2010-04-02 14:30	--------	d-----w-	c:\program files\DIFX
2010-04-02 14:30 . 2006-12-21 22:11	40576	------w-	c:\windows\system32\drivers\VCommUSB.sys
2010-04-02 09:29 . 2010-04-02 09:29	516480	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\EmailScannerAddin.dll
2010-04-02 09:29 . 2010-04-02 09:29	17632	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\WSCUpdate.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-23 10:31 . 2007-03-19 17:03	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-23 06:07 . 2010-02-02 19:51	--------	d-----w-	c:\program files\NVIDIA Corporation
2010-04-23 04:41 . 2009-03-07 14:21	--------	d-----w-	c:\documents and settings\Dany\Application Data\WeatherWatcher
2010-04-22 20:21 . 2010-02-20 21:16	--------	d-----w-	c:\documents and settings\Dany\Application Data\vlc
2010-04-22 18:49 . 2004-08-05 12:00	546120	----a-w-	c:\windows\system32\perfh00C.dat
2010-04-22 18:49 . 2004-08-05 12:00	99178	----a-w-	c:\windows\system32\perfc00C.dat
2010-04-22 12:02 . 2004-08-05 12:00	42112	----a-w-	c:\windows\system32\drivers\Imapi.sys
2010-04-22 08:54 . 2007-03-20 12:39	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-19 16:58 . 2007-03-19 16:56	58136	----a-w-	c:\documents and settings\Dany\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-19 16:43 . 2007-03-20 13:02	117248	----a-w-	c:\windows\system32\drivers\SSIDRV.sys
2010-04-19 16:39 . 2007-03-21 13:35	--------	d-----w-	c:\program files\TechniSat DVB
2010-04-19 16:39 . 2007-03-19 12:26	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-04-19 16:38 . 2007-03-19 16:12	--------	d-----w-	c:\program files\Smartione
2010-04-19 16:37 . 2009-09-26 15:12	--------	d-----w-	c:\program files\ProgFinder
2010-04-19 16:36 . 2009-08-12 11:06	--------	d-----w-	c:\program files\Panda Security
2010-04-19 16:34 . 2007-03-21 13:35	--------	d-----w-	c:\program files\DVBViewerTE
2010-04-19 16:22 . 2007-04-05 21:51	--------	d-----w-	c:\documents and settings\All Users\Application Data\Autodesk
2010-04-19 15:46 . 2009-09-19 17:52	4945232	----a-w-	c:\documents and settings\Dany\Application Data\TomTom\HOME\Profiles\w3c08jqu.default\extensions\Navcore.8.413.1237@tomtom.com\8-413-1237-1.dll
2010-04-17 21:47 . 2007-12-10 07:36	--------	d-----w-	c:\program files\Fichiers communs\Logishrd
2010-04-17 19:15 . 2007-03-19 14:55	--------	d-----w-	c:\program files\Logitech
2010-04-17 19:14 . 2007-03-19 14:55	--------	d-----w-	c:\program files\Fichiers communs\Logitech
2010-04-15 15:49 . 2009-02-08 07:42	--------	d-----w-	c:\program files\Google
2010-04-12 10:40 . 2008-10-01 13:10	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-04-12 10:37 . 2008-10-01 13:10	5918776	----a-w-	c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-12 07:29 . 2007-04-30 20:15	--------	d-----w-	c:\program files\BitTorrent_DNA
2010-04-12 05:34 . 2010-03-19 10:27	3757392	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\vcore.dll
2010-04-12 05:34 . 2010-03-19 10:27	259408	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extendedemediation.dll
2010-04-12 05:33 . 2010-03-19 10:27	226640	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libZip.dll
2010-04-12 05:33 . 2010-03-19 10:27	390480	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libVvs.dll
2010-04-12 05:33 . 2010-03-19 10:27	173392	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libtd.dll
2010-04-12 05:33 . 2010-03-19 10:27	296272	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libRar.dll
2010-04-12 05:33 . 2010-03-19 10:27	345424	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libOleA.dll
2010-04-12 05:33 . 2010-03-19 10:27	206160	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libNSIS.dll
2010-04-12 05:33 . 2010-03-19 10:27	177488	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libMsi.dll
2010-04-12 05:33 . 2010-03-19 10:27	283984	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libEmail.dll
2010-04-12 05:33 . 2010-03-19 10:27	206160	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libCHM.dll
2010-04-09 09:29 . 2010-03-19 10:27	966104	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-04-09 09:29 . 2010-03-19 10:27	1265264	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-04-08 10:10 . 2007-05-18 12:30	--------	d-----w-	c:\program files\FastStone Capture
2010-04-02 14:42 . 2008-06-18 10:05	335	-c--a-w-	c:\windows
sreg.dat
2010-03-29 22:46 . 2008-10-01 13:10	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 22:45 . 2008-10-01 13:10	20824	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-03-29 19:36 . 2007-03-20 12:36	--------	d-----w-	c:\program files\CCleaner
2010-03-20 16:00 . 2007-06-23 13:34	--------	d-----w-	c:\documents and settings\Dany\Application Data\Canon
2010-03-19 10:27 . 2010-03-19 10:27	95024	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\SBREDrv.sys
2010-03-10 06:16 . 2004-08-05 12:00	420352	----a-w-	c:\windows\system32\vbscript.dll
2010-03-08 13:51 . 2008-12-19 06:37	--------	d-----w-	c:\documents and settings\Dany\Application Data\dvdcss
2010-03-03 09:23 . 2007-03-19 15:54	--------	d-----w-	c:\program files\IZArc
2010-02-25 20:47 . 2007-03-19 16:26	--------	d-----w-	c:\documents and settings\Dany\Application Data\HARVEST S.A
2010-02-25 20:46 . 2010-02-25 20:46	--------	d-----w-	c:\program files\ClickImpots plus SCI 2010
2010-02-25 18:11 . 2007-05-04 20:42	--------	d-----w-	c:\program files\AM-DeadLink
2010-02-25 06:17 . 2004-08-05 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2004-08-05 12:00	455680	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 19:06 . 2004-08-05 12:00	2148352	----a-w-	c:\windows\system32
toskrnl.exe
2010-02-16 19:06 . 2004-08-04 00:49	2026496	----a-w-	c:\windows\system32
tkrnlpa.exe
2010-02-12 10:03 . 2010-02-24 22:13	293376	------w-	c:\windows\system32\browserchoice.exe
2010-02-12 04:34 . 2004-08-05 12:00	100864	----a-w-	c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-05 12:00	226880	----a-w-	c:\windows\system32\drivers	cpip6.sys
2010-02-04 15:53 . 2010-03-19 10:16	2954656	-c--a-w-	c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-02-04 15:53 . 2010-03-19 10:27	64288	----a-w-	c:\windows\system32\drivers\Lbd.sys
2010-02-01 09:45 . 2010-02-01 09:45	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe
2010-02-01 09:45 . 2010-02-01 09:45	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe
2010-02-01 09:44 . 2010-02-01 09:44	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe
2006-05-03 09:06 . 2009-10-09 15:07	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-10-09 15:07	31232	--sh--r-	c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-10-09 15:07	216064	--sh--r-	c:\windows\system32
bDX.dll
.

dbourgeo · Answer

Partie 2


(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"WeatherWatcher"="c:\program files\Weather Watcher\ww.exe" [2008-11-18 1081344]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-06-07 20480]
"RSRWin.exe"="c:\windows\RSRWin.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KBDriver"="c:\program files\Keyboard Driver\OEMDriver.exe" [2004-08-25 151552]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-03-06 488984]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-01-27 1312848]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-04-07 2145000]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-03 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-03 13670504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RSRWin.exe"="c:\windows\RSRWin.exe" [BU]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000D7}"= "c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABSEHB.DLL" [2006-11-07 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\!SABWinLogon]
2007-02-27 09:24	159744	----a-w-	c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LBTWlgn]
2010-01-29 21:17	64592	----a-w-	c:\program files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\acaptuser32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Acrobat.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Server4PC.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Dany^Menu Démarrer^Programmes^Démarrage^Logitech . Enregistrement du produit.lnk]
path=c:\documents and settings\Dany\Menu Démarrer\Programmes\Démarrage\Logitech . Enregistrement du produit.lnk
backup=c:\windows\pss\Logitech . Enregistrement du produit.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-03-29 22:46	437584	----a-w-	c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrintDisp]
2009-08-21 10:36	878080	----a-w-	c:\windows\system32\PrintDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 15:18	413696	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\eMule\emule.exe"=
"c:\Program Files\BitTorrent\bittorrent.exe"=
"c:\Program Files\Pando Networks\Pando\pando.exe"=
"c:\Program Files\Fichiers communs\Ahead\Nero Web\SetupX.exe"=
"c:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\VideoLAN\VLC\vlc.exe"=
"c:\Program Files\Kyodai Mahjongg\kmj.exe"=
"c:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Java\jre1.6.0_01\launch4j-tmp\JDownloader.exe"=
"c:\WINDOWS\system32\java.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\program files\Microsoft ActiveSyncapimgr.exe"= c:\program files\Microsoft ActiveSyncapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [19/03/2010 12:27 64288]
R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [26/03/2007 16:26 16896]
R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [26/03/2007 16:26 52224]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [07/04/2010 21:07 114984]
R1 SABDIFSV;SABDIFSV;c:\program files\SuperAdBlocker.com\Super Ad Blocker\sabdifsv.sys [21/09/2005 10:17 5632]
R1 SABKUTIL;SABKUTIL;c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.SYS [20/02/2007 15:02 32256]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [07/04/2010 21:07 810120]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [01/10/2008 15:10 303952]
R2 Printer Control;Printer Control;c:\windows\system32\PrintCtrl.exe [16/11/2009 14:52 77824]
R2 RegServ;RegServ;c:\windows\SRNTService.exe [12/11/2009 12:14 69632]
R2 TomTomHOMEService;TomTomHOMEService;f:	omtom home 2\TomTomHOMEService.exe [13/11/2009 13:31 92008]
R3 adatadrv;Autodata Protection Service;c:\windows\system32\drivers\adatadrv.sys [02/11/2009 10:32 762112]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [01/10/2008 15:10 20824]
S2 gupdate1c989c0d9b3d5dc;Google Update Service (gupdate1c989c0d9b3d5dc);c:\program files\Google\Update\GoogleUpdate.exe [08/02/2009 09:42 133104]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32egedt32.exe [05/08/2004 14:00 3584]
S2 tqavcdyu;Logitech AEC Helper;c:\windows\System32\svchost.exe -k netsvcs [05/08/2004 14:00 14336]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [04/02/2010 17:52 1265264]
S3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\drivers\MosIrUsb.sys [14/04/2004 14:52 20736]
S3 ParadigmVScanner;USB Scanner Still Image Device Service;c:\windows\system32\drivers\usbscan.sys [19/03/2007 17:32 15104]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14/10/2007 19:37 717296]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
tqavcdyu
.
Contenu du dossier 'Tâches planifiées'

2010-04-23 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 09:29]

2010-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 07:42]

2010-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 07:42]

2010-04-22 c:\windows\Tasks\User_Feed_Synchronization-{B4010896-F085-4E90-8706-E2D3865DFB9B}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = localhost
IE: Ajouter au fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
Trusted Zone: secuser.com\www
TCP: {9E9D081D-EAA5-4C2C-ABA7-6BA4EE5C7653} = 212.27.54.252,213.228.0.23
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {A364AF35-0CDF-41E8-8F3B-E0E55E15EBA1} - hxxp://www.programchecker.com/dll/nixon.cab
FF - ProfilePath - c:\documents and settings\Dany\Application Data\Mozilla\Firefox\Profiles\6ndeje8e.default\
FF - prefs.js: browser.startup.homepage - hxxp://fr.my.yahoo.com/
FF - plugin: c:\program files\Google\Google Earth\plugin
pgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23
pGoogleOneClick8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-nwiz - nwiz.exe
AddRemove-NVIDIA Display Control Panel - c:\program files\NVIDIA Corporation\Uninstall
vuninst.exe



**************************************************************************
Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A017AF56-B493-BA8F-B78A-ABAC1F958DAB}*]
"faigafmkfagb"=hex:6d,62,6e,67,67,6a,6f,63,66,6b,62,6b,67,6a,6f,6d,6d,62,61,6b,
   64,65,65,69,6a,69,6b,6b,63,6f,63,6a,6f,6a,66,6d,68,62,6e,70,68,68,65,66,64,\
"gajeimeomgllde"=hex:63,61,6b,66,66,68,00,00
"gaiennfajdkfje"=hex:63,61,6b,66,66,68,00,00

[HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:c9,8a,a1,d3,ea,6c,33,6c,1a,e7,0d,94,b3,e1,f4,f7,96,79,6f,5e,d5,25,6e,
   08,a3,e8,1e,f3,1a,70,7e,89,36,32,94,d1,a6,5a,6b,3e,40,01,54,44,f7,21,de,8b,\
"??"=hex:6b,17,e5,79,7b,28,33,4c,05,ba,2a,9e,a9,42,7d,26

[HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info]
@Denied: (2) (LocalSystem)
"AppDataDir"="c:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\"
"DataDir"="ESET\ESET Smart Security\"
"EditionName"=" "
"InstallDir"="c:\Program Files\ESET\ESET Smart Security\"
"LanguageId"=dword:0000040c
"PackageTag"=dword:6090e758
"ProductBase"=dword:00000001
"ProductCode"="{B91B907B-3542-4DDB-84FA-55EDE3F13969}"
"ProductName"="ESET Smart Security"
"ProductType"="ess"
"ProductVersion"="4.2.40.10"
"UniqueId"="0007876D4BD01B15"
"ScannerBuild"=dword:00001aeb
"ScannerVersionId"=dword:00001390
"ScannerVersion"="Open window for status."

