HELP! Ordi plante - Rapport Hijackthis

La restauration a marché, j'ai re accès à Internet;

par contre, Ccleaner ne marche plus, mcafee ne peut etre desinstallé, en autres.

Donc le rapport RSIT:

ComboFix 09-04-21.03 - verzao 20/04/2009 20:50.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.990.667 [GMT 2:00]
Lancé depuis: e:\documents and settings\verzao\Bureau\ComboFix.exe
Commutateurs utilisés :: e:\documents and settings\verzao\Bureau\CFscript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated)
FW: McAfee Personal Firewall *enabled*
* Un nouveau point de restauration a été créé

FILE ::
F:\twgasc.exe
H:\srut.pif
K:\ujdmkc.pif
.

((((((((((((((((((((((((((((( Fichiers créés du 2009-03-21 au 2009-04-21 ))))))))))))))))))))))))))))))))))))
.

2009-04-18 11:32 . 2009-03-20 18:47 -------- d-----w e:\documents and settings\verzao\Application Data\MSN6
2009-04-17 23:21 . 2008-10-16 12:06 27496 ----a-w e:\windows\system32\mucltui.dll.mui
2009-04-17 19:03 . 2009-03-20 18:49 -------- d-----w e:\documents and settings\All Users\Application Data\Adobe(2)
2009-04-17 18:51 . 2009-04-17 18:51 -------- d-----w e:\documents and settings\verzao\PrivacIE
2009-04-17 18:45 . 2009-04-17 18:45 -------- d-sh--w e:\documents and settings\NetworkService\IETldCache
2009-04-17 18:44 . 2009-04-17 18:44 -------- d-sh--w e:\documents and settings\verzao\IETldCache
2009-04-17 18:41 . 2009-04-17 18:41 -------- d-----w e:\windows\ie8updates
2009-04-17 18:38 . 2009-03-20 19:18 -------- dc-h--w e:\windows\ie8
2009-04-17 18:38 . 2009-03-20 19:16 -------- d-----w e:\windows\system32\fr-FR
2009-04-17 18:33 . 2009-02-28 04:55 105984 -c----w e:\windows\system32\dllcache\iecompat.dll
2009-04-14 20:57 . 2009-03-20 18:51 -------- d-----w e:\documents and settings\verzao\Application Data\vlc(2)
2009-04-14 20:52 . 2009-04-14 20:52 54156 ---ha-w e:\windows\QTFont.qfn
2009-04-14 20:52 . 2009-04-14 20:52 1409 ----a-w e:\windows\QTFont.for
2009-04-14 19:41 . 2009-04-14 19:41 -------- d-----w E:\autorun.inf
2009-04-10 12:36 . 2009-04-10 12:36 96168 ----a-w e:\documents and settings\verzao\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-10 12:17 . 2009-04-10 12:17 -------- d-----w e:\documents and settings\verzao\Application Data\AdobeUM
2009-04-10 12:17 . 2009-03-20 18:49 -------- d-----w e:\documents and settings\verzao\Local Settings\Application Data\Adobe
2009-04-10 01:42 . 2009-04-16 21:49 664 ----a-w e:\windows\system32\d3d9caps.dat
2009-04-10 00:28 . 2009-04-10 00:28 -------- d-----w e:\documents and settings\verzao\Application Data\Malwarebytes
2009-04-10 00:28 . 2009-04-06 13:32 15504 ----a-w e:\windows\system32\drivers\mbam.sys
2009-04-10 00:28 . 2009-04-06 13:32 38496 ----a-w e:\windows\system32\drivers\mbamswissarmy.sys
2009-04-10 00:28 . 2009-04-10 00:28 -------- d-----w e:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-09 11:08 . 2009-04-09 11:09 -------- d-----w E:\rsit
2009-04-08 21:45 . 2009-04-08 21:45 -------- d-----w e:\windows\system32\LogFiles
2009-04-06 19:42 . 2009-04-06 19:47 -------- d-----w e:\windows\SHELLNEW
2009-04-06 19:42 . 2009-04-06 19:42 -------- d-----w e:\documents and settings\verzao\Local Settings\Application Data\Microsoft Help
2009-04-06 19:41 . 2009-04-06 19:38 -------- d-----w e:\documents and settings\All Users\Application Data\Microsoft Help
2009-04-06 19:41 . 2009-04-06 19:41 -------- d--h--r E:\MSOCache
2009-04-06 19:35 . 2009-04-06 19:35 -------- d-----w e:\documents and settings\verzao\Application Data\DAEMON Tools
2009-04-06 19:35 . 2009-04-06 19:35 -------- d-----w e:\documents and settings\verzao\Application Data\DAEMON Tools Pro
2009-04-06 19:34 . 2009-04-06 19:34 -------- d-----w e:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-04-06 19:29 . 2009-04-06 19:36 -------- d-----w e:\documents and settings\verzao\Application Data\DAEMON Tools Lite
2009-04-06 19:22 . 2009-04-06 19:22 717296 ----a-w e:\windows\system32\drivers\sptd.sys
2009-04-06 18:53 . 2009-04-10 15:02 -------- d-----w e:\documents and settings\verzao\Application Data\uTorrent
2009-04-05 23:49 . 2009-04-05 23:49 -------- d-----w e:\windows\system32\Logs
2009-04-05 21:53 . 2009-04-05 21:54 -------- d-----w e:\documents and settings\verzao\Application Data\dvdcss
2009-04-05 21:16 . 2009-04-05 21:16 -------- d-----w e:\windows\system32\config\systemprofile\Application Data\SACore
2009-04-05 20:58 . 2009-04-05 21:09 -------- d-----w e:\windows\system32\CatRoot_bak
2009-04-05 20:57 . 2008-06-14 17:59 272768 -c----w e:\windows\system32\dllcache\bthport.sys
2009-04-05 20:57 . 2008-06-14 17:59 272768 ------w e:\windows\system32\drivers\bthport.sys
2009-04-05 20:57 . 2008-08-14 13:44 2138112 -c----w e:\windows\system32\dllcache\ntkrnlmp.exe
2009-04-05 20:57 . 2008-08-14 13:44 2059776 -c----w e:\windows\system32\dllcache\ntkrnlpa.exe
2009-04-05 20:57 . 2008-08-14 13:44 2182400 -c----w e:\windows\system32\dllcache\ntoskrnl.exe
2009-04-05 20:57 . 2008-08-14 13:44 2017792 -c----w e:\windows\system32\dllcache\ntkrpamp.exe
2009-04-05 20:56 . 2008-10-24 11:10 453632 -c----w e:\windows\system32\dllcache\mrxsmb.sys
2009-04-05 20:56 . 2009-04-20 18:49 -------- d-----w e:\documents and settings\LocalService\Application Data\SACore
2009-04-02 22:26 . 2009-01-07 17:21 26144 ----a-w e:\windows\system32\spupdsvc.exe
2009-04-02 21:06 . 2009-04-06 20:25 -------- d-----w e:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-02 18:24 . 2009-04-02 18:24 0 ----a-w e:\windows\nsreg.dat
2009-04-02 18:23 . 2009-04-02 18:23 -------- d-----w e:\documents and settings\verzao\Local Settings\Application Data\Mozilla
2009-04-02 18:22 . 2004-08-03 21:08 26496 -c--a-w e:\windows\system32\dllcache\usbstor.sys
2009-04-01 23:47 . 2009-03-20 19:31 10544 ----a-w e:\windows\system32\Config.MPF
2009-04-01 23:05 . 2009-04-01 23:05 -------- d-----w e:\documents and settings\LocalService\Bureau
2009-04-01 23:04 . 2006-03-03 09:07 143360 ----a-w e:\windows\system32\dunzip32.dll
2009-04-01 23:04 . 2006-03-03 09:07 143360 ----a-w e:\windows\system32\dunzip32(2).dll
2009-04-01 23:02 . 2006-12-22 14:02 32008 ----a-w e:\windows\system32\drivers\mferkdk.sys
2009-04-01 23:02 . 2006-12-22 14:02 37480 ----a-w e:\windows\system32\drivers\mfesmfk.sys
2009-04-01 23:02 . 2006-12-22 14:02 34184 ----a-w e:\windows\system32\drivers\mfebopk.sys
2009-04-01 23:02 . 2006-12-22 14:02 71496 ----a-w e:\windows\system32\drivers\mfeavfk.sys
2009-04-01 23:02 . 2006-12-22 14:02 170408 ----a-w e:\windows\system32\drivers\mfehidk.sys
2009-04-01 23:02 . 2007-03-02 12:16 109608 ----a-w e:\windows\system32\drivers\Mpfp.sys
2009-04-01 23:00 . 2009-04-01 23:05 -------- d-----w e:\documents and settings\All Users\Application Data\McAfee

