Bonjour, J'espère que vous allez bien. Je rencontre de nombreux problèmes avec mon ordinateur depuis quelques temps. Pour commencer, je n'ai plus accès à mon gestionnaire des taches( lorsque je fais ctrl+alt+supp il est écrit que le gestionnaire des tâches a été désactivé par votre administrateur). Ensuite, il m'est - impossible d'installer un nouvel antivirus (l'ancien me causait trop problème !) - impossible de réaliser des scan en ligne sur tous les sites que j'ai essayé (pourtant, j'ai l'impression d'être OK du côté des activex, il y a peut-être quelque chose qui m'échappe) - Impossible de lancer sypbot - J'ai même eu droit à la page bleue apparaissant de façon ponctuelle faisant redémarrer mon ordi J'ai essayé de lancer quelques logiciels : - Malwarebytes (à chaque scan, j'ai l'impression que les mêmes fichiers douteux revenaient) - Ad-aware Voici ci-dessous un rapport hijackthis Merci d'avance de votre aide !! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 02:13:06, on 24/05/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE C:\Apps\ActivBoard\MMKeybd.exe C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe C:\apps\ActivSurf\4448364\Program\backweb-4448364.exe C:\WINDOWS\System32\rmctrl.exe C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\Program Files\MessengerPlus! 3\MsgPlus.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Fichiers communs\Real\Update_OB\rnathchk.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\QuickTime\QTTask.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\WiFiConnector\NintendoWFCReg.exe C:\Apps\ActivBoard\nhksrv.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Apps\ActivBoard\TrayMon.exe C:\Apps\ActivBoard\OSD.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\yixhdc.exe C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\xlsvt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file) O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe" O4 - HKLM\..\Run: [ActivSurf] C:\apps\ActivSurf\4448364\Program\backweb-4448364.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe" O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\System32\rmctrl.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [MoneyAgent] ""C:\Program Files\Microsoft Money\System\Money Express.exe"" O4 - HKCU\..\Run: [Update Service] "C:\Program Files\Fichiers communs\Teknum Systems\update.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab O16 - DPF: {1EA1F119-9BCB-4B95-84BB-2B49D00CE9DE} (MessengerStatsClient Class) - http://messenger.zonenxt.msn-int.com/binary/MessengerStatsClient.cab O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.gocyberlink.com/winxp/CheckDVD.cab O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {BEC31341-BE4C-4358-B79B-B89A5FCF8885} (Minesweeper Flags Class) - http://messenger.zonenxt.msn-int.com/binary/MineSweeper.cab O16 - DPF: {E3CE3CB2-A027-469F-9073-B9440036174F} (Checkers Class) - http://messenger.zonenxt.msn-int.com/binary/Checkers.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by1fd.bay1.hotmail.msn.com/activex/HMAtchmt.ocx O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Unknown owner - C:\Program Files\Norton Internet Security\SymProxySvc.exe (file missing) O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Salut , faut faire un script combo : [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\knbwwgw] "ServiceDll"="c:\windows\system32\eslwkuq.dll" conficker ..

Si c'est ça la cause de mon problème, pourquoi les programmes que je lance (usbfix pour ne citer que lui) ne fonctionnent pas ? Ai-je oublié quelque chose ?! Je passe toutes mes soirées à lancer des programmes et au final, l'infection semble s'étendre. Je ne sais vraiment plus quoi faire !

relance Combofix on va retenter un script que tu effectueras le net débranché

Bonjour gen, Pour être bien clair, tu veux que : - Je lance combofix avec CFScript le net débranché ? - Je lance combofix comme d'habitude net branché et ensuite dans un second temps lancement d'un nouveau scriipt le net débranché ?