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODI04.00.00.01PRO"="9D8A793893C67688BABF2127E6827D4EDA27D0B11FE83A54D5B0D036F379505986151D5064A59CBDED6A2809C6A9A2B32649710525FAD4FDAAF876CF66BE1FBE69B863305159C752A70E9D905181A2C6BAA61FF21A7210CD84CF997A8EA3CA554F74747F000E9024F0AE12363A1108833BEF6AE6E052890245AD6FB21AC02A417AA7CBEA8A9820D3FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407C038D530D6EB3452BA7FD869164D67945902353A9A01F6341CC2B6562780CCDEFA4EC48EE171B24A9828A0D10040AB7F217F0D4C04C8847EE2F78CC3B75F30A22FF2687BF86AF80E8E7E07AE568C832C493B1511FCE11C3838687F68F248D965E9703A3525380C85188F5A6542B37FCBEB03FD9CEA3E891B924E820A2A64EBE1200992D0C3DE040A46C8F77C4F31CCFA578D4907A7EF2EA19D465F71A4839C9379621FE8A8038B3B5EF712FD7D252C988FF1CD6BFEB2800DB852306A1B15373D5408DF1A1BF1627A5A522DF9BFD2F147492CB7E9B2E008E17857E445BC301962BF682987D5985AEDE7ED2503002385EE6F9E04A6F77DE3E6A39F41582A8F35CD01D5A5D4078BDD8067C5252E992063B9210C0748F6ACC3A936575EFA7A8F118C8F85D0AD5281E45FEEBA31965BFB9C97311D667B4D37EDF85E12260A3833486E1992FABECFD380FB490F1EDC8A88D3BAA4DE9D6E8B09BBE901C2D9665F9F080A7E7CC9B90903538E72EA15205FBFC39BB6C07B56B7B41A5436448CF3E39F123752A336D47E3194909DD8950B853C36F45718216ACAEE895447D2261D2BA03D14DED08C48A12590BE2E496F449C3D0DC5279C87E5301021CAB591E24C8FB47401A0ACEC535A4A259DBE8EC97E39A83C51FDEA7808CA1688DAB38451F35E11B5A346454E36032F46F09CE19E6963054C9DE40313956E9F7D6C2A9457085A9093E5B60FF6B7EB07FBC4C9DBB93C967ED8F79B4AC8D564F251ADB3112A023830B27309DE0521D6285F667BFDBF33C2E4126D9589E2146AF8E90C202A56DB2492CFBE8AEEE8C0FB0FA2E71BABA38A4C2CBC5277EAF920B03F3F3E73753D1A3AFC377BBBDEE6668458071FC6AA31060C6C31BE1C81FDCEDB75E0BAE26C123E8ED9CBA4CF3099E9914964274FA8856D4D62DB8B12BE31F40771EDBDDDEBDAD125B6837530496BA3B546265E3AB2138A4FEBBCD81DFD2BF03D2B1B480036746378C6E9707A749E71F55C4B66423E9DAB470E670BB17AD4A17FC0B41E9F708F8076DD9BD97DE0C73550B8E7A35322C1A2DCF105C6FC53EE6AC4F0164743242FC082F6CBBBBF21CF5532AFA1438F18EAC7ACE0D17ADA8E0BB2F3A3AF8FA53E2AB971B04163F62A72B9FD38B4B14DC1DBF545CC1E515F9411E6EADF8888"

[HKEY_LOCAL_MACHINE\software\swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1060)
c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll

- - - - - - - > 'explorer.exe'(3744)
c:\docume~1\Dany\LOCALS~1\Temp\IadHide4.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32
vsvc32.exe
c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\IoctlSvc.exe
e:\xp\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MICROS~2apimgr.exe
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\SearchIndexer.exe
c:\program files\Fichiers communs\LogiShrd\KHAL3\KHALMNPR.EXE
c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Heure de fin: 2010-04-23  16:06:06 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-04-23 14:06
ComboFix2.txt  2010-04-23 04:41
ComboFix3.txt  2010-04-22 20:02

Avant-CF: 27 260 346 368 octets libres
Après-CF: 27 334 242 304 octets libres

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - D3BC97CA680B206083C7AF3B4E9915A2

moment de grace · Answer

la manip semble avoir échoué

de plus ce combo n'est plus à jour

supprimes et retélécharges le

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

dbourgeo · Answer

Partie 1 nouveau combofix


ComboFix 10-04-21.01 - Dany 23/04/2010  17:31:14.6.2 - x86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.2047.1226 [GMT 2:00]
Lancé depuis: c:\documents and settings\Dany\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Dany\Bureau\CFScript.txt
AV: BitDefender Internet Security v10 *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: ESET Smart Security 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: BitDefender Internet Security v10 *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
FW: Pare-feu personnel d'ESET *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
- Mode FONCTIONNALITES REDUITES -
.

(((((((((((((((((((((((((((((   Fichiers créés du 2010-03-23 au 2010-04-23  ))))))))))))))))))))))))))))))))))))
.

2010-04-23 10:39 . 2010-04-23 11:13	--------	d-----w-	c:\program files\SEAF
2010-04-22 18:56 . 2010-04-23 06:05	--------	d-----w-	c:\program files\ZHPDiag
2010-04-22 16:36 . 2010-04-22 18:20	--------	d-----w-	C:\Kill'em
2010-04-22 16:35 . 2010-04-22 18:29	--------	d-----w-	c:\program files\List_Kill'em
2010-04-22 11:05 . 2010-04-23 06:15	--------	d-----w-	c:\program files	rend micro
2010-04-22 11:05 . 2010-04-22 11:05	--------	d-----w-	C:sit
2010-04-22 09:46 . 2010-04-22 09:46	--------	d-----w-	c:\program files\ESET
2010-04-19 16:12 . 2010-04-19 16:12	--------	d-----w-	c:\program files\TomTom International B.V
2010-04-18 09:39 . 2010-04-18 09:39	--------	d-----w-	c:\program files\Microsoft ActiveSync
2010-04-18 09:23 . 2010-04-18 09:23	--------	d-sh--w-	c:\documents and settings\Default User\IETldCache
2010-04-18 07:46 . 2010-04-18 07:46	--------	d-----w-	c:\program files\Microsoft.NET
2010-04-18 07:43 . 2010-04-18 07:43	--------	d-----w-	c:\windows\SHELLNEW
2010-04-18 07:42 . 2010-04-18 07:42	--------	d-----r-	C:\MSOCache
2010-04-17 21:46 . 2010-04-17 21:46	--------	d-----w-	c:\documents and settings\All Users\Application Data\Logishrd
2010-04-17 19:27 . 2010-04-17 19:27	--------	d-----w-	c:\windows\system32\wbem\Repository
2010-04-17 19:16 . 2010-04-17 19:16	--------	d-----w-	c:\documents and settings\Dany\Local Settings\Application Data\Logishrd
2010-04-17 19:10 . 2010-04-17 19:11	--------	d-----w-	c:\documents and settings\Dany\Application Data\Logishrd
2010-04-16 18:00 . 2010-04-16 18:00	--------	d-----w-	c:\program files\TrendMicro
2010-04-14 05:15 . 2010-04-14 05:53	--------	d-----w-	c:\program files\Trojan Killer
2010-04-13 06:36 . 2010-04-22 07:57	--------	d-----w-	C:\Ad-Remover
2010-04-12 23:11 . 2009-05-07 07:04	157712	----a-w-	c:\windows\system32\drivers	mcomm.sys
2010-04-12 11:57 . 2010-04-12 19:51	--------	d-----w-	c:\documents and settings\Dany\Local Settings\Application Data\Google
2010-04-12 10:37 . 2010-04-12 10:37	699904	----a-w-	c:\windows\is-5NVC6.exe
2010-04-12 08:59 . 2010-04-12 08:59	140288	----a-w-	c:\windows\system32\drivers\ethsrmex.sys
2010-04-07 19:08 . 2010-04-07 19:08	55232	----a-w-	c:\windows\system32\drivers\epfwtdi.sys
2010-04-07 19:08 . 2010-04-07 19:08	32584	----a-w-	c:\windows\system32\drivers\epfwndis.sys
2010-04-07 19:08 . 2010-04-07 19:08	134488	----a-w-	c:\windows\system32\drivers\epfw.sys
2010-04-07 19:07 . 2010-04-07 19:07	114984	----a-w-	c:\windows\system32\drivers\ehdrv.sys
2010-04-07 19:03 . 2010-04-07 19:03	139192	----a-w-	c:\windows\system32\drivers\eamon.sys
2010-04-03 17:23 . 2010-04-03 17:23	278120	----a-w-	c:\windows\system32
vmccs.dll
2010-04-03 17:23 . 2010-04-03 17:23	154216	----a-w-	c:\windows\system32
vsvc32.exe
2010-04-03 17:23 . 2010-04-03 17:23	145000	----a-w-	c:\windows\system32
vcolor.exe
2010-04-03 17:23 . 2010-04-03 17:23	13670504	----a-w-	c:\windows\system32
vcpl.dll
2010-04-03 17:23 . 2010-04-03 17:23	110696	----a-w-	c:\windows\system32
vmctray.dll
2010-04-03 17:22 . 2010-04-03 17:22	81920	----a-w-	c:\windows\system32
vwddi.dll
2010-04-02 14:30 . 2010-04-02 14:30	--------	d-----w-	c:\program files\DIFX
2010-04-02 14:30 . 2006-12-21 22:11	40576	------w-	c:\windows\system32\drivers\VCommUSB.sys