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-17 19:18 . 2009-04-17 19:18 7268 ----a-w E:\JavaRa.log
2009-04-17 19:18 . 2009-04-01 21:40 -------- d-----w e:\program files\Java
2009-04-17 19:04 . 2009-04-10 12:17 -------- d-----w e:\program files\Fichiers communs\Adobe
2009-04-10 15:29 . 2009-04-10 15:29 -------- d-----w e:\program files\CCCLEANER
2009-04-10 14:52 . 2009-04-06 19:33 -------- d-----w e:\program files\DAEMON Tools Toolbar
2009-04-10 00:28 . 2009-04-10 00:28 -------- d-----w e:\program files\Malwarebytes' Anti-Malware
2009-04-09 14:33 . 2009-04-09 09:11 -------- d-----w e:\program files\Trend Micro
2009-04-09 12:05 . 2009-04-09 12:05 -------- d-----w e:\program files\CCleaner
2009-04-06 21:11 . 2009-04-02 21:06 -------- d-----w e:\program files\Spybot - Search & Destroy
2009-04-06 20:32 . 2009-04-01 23:01 -------- d-----w e:\program files\McAfee
2009-04-06 19:48 . 2009-04-06 19:48 -------- d-----w e:\program files\Microsoft Works
2009-04-06 19:48 . 2009-04-06 19:48 -------- d-----w e:\program files\MSBuild
2009-04-06 19:46 . 2009-04-06 19:46 -------- d-----w e:\program files\Microsoft.NET
2009-04-06 19:34 . 2009-04-06 19:33 -------- d-----w e:\program files\DAEMON Tools Lite
2009-04-06 19:07 . 2009-04-06 19:07 -------- d-----w e:\program files\eMule
2009-04-06 18:53 . 2009-04-06 18:53 -------- d-----w e:\program files\uTorrent
2009-04-01 23:04 . 2009-04-01 23:01 -------- d-----w e:\program files\Fichiers communs\McAfee
2009-04-01 23:02 . 2009-04-01 23:01 -------- d-----w e:\program files\McAfee.com
2009-04-01 21:45 . 2009-04-01 21:45 -------- d-----w e:\documents and settings\All Users\Application Data\hpqwmi
2009-04-01 21:40 . 2009-04-01 21:22 -------- d-----w e:\program files\HPQ
2009-04-01 21:40 . 2009-04-01 20:56 -------- d--h--w e:\program files\InstallShield Installation Information
2009-04-01 21:40 . 2009-04-01 21:40 -------- d-----w e:\program files\Fichiers communs\Java
2009-04-01 21:39 . 2009-04-01 21:39 -------- d-----w e:\documents and settings\All Users\Application Data\InstallShield
2009-04-01 21:39 . 2009-04-01 20:56 -------- d-----w e:\program files\Fichiers communs\InstallShield
2009-04-01 21:38 . 2009-04-01 21:38 -------- d-----w e:\program files\Fichiers communs\TiVo Shared
2009-04-01 21:38 . 2009-04-01 21:38 -------- d-----w e:\program files\Sonic
2009-04-01 21:38 . 2009-04-01 21:38 -------- d-----w e:\program files\Fichiers communs\SureThing Shared
2009-04-01 21:37 . 2009-04-01 21:37 -------- d-----w e:\program files\Fichiers communs\Sonic Shared
2009-04-01 21:36 . 2009-04-01 21:36 1557 --sha-r e:\windows\system32\drivers\103C_HP_NTBK_Pavilion ZV6100 (EK843EA#ABF)_YN_0Pavi_QCND54103PT_EU_46_I3085_SHP_V42.3A_BF.1A_T050903_WXH2_L40C_M991_J100_7AMD_8Athlon 64_92.19_#090401_N10EC8139_(EK843EA#ABF)_XMOBILE_CN10_Z10024378_2F.1A_G.MRK
2009-04-01 21:29 . 2009-04-01 21:29 -------- d-----w e:\documents and settings\verzao\Application Data\Apple Computer
2009-04-01 21:29 . 2009-04-01 21:28 -------- d-----w e:\program files\QuickTime
2009-04-01 21:28 . 2009-04-01 20:39 79431 ----a-w e:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-01 21:28 . 2009-04-01 21:28 -------- d-----w e:\documents and settings\All Users\Application Data\QuickTime
2009-04-01 21:28 . 2009-04-01 21:28 -------- d-----w e:\program files\iPod
2009-04-01 21:28 . 2009-04-01 21:28 -------- d-----w e:\program files\iTunes
2009-04-01 21:28 . 2009-04-01 21:28 -------- d-----w e:\documents and settings\All Users\Application Data\Apple Computer
2009-04-01 21:27 . 2009-04-01 21:27 -------- d-----w e:\program files\Hp