oui pour l'instant relances Combofix le cable ethernet débranché

Voici le rapport de combofix avec CFScript avec cable ethernet débranché ComboFix 09-05-30.03 - solo & kad 01/06/2009 21:12.13 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.255.76 [GMT 2:00] Lancé depuis: c:\documents and settings\solo & kad\Bureau\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\solo & kad\Bureau\CFScript.txt FILE :: "c:\docume~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll" "c:\docume~1\SOLO&K~1\LOCALS~1\temp\miph.exe" "c:\docume~1\SOLO&K~1\LOCALS~1\temp\winglkuvf.exe" "c:\documents and settings\solo & kad\Local Settings\temp\IadHide3.dll" "c:\windows\system32\drivers\mfhnjq.sys" "c:\windows\system32\eslwkuq.dll" "E:\whwv.pif" "F:\trqfq.exe" . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll c:\documents and settings\solo & kad\Local Settings\temp\IadHide3.dll E:\whwv.pif F:\trqfq.exe . ---- Exécution préalable ------- . E:\whwv.pif F:\trqfq.exe . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ABP470N5 -------\Legacy_ABP470N5 -------\Service_abp470n5 ((((((((((((((((((((((((((((( Fichiers créés du 2009-05-01 au 2009-06-01 )))))))))))))))))))))))))))))))))))) . 2009-05-30 21:32 . 2009-05-30 21:33 -------- d-----w c:\program files\CCleaner 2009-05-30 20:41 . 2009-05-30 20:42 3371383 ----a-w c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2009-05-26 18:33 . 2009-05-31 11:48 -------- d-----w C:\rsit 2009-05-25 18:28 . 2009-05-25 18:28 -------- d-----w C:\_OTMoveIt 2009-05-25 15:31 . 2009-05-25 15:41 -------- d-----w C:\SDFix 2009-05-24 08:17 . 2005-07-26 04:39 60416 ------w c:\windows\system32\dllcache\colbact.dll 2009-05-24 08:17 . 2009-03-06 14:46 286208 ------w c:\windows\system32\dllcache\pdh.dll 2009-05-24 08:17 . 2009-02-09 10:20 473088 ------w c:\windows\system32\dllcache\fastprox.dll 2009-05-24 08:17 . 2009-02-06 16:54 35328 ------w c:\windows\system32\dllcache\sc.exe 2009-05-24 08:17 . 2009-02-06 16:39 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe 2009-05-24 08:17 . 2009-02-09 10:20 685056 ------w c:\windows\system32\dllcache\advapi32.dll 2009-05-24 08:17 . 2009-02-09 10:20 399360 ------w c:\windows\system32\dllcache\rpcss.dll 2009-05-24 08:17 . 2009-02-09 10:08 111104 ------w c:\windows\system32\dllcache\services.exe 2009-05-24 08:17 . 2009-02-09 10:20 739840 ------w c:\windows\system32\dllcache\ntdll.dll 2009-05-24 08:17 . 2009-02-09 10:20 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll 2009-05-24 08:16 . 2008-12-16 12:49 351232 ------w c:\windows\system32\dllcache\winhttp.dll 2009-05-24 08:16 . 2008-04-21 21:27 219136 ------w c:\windows\system32\dllcache\wordpad.exe 2009-05-24 00:12 . 2009-05-24 00:12 -------- d-----w c:\program files\Trend Micro 2009-05-23 08:15 . 2009-05-25 01:40 -------- d-----w c:\windows\system32\fr-fr 2009-05-22 23:56 . 2009-05-22 23:56 -------- d-----w c:\program files\ToniArts 2009-05-22 19:42 . 2009-05-22 19:42 -------- d-----w c:\documents and settings\solo & kad\Application Data\Yahoo! 2009-05-22 19:42 . 2009-05-22 19:52 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion 2009-05-22 19:42 . 2009-05-22 19:42 -------- d-----w c:\program files\Yahoo! 2009-05-16 21:07 . 2009-05-16 21:07 133 ----a-w c:\documents and settings\solo & kad\Local Settings\Application Data\fusioncache.dat 2009-05-16 21:07 . 2009-05-16 21:07 -------- d-----w c:\documents and settings\solo & kad\Local Settings\Application Data\ApplicationHistory 2009-05-12 22:26 . 2009-05-12 22:26 -------- d-----w c:\program files\Vilma 2009-05-12 21:06 . 2009-05-28 21:57 -------- d-----w c:\program files\Spybot - Search & Destroy 2009-05-12 21:06 . 2009-05-28 21:57 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-05-12 18:38 . 2009-05-12 18:38 -------- d-----w c:\documents and settings\solo & kad\Application Data\Malwarebytes 2009-05-12 18:38 . 2009-05-26 11:19 19096 ----a-w c:\windows\system32\drivers\mbam.sys 2009-05-12 18:38 . 2009-05-26 11:20 40160 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-05-12 18:38 . 2009-05-31 20:53 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-05-12 18:38 . 2009-05-12 18:38 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes 2009-05-11 20:33 . 