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-23 14:05 . 2009-03-07 14:21	--------	d-----w-	c:\documents and settings\Dany\Application Data\WeatherWatcher
2010-04-23 10:31 . 2007-03-19 17:03	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-23 06:07 . 2010-02-02 19:51	--------	d-----w-	c:\program files\NVIDIA Corporation
2010-04-22 20:21 . 2010-02-20 21:16	--------	d-----w-	c:\documents and settings\Dany\Application Data\vlc
2010-04-22 18:49 . 2004-08-05 12:00	546120	----a-w-	c:\windows\system32\perfh00C.dat
2010-04-22 18:49 . 2004-08-05 12:00	99178	----a-w-	c:\windows\system32\perfc00C.dat
2010-04-22 12:02 . 2004-08-05 12:00	42112	----a-w-	c:\windows\system32\drivers\Imapi.sys
2010-04-22 08:54 . 2007-03-20 12:39	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-21 11:07 . 2010-04-21 11:07	388096	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-21 09:01 . 2010-04-13 12:26	193872	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\lib7zip.dll
2010-04-21 09:01 . 2010-04-13 12:26	1000784	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\lgpl.dll
2010-04-19 16:58 . 2007-03-19 16:56	58136	----a-w-	c:\documents and settings\Dany\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-19 16:43 . 2007-03-20 13:02	117248	----a-w-	c:\windows\system32\drivers\SSIDRV.sys
2010-04-19 16:39 . 2007-03-21 13:35	--------	d-----w-	c:\program files\TechniSat DVB
2010-04-19 16:39 . 2007-03-19 12:26	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-04-19 16:38 . 2007-03-19 16:12	--------	d-----w-	c:\program files\Smartione
2010-04-19 16:37 . 2009-09-26 15:12	--------	d-----w-	c:\program files\ProgFinder
2010-04-19 16:36 . 2009-08-12 11:06	--------	d-----w-	c:\program files\Panda Security
2010-04-19 16:34 . 2007-03-21 13:35	--------	d-----w-	c:\program files\DVBViewerTE
2010-04-19 16:22 . 2007-04-05 21:51	--------	d-----w-	c:\documents and settings\All Users\Application Data\Autodesk
2010-04-19 15:46 . 2009-09-19 17:52	4945232	----a-w-	c:\documents and settings\Dany\Application Data\TomTom\HOME\Profiles\w3c08jqu.default\extensions\Navcore.8.413.1237@tomtom.com\8-413-1237-1.dll
2010-04-17 21:47 . 2010-04-17 19:17	53248	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-04-17 21:47 . 2007-12-10 07:36	--------	d-----w-	c:\program files\Fichiers communs\Logishrd
2010-04-17 19:15 . 2007-03-19 14:55	--------	d-----w-	c:\program files\Logitech
2010-04-17 19:14 . 2007-03-19 14:55	--------	d-----w-	c:\program files\Fichiers communs\Logitech
2010-04-15 15:49 . 2009-02-08 07:42	--------	d-----w-	c:\program files\Google
2010-04-12 10:40 . 2008-10-01 13:10	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-04-12 10:37 . 2008-10-01 13:10	5918776	----a-w-	c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-12 07:29 . 2007-04-30 20:15	--------	d-----w-	c:\program files\BitTorrent_DNA
2010-04-12 05:34 . 2010-03-19 10:27	3757392	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\vcore.dll
2010-04-12 05:34 . 2010-03-19 10:27	259408	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extendedemediation.dll
2010-04-12 05:33 . 2010-03-19 10:27	226640	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libZip.dll
2010-04-12 05:33 . 2010-03-19 10:27	390480	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libVvs.dll
2010-04-12 05:33 . 2010-03-19 10:27	173392	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libtd.dll
2010-04-12 05:33 . 2010-03-19 10:27	296272	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libRar.dll
2010-04-12 05:33 . 2010-03-19 10:27	345424	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libOleA.dll
2010-04-12 05:33 . 2010-03-19 10:27	206160	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libNSIS.dll
2010-04-12 05:33 . 2010-03-19 10:27	177488	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libMsi.dll
2010-04-12 05:33 . 2010-03-19 10:27	283984	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libEmail.dll
2010-04-12 05:33 . 2010-03-19 10:27	206160	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libCHM.dll
2010-04-09 09:29 . 2010-03-19 10:27	966104	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-04-09 09:29 . 2010-03-19 10:27	1265264	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-04-08 10:10 . 2007-05-18 12:30	--------	d-----w-	c:\program files\FastStone Capture
2010-04-02 14:42 . 2008-06-18 10:05	335	-c--a-w-	c:\windows
sreg.dat
2010-03-29 22:46 . 2008-10-01 13:10	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 22:45 . 2008-10-01 13:10	20824	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-03-29 19:36 . 2007-03-20 12:36	--------	d-----w-	c:\program files\CCleaner
2010-03-20 16:00 . 2007-06-23 13:34	--------	d-----w-	c:\documents and settings\Dany\Application Data\Canon
2010-03-19 10:27 . 2010-03-19 10:27	95024	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\SBREDrv.sys
2010-03-10 06:16 . 2004-08-05 12:00	420352	----a-w-	c:\windows\system32\vbscript.dll
2010-03-08 13:51 . 2008-12-19 06:37	--------	d-----w-	c:\documents and settings\Dany\Application Data\dvdcss
2010-03-03 09:23 . 2007-03-19 15:54	--------	d-----w-	c:\program files\IZArc
2010-02-25 20:47 . 2007-03-19 16:26	--------	d-----w-	c:\documents and settings\Dany\Application Data\HARVEST S.A
2010-02-25 20:46 . 2010-02-25 20:46	--------	d-----w-	c:\program files\ClickImpots plus SCI 2010
2010-02-25 18:11 . 2007-05-04 20:42	--------	d-----w-	c:\program files\AM-DeadLink
2010-02-25 06:17 . 2004-08-05 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2004-08-05 12:00	455680	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 19:06 . 2004-08-05 12:00	2148352	----a-w-	c:\windows\system32
toskrnl.exe
2010-02-16 19:06 . 2004-08-04 00:49	2026496	----a-w-	c:\windows\system32
tkrnlpa.exe
2010-02-12 10:03 . 2010-02-24 22:13	293376	------w-	c:\windows\system32\browserchoice.exe
2010-02-12 04:34 . 2004-08-05 12:00	100864	----a-w-	c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-05 12:00	226880	----a-w-	c:\windows\system32\drivers	cpip6.sys
2010-02-04 15:53 . 2010-03-19 10:16	2954656	-c--a-w-	c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-02-04 15:53 . 2010-03-19 10:27	64288	----a-w-	c:\windows\system32\drivers\Lbd.sys
2010-02-01 09:45 . 2010-02-01 09:45	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe
2010-02-01 09:45 . 2010-02-01 09:45	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe
2010-02-01 09:44 . 2010-02-01 09:44	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe
2006-05-03 09:06 . 2009-10-09 15:07	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-10-09 15:07	31232	--sh--r-	c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-10-09 15:07	216064	--sh--r-	c:\windows\system32
bDX.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"WeatherWatcher"="c:\program files\Weather Watcher\ww.exe" [2008-11-18 1081344]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-06-07 20480]
"RSRWin.exe"="c:\windows\RSRWin.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KBDriver"="c:\program files\Keyboard Driver\OEMDriver.exe" [2004-08-25 151552]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-03-06 488984]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-01-27 1312848]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-04-07 2145000]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-03 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-03 13670504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RSRWin.exe"="c:\windows\RSRWin.exe" [BU]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000D7}"= "c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABSEHB.DLL" [2006-11-07 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\!SABWinLogon]
2007-02-27 09:24	159744	----a-w-	c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LBTWlgn]
2010-01-29 21:17	64592	----a-w-	c:\program files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\acaptuser32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Acrobat.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Server4PC.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Dany^Menu Démarrer^Programmes^Démarrage^Logitech . Enregistrement du produit.lnk]
path=c:\documents and settings\Dany\Menu Démarrer\Programmes\Démarrage\Logitech . Enregistrement du produit.lnk
backup=c:\windows\pss\Logitech . Enregistrement du produit.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-03-29 22:46	437584	----a-w-	c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrintDisp]
2009-08-21 10:36	878080	----a-w-	c:\windows\system32\PrintDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 15:18	413696	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\eMule\emule.exe"=
"c:\Program Files\BitTorrent\bittorrent.exe"=
"c:\Program Files\Pando Networks\Pando\pando.exe"=
"c:\Program Files\Fichiers communs\Ahead\Nero Web\SetupX.exe"=
"c:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\VideoLAN\VLC\vlc.exe"=
"c:\Program Files\Kyodai Mahjongg\kmj.exe"=
"c:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Java\jre1.6.0_01\launch4j-tmp\JDownloader.exe"=
"c:\WINDOWS\system32\java.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\program files\Microsoft ActiveSyncapimgr.exe"= c:\program files\Microsoft ActiveSyncapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [19/03/2010 12:27 64288]
R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [26/03/2007 16:26 16896]
R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [26/03/2007 16:26 52224]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [07/04/2010 21:07 114984]
R1 SABDIFSV;SABDIFSV;c:\program files\SuperAdBlocker.com\Super Ad Blocker\sabdifsv.sys [21/09/2005 10:17 5632]
R1 SABKUTIL;SABKUTIL;c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.SYS [20/02/2007 15:02 32256]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [07/04/2010 21:07 810120]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [01/10/2008 15:10 303952]
R2 Printer Control;Printer Control;c:\windows\system32\PrintCtrl.exe [16/11/2009 14:52 77824]
R2 RegServ;RegServ;c:\windows\SRNTService.exe [12/11/2009 12:14 69632]
R2 TomTomHOMEService;TomTomHOMEService;f:	omtom home 2\TomTomHOMEService.exe [13/11/2009 13:31 92008]
R3 adatadrv;Autodata Protection Service;c:\windows\system32\drivers\adatadrv.sys [02/11/2009 10:32 762112]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [01/10/2008 15:10 20824]
S2 gupdate1c989c0d9b3d5dc;Google Update Service (gupdate1c989c0d9b3d5dc);c:\program files\Google\Update\GoogleUpdate.exe [08/02/2009 09:42 133104]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32egedt32.exe [05/08/2004 14:00 3584]
S2 tqavcdyu;Logitech AEC Helper;c:\windows\System32\svchost.exe -k netsvcs [05/08/2004 14:00 14336]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [04/02/2010 17:52 1265264]
S3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\drivers\MosIrUsb.sys [14/04/2004 14:52 20736]
S3 ParadigmVScanner;USB Scanner Still Image Device Service;c:\windows\system32\drivers\usbscan.sys [19/03/2007 17:32 15104]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14/10/2007 19:37 717296]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
tqavcdyu
.
Contenu du dossier 'Tâches planifiées'

2010-04-23 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 09:29]

2010-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 07:42]

2010-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 07:42]

2010-04-22 c:\windows\Tasks\User_Feed_Synchronization-{B4010896-F085-4E90-8706-E2D3865DFB9B}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.

dbourgeo · Answer

Partie 2 nouveau combofix



------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = localhost
IE: Ajouter au fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
Trusted Zone: secuser.com\www
TCP: {9E9D081D-EAA5-4C2C-ABA7-6BA4EE5C7653} = 212.27.54.252,213.228.0.23
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {A364AF35-0CDF-41E8-8F3B-E0E55E15EBA1} - hxxp://www.programchecker.com/dll/nixon.cab
FF - ProfilePath - c:\documents and settings\Dany\Application Data\Mozilla\Firefox\Profiles\6ndeje8e.default\
FF - prefs.js: browser.startup.homepage - hxxp://fr.my.yahoo.com/
FF - plugin: c:\program files\Google\Google Earth\plugin
pgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23
pGoogleOneClick8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-23 17:38
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A017AF56-B493-BA8F-B78A-ABAC1F958DAB}*]
"faigafmkfagb"=hex:6d,62,6e,67,67,6a,6f,63,66,6b,62,6b,67,6a,6f,6d,6d,62,61,6b,
   64,65,65,69,6a,69,6b,6b,63,6f,63,6a,6f,6a,66,6d,68,62,6e,70,68,68,65,66,64,\
"gajeimeomgllde"=hex:63,61,6b,66,66,68,00,00
"gaiennfajdkfje"=hex:63,61,6b,66,66,68,00,00

[HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:c9,8a,a1,d3,ea,6c,33,6c,1a,e7,0d,94,b3,e1,f4,f7,96,79,6f,5e,d5,25,6e,
   08,a3,e8,1e,f3,1a,70,7e,89,36,32,94,d1,a6,5a,6b,3e,40,01,54,44,f7,21,de,8b,\
"??"=hex:6b,17,e5,79,7b,28,33,4c,05,ba,2a,9e,a9,42,7d,26

[HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info]
@Denied: (2) (LocalSystem)
"AppDataDir"="c:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\"
"DataDir"="ESET\ESET Smart Security\"
"EditionName"=" "
"InstallDir"="c:\Program Files\ESET\ESET Smart Security\"
"LanguageId"=dword:0000040c
"PackageTag"=dword:6090e758
"ProductBase"=dword:00000001
"ProductCode"="{B91B907B-3542-4DDB-84FA-55EDE3F13969}"
"ProductName"="ESET Smart Security"
"ProductType"="ess"
"ProductVersion"="4.2.40.10"
"UniqueId"="0007876D4BD01B15"
"ScannerBuild"=dword:00001aeb
"ScannerVersionId"=dword:00001390
"ScannerVersion"="Open window for status."

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODI04.00.00.01PRO"="9D8A793893C67688BABF2127E6827D4EDA27D0B11FE83A54D5B0D036F379505986151D5064A59CBDED6A2809C6A9A2B32649710525FAD4FDAAF876CF66BE1FBE69B863305159C752A70E9D905181A2C6BAA61FF21A7210CD84CF997A8EA3CA554F74747F000E9024F0AE12363A1108833BEF6AE6E052890245AD6FB21AC02A417AA7CBEA8A9820D3FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407C038D530D6EB3452BA7FD869164D67945902353A9A01F6341CC2B6562780CCDEFA4EC48EE171B24A9828A0D10040AB7F217F0D4C04C8847EE2F78CC3B75F30A22FF2687BF86AF80E8E7E07AE568C832C493B1511FCE11C3838687F68F248D965E9703A3525380C85188F5A6542B37FCBEB03FD9CEA3E891B924E820A2A64EBE1200992D0C3DE040A46C8F77C4F31CCFA578D4907A7EF2EA19D465F71A4839C9379621FE8A8038B3B5EF712FD7D252C988FF1CD6BFEB2800DB852306A1B15373D5408DF1A1BF1627A5A522DF9BFD2F147492CB7E9B2E008E17857E445BC301962BF682987D5985AEDE7ED2503002385EE6F9E04A6F77DE3E6A39F41582A8F35CD01D5A5D4078BDD8067C5252E992063B9210C0748F6ACC3A936575EFA7A8F118C8F85D0AD5281E45FEEBA31965BFB9C97311D667B4D37EDF85E12260A3833486E1992FABECFD380FB490F1EDC8A88D3BAA4DE9D6E8B09BBE901C2D9665F9F080A7E7CC9B90903538E72EA15205FBFC39BB6C07B56B7B41A5436448CF3E39F123752A336D47E3194909DD8950B853C36F45718216ACAEE895447D2261D2BA03D14DED08C48A12590BE2E496F449C3D0DC5279C87E5301021CAB591E24C8FB47401A0ACEC535A4A259DBE8EC97E39A83C51FDEA7808CA1688DAB38451F35E11B5A346454E36032F46F09CE19E6963054C9DE40313956E9F7D6C2A9457085A9093E5B60FF6B7EB07FBC4C9DBB93C967ED8F79B4AC8D564F251ADB3112A023830B27309DE0521D6285F667BFDBF33C2E4126D9589E2146AF8E90C202A56DB2492CFBE8AEEE8C0FB0FA2E71BABA38A4C2CBC5277EAF920B03F3F3E73753D1A3AFC377BBBDEE6668458071FC6AA31060C6C31BE1C81FDCEDB75E0BAE26C123E8ED9CBA4CF3099E9914964274FA8856D4D62DB8B12BE31F40771EDBDDDEBDAD125B6837530496BA3B546265E3AB2138A4FEBBCD81DFD2BF03D2B1B480036746378C6E9707A749E71F55C4B66423E9DAB470E670BB17AD4A17FC0B41E9F708F8076DD9BD97DE0C73550B8E7A35322C1A2DCF105C6FC53EE6AC4F0164743242FC082F6CBBBBF21CF5532AFA1438F18EAC7ACE0D17ADA8E0BB2F3A3AF8FA53E2AB971B04163F62A72B9FD38B4B14DC1DBF545CC1E515F9411E6EADF8888"

[HKEY_LOCAL_MACHINE\software\swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1060)
c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll

- - - - - - - > 'explorer.exe'(2028)
c:\docume~1\Dany\LOCALS~1\Temp\IadHide4.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32
vsvc32.exe
c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\IoctlSvc.exe
e:\xp\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MICROS~2apimgr.exe
c:\program files\Fichiers communs\LogiShrd\KHAL3\KHALMNPR.EXE
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\SearchIndexer.exe
c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
c:\windows\system32\SearchProtocolHost.exe
.
**************************************************************************
.
Heure de fin: 2010-04-23  17:43:01 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-04-23 15:42
ComboFix2.txt  2010-04-23 14:06
ComboFix3.txt  2010-04-23 04:41
ComboFix4.txt  2010-04-22 20:02

Avant-CF: 27 334 238 208 octets libres
Après-CF: 27 285 172 224 octets libres

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 139A458564F1DC6A7DBB7939620CF1CA

moment de grace · Answer

ok 

comment va le pc 

toujours ton message d'erreur au debut ? 