2009-04-01 21:27 . 2009-04-01 21:27 -------- d-----w e:\program files\Hewlett-Packard
2009-04-01 21:26 . 2009-04-01 21:26 -------- d-----w e:\program files\CPQ
2009-04-01 21:25 . 2009-04-01 21:25 -------- d-----w e:\program files\InterVideo
2009-04-01 21:23 . 2009-04-01 21:23 129 ----a-w e:\documents and settings\verzao\Local Settings\Application Data\fusioncache.dat
2009-04-01 21:00 . 2009-04-01 21:00 -------- d-----w e:\program files\CONEXANT
2009-04-01 20:57 . 2009-04-01 20:57 -------- d-----w e:\program files\WIDCOMM
2009-04-01 20:56 . 2009-04-01 20:56 -------- d-----w e:\program files\AMD
2009-04-01 20:51 . 2009-04-01 20:51 -------- d-----w e:\program files\Fichiers communs\SupportSoft
2009-04-01 20:40 . 2009-04-01 20:40 -------- d-----w e:\program files\microsoft frontpage
2009-04-01 20:38 . 2009-04-01 20:38 -------- d-----w e:\program files\Services en ligne
2009-04-01 20:36 . 2009-04-01 20:36 21892 ----a-w e:\windows\system32\emptyregdb.dat
2009-03-20 19:34 . 2004-08-05 12:00 64052 ----a-w e:\windows\system32\perfc00C.dat
2009-03-20 19:34 . 2004-08-05 12:00 445672 ----a-w e:\windows\system32\perfh00C.dat
2009-03-20 19:12 . 2009-03-20 19:12 -------- d-----w e:\program files\Microsoft Silverlight
2009-03-20 19:06 . 2009-03-20 18:46 -------- d-----w e:\documents and settings\All Users\Application Data\SiteAdvisor
2009-03-20 18:51 . 2009-03-20 18:51 -------- d-----w e:\documents and settings\verzao\Application Data\vlc
2009-03-20 18:48 . 2009-04-17 20:34 -------- d-----w e:\program files\Fichiers communs\Softwin
2009-03-20 18:47 . 2009-04-18 01:04 -------- d-----w e:\program files\Microsoft CAPICOM 2.1.0.2
2009-03-20 18:45 . 2009-03-19 19:38 -------- d-----w e:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-03-20 18:45 . 2009-03-19 19:38 -------- d-----w e:\program files\Yahoo!
2009-03-19 21:36 . 2009-03-19 21:35 4920 ----a-w E:\UsbFix.txt
2009-03-08 03:34 . 2004-08-05 12:00 914944 ----a-w e:\windows\system32\wininet.dll
2009-03-08 03:34 . 2004-08-05 12:00 43008 ----a-w e:\windows\system32\licmgr10.dll
2009-03-08 03:33 . 2004-08-05 12:00 18944 ----a-w e:\windows\system32\corpol.dll
2009-03-08 03:33 . 2004-08-05 12:00 420352 ----a-w e:\windows\system32\vbscript.dll
2009-03-08 03:32 . 2004-08-05 12:00 72704 ----a-w e:\windows\system32\admparse.dll
2009-03-08 03:32 . 2004-08-05 12:00 71680 ----a-w e:\windows\system32\iesetup.dll
2009-03-08 03:31 . 2004-08-05 12:00 34816 ----a-w e:\windows\system32\imgutil.dll
2009-03-08 03:31 . 2004-08-05 12:00 48128 ----a-w e:\windows\system32\mshtmler.dll
2009-03-08 03:31 . 2004-08-05 12:00 45568 ----a-w e:\windows\system32\mshta.exe
2009-03-08 03:22 . 2004-08-05 12:00 156160 ----a-w e:\windows\system32\msls31.dll
2009-02-09 14:17 . 2004-08-05 12:00 1846400 ----a-w e:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="e:\program files\Messenger\msmsgs.exe" [2004-10-13 1767936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cpqset"="e:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 315454]
"HP Software Update"="e:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 122880]
"iTunesHelper"="e:\program files\iTunes\iTunesHelper.exe" [2004-10-13 356352]
"eabconfg.cpl"="e:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 372736]
"SunJavaUpdateSched"="e:\program files\Java\jre1.5.0_02\bin\jusched.exe" [2005-03-04 114799]
"hpWirelessAssistant"="e:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-11 876544]
"MskAgentexe"="e:\program files\McAfee\MSK\MskAgent.exe" [2007-01-17 254544]
"mcagent_exe"="e:\program files\McAfee.com\Agent\mcagent.exe" [BU]
"QuickTime Task"="e:\program files\QuickTime\qttask.exe" [2009-04-01 176128]