2009-05-16 14:36 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-28 16:42 . 2002-09-10 10:36 77468 ----a-w c:\windows\system32\perfc00C.dat 2009-05-28 16:42 . 2002-09-10 10:36 473864 ----a-w c:\windows\system32\perfh00C.dat 2009-05-27 17:50 . 2003-03-22 09:58 57904 ----a-w c:\documents and settings\solo & kad\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-05-23 00:26 . 2003-01-15 07:08 -------- d-----w c:\program files\DesignPro 2000 2009-05-23 00:24 . 2007-04-30 22:45 -------- d-----w c:\program files\adslTV 2009-05-23 00:24 . 2003-03-27 21:16 -------- d-----w c:\program files\Fichiers communs\Symantec Shared 2009-05-23 00:21 . 2005-11-15 18:18 -------- d-----w c:\program files\BitComet 2009-05-22 23:56 . 2003-01-15 06:55 -------- d--h--w c:\program files\InstallShield Installation Information 2009-05-22 17:43 . 2003-03-27 21:16 -------- d-----w c:\program files\Symantec 2009-05-21 21:43 . 2004-07-21 21:06 10022 --sha-w c:\windows\system32\KGyGaAvL.sys 2009-04-13 22:33 . 2009-04-13 22:33 -------- d-----w c:\program files\Bonjour 2009-04-13 22:31 . 2009-04-13 22:29 -------- d-----w c:\program files\QuickTime 2009-04-06 21:14 . 2009-03-18 23:22 -------- d-----w c:\program files\QuickTime(2) 2009-04-06 21:14 . 2009-03-18 22:49 -------- d-----w c:\program files\Apple Software Update 2009-03-26 13:23 . 2009-04-13 22:23 1900544 ----a-w c:\windows\system32\usbaaplrc.dll 2009-03-26 13:23 . 2007-10-03 16:57 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys 2009-03-06 14:46 . 2004-05-03 06:59 286208 ----a-w c:\windows\system32\pdh.dll 2009-01-14 21:37 . 2006-03-31 21:13 67696 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2009-01-14 21:37 . 2006-03-31 21:13 54376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2009-01-14 21:37 . 2008-05-09 11:50 34952 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2009-01-14 21:37 . 2008-05-09 11:50 46720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2009-01-14 21:37 . 2006-03-31 21:13 172144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2001-07-25 192568] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "EM_EXEC"="c:\progra~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2002-01-28 35328] "ACTIVBOARD"="c:\apps\ActivBoard\MMKeybd.exe" [2002-06-19 262144] "ActivSurf"="c:\apps\ActivSurf\4448364\Program\backweb-4448364.exe" [2003-01-15 16384] "RemoteControl"="c:\windows\System32\rmctrl.exe" [2000-10-16 110592] "LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-12-14 532480] "LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-12-14 290816] "Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2006-09-13 177880] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 206232] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 251200] "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2003-12-13 225325] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-19 110592] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-19 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Lancer l'utilitaire d'enregistrement.lnk - c:\program files\WiFiConnector\NintendoWFCReg.exe [2006-2-6 1155072] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"= 1 (0x1) "DisableRegistryTools"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\MsgPlusLoader.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 "UacDisableNotify"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "UacDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\APPS\\ActivSurf\\4448364\\Program\\backWeb-4448364.exe"= c:\\apps\\ActivSurf\\4448364\\Program\\backweb-4448364.exe "c:\\Documents and Settings\\solo & kad\\Mes documents\\mircfr\\mircfr\\mirc.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\SPSSInc\\Statistics17\\statistics.com"= "c:\\Program Files\\SPSSInc\\Statistics17\\statistics.exe"= "c:\\Program Files\\SPSSInc\\Statistics17\\SPSSWinWrapIDE.