Je cherche beaucoup...et maintenant je trouve !  
(sourire)

dbourgeo · Answer

Oui j'ai toujours le message au démarrage de windows mais ce n'est pas grave et mon PC tourne super bien. Donc ce n'est pas gênant.
Je tiens vraiment à te remercier car tu as passé un temps fou pour m'aider c'est trés sympa de ta part.
Bonsoir
Cordialement Daniel.

moment de grace · Answer

as tu le cd de windows pour faire une réparation ?

dbourgeo · Answer

Oui j'ai le CD de windows mais je ne sais pas comment faire la manip mais tu sais cela ne me gêne pas du tout ce message et tout a l'air de fonctionner. Je n'ai vraiment pas de soucis et toutes mes attaques sont finies.
Tu penses qu'il y a un risque de rester comme ça ?
Daniel

moment de grace · Answer

disons que c'est pas propre...

petite réparation

    *  Cliquez sur le menu Démarrer
    * Sélectionnez Exécuter
    * Tapez SFC /scannow puis cliquez sur OK (bien mettre un espace entre SFC et /scannow).

dbourgeo · Answer

Bonjour moment de grace,
Je viens d'essayer la manipulation de dessus et ça démarre bien mais ensuite cela me met d'insérer le CD de windows , ce que je fais et là il me dit que ce n'est pas le bon disque de windows et il faut ignorer le fichier et ainsi de suite.
Pourtant c'est l(original et c'est avec que j'ai fait l'installation, à ne rien comprendre.
il Y a vraiment du mal, je ne sais pas ce que j'ai chopé mais c'est de la folie.
Daniel

Utilisateur anonyme · Answer

Stylé ton titre xD

moment de grace · Answer

1) 

booter au demarrage dessus 

2) 

ne pas suivre la proposition de réparation au depart mais installer une nouvelle version 

3) 
en temps normal, il voit l'exploitation installée et propose de réinstaller à cet emplacement ou de réparer 
=> suivre réparer, il va repasser sur le windows précédent en modifiant ou complétant s'il y a lieu sans effacer tes données et logiciels en place

dbourgeo · Answer

Par contre je boot au démarrage entre Xp et vista et j'ai peur de perdre ce boot en faisant cette réparation.
Qu'en penses-tu ?
Par contre je suis obligé de m'absenter jusqu'à  16 heures cet après-midi.
J'attaquerai ce soir.
A plus tard et encore merci.
Daniel.

dbourgeo · Answer

Bonjour moment de grace,
Excuse-moi, mais je n'ai pu que revenir ce matin.
Pour en revenir à mon PC je me sers essentiellement de XP et j'ai bien le CD mais au démarrage j'ai un boot avec vista installé sur le même disque dur.
Par contre je n'ai pas de cd vista car je l'avais installé au tout début car ma soeur qui est à 500 km de moi a acheté un PC portable avec vista et donc je m'en sers pour lui expliquer des trucs pour faire marcher ou la dépanner . J'essaye comme toi mais à petite échelle.
Voila pour mon installation. C'est pour çà que je ne veux pas trop y toucher maintenant car j'ai peur d'avoir des problèmes.
Daniel.

moment de grace · Answer

bonjour

en effet ca pourrait expliquer l'erreur du lancement...et dans ces conditions, délicat de régler ce soucis à distance sans prendre des risques

si un jour tu formates ton pc, profites en sans pour supprimer tout ca

ok
on finalise proprement ton sujet

fais un nouveau RSIT et postes le rapport log stp

(réponse dans la journée)

dbourgeo · Answer

Partie 1



Logfile of random's system information tool 1.06 (written by random/random)
Run by Dany at 2010-04-25 11:21:46
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 26 GB (36%) free of 72 GB
Total RAM: 2047 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:21:51, on 25/04/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PrintCtrl.exe
C:\WINDOWS\srntservice.exe
E:\XP\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
F:\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Keyboard Driver\OEMDriver.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Weather Watcher\ww.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\PROGRA~1\MICROS~2apimgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Dany\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dany\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dany\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dany\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Dany.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Super Ad Blocker Toolbar - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\sabtb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [KBDriver] "C:\Program Files\Keyboard Driver\OEMDriver.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WeatherWatcher] "C:\Program Files\Weather Watcher\ww.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [RSRWin.exe] C:\Windows\RSRWin.exe (User 'Default user')
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format PDF - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.asf.fr/AxisCamControl.ocx
O16 - DPF: {A364AF35-0CDF-41E8-8F3B-E0E55E15EBA1} (Zenturi Active Programs Control) - http://www.programchecker.com/dll/nixon.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E9D081D-EAA5-4C2C-ABA7-6BA4EE5C7653}: NameServer = 212.27.54.252,213.228.0.23
O20 - AppInit_DLLs: C:\WINDOWS\system32\acaptuser32.dll
O20 - Winlogon Notify: !SABWinLogon - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c989c0d9b3d5dc) (gupdate1c989c0d9b3d5dc) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Printer Control - ActMask Co.,Ltd - https://www.all2pdf.com/ - C:\WINDOWS\system32\PrintCtrl.exe
O23 - Service: RegServ - Unknown owner - C:\WINDOWS\srntservice.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - SuperAdBlocker.com - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\XP\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TomTomHOMEService - TomTom - F:\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

dbourgeo · Answer

Partie 2



======List of files/folders created in the last 1 months======

2010-04-23 19:22:35 ----SHD---- C:\$RECYCLE.BIN
2010-04-23 17:43:01 ----A---- C:\ComboFix.txt
2010-04-23 17:33:41 ----D---- C:\WINDOWS	emp
2010-04-23 17:30:20 ----D---- C:\ComboFix
2010-04-23 15:55:23 ----A---- C:\WINDOWS\NIRCMD.exe
2010-04-23 13:13:11 ----A---- C:\SEAFlog.txt
2010-04-23 12:40:37 ----A---- C:\TmpSeaf.txt
2010-04-23 12:39:37 ----D---- C:\Program Files\SEAF
2010-04-22 21:46:23 ----A---- C:\Boot.bak
2010-04-22 21:46:19 ----RASHD---- C:\cmdcons
2010-04-22 21:45:03 ----A---- C:\WINDOWS\MBR.exe
2010-04-22 21:45:01 ----A---- C:\WINDOWS\PEV.exe
2010-04-22 21:41:17 ----D---- C:\Qoobox
2010-04-22 20:56:54 ----D---- C:\Program Files\ZHPDiag
2010-04-22 18:36:25 ----D---- C:\Kill'em
2010-04-22 18:36:25 ----A---- C:\List'em.txt
2010-04-22 18:35:37 ----A---- C:\more.txt
2010-04-22 18:35:14 ----D---- C:\Program Files\List_Kill'em
2010-04-22 13:05:20 ----D---- C:sit
2010-04-22 13:05:20 ----D---- C:\Program Files	rend micro
2010-04-22 11:46:43 ----D---- C:\Program Files\ESET
2010-04-22 09:52:25 ----A---- C:\Ad-Report-SCAN[4].txt
2010-04-19 18:26:09 ----A---- C:\WINDOWS\Asde_SusX70p3.ini
2010-04-19 18:26:09 ----A---- C:\WINDOWS\Asde_Renault.ini
2010-04-19 18:26:09 ----A---- C:\WINDOWS\Asde_InjX83P2.ini
2010-04-19 18:26:09 ----A---- C:\WINDOWS\Asde_InjX70P3.ini
2010-04-19 18:26:09 ----A---- C:\WINDOWS\Asde_Dacia.ini
2010-04-19 18:26:09 ----A---- C:\WINDOWS\5800Hard.ini
2010-04-19 18:12:42 ----D---- C:\Program Files\TomTom International B.V
2010-04-18 11:39:13 ----D---- C:\Program Files\Microsoft ActiveSync
2010-04-18 09:46:38 ----D---- C:\Program Files\Microsoft Visual Studio
2010-04-18 09:46:28 ----D---- C:\Program Files\Microsoft.NET
2010-04-18 09:43:32 ----D---- C:\WINDOWS\SHELLNEW
2010-04-18 09:42:58 ----RD---- C:\MSOCache
2010-04-17 23:46:35 ----D---- C:\Documents and Settings\All Users\Application Data\Logishrd
2010-04-17 21:10:54 ----D---- C:\Documents and Settings\Dany\Application Data\Logishrd
2010-04-16 20:00:50 ----D---- C:\Program Files\TrendMicro
2010-04-14 07:15:35 ----D---- C:\Program Files\Trojan Killer
2010-04-13 08:36:15 ----D---- C:\Ad-Remover
2010-04-12 12:37:58 ----A---- C:\WINDOWS\is-5NVC6.exe
2010-04-03 19:23:18 ----A---- C:\WINDOWS\system32
vmccs.dll
2010-04-03 19:23:16 ----A---- C:\WINDOWS\system32
vsvc32.exe
2010-04-03 19:23:16 ----A---- C:\WINDOWS\system32
vmctray.dll
2010-04-03 19:23:16 ----A---- C:\WINDOWS\system32
vcpl.dll
2010-04-03 19:23:16 ----A---- C:\WINDOWS\system32
vcolor.exe
2010-04-03 19:22:54 ----A---- C:\WINDOWS\system32
vwddi.dll
2010-04-02 16:30:47 ----D---- C:\Program Files\DIFX