e:\documents and settings\verzao\Menu D‚marrer\Programmes\D‚marrage\
Notification de cadeaux MSN.lnk - e:\documents and settings\verzao\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2009-3-20 135680]

e:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - e:\program files\WIDCOMM\Logiciel Bluetooth\BTTray.exe [2004-12-23 651325]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\iTunes\\iTunes.exe"=
"e:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Windows Media Player\\wmsetsdk.exe"=
"e:\\Program Files\\HPQ\\Default Settings\\cpqset.exe"=
"e:\\Program Files\\uTorrent\\uTorrent.exe"=
"e:\\program files\\mcafee\\mpf\\mc\\mpfalert.exe"=
"e:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"e:\\Program Files\\Java\\jre1.5.0_02\\bin\\jucheck.exe"=
"e:\\PROGRA~1\\mcafee\\msc\\mcuimgr.exe"=
"e:\\Documents and Settings\\verzao\\Bureau\\RSIT.exe"=
"e:\\PROGRA~1\\mcafee\\msc\\mcupdmgr.exe"=
"e:\\Program Files\\QuickTime\\qttask.exe"=
"k:\\UsbFix\\Tools\\pv.exe"=
"e:\\Program Files\\HPQ\\shared\\hpqwmi.exe"=
"e:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"e:\\Program Files\\Java\\jre1.5.0_02\\bin\\jusched.exe"=
"e:\\Program Files\\iPod\\bin\\iPodService.exe"=
"e:\\Program Files\\Hp\\HP Software Update\\HPWuSchd2.exe"=
"e:\\Program Files\\iTunes\\iTunesHelper.exe"=
"e:\\Program Files\\Messenger\\msmsgs.exe"=

R2 0238711239050164mcinstcleanup;McAfee Application Installer Cleanup (0238711239050164); [x]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;e:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-02-11 210216]
S3 abp470n5;abp470n5; [x]
S3 HSFHWATI;HSFHWATI;e:\windows\system32\DRIVERS\HSFHWATI.sys [2005-03-22 200192]

.
Contenu du dossier 'Tâches planifiées'

2009-04-14 e:\windows\Tasks\McDefragTask.job
- e:\program files\mcafee\mqc\QcConsol.exe [2009-04-01 11:32]