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\WINDOWS\\System32\\rmctrl.exe"= "c:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"= "c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"= "c:\\Program Files\\Logitech\\Video\\FxSvr2.exe"= "c:\\Apps\\ActivBoard\\OSD.exe"= "c:\\Program Files\\Logitech\\Video\\LogiTray.exe"= "c:\\WINDOWS\\system32\\netsh.exe"= "c:\\Apps\\ActivBoard\\MMKeybd.exe"= "c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"= "c:\\divtools\\unzip\\unzip.exe"= "c:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIBVE.EXE"= "c:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe"= "c:\\Apps\\ActivBoard\\TrayMon.exe"= "c:\\Program Files\\Fichiers communs\\Real\\Update_OB\\rnathchk.exe"= "c:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe"= "c:\\Program Files\\Microsoft Money\\System\\urlmap.exe"= "c:\\Program Files\\Virtual CD v4 SDK\\system\\vcsplay.exe"= "c:\\Program Files\\iTunes\\iTunesHelper.exe"= "c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"= "c:\\Program Files\\QuickTime\\QTTask.exe"= "c:\\WINDOWS\\system32\\LVCOMSX.EXE"= c:\\WINDOWS\\system32\\LVComsX.exe "c:\\apps\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe"= "c:\\WINDOWS\\system32\\wuauclt.exe"= "c:\\Documents and Settings\\solo & kad\\Bureau\\OTMoveIt3.exe"= "c:\\Program Files\\Java\\jre6\\bin\\jucheck.exe"= "c:\\WINDOWS\\PEV.exe"= "c:\\WINDOWS\\system32\\CF12546.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "7593:TCP"= 7593:TCP:BitComet 7593 TCP "7593:UDP"= 7593:UDP:BitComet 7593 UDP "18207:TCP"= 18207:TCP:NortonAV "14790:TCP"= 14790:TCP:NortonAV "17053:TCP"= 17053:TCP:NortonAV "16428:TCP"= 16428:TCP:NortonAV "12094:TCP"= 12094:TCP:NortonAV "16161:TCP"= 16161:TCP:NortonAV "15154:TCP"= 15154:TCP:NortonAV "17769:TCP"= 17769:TCP:NortonAV "18615:TCP"= 18615:TCP:NortonAV "17099:TCP"= 17099:TCP:NortonAV "16624:TCP"= 16624:TCP:NortonAV "14042:TCP"= 14042:TCP:NortonAV "13501:TCP"= 13501:TCP:NortonAV "12666:TCP"= 12666:TCP:NortonAV "16570:TCP"= 16570:TCP:NortonAV "17502:TCP"= 17502:TCP:NortonAV "15401:TCP"= 15401:TCP:NortonAV "13048:TCP"= 13048:TCP:NortonAV "14708:TCP"= 14708:TCP:NortonAV "12292:TCP"= 12292:TCP:NortonAV "14257:TCP"= 14257:TCP:NortonAV "16535:TCP"= 16535:TCP:NortonAV "18739:TCP"= 18739:TCP:NortonAV "12163:TCP"= 12163:TCP:NortonAV "18148:TCP"= 18148:TCP:NortonAV "17868:TCP"= 17868:TCP:NortonAV "12943:TCP"= 12943:TCP:NortonAV "16101:TCP"= 16101:TCP:NortonAV "16251:TCP"= 16251:TCP:NortonAV "16753:TCP"= 16753:TCP:NortonAV "15336:TCP"= 15336:TCP:NortonAV "18647:TCP"= 18647:TCP:NortonAV "12632:TCP"= 12632:TCP:NortonAV "15170:TCP"= 15170:TCP:NortonAV "17090:TCP"= 17090:TCP:NortonAV "15836:TCP"= 15836:TCP:NortonAV "17166:TCP"= 17166:TCP:NortonAV "15233:TCP"= 15233:TCP:NortonAV "16990:TCP"= 16990:TCP:NortonAV "17075:TCP"= 17075:TCP:NortonAV "12489:TCP"= 12489:TCP:NortonAV "12933:TCP"= 12933:TCP:NortonAV "14226:TCP"= 14226:TCP:NortonAV "15048:TCP"= 15048:TCP:NortonAV "15247:TCP"= 15247:TCP:NortonAV "16454:TCP"= 16454:TCP:NortonAV "14550:TCP"= 14550:TCP:NortonAV "13250:TCP"= 13250:TCP:NortonAV "15433:TCP"= 15433:TCP:NortonAV "15524:TCP"= 15524:TCP:NortonAV "17694:TCP"= 17694:TCP:NortonAV "12374:TCP"= 12374:TCP:NortonAV "14274:TCP"= 14274:TCP:NortonAV "16379:TCP"= 16379:TCP:NortonAV "16610:TCP"= 16610:TCP:NortonAV "16062:TCP"= 16062:TCP:NortonAV "14002:TCP"= 14002:TCP:NortonAV "17939:TCP"= 17939:TCP:NortonAV "16422:TCP"= 16422:TCP:NortonAV "15837:TCP"= 15837:TCP:NortonAV "12238:TCP"= 12238:TCP:NortonAV "12756:TCP"= 12756:TCP:NortonAV "14745:TCP"= 14745:TCP:NortonAV "12059:TCP"= 12059:TCP:NortonAV "13540:TCP"= 13540:TCP:NortonAV "14504:TCP"= 14504:TCP:NortonAV "16185:TCP"= 16185:TCP:NortonAV "17627:TCP"= 17627:TCP:NortonAV "18380:TCP"= 18380:TCP:NortonAV "18906:TCP"= 18906:TCP:NortonAV "13762:TCP"= 13762:TCP:NortonAV "14045:TCP"= 14045:TCP:NortonAV "12887:TCP"= 12887:TCP:NortonAV "12719:TCP"= 12719:TCP:NortonAV "17875:TCP"= 17875:TCP:NortonAV "18757:TCP"= 18757:TCP:NortonAV "1851:TCP"= 1851:TCP:saeztun R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\FWDRV.SYS [19/03/2004 17:15 147456] R1 msikbd2k;Multimedia Keyboard Filter Driver;c:\windows\system32\drivers\Msikbd2k.sys [15/01/2003 09:03 6656] R3 STAC97NA;SigmaTel 3D Environmental Audio;c:\windows\system32\drivers\stac97na.sys [01/01/1980 01:00 296179] R3 STAC97NH;STAC97NH;c:\windows\system32\drivers\stac97nh.sys [01/01/1980 01:00 231983] S0 ommq;ommq;c:\windows\system32\drivers\mhhpuiv.sys --> c:\windows\system32\drivers\mhhpuiv.sys [?] S3 adiusbae;USB ADSL LAN Adapter;c:\windows\system32\DRIVERS\adiusbae.sys --> c:\windows\system32\DRIVERS\adiusbae.sys [?] S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.sys [18/06/2004 11:00 25244] S3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\drivers\fbxusb32.sys [13/05/2005 19:00 21344] --- Autres Services/Pilotes en mémoire --- *NewlyCreated* - ABP470N5 *Deregistered* - aawservice *Deregistered* - abp470n5 *Deregistered* - Apple Mobile Device *Deregistered* - AudioSrv *Deregistered* - BITS *Deregistered* - Browser *Deregistered* - BthServ *Deregistered* - C-DillaCdaC11BA *Deregistered* - CryptSvc *Deregistered* - DcomLaunch *Deregistered* - Dhcp *Deregistered* - Dnscache *Deregistered* - ERSvc *Deregistered* - EventSystem *Deregistered* - FastUserSwitchingCompatibility *Deregistered* - helpsvc *Deregistered* - HidServ *Deregistered* - HTTPFilter *Deregistered* - JavaQuickStarterService *Deregistered* - lanmanserver *Deregistered* - lanmanworkstation *Deregistered* - LmHosts *Deregistered* - MDM *Deregistered* - Netman *Deregistered* - nhksrv *Deregistered* - Nla *Deregistered* - NVSvc *Deregistered* - PolicyAgent *Deregistered* - ProtectedStorage *Deregistered* - RasAuto *Deregistered* - RasMan *Deregistered* - RpcSs *Deregistered* - SamSs *Deregistered* - Schedule *Deregistered* - seclogon *Deregistered* - SENS *Deregistered* - SharedAccess *Deregistered* - ShellHWDetection *Deregistered* - SLService *Deregistered* - Spooler *Deregistered* - srservice *Deregistered* - SSDPSRV *Deregistered* - stisvc *Deregistered* - sym_hi *Deregistered* - sym_u3 *Deregistered* - SYMTDI *Deregistered* - SymWSC *Deregistered* - TapiSrv *Deregistered* - Tcpip *Deregistered* - TermDD *Deregistered* - TermService *Deregistered* - Themes *Deregistered* - TosIde *Deregistered* - TrkWks *Deregistered* - ultra *Deregistered* - Update *Deregistered* - upnphost *Deregistered* - vcsmpdrv *Deregistered* - VCSSecS *Deregistered* - VgaSave *Deregistered* - viaagp *Deregistered* - ViaIde *Deregistered* - VolSnap *Deregistered* - W32Time *Deregistered* - Wanarp *Deregistered* - WebClient *Deregistered* - winmgmt *Deregistered* - WmiApSrv *Deregistered* - WS2IFSL *Deregistered* - wscsvc *Deregistered* - wuauserv *Deregistered* - WZCSVC . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 IE: {{1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - c:\apps\IECustom\script.htm DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab DPF: {1EA1F119-9BCB-4B95-84BB-2B49D00CE9DE} - hxxp://messenger.zonenxt.msn-int.com/binary/MessengerStatsClient.cab DPF: {8731163E-77B9-4F91-9122-F112521C28AF} - hxxp://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab DPF: {BEC31341-BE4C-4358-B79B-B89A5FCF8885} - hxxp://messenger.zonenxt.msn-int.com/binary/MineSweeper.cab DPF: {E3CE3CB2-A027-469F-9073-B9440036174F} - hxxp://messenger.zonenxt.msn-int.com/binary/Checkers.cab FF - ProfilePath - c:\documents and settings\solo & kad\Application Data\Mozilla\Firefox\Profiles\36a4s2zn.default\ FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-01 21:31 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-1907411925-840360825-1460304000-1007\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) @SACL= . ------------------------ Autres processus actifs ------------------------ . c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\apps\ActivBoard\nhksrv.exe c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\system32\drivers\CDAC11BA.EXE c:\program files\Java\jre6\bin\jqs.exe c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\slserv.exe c:\program files\Virtual CD v4 SDK\System\vcssecs.exe c:\windows\system32\rundll32.exe c:\windows\system32\rundll32.exe c:\apps\ActivBoard\Traymon.exe c:\apps\ActivBoard\osd.exe c:\program files\Fichiers communs\Real\Update_OB\rnathchk.exe c:\windows\system32\LVCOMSX.EXE c:\program files\Logitech\Video\FxSvr2.exe . ************************************************************************** . Heure de fin: 2009-06-01 22:13 - La machine a redémarré ComboFix-quarantined-files.txt 2009-06-01 20:13 ComboFix2.txt 2009-05-30 19:07 ComboFix3.txt 2009-05-28 23:22 ComboFix4.txt 2009-05-24 22:25 ComboFix5.txt 2009-05-30 19:54 Avant-CF: 7 108 489 216 octets libres Après-CF: 6 987 599 872 octets libres 412 --- E O F --- 2009-05-31 18:08