======List of files/folders modified in the last 1 months======

2010-04-25 11:21:47 ----D---- C:\WINDOWS\Prefetch
2010-04-25 10:34:13 ----D---- C:\WINDOWS
2010-04-25 10:33:22 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-24 08:55:10 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-24 07:58:08 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-23 17:43:03 ----D---- C:\WINDOWS\system32\drivers
2010-04-23 17:42:24 ----D---- C:\Documents and Settings\Dany\Application Data\WeatherWatcher
2010-04-23 17:36:31 ----A---- C:\WINDOWS\system.ini
2010-04-23 17:31:01 ----D---- C:\WINDOWS\system32
2010-04-23 12:39:37 ----D---- C:\Program Files
2010-04-23 12:31:10 ----SHD---- C:\WINDOWS\Installer
2010-04-23 12:31:10 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2010-04-23 12:31:10 ----D---- C:\Config.Msi
2010-04-23 11:33:13 ----SD---- C:\WINDOWS\Tasks
2010-04-23 08:07:26 ----D---- C:\WINDOWS\Help
2010-04-23 08:07:26 ----D---- C:\Program Files\NVIDIA Corporation
2010-04-23 08:06:58 ----HD---- C:\WINDOWS\inf
2010-04-23 08:06:57 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-04-23 06:32:22 ----D---- C:\WINDOWS\system32\config
2010-04-23 06:32:13 ----D---- C:\WINDOWS\ERDNT
2010-04-23 06:30:21 ----D---- C:\WINDOWS\AppPatch
2010-04-23 06:30:20 ----D---- C:\Program Files\Fichiers communs
2010-04-22 22:21:36 ----D---- C:\Documents and Settings\Dany\Application Data\vlc
2010-04-22 21:46:23 ----RASH---- C:\boot.ini
2010-04-22 20:49:03 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-04-22 20:47:30 ----A---- C:\AUTOEXEC.BAT
2010-04-22 20:47:25 ----D---- C:\WINDOWS\Debug
2010-04-22 11:38:56 ----D---- C:\WINDOWS\ServicePackFiles
2010-04-22 10:54:30 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-22 10:54:22 ----D---- C:\WINDOWS\system32\LogFiles
2010-04-20 23:37:38 ----A---- C:\WINDOWS\wininit.ini
2010-04-20 11:41:02 ----D---- C:\WINDOWS\pss
2010-04-20 06:26:10 ----D---- C:\WINDOWS\system32\Restore
2010-04-19 18:45:50 ----RSD---- C:\WINDOWS\assembly
2010-04-19 18:39:23 ----HD---- C:\Program Files\InstallShield Installation Information
2010-04-19 18:39:23 ----D---- C:\Program Files\TechniSat DVB
2010-04-19 18:38:50 ----D---- C:\Documents and Settings
2010-04-19 18:38:28 ----D---- C:\Program Files\Smartione
2010-04-19 18:37:49 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-04-19 18:37:07 ----D---- C:\Program Files\ProgFinder
2010-04-19 18:36:33 ----D---- C:\Program Files\Panda Security
2010-04-19 18:34:12 ----D---- C:\Program Files\DVBViewerTE
2010-04-19 18:26:13 ----A---- C:\Trace.ini
2010-04-19 18:26:11 ----D---- C:\HELP
2010-04-19 18:26:11 ----A---- C:\WINDOWS\ODBC.INI
2010-04-19 18:22:51 ----D---- C:\Documents and Settings\All Users\Application Data\Autodesk
2010-04-19 18:22:46 ----RSD---- C:\WINDOWS\Fonts
2010-04-19 18:06:18 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2010-04-19 18:05:17 ----A---- C:\WINDOWS\win.ini
2010-04-19 18:05:16 ----D---- C:\Program Files\Fichiers communs\System
2010-04-19 07:06:00 ----D---- C:\WINDOWS
etwork diagnostic
2010-04-18 11:41:54 ----SD---- C:\Documents and Settings\Dany\Application Data\Microsoft
2010-04-18 09:49:56 ----D---- C:\WINDOWS\system32\wbem
2010-04-18 09:46:40 ----D---- C:\Program Files\Microsoft Office
2010-04-18 09:46:38 ----D---- C:\Program Files\Fichiers communs\DESIGNER
2010-04-18 09:20:40 ----D---- C:\WINDOWS\WinSxS
2010-04-17 23:47:28 ----D---- C:\Program Files\Fichiers communs\Logishrd
2010-04-17 21:27:19 ----D---- C:\WINDOWS\Registration
2010-04-17 21:15:34 ----D---- C:\Program Files\Logitech
2010-04-17 21:14:48 ----D---- C:\Program Files\Fichiers communs\Logitech
2010-04-17 15:48:39 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-04-17 06:32:13 ----SHD---- C:\System Volume Information
2010-04-15 17:49:59 ----D---- C:\Program Files\Google
2010-04-15 07:07:49 ----D---- C:\WINDOWS\system32\CatRoot
2010-04-14 07:09:30 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-14 07:07:30 ----D---- C:\WINDOWS\ie8updates
2010-04-13 08:03:38 ----D---- C:\ADCDA2
2010-04-12 12:40:13 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-04-12 09:29:39 ----D---- C:\Program Files\BitTorrent_DNA
2010-04-09 14:41:08 ----A---- C:\WINDOWS\xgicode.ini
2010-04-08 12:10:00 ----D---- C:\Program Files\FastStone Capture
2010-04-06 19:52:54 ----A---- C:\WINDOWS\system32\MRT.exe
2010-04-05 18:57:01 ----D---- C:\WINDOWS\Minidump
2010-04-04 20:01:33 ----AC---- C:\WINDOWS\ODBCINST.INI
2010-04-03 22:55:32 ----A---- C:\WINDOWS\system32\OpenCL.dll
2010-04-03 22:55:32 ----A---- C:\WINDOWS\system32
vuninst.exe
2010-04-03 22:55:32 ----A---- C:\WINDOWS\system32
vudisp.exe
2010-04-03 22:55:32 ----A---- C:\WINDOWS\system32
voglnt.dll
2010-04-03 22:55:32 ----A---- C:\WINDOWS\system32
vcuvid.dll
2010-04-03 22:55:32 ----A---- C:\WINDOWS\system32
vcuvenc.dll
2010-04-03 22:55:32 ----A---- C:\WINDOWS\system32
vcuda.dll
2010-04-03 22:55:32 ----A---- C:\WINDOWS\system32
vcompiler.dll
2010-04-03 22:55:32 ----A---- C:\WINDOWS\system32
vcodins.dll
2010-04-03 22:55:32 ----A---- C:\WINDOWS\system32
vcod.dll
2010-04-03 22:55:32 ----A---- C:\WINDOWS\system32
vapi.dll
2010-04-03 22:55:32 ----A---- C:\WINDOWS\system32
v4_disp.dll
2010-04-02 16:42:01 ----D---- C:\Documents and Settings\Dany\Application Data\Mozilla
2010-03-30 23:03:01 ----D---- C:\Program Files\Internet Explorer
2010-03-29 21:36:11 ----D---- C:\Program Files\CCleaner

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-04-07 114984]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2010-04-07 55232]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
R1 PQNTDrv;PQNTDrv; C:\WINDOWS\system32\drivers\PQNTDrv.sys [2004-05-06 4228]
R1 SABDIFSV;SABDIFSV; \??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABDIFSV.SYS []
R1 SABKUTIL;SABKUTIL; \??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.sys []
R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032]
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [2002-07-17 16877]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-04-07 139192]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2010-04-07 134488]
R2 irda;Protocole IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R3 adatadrv;Autodata Protection Service; C:\WINDOWS\system32\DRIVERS\adatadrv.sys [2009-07-01 762112]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-04-07 32584]
R3 FETNDISB;VIA Rhine Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5b.sys [2003-11-11 41984]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-11-01 4620288]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2009-11-10 20240]
R3 L8042mou;SetPoint PS/2 Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\L8042mou.Sys [2009-11-10 63248]
R3 LMouKE;SetPoint Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2009-11-10 79504]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\LVUSBSta.sys [2007-03-06 41376]
R3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS
v4_mini.sys [2010-04-03 10232128]
R3 pepifilter;Volume Adapter; C:\WINDOWS\system32\DRIVERS\lv302af.sys [2007-03-06 14240]
R3 PID_PEPI;Logitech QuickCam IM(PID_PEPI); C:\WINDOWS\system32\DRIVERS\LV302V32.SYS [2007-03-06 1273504]
R3 Rasirda;Miniport réseau étendu (IrDA); C:\WINDOWS\system32\DRIVERSasirda.sys [2001-08-17 19584]
R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 Ad-Watch Connect Filter;Ad-Watch Connect Kernel Filter; \??\C:\WINDOWS\system32\drivers\NSDriver.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 FTDIBUS;USB Serial Converter Driver; C:\WINDOWS\system32\drivers\ftdibus.sys [2007-06-27 53184]
S3 FTSER2K;USB Serial Port Driver; C:\WINDOWS\system32\drivers\ftser2k.sys [2007-06-27 71488]
S3 irsir;Pilote série infrarouge Microsoft; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
S3 LVcKap;Logitech AEC Driver; C:\WINDOWS\system32\DRIVERS\LVcKap.sys [2007-03-06 1669664]
S3 LVMVDrv;Logitech Machine Vision Engine Loader; C:\WINDOWS\system32\DRIVERS\LVMVDrv.sys [2007-03-06 2261792]
S3 MosIrUsb;MosIrUsb.sys; C:\WINDOWS\system32\DRIVERS\MosIrUsb.sys [2004-04-14 20736]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NTSIM;NTSIM; \??\C:\WINDOWS\system32
tsim.sys []
S3 ParadigmVScanner;USB Scanner Still Image Device Service; C:\WINDOWS\system32\drivers\usbscan.sys [2008-04-13 15104]
S3 PID_08A0;Labtec WebCam(PID_08A0); C:\WINDOWS\system32\DRIVERS\LV302AV.SYS [2005-12-08 913408]
S3 SABProcEnum;SABProcEnum; \??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABProcEnum.sys []
S3 se59bus;Sony Ericsson Device 089 driver (WDM); C:\WINDOWS\system32\DRIVERS\se59bus.sys [2006-09-05 61536]
S3 se59mdfl;Sony Ericsson Device 089 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\se59mdfl.sys [2006-09-05 9360]
S3 se59mdm;Sony Ericsson Device 089 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\se59mdm.sys [2006-09-05 97088]
S3 se59obex;Sony Ericsson Device 089 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\se59obex.sys [2006-09-05 86432]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SNTNLUSB;SafeNet USB SuperPro/UltraPro/HardwareKey; C:\WINDOWS\system32\DRIVERS\SNTNLUSB.SYS [2008-07-11 37088]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 TVICHW32;TVICHW32; \??\C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS []
S3 usb_rndisx;Carte ISDN USB; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2006-04-10 104576]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-03-22 717296]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2010-04-07 810120]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-08-14 153376]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-03-30 303952]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32
vsvc32.exe [2010-04-03 154216]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 Printer Control;Printer Control; C:\WINDOWS\system32\PrintCtrl.exe [2009-06-16 77824]
R2 RegServ;RegServ; C:\WINDOWS\srntservice.exe [2009-11-12 69632]
R2 SABSVC;Super Ad Blocker Service; C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE [2005-08-31 65536]
R2 StarWindServiceAE;StarWind AE Service; E:\XP\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 TomTomHOMEService;TomTomHOMEService; F:\TomTom HOME 2\TomTomHOMEService.exe [2009-11-13 92008]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe [2008-06-09 53392]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-03-30 1533808]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe [2008-01-22 275752]
S2 gupdate1c989c0d9b3d5dc;Google Update Service (gupdate1c989c0d9b3d5dc); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-02-08 133104]
S2 LVSrvLauncher;LVSrvLauncher; C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe [2007-03-06 105248]
S2 NOD32FiXTemDono;Eset Nod32 Boot; C:\WINDOWS\system32egedt32.exe [2004-08-05 3584]
S2 tqavcdyu;Logitech AEC Helper; C:\WINDOWS\System32\svchost.exe [2004-08-05 14336]
S2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-05 14336]
S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2010-04-07 33560]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-11-24 651720]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-04-09 1265264]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Fichiers communs\LogiShrd\Bluetooth\lbtserv.exe [2010-01-29 292944]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2008-04-08 800040]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

moment de grace · Answer

1)
Cherches et cliques sur C:\Program Files\Trend Micro\HijackThis\Dany.exe
Au menu principal, choisir do a scan only, puis cocher la case devant les lignes suivantes à corriger et cliquer en bas sur Fix Checked (s'il manque des lignes...pas grave)

 O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe     
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime     
O4 - HKCU\..\Run: [WeatherWatcher] "C:\Program Files\Weather Watcher\ww.exe"  

..........................

2)
Mettre à jour la Console Java ? : 
https://www.java.com/fr/download/uninstalltool.jsp

et installer la nouvelle version si besoin est (dans ce cas désinstalle avant l'ancienne version). 

voici pour desinstaller : 

JavaRa 
http://raproducts.org/click/click.php?id=1

Décompresse le fichier sur le Bureau (Clic droit > Extraire tout). 
* Double-clique (clic droit "en tant qu'administrateur" pour Vista) sur le répertoire JavaRa. 
* Puis double-clique sur le fichier JavaRa.exe (le exe peut ne pas s'afficher). 
* Choisis Français puis clique sur Select. 
* Clique sur Recherche de mises à jour. 
* Sélectionne Mettre à jour via jucheck.exe puis clique sur Rechercher. 
* Autorise le processus à se connecter s'il le demande, clique sur Installer et suis les instructions d'installation qui prennent quelques minutes. 
* L'installation est terminée, reviens à l'écran de JavaRa et clique sur Effacer les anciennes versions. 
* Clique sur Oui pour confirmer. Laisse travailler et clique ensuite sur OK, puis une deuxième fois sur OK. 
* Un rapport va s'ouvrir. Poste-le dans ta prochaine réponse. 
* Ferme l'application. 

Note : le rapport se trouve aussi dans C:\ sous le nom JavaRa.log. 

.............

3)

* Lancez Adobe Reader
* Cliquez sur Edition --> Préférences --> JavaScript
* Décochez "Activer Acrobat JavaScript"
* Validez

....................

4)
IMPORTANT

Purger la restauration systeme XP

http://www.bibou0007.com/windows-xp-f101/purger-la-restauration-du-systeme-sous-windows-xp-t151.htm


.................

5)
Clique droit sur l'icône ZHPFix.exe sur ton Bureau, 
puis sélectionne 'Exécuter en tant qu'administrateur'. 

Clique sur le A rouge (Nettoyeur de Tools). 

Clique sur Nettoyer. 

Fais redémarrer l'ordi pour terminer le nettoyage.

....................................................


Recommandations pour l'avenir

Tu es la meilleure protection pour ton pc que tout autre antivirus, si tu admets un minimum de rigueur dans son utilisation...Les virus sont vigilants et pénètrent ta machine par toutes les portes que tu laisseras ouvertes...
-	logiciels non à jour (windows, internet explorer, java, adobe reader etc)
-	installation de toolbar
-	fréquentation de sites piégés
-	P2P
-	Application de cracks
-	Supports usb

Pour t'aider dans cette tâche, voici quelques pistes

 Pour naviguer sur internet plus en sécurité et à l'abri des publicités, je te conseille vivement d'installer et d'utiliser le navigateur firefox
http://www.mozilla-europe.org/fr/firefox/

 Une fois que c'est fait, lances le et installe l'extension de sécurité adblock plus 
pour bloquer les publicités
https://addons.mozilla.org/fr/mobile/addon/1865

............................

WOT - Extension pour ton navigateur internet : 
Voici une extension à télécharger qui te permettra, en faisant tes recherches sur google, de savoir si le site proposé lors de tes recherches est un site de confiance ou un site à éviter car il pourrait infecter ton PC : 
Pour Firefox : https://addons.mozilla.org/fr/firefox/addon/wot-safe-browsing-tool/ 
Pour internet explorer : https://chrome.google.com/webstore/detail/wot-web-of-trust-website/bhmmomiinigofkjcapegjjndpbikblnp 

........................


Tu dois aussi mettre à jour tous tes autres programmes pour combler des failles de sécurité... Vérifie les mises disponibles à l'aide de ce petit programme (choisis la version sans installation) : Update Checker 
https://www.commentcamarche.net/telecharger/utilitaires/9771-filehippo-app-manager/
Et particulièrement Internet explorer, même s'il n'est pas ton navigateur, car les MAJ sécurité Windows ne s'opèrent que par ce chemin là

......................................