2009-04-01 e:\windows\Tasks\McQcTask.job
- e:\program files\mcafee\mqc\QcConsol.exe [2009-04-01 11:32]
.
.
------- Examen supplémentaire -------
.
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
IE: E&xporter vers Microsoft Excel - e:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer à &Bluetooth - e:\program files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
FF - ProfilePath - e:\documents and settings\verzao\Application Data\Mozilla\Firefox\Profiles\vm07mdi4.default\
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://fr.msn.com/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - component: e:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: e:\program files\Java\jre1.5.0_02\bin\NPJava11.dll
FF - plugin: e:\program files\Java\jre1.5.0_02\bin\NPJava12.dll
FF - plugin: e:\program files\Java\jre1.5.0_02\bin\NPJava13.dll
FF - plugin: e:\program files\Java\jre1.5.0_02\bin\NPJava14.dll
FF - plugin: e:\program files\Java\jre1.5.0_02\bin\NPJava32.dll
FF - plugin: e:\program files\Java\jre1.5.0_02\bin\NPJPI150_02.dll
FF - plugin: e:\program files\Java\jre1.5.0_02\bin\NPOJI610.dll

---- PARAMETRES FIREFOX ----
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-20 20:52
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = e:\program files\HPQ\Default Settings\cpqset.exe????????????h????????? ???B?????????????hLC? ??????

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(728)
e:\program files\McAfee\MSK\mskoeplg.dll
e:\program files\McAfee\SiteAdvisor\saHook.dll
e:\windows\system32\ieframe.dll
e:\windows\system32\webcheck.dll
.
Heure de fin: 2009-04-20 20:53
ComboFix-quarantined-files.txt 2009-04-20 18:53
ComboFix2.txt 2009-04-16 19:16

Avant-CF: 55 992 979 456 octets libres
Après-CF: 55 939 530 752 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

280 --- E O F --- 2009-04-05 23:49


:)

hi!

Voila le rapport :

Logfile of random's system information tool 1.06 (written by random/random)
Run by verzao at 2009-04-22 22:28:07
Microsoft Windows XP Édition familiale Service Pack 2
System drive E: has 52 GB (80%) free of 65 GB
Total RAM: 990 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:20:43, on 10/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
E:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
E:\Program Files\McAfee\SiteAdvisor\McSACore.exe
E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
e:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
E:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
e:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
e:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
E:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
E:\Program Files\McAfee\MPF\MPFSrv.exe
E:\PROGRA~1\McAfee\MPS\mps.exe
E:\Program Files\McAfee\MSK\MskSrver.exe
E:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
E:\Program Files\iTunes\iTunesHelper.exe
E:\Program Files\QuickTime\qttask.exe
E:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
E:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
E:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
E:\Program Files\McAfee\MSK\MskAgent.exe
E:\Program Files\DAEMON Tools Lite\daemon.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
E:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
E:\Program Files\McAfee\MPS\mpsevh.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\Program Files\HPQ\shared\hpqwmi.exe
e:\PROGRA~1\mcafee\msc\mcuimgr.exe
E:\WINDOWS\system32\NOTEPAD.EXE
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Microsoft Office\Office12\WINWORD.EXE
E:\WINDOWS\system32\WISPTIS.EXE
C:\Hijackis\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - e:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - e:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - e:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - E:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Cpqset] E:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [HP Software Update] E:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] E:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] E:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] E:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [MskAgentexe] E:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [mcagent_exe] E:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SmartAccess AutoStart] "D:\SmartAccess\bcont_nm.exe" /url "D:\SmartAccess\common\snapins\restart\cl_restart_landing.htm" /language "en" /restart bcont.exe /starthidden
O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [cdoosoft] E:\WINDOWS\system32\olhrwef.exe
O4 - Global Startup: BTTray.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - E:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - e:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: McAfee Application Installer Cleanup (0238711239050164) (0238711239050164mcinstcleanup) - Unknown owner - E:\DOCUME~1\verzao\LOCALS~1\Temp\023871~1.EXE (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - E:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - E:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - E:\Program Files\HPQ\shared\hpqwmi.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - E:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - E:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - e:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - E:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - e:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - e:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - E:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - E:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - E:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - E:\Program Files\McAfee\MSK\MskSrver.exe

Ok merci! Je ferais ca dans le WE et te posterai le rapport!
En tout cas merci bcp pour ta patience, etc...!
:)

Hello :)!

Ah zut, j'ai pas pu lire ton message avant alors je te mets quand mm le rapport RSIT fait hier.
Et je te dirai pour le nouveau rapport USB fix!