---> Télécharge et installe CCleaner (N'installe pas la Yahoo Toolbar) : * Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc.... * Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage. * Ensuite, choisis Registre, puis Chercher des erreurs. Une fois terminé, répare toutes les erreurs tant de fois qu il en trouve a l analyse * Veille a ce que dans les options le reglage soit au demarrage de windows et réglé sur "effacement securisé" 35 passes (guttman) __________________________________________________ ensuite relances rsit stp

Voici le rapport log.txt de RSIT Logfile of random's system information tool 1.06 (written by random/random) Run by solo & kad at 2009-06-01 23:20:41 Microsoft Windows XP Édition familiale Service Pack 2 System drive C: has 7 GB (9%) free of 74 GB Total RAM: 255 MB (23% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:20:57, on 01/06/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Apps\ActivBoard\nhksrv.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE C:\Apps\ActivBoard\MMKeybd.exe C:\WINDOWS\System32\rmctrl.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Logitech\Video\LogiTray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\Apps\ActivBoard\TrayMon.exe C:\Apps\ActivBoard\OSD.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Fichiers communs\Real\Update_OB\rnathchk.exe C:\Program Files\WiFiConnector\NintendoWFCReg.exe C:\WINDOWS\system32\LVComsX.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\WINDOWS\explorer.exe C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winptwb.exe C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winmytb.exe C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\vdjai.exe C:\Program Files\Microsoft Money\System\urlmap.exe C:\Documents and Settings\solo & kad\Bureau\RSIT.exe C:\Program Files\Trend Micro\HijackThis\solo & kad.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file) O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe O4 - HKLM\..\Run: [ActivSurf] C:\apps\ActivSurf\4448364\Program\backweb-4448364.exe O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\System32\rmctrl.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [MoneyAgent] ""C:\Program Files\Microsoft Money\System\Money Express.exe"" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab O16 - DPF: {1EA1F119-9BCB-4B95-84BB-2B49D00CE9DE} (MessengerStatsClient Class) - http://messenger.zonenxt.msn-int.com/binary/MessengerStatsClient.cab O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.gocyberlink.com/winxp/CheckDVD.cab O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {BEC31341-BE4C-4358-B79B-B89A5FCF8885} (Minesweeper Flags Class) - http://messenger.zonenxt.msn-int.com/binary/MineSweeper.cab O16 - DPF: {E3CE3CB2-A027-469F-9073-B9440036174F} (Checkers Class) - http://messenger.zonenxt.msn-int.com/binary/Checkers.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by1fd.bay1.hotmail.msn.com/activex/HMAtchmt.ocx O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab O20 - AppInit_DLLs: C:\WINDOWS\system32\MsgPlusLoader.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Unknown owner - C:\Program Files\Norton Internet Security\SymProxySvc.exe (file missing) O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