Pour éviter une infection toolbar, il faut tout lire attentivement lorsque tu installes un programme gratuit, et décocher tous les programmes additionnels qui sont proposés, en particulier les barres d'outils !

..........................

Vaccines tes disques amovibles à l'aide de USBFix (de Chiquitine29 et C_XX) 
http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe
Au menu principal, choisis l'option 3 (Vaccination).
............................
garder Malwarebytes et faire un examen de temps en temps ton PC, avec mise à jour avant chaque scan
.......................


Télécharge et installe CCleaner (N'installe pas la Yahoo Toolbar) :
 https://www.commentcamarche.net/telecharger/utilitaires/5647-ccleaner/

* Lance-le.(clic droit "en tant qu'administrateur" pour Vista) Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc.... 
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage. 
* Ensuite, choisis Registre, puis Chercher des erreurs. Une fois terminé, répare toutes les erreurs tant de fois qu il en trouve a l analyse 

..........................
utilitaire pour défragmenter , utilises pour ce faire Defraggler https://www.clubic.com/telecharger-fiche44314-defraggler.html

........................
A lire pour mieux comprendre l'environnement qui t'entoure
http://assiste.com.free.fr/p/abc/a/zombies_et_botnets.html
https://www.malekal.com/fichiers/projetantimalwares/ProjetAntiMalware-courte.pdf

http://www.libellules.ch/...

dbourgeo · Answer

Réponse pour java

JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Sun Apr 25 14:08:42 2010

Found and removed: C:\Program Files\Java\jre1.6.0_01

Found and removed: C:\Documents and Settings\Dany\Application Data\Sun\Java\jre1.6.0_16

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.6.0_01\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.6.0_01\bin\

------------------------------------

Finished reporting.

moment de grace · Answer

ok

ne pars pas trop vite j'aurais encore une suppression à te transmettre, mais je dois vérifier avant

dbourgeo · Answer

Non, non je ne pars pas.

moment de grace · Answer

as tu encore combofix ?

moment de grace · Answer

Rends toi sur ce site : 

https://www.virustotal.com/gui/ 

Clique sur parcourir et cherche ce fichier : 

c:\docume~1\Dany\LOCALS~1\Temp\IadHide4.dll

c:\windows\system32\drivers\Imapi.sys 



Clique sur Send File. 

Un rapport va s'élaborer ligne à ligne. 

Attends la fin. Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copie le dans ta réponse.

Si tu ne trouves pas le fichier alors

Affiche tous les fichiers et dossiers : 

Pour cela : 
Clique sur démarrer/panneau de configuration/option des dossiers/affichage 

Cocher afficher les dossiers cachés

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" 

Décocher masquer les extensions dont le type est connu 

Puis fais «appliquer» pour valider les changements. 

Et OK

dbourgeo · Answer

Fichier Iadhide4.dll

 Fichier 0c0368b82472699af66dacd091fef4fa  reçu le 2010.04.14 14:10:58 (UTC)
Situation actuelle: terminé
Résultat: 0/40 (0.00%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared 	4.5.0.50 	2010.04.14 	-
AhnLab-V3 	5.0.0.2 	2010.04.13 	-
AntiVir 	7.10.6.76 	2010.04.14 	-
Antiy-AVL 	2.0.3.7 	2010.04.14 	-
Authentium 	5.2.0.5 	2010.04.14 	-
Avast 	4.8.1351.0 	2010.04.14 	-
Avast5 	5.0.332.0 	2010.04.14 	-
AVG 	9.0.0.787 	2010.04.14 	-
BitDefender 	7.2 	2010.04.14 	-
CAT-QuickHeal 	10.00 	2010.04.14 	-
ClamAV 	0.96.0.3-git 	2010.04.14 	-
Comodo 	4596 	2010.04.14 	-
DrWeb 	5.0.2.03300 	2010.04.14 	-
eSafe 	7.0.17.0 	2010.04.14 	-
eTrust-Vet 	35.2.7425 	2010.04.14 	-
F-Prot 	4.5.1.85 	2010.04.13 	-
F-Secure 	9.0.15370.0 	2010.04.14 	-
Fortinet 	4.0.14.0 	2010.04.12 	-
GData 	19 	2010.04.14 	-
Ikarus 	T3.1.1.80.0 	2010.04.14 	-
Jiangmin 	13.0.900 	2010.04.13 	-
Kaspersky 	7.0.0.125 	2010.04.14 	-
McAfee 	5.400.0.1158 	2010.04.14 	-
McAfee-GW-Edition 	6.8.5 	2010.04.14 	-
Microsoft 	1.5605 	2010.04.14 	-
NOD32 	5028 	2010.04.14 	-
Norman 	6.04.11 	2010.04.14 	-
nProtect 	2010-04-14.01 	2010.04.14 	-
Panda 	10.0.2.7 	2010.04.13 	-
PCTools 	7.0.3.5 	2010.04.14 	-
Prevx 	3.0 	2010.04.14 	-
Rising 	22.43.02.04 	2010.04.14 	-
Sophos 	4.52.0 	2010.04.14 	-
Sunbelt 	6175 	2010.04.14 	-
Symantec 	20091.2.0.41 	2010.04.14 	-
TheHacker 	6.5.2.0.261 	2010.04.14 	-
TrendMicro 	9.120.0.1004 	2010.04.14 	-
VBA32 	3.12.12.4 	2010.04.14 	-
ViRobot 	2010.4.14.2276 	2010.04.14 	-
VirusBuster 	5.0.27.0 	2010.04.13 	-
Information additionnelle
File size: 24576 bytes
MD5   : 0c0368b82472699af66dacd091fef4fa
SHA1  : 3ab11609fe1f75ee5bb318d076dfd5221f33949e
SHA256: b0f74882718dbf1817bdbfb66a88326e3364bfe4c1d1f25999882d82a909790a
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10FB
timedatestamp.....: 0x3F2FB8B2 (Tue Aug 5 16:01:22 2003)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xB9C 0x1000 4.95 5739572a7c23ee09799c36f593da6f09
.rdata 0x2000 0x510 0x1000 2.12 facafcfd13631650bd8f492cc8629d68
.data 0x3000 0x364 0x1000 0.67 fccf61d889d1b9bffe95e885e7f9550a
.rsrc 0x4000 0x478 0x1000 1.15 b53f1632b81d342262aa96fcf98b896a
.reloc 0x5000 0x1EE 0x1000 1.04 82d97348bc6cd93543351ab96db3fe7e

( 3 imports )

> advapi32.dll: SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegCloseKey, RegQueryValueExA, RegOpenKeyExA
> kernel32.dll: GetCommandLineA, MapViewOfFile, CreateFileMappingA, UnmapViewOfFile, lstrcpynA, lstrlenA, DisableThreadLibraryCalls, CloseHandle, GetLastError, CreateEventA, SetEvent, GetModuleFileNameA, OpenEventA, GlobalAddAtomA, GetCurrentProcessId, GlobalDeleteAtom, GetTickCount, lstrcmpiA, WaitForSingleObject
> user32.dll: CallNextHookEx, UnhookWindowsHookEx, LoadStringA, SetWindowsHookExA, IsWindow, RegisterWindowMessageA, PostMessageA, wsprintfA

( 1 exports )

> GetLastEventTime, GetNKeys, SetEventNow, StartTrapping, StopTrapping, VerifyTrapping, _MyCBTProc@12, _MyKeyboardProc@12, _MyMouseProc@12, __DllMainCRTStartup@12
TrID  : File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ThreatExpert: https://www.symantec.com?md5=0c0368b82472699af66dacd091fef4fa
ssdeep: 192:WPxgoNoxLJdZYoB5XCr4ilrz1jt/u0F88ji0kl:WP2i0nBdCr4u1jtDF882P
sigcheck: publisher....: BackWeb
copyright....: (c)2001 BackWeb Technologies.
product......: BackWeb IAdHide
description..: IAdHide
original name: IAdHide.dll
internal name: IAdHide
file version.: Version 6.1.4 (Build 68R)
comments.....:
signers......: -
signing date.: -
verified.....: Unsigned
PEiD  : -
RDS   : NSRL Reference Data Set
-

dbourgeo · Answer

Fichier Imapi.sys


 Fichier imapi.sys reçu le 2010.04.24 17:55:30 (UTC)
Situation actuelle: terminé
Résultat: 0/39 (0.00%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared 	4.5.0.50 	2010.04.24 	-
AhnLab-V3 	5.0.0.2 	2010.04.24 	-
AntiVir 	8.2.1.224 	2010.04.23 	-
Antiy-AVL 	2.0.3.7 	2010.04.23 	-
Authentium 	5.2.0.5 	2010.04.24 	-
Avast 	4.8.1351.0 	2010.04.24 	-
Avast5 	5.0.332.0 	2010.04.24 	-
AVG 	9.0.0.787 	2010.04.24 	-
BitDefender 	7.2 	2010.04.24 	-
CAT-QuickHeal 	10.00 	2010.04.23 	-
ClamAV 	0.96.0.3-git 	2010.04.24 	-
Comodo 	4676 	2010.04.24 	-
DrWeb 	5.0.2.03300 	2010.04.24 	-
eSafe 	7.0.17.0 	2010.04.22 	-
eTrust-Vet 	35.2.7448 	2010.04.24 	-
F-Prot 	4.5.1.85 	2010.04.24 	-
F-Secure 	9.0.15370.0 	2010.04.24 	-
Fortinet 	4.0.14.0 	2010.04.21 	-
GData 	21 	2010.04.24 	-
Ikarus 	T3.1.1.80.0 	2010.04.24 	-
Jiangmin 	13.0.900 	2010.04.24 	-
Kaspersky 	7.0.0.125 	2010.04.24 	-
McAfee-GW-Edition 	6.8.5 	2010.04.23 	-
Microsoft 	1.5703 	2010.04.24 	-
NOD32 	5057 	2010.04.24 	-
Norman 	6.04.11 	2010.04.24 	-
nProtect 	2010-04-24.01 	2010.04.24 	-
Panda 	10.0.2.7 	2010.04.24 	-
PCTools 	7.0.3.5 	2010.04.24 	-
Prevx 	3.0 	2010.04.24 	-
Rising 	22.44.05.04 	2010.04.24 	-
Sophos 	4.53.0 	2010.04.24 	-
Sunbelt 	6217 	2010.04.24 	-
Symantec 	20091.2.0.41 	2010.04.24 	-
TheHacker 	6.5.2.0.268 	2010.04.23 	-
TrendMicro 	9.120.0.1004 	2010.04.24 	-
VBA32 	3.12.12.4 	2010.04.23 	-
ViRobot 	2010.4.24.2293 	2010.04.24 	-
VirusBuster 	5.0.27.0 	2010.04.24 	-
Information additionnelle
File size: 42112 bytes
MD5   : 083a052659f5310dd8b6a6cb05edcf8e
SHA1  : 11a1c247e82b8deb69bfa852259caf9793ef0aee
SHA256: 48d39b03ffb6faa1529b774443ba12618ae3982d9f65a7b9d18f2269f78b31f4
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x8AFB
timedatestamp.....: 0x480253B9 (Sun Apr 13 20:40:57 2008)
machinetype.......: 0x14C (Intel I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x2E10 0x2E80 6.21 62ccafd161a46a2033af0e2f8a821703
.rdata 0x3180 0x944 0x980 4.64 1650a10579166ceb06e890fe6e9b9e55
.data 0x3B00 0xA0 0x100 2.60 b77b7dc9cc33d390bb794b90862dbf38
PAGE 0x3C00 0x4CA4 0x4D00 6.28 548e00a65bd96595b13b89eeb9dd7f42
INIT 0x8900 0x98E 0xA00 5.74 55109560740e8202a570a2958620e5d9
.rsrc 0x9300 0x3D8 0x400 3.35 68b16ae21ac47ac899e8bc7d63b83c82
.reloc 0x9700 0xD1C 0xD80 6.47 7e8b29e28a5e53a9011786f9ab9b572a

( 0 imports )


( 0 exports )
TrID  : File type identification
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 384:M9q2RDELaZX62oL2/41jCENG618J8spVXjcx8itNVBgARvYlebRO4hL5nDzzc128:D2RUaJx0Jmy1EpFuvIItOKD81jIEOx
sigcheck: publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: IMAPI Kernel Driver
original name: IMAPI.sys
internal name: IMAPI.sys
file version.: 5.1.2600.5512 (xpsp.080413-2108)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEiD  : -
packers (Kaspersky): PE_Patch
RDS   : NSRL Reference Data Set
-

dbourgeo · Answer

Je viens de réinstaller combofix.

moment de grace · Answer

/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour dbourgeo, il n'est pas transposable sur un autre ordinateur ! 

crées un sur ton bureau un nouveau fichier bloc note que tu nommeras CFScript
Copies y ce texte dedans et enregistres le




KillAll:: 

Netsvc:: 

tqavcdyu 

SkipFix::



* Désactive tes logiciels de protection 
* Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe (comme le lien suivant) 
http://apu.mabul.org/up/apu/2008/09/06/ ... 35my8h.gif 
* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé. 
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu. 
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt

dbourgeo · Answer

Partie 1

ComboFix 10-04-21.01 - Dany 25/04/2010  18:20:13.7.2 - x86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.2047.1505 [GMT 2:00]
Lancé depuis: c:\documents and settings\Dany\Mes documents\Downloads\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Dany\Bureau\CFScript.txt
AV: BitDefender Internet Security v10 *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: ESET Smart Security 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: BitDefender Internet Security v10 *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
FW: Pare-feu personnel d'ESET *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
- Mode FONCTIONNALITES REDUITES -
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-3602737474-2172167897-2797940940-1000
c:\$recycle.bin\S-1-5-21-3602737474-2172167897-2797940940-1000\desktop.ini
c:\$recycle.bin\S-1-5-21-4200881234-2146675543-2877990657-1000
c:\$recycle.bin\S-1-5-21-4200881234-2146675543-2877990657-1000\desktop.ini

.
(((((((((((((((((((((((((((((   Fichiers créés du 2010-03-25 au 2010-04-25  ))))))))))))))))))))))))))))))))))))
.