Logfile of random's system information tool 1.06 (written by random/random)
Run by verzao at 2009-04-28 00:20:38
Microsoft Windows XP Édition familiale Service Pack 2
System drive E: has 54 GB (82%) free of 65 GB
Total RAM: 990 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:20:43, on 10/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
E:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
E:\Program Files\McAfee\SiteAdvisor\McSACore.exe
E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
e:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
E:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
e:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
e:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
E:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
E:\Program Files\McAfee\MPF\MPFSrv.exe
E:\PROGRA~1\McAfee\MPS\mps.exe
E:\Program Files\McAfee\MSK\MskSrver.exe
E:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
E:\Program Files\iTunes\iTunesHelper.exe
E:\Program Files\QuickTime\qttask.exe
E:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
E:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
E:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
E:\Program Files\McAfee\MSK\MskAgent.exe
E:\Program Files\DAEMON Tools Lite\daemon.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
E:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
E:\Program Files\McAfee\MPS\mpsevh.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\Program Files\HPQ\shared\hpqwmi.exe
e:\PROGRA~1\mcafee\msc\mcuimgr.exe
E:\WINDOWS\system32\NOTEPAD.EXE
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Microsoft Office\Office12\WINWORD.EXE
E:\WINDOWS\system32\WISPTIS.EXE
C:\Hijackis\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/...
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - e:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - e:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - e:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - E:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Cpqset] E:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [HP Software Update] E:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] E:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] E:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] E:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [MskAgentexe] E:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [mcagent_exe] E:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SmartAccess AutoStart] "D:\SmartAccess\bcont_nm.exe" /url "D:\SmartAccess\common\snapins\restart\cl_restart_landing.htm" /language "en" /restart bcont.exe /starthidden
O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [cdoosoft] E:\WINDOWS\system32\olhrwef.exe
O4 - Global Startup: BTTray.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - E:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - e:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: McAfee Application Installer Cleanup (0238711239050164) (0238711239050164mcinstcleanup) - Unknown owner - E:\DOCUME~1\verzao\LOCALS~1\Temp\023871~1.EXE (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - E:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - E:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - E:\Program Files\HPQ\shared\hpqwmi.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - E:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - E:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - e:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - E:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - e:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - e:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - E:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - E:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - E:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - E:\Program Files\McAfee\MSK\MskSrver.exe

Hello,

Voici USBFIX - Ca a pas mal planté durant le processus, j'ai du appuyer sur un message d'erreur "autorun.inf" et je crois que c'est a cause de ces deux fameuses clés USB...



############################## [ UsbFix V3.014 ]

# User : verzao (Administrateurs) # VERO
# Update on 27/04/09 by C_XX & Chiquitine29
# Start at: 22:12:20 | 28/04/2009

# AMD Athlon(tm) 64 Processor 3500+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : McAfee VirusScan [ (!) Disabled | Updated ]
# FW : McAfee Personal Firewall[ Enabled ]

# C:\ # Disque fixe local # 29,29 Go (14,39 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque fixe local # 63,86 Go (52,39 Go free) # NTFS
# F:\ # Disque amovible # 1,39 Go (0,06 Mo free) # FAT32
# G:\ # Disque CD-ROM
# H:\ # Disque amovible # 1,39 Go (18,91 Mo free) # FAT
# I:\ # Disque amovible # 499,72 Mo (329,38 Mo free) # FAT
# J:\ # Disque amovible # 499,72 Mo (329,38 Mo free) # FAT
# K:\ # Disque amovible # 953,72 Mo (724,19 Mo free) [KINGSTON] # FAT

############################## [ Processus actifs ]

E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\csrss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\logonui.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\userinit.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
E:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
E:\Program Files\McAfee\SiteAdvisor\McSACore.exe
E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
e:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
E:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
e:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
e:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
E:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
E:\Program Files\McAfee\MPF\MPFSrv.exe
E:\PROGRA~1\McAfee\MPS\mps.exe
E:\Program Files\McAfee\MSK\MskSrver.exe
E:\WINDOWS\system32\wdfmgr.exe
E:\Program Files\McAfee\MPS\mpsevh.exe
E:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Fichiers # Dossiers infectieux ]

F:\autorun.inf # -> fichier appelé : "F:\ sjpoc.cmd" ( absent ! )
Deleted ! F:\twgasc.exe
Deleted ! F:\autorun.inf
Deleted ! F:\hgwk.pif
H:\autorun.inf # -> fichier appelé : "H:\ omoo.pif" ( absent ! )
Deleted ! H:\srut.pif
Deleted ! H:\autorun.inf
Deleted ! H:\omoo.pif
(!) Not Deleted ! I:\autorun.inf
(!) Not Deleted ! J:\autorun.inf

################## [ Registre # Clés Run infectieuses ]

# HKLM\software\microsoft\security center\\ "AntiVirusDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\\ "AntiVirusOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\\ "FirewallOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\\ "UacDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\\ "UpdatesDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\Svc\\ "AntiVirusDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\Svc\\ "AntiVirusOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\Svc\\ "FirewallDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\Svc\\ "FirewallOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\Svc\\ "UacDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\Svc\\ "UpdatesDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKCU\SOFTWARE\...\CurrentVersion\Policies\System\\ "DisableRegistryTools"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKCU\SOFTWARE\...\CurrentVersion\Policies\System\\ "DisableTaskMgr"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !

################## [ Registre # Mountpoints2 ]

# -> Not Found !

################## [ Listing des fichiers présent ]

[29/03/2009 23:02|--a------|0] - C:\10b8ea1
[15/03/2009 23:58|--a------|840] - C:\aaw7boot.log
[15/03/2009 21:24|--a------|1052] - C:\aswBoot.log
[15/03/2009 21:26|--a------|0] - C:\AUTOEXEC.BAT
[01/04/2009 22:31|--a------|331] - C:\Boot.bak
[20/04/2009 20:50|-rahs----|401] - C:\boot.ini
[05/08/2004 14:00|-rahs----|4952] - C:\Bootfont.bin
[03/08/2004 23:00|--a------|263488] - C:\cmldr
[15/03/2009 21:26|--a------|0] - C:\CONFIG.SYS
[01/04/2009 23:24|--a------|31169] - C:\DNSP1.LOG
[01/04/2009 22:22|--ahs----|1038667776] - C:\hiberfil.sys
[01/04/2009 23:28|--a------|171] - C:\HSC.log
[15/03/2009 21:26|-rahs----|0] - C:\IO.SYS
[01/04/2009 23:34|--a------|161] - C:\mscuxp.log
[15/03/2009 21:26|-rahs----|0] - C:\MSDOS.SYS
[05/08/2004 14:00|-rahs----|47564] - C:\NTDETECT.COM
[05/08/2004 14:00|-rahs----|251712] - C:\ntldr
[01/04/2009 23:37|--a------|200] - C:\sedinst2.log
[01/04/2009 23:40|--a------|171] - C:\setup.log
[16/03/2009 23:59|--ah-----|268] - C:\sqmdata00.sqm
[01/04/2009 22:05|--ah-----|268] - C:\sqmdata01.sqm
[01/04/2009 22:18|--ah-----|268] - C:\sqmdata02.sqm
[16/03/2009 23:59|--ah-----|244] - C:\sqmnoopt00.sqm
[01/04/2009 22:05|--ah-----|244] - C:\sqmnoopt01.sqm
[01/04/2009 22:18|--ah-----|244] - C:\sqmnoopt02.sqm
[01/04/2009 23:40|--a------|24078] - C:\sunjava.log
[15/03/2009 23:39|--a------|190] - C:\syntp.log
[15/03/2009 23:03|--a------|32] - C:\ticrdbus.log
[20/04/2009 20:53|--a------|20678] - E:\ComboFix.txt
[17/04/2009 21:18|--a------|7268] - E:\JavaRa.log
[?|?|?] - E:\pagefile.sys
[28/04/2009 22:34|--a------|6199] - E:\UsbFix.txt
[09/03/2009 12:10|--a------|31455016] - F:\setupfre(2).exe
[05/08/2004 14:00|-r-hs----|359] - F:\autorun.inf
[28/04/2009 22:14|-r-hs----|173055] - F:\ppftvb.cmd
[19/03/2009 22:00|--a------|3050] - F:\BOOTEX.LOG
[28/04/2009 22:11|-r-hs----|173055] - F:\sjpoc.cmd
[25/01/2009 02:55|--a------|14881] - F:\Lucie.wpl
[17/11/2007 15:33|--a------|37888] - F:\Statuts Esquiva Brasil.doc
[17/11/2007 14:24|--a------|28672] - F:\Déclaration Initiale d'Association.doc
[01/03/2008 14:24|--a------|27136] - F:\Esquiva Brasil - projet déposé en prefecture.doc
[04/06/2008 13:38|--a------|314880] - F:\ESQUIVA BRASIL - projet pour Théâtre de l'Utopie.doc
[01/10/2008 15:59|--a------|22016] - F:\Hiya Secrétaire.doc
[25/10/2008 12:25|--a------|11045] - F:\La mise en forme.odt
[05/08/2004 14:00|-r-hs----|260] - H:\autorun.inf
[28/04/2009 22:14|-r-hs----|173055] - H:\hqvh.exe
[19/03/2009 22:00|--a------|1530] - H:\BOOTEX.LOG
[26/03/2009 22:05|--a------|741453824] - H:\Les Lois De L'attraction - Divx Fr.avi
[19/03/2009 22:01|-r-hs----|222207] - H:\wuuwkq.exe
[14/04/2009 20:18|--a------|366993408] - H:\The.Mentalist.S01E19.VOSTFR.HDTV.XviD-DRAGONS.avi
[14/04/2009 20:18|--a------|367003648] - H:\The.Mentalist.S01E18.VOSTFR.HDTV.XviD-DRAGONS.avi
[12/11/2008 09:42|--a------|118] - I:\autorun.inf
[07/11/2008 17:21|--a------|45] - I:\SMARTNotebookSE.bat
[12/11/2008 09:42|--a------|118] - J:\autorun.inf
[07/11/2008 17:21|--a------|45] - J:\SMARTNotebookSE.bat
[23/04/2009 10:42|--a------|361984] - K:\STOPzilla_Setup.exe
[15/04/2009 17:19|--a------|1886] - K:\monsauveur.txt
[19/03/2009 22:16|-r-hs----|222207] - K:\ehjlss.exe
[20/04/2009 11:36|--a------|132519] - K:\Réparer Windows XP.mht
[16/04/2009 21:20|--a------|18373] - K:\lograpportCombix.txt
[17/04/2009 22:32|--a------|296] - K:\WMPInfo.xml
[17/04/2009 22:33|--a------|55220] - K:\logRSIT.txt
[17/04/2009 21:24|--a------|7268] - K:\JavaRa.log
[17/04/2009 15:55|--a------|1770] - K:\17.0.09 comment ca marche.txt
[20/04/2009 11:18|--a------|253333] - K:\HELP! Ordi plante - Rapport Hijackthis.mht
[20/03/2009 20:45|--a------|688] - K:\script.txt
[22/03/2009 12:54|--a------|360448] - K:\_20090319.doc
[20/04/2009 20:55|--a------|20678] - K:\rapport combofix 200409.txt
[09/04/2009 13:15|--a------|47064] - K:\log.txt
[20/04/2009 14:25|--a------|1775] - K:\le sauveur du lundi.txt
[20/04/2009 20:56|--a------|54701] - K:\RSITtools.txt
[20/04/2009 21:06|--a------|5609] - K:\UsbFix200409.txt
[17/04/2009 22:33|--a------|26046816] - K:\bitdefender-free-edition_bitdefender_free_edition_10.0_francais_11128.exe
[20/04/2009 21:22|--a------|4227] - K:\UsbFix200409-2.txt
[22/04/2009 22:28|--a------|57596] - K:\RSIT220409.txt
[14/04/2009 21:47|--a------|56586] - K:\log RSIT 140409.txt
[09/04/2009 15:54|--a------|45935] - K:\logrsti.txt
[28/04/2009 00:21|--a------|57596] - K:\RSIT270409.txt
[28/04/2009 13:04|--a------|202] - K:\mon sauveur du mardi.txt
[09/04/2009 17:39|--a------|1031] - K:\reponse internet!.txt
[15/04/2009 17:11|--a------|334429] - K:\affich-11916968-help-ordi-plante-rapport-hijackthis.htm
[09/04/2009 18:21|--a------|169984] - K:\UltraMax_AMB-5185_NPA_Global_Launch.doc
[24/04/2009 11:14|--a------|4290] - K:\BOOTEX.LOG
[10/04/2009 16:43|--a------|1740] - K:\mbam-log-2009-04-10 (16-43-34).txt
[10/04/2009 16:44|--a------|1866] - K:\mbam-log-2009-04-10 (16-44-04).txt