bon il est encore là .. :( j'ai envoyé un help

On va retenter un script comme ca : __________________________________________________________ =>/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement cet ordinateur,<= =>il est fort déconseillé de le transposer sur un autre ordinateur !<=====| --------------------------------------------------------------- Toujours avec toutes les protections désactivées, fais ceci : • Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes) • Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) : ---------------------------------------------------------- File:: C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winptwb.exe C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winmytb.exe C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\vdjai.exe C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windfdbf.exe C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windrlq.exe C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxwjxo.exe C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxrmsjx.exe C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winqdvccg.exe F:\trqfq.exe E:\whwv.pif Driver:: winptwb winmytb vdjai windfdbf windrlq winxwjxo winxrmsjx winqdvccg whwv trqfq Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=- "DisableRegistryTools"=- [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\WINDOWS\PEV.exe"="C:\WINDOWS\PEV.exe:*:Disabled:ipsec" "C:\WINDOWS\PEV.exe"=- "C:\WINDOWS\system32\CF12546.exe"=- "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winptwb.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winptwb.exe:*:Disabled:ipsec" "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winptwb.exe"=- "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windfdbf.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windfdbf.exe:*:Disabled:ipsec" "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windfdbf.exe"=- "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winmytb.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winmytb.exe:*:Disabled:ipsec" "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winmytb.exe"=- "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windrlq.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windrlq.exe:*:Disabled:ipsec" "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windrlq.exe"=- "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxwjxo.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxwjxo.exe:*:Disabled:ipsec" "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxwjxo.exe"=- "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxrmsjx.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxrmsjx.exe:*:Disabled:ipsec" "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxrmsjx.exe"=- "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winqdvccg.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winqdvccg.exe:*:Disabled:ipsec" "C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winqdvccg.exe"=- [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28fefb21-1640-11dd-9bdd-0020ed5dc423}\shell\AutOplAy\command] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28fefb21-1640-11dd-9bdd-0020ed5dc423}\shell\AutoRun\command] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28fefb21-1640-11dd-9bdd-0020ed5dc423}\shell\explOre\command] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28fefb21-1640-11dd-9bdd-0020ed5dc423}\shell\opEn\command] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb36465c-4860-11dd-9c42-0020ed5dc423}\shell\AUtOplAy\command] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb36465c-4860-11dd-9c42-0020ed5dc423}\shell\AutoRun\command] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb36465c-4860-11dd-9c42-0020ed5dc423}\shell\eXplOre\command] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb36465c-4860-11dd-9c42-0020ed5dc423}\shell\opEn\command] ------------------------------------------------------------------ • Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt • Quitte le Bloc Notes • Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) Comme ceci • Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé. • Une fois le scan achevé, un rapport va s'afficher: poste son contenu. • Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