2010-04-25 12:36 . 2010-04-25 12:36	--------	d-----w-	c:\program files\WOT
2010-04-25 12:07 . 2010-04-12 15:29	411368	----a-w-	c:\windows\system32\deployJava1.dll
2010-04-25 11:54 . 2010-04-25 11:54	--------	d-----w-	c:\program files\Microsoft ActiveSync
2010-04-25 11:10 . 2010-04-25 11:10	--------	d-----w-	C:\DVR111D
2010-04-25 10:46 . 2010-04-25 10:46	--------	d-sh--w-	c:\documents and settings\Administrateur\IETldCache
2010-04-24 06:01 . 2001-08-17 19:28	871388	-c--a-w-	c:\windows\system32\dllcache\bcmdm.sys
2010-04-24 06:00 . 2004-08-03 20:32	231552	-c--a-w-	c:\windows\system32\dllcache\ac97ali.sys
2010-04-24 06:00 . 2001-08-17 19:52	23552	-c--a-w-	c:\windows\system32\dllcache\abp480n5.sys
2010-04-24 06:00 . 2001-08-23 15:46	98304	-c--a-w-	c:\windows\system32\dllcache\a3d.dll
2010-04-24 06:00 . 2001-08-23 15:46	462848	-c--a-w-	c:\windows\system32\dllcache\a3dapi.dll
2010-04-24 06:00 . 2001-08-23 15:46	38400	-c--a-w-	c:\windows\system32\dllcache\8514a.dll
2010-04-24 06:00 . 2008-04-13 18:46	48128	-c--a-w-	c:\windows\system32\dllcache\61883.sys
2010-04-24 06:00 . 2008-04-13 18:40	12288	-c--a-w-	c:\windows\system32\dllcache\4mmdat.sys
2010-04-24 06:00 . 2008-04-13 18:46	53376	-c--a-w-	c:\windows\system32\dllcache\1394bus.sys
2010-04-24 06:00 . 2001-08-23 15:46	689216	-c--a-w-	c:\windows\system32\dllcache\3dfxvs.dll
2010-04-24 06:00 . 2001-08-17 20:06	11264	-c--a-w-	c:\windows\system32\dllcache\1394vdbg.sys
2010-04-24 06:00 . 2001-08-17 19:28	762780	-c--a-w-	c:\windows\system32\dllcache\3cwmcru.sys
2010-04-24 06:00 . 2001-08-17 18:48	148352	-c--a-w-	c:\windows\system32\dllcache\3dfxvsm.sys
2010-04-24 06:00 . 2001-08-23 15:46	66048	-c--a-w-	c:\windows\system32\dllcache\s3legacy.dll
2010-04-22 18:56 . 2010-04-25 12:27	--------	d-----w-	c:\program files\ZHPDiag
2010-04-22 16:36 . 2010-04-22 18:20	--------	d-----w-	C:\Kill'em
2010-04-22 11:05 . 2010-04-25 12:00	--------	d-----w-	c:\program files	rend micro
2010-04-22 09:46 . 2010-04-22 09:46	--------	d-----w-	c:\program files\ESET
2010-04-19 16:12 . 2010-04-19 16:12	--------	d-----w-	c:\program files\TomTom International B.V
2010-04-18 09:23 . 2010-04-18 09:23	--------	d-sh--w-	c:\documents and settings\Default User\IETldCache
2010-04-18 07:46 . 2010-04-18 07:46	--------	d-----w-	c:\program files\Microsoft.NET
2010-04-18 07:43 . 2010-04-18 07:43	--------	d-----w-	c:\windows\SHELLNEW
2010-04-18 07:42 . 2010-04-18 07:42	--------	d-----r-	C:\MSOCache
2010-04-17 21:46 . 2010-04-17 21:46	--------	d-----w-	c:\documents and settings\All Users\Application Data\Logishrd
2010-04-17 19:27 . 2010-04-17 19:27	--------	d-----w-	c:\windows\system32\wbem\Repository
2010-04-17 19:16 . 2010-04-17 19:16	--------	d-----w-	c:\documents and settings\Dany\Local Settings\Application Data\Logishrd
2010-04-17 19:10 . 2010-04-17 19:11	--------	d-----w-	c:\documents and settings\Dany\Application Data\Logishrd
2010-04-16 18:00 . 2010-04-16 18:00	--------	d-----w-	c:\program files\TrendMicro
2010-04-14 05:15 . 2010-04-14 05:53	--------	d-----w-	c:\program files\Trojan Killer
2010-04-12 23:11 . 2009-05-07 07:04	157712	----a-w-	c:\windows\system32\drivers	mcomm.sys
2010-04-12 11:57 . 2010-04-12 19:51	--------	d-----w-	c:\documents and settings\Dany\Local Settings\Application Data\Google
2010-04-12 10:37 . 2010-04-12 10:37	699904	----a-w-	c:\windows\is-5NVC6.exe
2010-04-12 08:59 . 2010-04-12 08:59	140288	----a-w-	c:\windows\system32\drivers\ethsrmex.sys
2010-04-07 19:08 . 2010-04-07 19:08	55232	----a-w-	c:\windows\system32\drivers\epfwtdi.sys
2010-04-07 19:08 . 2010-04-07 19:08	32584	----a-w-	c:\windows\system32\drivers\epfwndis.sys
2010-04-07 19:08 . 2010-04-07 19:08	134488	----a-w-	c:\windows\system32\drivers\epfw.sys
2010-04-07 19:07 . 2010-04-07 19:07	114984	----a-w-	c:\windows\system32\drivers\ehdrv.sys
2010-04-07 19:03 . 2010-04-07 19:03	139192	----a-w-	c:\windows\system32\drivers\eamon.sys
2010-04-03 17:23 . 2010-04-03 17:23	278120	----a-w-	c:\windows\system32
vmccs.dll
2010-04-03 17:23 . 2010-04-03 17:23	154216	----a-w-	c:\windows\system32
vsvc32.exe
2010-04-03 17:23 . 2010-04-03 17:23	145000	----a-w-	c:\windows\system32
vcolor.exe
2010-04-03 17:23 . 2010-04-03 17:23	13670504	----a-w-	c:\windows\system32
vcpl.dll
2010-04-03 17:23 . 2010-04-03 17:23	110696	----a-w-	c:\windows\system32
vmctray.dll
2010-04-03 17:22 . 2010-04-03 17:22	81920	----a-w-	c:\windows\system32
vwddi.dll
2010-04-02 14:30 . 2010-04-02 14:30	--------	d-----w-	c:\program files\DIFX
2010-04-02 14:30 . 2006-12-21 22:11	40576	------w-	c:\windows\system32\drivers\VCommUSB.sys

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-25 12:08 . 2007-03-22 16:36	--------	d-----w-	c:\program files\Java
2010-04-25 12:07 . 2007-03-22 16:36	--------	d-----w-	c:\program files\Fichiers communs\Java
2010-04-25 12:07 . 2010-04-25 12:07	503808	----a-w-	c:\documents and settings\Dany\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-593b904a-n\msvcp71.dll
2010-04-25 12:07 . 2010-04-25 12:07	499712	----a-w-	c:\documents and settings\Dany\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-593b904a-n\jmc.dll
2010-04-25 12:07 . 2010-04-25 12:07	348160	----a-w-	c:\documents and settings\Dany\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-593b904a-n\msvcr71.dll
2010-04-25 12:07 . 2010-04-25 12:07	61440	----a-w-	c:\documents and settings\Dany\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-34f28c45-n\decora-sse.dll
2010-04-25 12:07 . 2010-04-25 12:07	12800	----a-w-	c:\documents and settings\Dany\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-34f28c45-n\decora-d3d.dll
2010-04-25 11:56 . 2004-08-05 12:00	99178	----a-w-	c:\windows\system32\perfc00C.dat
2010-04-25 11:56 . 2004-08-05 12:00	546120	----a-w-	c:\windows\system32\perfh00C.dat
2010-04-25 11:03 . 2009-03-07 14:21	--------	d-----w-	c:\documents and settings\Dany\Application Data\WeatherWatcher
2010-04-23 10:31 . 2007-03-19 17:03	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-23 06:07 . 2010-02-02 19:51	--------	d-----w-	c:\program files\NVIDIA Corporation
2010-04-22 20:21 . 2010-02-20 21:16	--------	d-----w-	c:\documents and settings\Dany\Application Data\vlc
2010-04-22 08:54 . 2007-03-20 12:39	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-21 11:07 . 2010-04-21 11:07	388096	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-21 09:01 . 2010-04-13 12:26	193872	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\lib7zip.dll
2010-04-21 09:01 . 2010-04-13 12:26	1000784	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\lgpl.dll
2010-04-19 16:58 . 2007-03-19 16:56	58136	----a-w-	c:\documents and settings\Dany\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-19 16:43 . 2007-03-20 13:02	117248	----a-w-	c:\windows\system32\drivers\SSIDRV.sys
2010-04-19 16:39 . 2007-03-21 13:35	--------	d-----w-	c:\program files\TechniSat DVB
2010-04-19 16:39 . 2007-03-19 12:26	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-04-19 16:38 . 2007-03-19 16:12	--------	d-----w-	c:\program files\Smartione
2010-04-19 16:37 . 2009-09-26 15:12	--------	d-----w-	c:\program files\ProgFinder
2010-04-19 16:36 . 2009-08-12 11:06	--------	d-----w-	c:\program files\Panda Security
2010-04-19 16:34 . 2007-03-21 13:35	--------	d-----w-	c:\program files\DVBViewerTE
2010-04-19 16:22 . 2007-04-05 21:51	--------	d-----w-	c:\documents and settings\All Users\Application Data\Autodesk
2010-04-19 15:46 . 2009-09-19 17:52	4945232	----a-w-	c:\documents and settings\Dany\Application Data\TomTom\HOME\Profiles\w3c08jqu.default\extensions\Navcore.8.413.1237@tomtom.com\8-413-1237-1.dll
2010-04-17 21:47 . 2010-04-17 19:17	53248	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-04-17 21:47 . 2007-12-10 07:36	--------	d-----w-	c:\program files\Fichiers communs\Logishrd
2010-04-17 19:15 . 2007-03-19 14:55	--------	d-----w-	c:\program files\Logitech
2010-04-17 19:14 . 2007-03-19 14:55	--------	d-----w-	c:\program files\Fichiers communs\Logitech
2010-04-15 15:49 . 2009-02-08 07:42	--------	d-----w-	c:\program files\Google
2010-04-12 10:40 . 2008-10-01 13:10	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-04-12 10:37 . 2008-10-01 13:10	5918776	----a-w-	c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-12 07:29 . 2007-04-30 20:15	--------	d-----w-	c:\program files\BitTorrent_DNA
2010-04-12 05:34 . 2010-03-19 10:27	3757392	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\vcore.dll
2010-04-12 05:34 . 2010-03-19 10:27	259408	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extendedemediation.dll
2010-04-12 05:33 . 2010-03-19 10:27	226640	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libZip.dll
2010-04-12 05:33 . 2010-03-19 10:27	390480	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libVvs.dll
2010-04-12 05:33 . 2010-03-19 10:27	173392	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libtd.dll
2010-04-12 05:33 . 2010-03-19 10:27	296272	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libRar.dll
2010-04-12 05:33 . 2010-03-19 10:27	345424	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libOleA.dll
2010-04-12 05:33 . 2010-03-19 10:27	206160	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libNSIS.dll
2010-04-12 05:33 . 2010-03-19 10:27	177488	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libMsi.dll
2010-04-12 05:33 . 2010-03-19 10:27	283984	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libEmail.dll
2010-04-12 05:33 . 2010-03-19 10:27	206160	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libCHM.dll
2010-04-09 09:29 . 2010-03-19 10:27	966104	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-04-09 09:29 . 2010-03-19 10:27	1265264	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-04-08 10:10 . 2007-05-18 12:30	--------	d-----w-	c:\program files\FastStone Capture
2010-04-02 14:42 . 2008-06-18 10:05	335	-c--a-w-	c:\windows
sreg.dat
2010-03-29 22:46 . 2008-10-01 13:10	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 22:45 . 2008-10-01 13:10	20824	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-03-29 19:36 . 2007-03-20 12:36	--------	d-----w-	c:\program files\CCleaner
2010-03-20 16:00 . 2007-06-23 13:34	--------	d-----w-	c:\documents and settings\Dany\Application Data\Canon
2010-03-19 10:27 . 2010-03-19 10:27	95024	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\SBREDrv.sys
2010-03-10 06:16 . 2004-08-05 12:00	420352	----a-w-	c:\windows\system32\vbscript.dll
2010-03-08 13:51 . 2008-12-19 06:37	--------	d-----w-	c:\documents and settings\Dany\Application Data\dvdcss
2010-03-03 09:23 . 2007-03-19 15:54	--------	d-----w-	c:\program files\IZArc
2010-02-25 20:47 . 2007-03-19 16:26	--------	d-----w-	c:\documents and settings\Dany\Application Data\HARVEST S.A
2010-02-25 20:46 . 2010-02-25 20:46	--------	d-----w-	c:\program files\ClickImpots plus SCI 2010
2010-02-25 18:11 . 2007-05-04 20:42	--------	d-----w-	c:\program files\AM-DeadLink
2010-02-25 06:17 . 2004-08-05 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2004-08-05 12:00	455680	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 19:06 . 2004-08-05 12:00	2148352	----a-w-	c:\windows\system32
toskrnl.exe
2010-02-16 19:06 . 2004-08-04 00:49	2026496	----a-w-	c:\windows\system32
tkrnlpa.exe
2010-02-12 10:03 . 2010-02-24 22:13	293376	------w-	c:\windows\system32\browserchoice.exe
2010-02-12 04:34 . 2004-08-05 12:00	100864	----a-w-	c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-05 12:00	226880	----a-w-	c:\windows\system32\drivers	cpip6.sys
2010-02-04 15:53 . 2010-03-19 10:16	2954656	-c--a-w-	c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-02-04 15:53 . 2010-03-19 10:27	64288	----a-w-	c:\windows\system32\drivers\Lbd.sys
2010-02-01 09:45 . 2010-02-01 09:45	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe
2010-02-01 09:45 . 2010-02-01 09:45	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe
2010-02-01 09:44 . 2010-02-01 09:44	10134	----a-r-	c:\documents and settings\Dany\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe
2006-05-03 09:06 . 2009-10-09 15:07	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-10-09 15:07	31232	--sh--r-	c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-10-09 15:07	216064	--sh--r-	c:\windows\system32
bDX.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"WeatherWatcher"="c:\program files\Weather Watcher\ww.exe" [2008-11-18 1081344]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-06-07 20480]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2010-03-03 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KBDriver"="c:\program files\Keyboard Driver\OEMDriver.exe" [2004-08-25 151552]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-03-06 488984]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-01-27 1312848]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-04-07 2145000]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-03 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-03 13670504]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000D7}"= "c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABSEHB.DLL" [2006-11-07 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\!SABWinLogon]
2007-02-27 09:24	159744	----a-w-	c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LBTWlgn]
2010-01-29 21:17	64592	----a-w-	c:\program files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\acaptuser32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Acrobat.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Server4PC.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Dany^Menu Démarrer^Programmes^Démarrage^Logitech . Enregistrement du produit.lnk]
path=c:\documents and settings\Dany\Menu Démarrer\Programmes\Démarrage\Logitech . Enregistrement du produit.lnk
backup=c:\windows\pss\Logitech . Enregistrement du produit.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-03-29 22:46	437584	----a-w-	c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrintDisp]
2009-08-21 10:36	878080	----a-w-	c:\windows\system32\PrintDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 15:18	413696	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\eMule\emule.exe"=
"c:\Program Files\BitTorrent\bittorrent.exe"=
"c:\Program Files\Pando Networks\Pando\pando.exe"=
"c:\Program Files\Fichiers communs\Ahead\Nero Web\SetupX.exe"=
"c:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\VideoLAN\VLC\vlc.exe"=
"c:\Program Files\Kyodai Mahjongg\kmj.exe"=
"c:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\WINDOWS\system32\java.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\program files\Microsoft ActiveSyncapimgr.exe"= c:\program files\Microsoft ActiveSyncapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [19/03/2010 12:27 64288]
R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [26/03/2007 16:26 16896]
R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [26/03/2007 16:26 52224]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [07/04/2010 21:07 114984]
R1 SABDIFSV;SABDIFSV;c:\program files\SuperAdBlocker.com\Super Ad Blocker\sabdifsv.sys [21/09/2005 10:17 5632]
R1 SABKUTIL;SABKUTIL;c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.SYS [20/02/2007 15:02 32256]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [07/04/2010 21:07 810120]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [01/10/2008 15:10 303952]
R2 Printer Control;Printer Control;c:\windows\system32\PrintCtrl.exe [16/11/2009 14:52 77824]
R2 RegServ;RegServ;c:\windows\SRNTService.exe [12/11/2009 12:14 69632]
R2 TomTomHOMEService;TomTomHOMEService;f:	omtom home 2\TomTomHOMEService.exe [13/11/2009 13:31 92008]
R3 adatadrv;Autodata Protection Service;c:\windows\system32\drivers\adatadrv.sys [02/11/2009 10:32 762112]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [01/10/2008 15:10 20824]
S2 gupdate1c989c0d9b3d5dc;Google Update Service (gupdate1c989c0d9b3d5dc);c:\program files\Google\Update\GoogleUpdate.exe [08/02/2009 09:42 133104]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32egedt32.exe [05/08/2004 14:00 3584]
S2 tqavcdyu;Logitech AEC Helper;c:\windows\System32\svchost.exe -k netsvcs [05/08/2004 14:00 14336]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [04/02/2010 17:52 1265264]
S3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\drivers\MosIrUsb.sys [14/04/2004 14:52 20736]
S3 ParadigmVScanner;USB Scanner Still Image Device Service;c:\windows\system32\drivers\usbscan.sys [19/03/2007 17:32 15104]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14/10/2007 19:37 717296]
.
Contenu du dossier 'Tâches planifiées'