################## [ Vaccination ]

# C:\autorun.inf -> Folder created by UsbFix.
# E:\autorun.inf -> Folder created by UsbFix.
# K:\autorun.inf -> Folder created by UsbFix.

################## [ Cracks / Keygens / Serials ]

# -> Nothing found !

################## [ ! Fin du rapport # UsbFix V3.014 ! ]


Je fais le reste des que possible et te soumet le rapport!
X :)

Ola!,

Alors les I, J et F sont les cles USB (deux st identiques et sont certainement celles qui m'ont infectees au debut).
Je ne sais pas si j'ai enleve la protection en ecriture car je ne sais comment faire??

Sinon, je reconfirme que je n'arrive pas a cceder a ce site via mon ordi, ca bloque!!Ni a ceux des antivirus!

Je pars pdt 10 jours la mais a mon retour, je ferais ce que tu m'as dit et collerai mon rapport!

Arggggggg, suis un vrai boulet, hein! hehe

A bientot!
:)

Salut! De retour...

Avec des mauvaises nouvelles : je n'ai pu acceder a AUCUN site, donc, je crois que mon ordi plante completement sur tout ce qui est antivirus, anti malware, spyware...

Que faire?

A +!!

Bonjour,

Désolée pour la réponse tardive, tout semble marcher maintenant, mais j'ai un message d'erreur qui s'affiche au départ et ensuite de temps en temps :
_______
Runtime Error!
Program: E:\Program Files\McAfee\MPF\MPFSrv.exe

R6002
Floating point not loaded
_______
Saurais-tu ce que c'est?
Merci et bonne journée!

Bon, je vais encore mettre une semaine à te répondre (suis pas chez moi en ce moment) pour le RSIT mais pour McAfee la réponse est oui, et c'est vraiment un antivirus de M****!

A +

Hello,

Donc, probleme pour acceder a Internet hier.

J'ai voulu lancer USB fix. Apres avoir fait l'option 1, je lance l'option 2 et la, l'ordi a bloqué sur "Killing : Firefox.exe".
Ensuite, l'ordi n'a pas arrete de rebooter en affichant "recuperation susteme, votre ordi va etre arrete dans 1:00 min".
Bref, j'ai plus accès à Internet et dès que je veux le lancer (internet), le message d'erreur de recuperation du systeme apparait.

Des suggestions?

A +

Super merci, je fais ca!

allright, fais ça en début de semaine prochaine!

Bon week-end à toi,

@ +

Donc, je n'etais pas la du WE, c'est pour ca que je ne l'ai fait que hier.

L'option 2 de Findykill ne marche pas, elle stoppe à "Killing Firefox.exe" et l'ordi plante!

Ensuite, ComboFix, c'est la meme, quand il veut preparer le rapport, l'ordi gele (pendant deux heures!!).

Sinon, dans la liste des problemes, Internet ne marche pas, ni IE ni Firefox ne veulent s'ouvrir.

Quand je veux lancer CCleaner, et lancer une analyse, l'ordi me dit qu'il faut que je ferme d'abord Firefox alors qu'il n'est meme pas ouvert!!

A +