2010-04-23 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 09:29]

2010-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 07:42]

2010-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 07:42]

2010-04-25 c:\windows\Tasks\User_Feed_Synchronization-{B4010896-F085-4E90-8706-E2D3865DFB9B}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.

dbourgeo · Answer

Partie 2


------- Examen supplémentaire -------
.
uStart Page = hxxp://fr.my.yahoo.com/
uInternet Settings,ProxyOverride = localhost
IE: Ajouter au fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
Trusted Zone: secuser.com\www
TCP: {9E9D081D-EAA5-4C2C-ABA7-6BA4EE5C7653} = 212.27.54.252,213.228.0.23
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {A364AF35-0CDF-41E8-8F3B-E0E55E15EBA1} - hxxp://www.programchecker.com/dll/nixon.cab
FF - ProfilePath - c:\documents and settings\Dany\Application Data\Mozilla\Firefox\Profiles\6ndeje8e.default\
FF - prefs.js: browser.startup.homepage - hxxp://fr.my.yahoo.com/
FF - plugin: c:\program files\Google\Google Earth\plugin
pgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23
pGoogleOneClick8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: e:\xp\Program Files\Mozilla Firefox\plugins
pdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
e:\xp\Program Files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
e:\xp\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
e:\xp\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-RSRWin.exe - c:\windows\RSRWin.exe
HKU-Default-Run-RSRWin.exe - c:\windows\RSRWin.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-25 18:25
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A017AF56-B493-BA8F-B78A-ABAC1F958DAB}*]
"faigafmkfagb"=hex:6d,62,6e,67,67,6a,6f,63,66,6b,62,6b,67,6a,6f,6d,6d,62,61,6b,
   64,65,65,69,6a,69,6b,6b,63,6f,63,6a,6f,6a,66,6d,68,62,6e,70,68,68,65,66,64,\
"gajeimeomgllde"=hex:63,61,6b,66,66,68,00,00
"gaiennfajdkfje"=hex:63,61,6b,66,66,68,00,00

[HKEY_USERS\S-1-5-21-1409082233-261903793-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:c9,8a,a1,d3,ea,6c,33,6c,1a,e7,0d,94,b3,e1,f4,f7,96,79,6f,5e,d5,25,6e,
   08,a3,e8,1e,f3,1a,70,7e,89,36,32,94,d1,a6,5a,6b,3e,40,01,54,44,f7,21,de,8b,\
"??"=hex:6b,17,e5,79,7b,28,33,4c,05,ba,2a,9e,a9,42,7d,26

[HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info]
@Denied: (2) (LocalSystem)
"AppDataDir"="c:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\"
"DataDir"="ESET\ESET Smart Security\"
"EditionName"=" "
"InstallDir"="c:\Program Files\ESET\ESET Smart Security\"
"LanguageId"=dword:0000040c
"PackageTag"=dword:6090e758
"ProductBase"=dword:00000001
"ProductCode"="{B91B907B-3542-4DDB-84FA-55EDE3F13969}"
"ProductName"="ESET Smart Security"
"ProductType"="ess"
"ProductVersion"="4.2.40.10"
"UniqueId"="0007876D4BD01B15"
"ScannerBuild"=dword:00001aeb
"ScannerVersionId"=dword:00001390
"ScannerVersion"="Open window for status."

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODI04.00.00.01PRO"="9D8A793893C67688BABF2127E6827D4EDA27D0B11FE83A54D5B0D036F379505986151D5064A59CBDED6A2809C6A9A2B32649710525FAD4FDAAF876CF66BE1FBE69B863305159C752A70E9D905181A2C6BAA61FF21A7210CD84CF997A8EA3CA554F74747F000E9024F0AE12363A1108833BEF6AE6E052890245AD6FB21AC02A417AA7CBEA8A9820D3FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407C038D530D6EB3452BA7FD869164D67945902353A9A01F6341CC2B6562780CCDEFA4EC48EE171B24A9828A0D10040AB7F217F0D4C04C8847EE2F78CC3B75F30A22FF2687BF86AF80E8E7E07AE568C832C493B1511FCE11C3838687F68F248D965E9703A3525380C85188F5A6542B37FCBEB03FD9CEA3E891B924E820A2A64EBE1200992D0C3DE040A46C8F77C4F31CCFA578D4907A7EF2EA19D465F71A4839C9379621FE8A8038B3B5EF712FD7D252C988FF1CD6BFEB2800DB852306A1B15373D5408DF1A1BF1627A5A522DF9BFD2F147492CB7E9B2E008E17857E445BC301962BF682987D5985AEDE7ED2503002385EE6F9E04A6F77DE3E6A39F41582A8F35CD01D5A5D4078BDD8067C5252E992063B9210C0748F6ACC3A936575EFA7A8F118C8F85D0AD5281E45FEEBA31965BFB9C97311D667B4D37EDF85E12260A3833486E1992FABECFD380FB490F1EDC8A88D3BAA4DE9D6E8B09BBE901C2D9665F9F080A7E7CC9B90903538E72EA15205FBFC39BB6C07B56B7B41A5436448CF3E39F123752A336D47E3194909DD8950B853C36F45718216ACAEE895447D2261D2BA03D14DED08C48A12590BE2E496F449C3D0DC5279C87E5301021CAB591E24C8FB47401A0ACEC535A4A259DBE8EC97E39A83C51FDEA7808CA1688DAB38451F35E11B5A346454E36032F46F09CE19E6963054C9DE40313956E9F7D6C2A9457085A9093E5B60FF6B7EB07FBC4C9DBB93C967ED8F79B4AC8D564F251ADB3112A023830B27309DE0521D6285F667BFDBF33C2E4126D9589E2146AF8E90C202A56DB2492CFBE8AEEE8C0FB0FA2E71BABA38A4C2CBC5277EAF920B03F3F3E73753D1A3AFC377BBBDEE6668458071FC6AA31060C6C31BE1C81FDCEDB75E0BAE26C123E8ED9CBA4CF3099E9914964274FA8856D4D62DB8B12BE31F40771EDBDDDEBDAD125B6837530496BA3B546265E3AB2138A4FEBBCD81DFD2BF03D2B1B480036746378C6E9707A749E71F55C4B66423E9DAB470E670BB17AD4A17FC0B41E9F708F8076DD9BD97DE0C73550B8E7A35322C1A2DCF105C6FC53EE6AC4F0164743242FC082F6CBBBBF21CF5532AFA1438F18EAC7ACE0D17ADA8E0BB2F3A3AF8FA53E2AB971B04163F62A72B9FD38B4B14DC1DBF545CC1E515F9411E6EADF8888"

[HKEY_LOCAL_MACHINE\software\swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1064)
c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll

- - - - - - - > 'explorer.exe'(696)
c:\docume~1\Dany\LOCALS~1\Temp\IadHide4.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32
vsvc32.exe
c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\IoctlSvc.exe
e:\xp\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\SearchIndexer.exe
c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
c:\progra~1\MICROS~2apimgr.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Fichiers communs\LogiShrd\KHAL3\KHALMNPR.EXE
.
**************************************************************************
.
Heure de fin: 2010-04-25  18:32:51 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-04-25 16:32

Avant-CF: 27 596 144 640 octets libres
Après-CF: 27 577 458 688 octets libres

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 49C85426B13AA34E1D23478D033C92F4

moment de grace · Answer

ok

si tout fonctionne, on en reste là

dbourgeo · Answer

Parfait, franchement je te dis un grand MERCI car vraiment je ne pensais pas à tout ça au niveau travail.
Merci pour ta disponibilité et tout le travail.
Cordialement Daniel.

dbourgeo · Answer

Tu es vraiment sympa.
Bonne fin de soirée.

Je n'y arrive pas, j'aides attaques de cheval

72 réponses

Discussions similaires

Newsletters