Problème gestionnaire des tâches / Antivirus - Page 6

Réponse 101 / 233
Ororo Messages postés 115 Statut Membre

Si c'est ça la cause de mon problème, pourquoi les programmes que je lance (usbfix pour ne citer que lui) ne fonctionnent pas ?
Ai-je oublié quelque chose ?!

Je passe toutes mes soirées à lancer des programmes et au final, l'infection semble s'étendre.

Je ne sais vraiment plus quoi faire !
0
Réponse 102 / 233
gen-hackman

relance Combofix on va retenter un script que tu effectueras le net débranché
0
Réponse 103 / 233
Ororo Messages postés 115 Statut Membre

Bonjour gen,

Pour être bien clair, tu veux que :

- Je lance combofix avec CFScript le net débranché ?
- Je lance combofix comme d'habitude net branché et ensuite dans un second temps lancement d'un nouveau scriipt le net débranché ?
0
Réponse 104 / 233
gen-hackman

oui pour l'instant relances Combofix le cable ethernet débranché
0
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Réponse 105 / 233
Ororo Messages postés 115 Statut Membre

Voici le rapport de combofix avec CFScript avec cable ethernet débranché

ComboFix 09-05-30.03 - solo & kad 01/06/2009 21:12.13 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.255.76 [GMT 2:00]
Lancé depuis: c:\documents and settings\solo & kad\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\solo & kad\Bureau\CFScript.txt

FILE ::
"c:\docume~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll"
"c:\docume~1\SOLO&K~1\LOCALS~1\temp\miph.exe"
"c:\docume~1\SOLO&K~1\LOCALS~1\temp\winglkuvf.exe"
"c:\documents and settings\solo & kad\Local Settings\temp\IadHide3.dll"
"c:\windows\system32\drivers\mfhnjq.sys"
"c:\windows\system32\eslwkuq.dll"
"E:\whwv.pif"
"F:\trqfq.exe"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
c:\documents and settings\solo & kad\Local Settings\temp\IadHide3.dll
E:\whwv.pif
F:\trqfq.exe
.
---- Exécution préalable -------
.
E:\whwv.pif
F:\trqfq.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ABP470N5
-------\Legacy_ABP470N5
-------\Service_abp470n5

((((((((((((((((((((((((((((( Fichiers créés du 2009-05-01 au 2009-06-01 ))))))))))))))))))))))))))))))))))))
.

2009-05-30 21:32 . 2009-05-30 21:33 -------- d-----w c:\program files\CCleaner
2009-05-30 20:41 . 2009-05-30 20:42 3371383 ----a-w c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-05-26 18:33 . 2009-05-31 11:48 -------- d-----w C:\rsit
2009-05-25 18:28 . 2009-05-25 18:28 -------- d-----w C:\_OTMoveIt
2009-05-25 15:31 . 2009-05-25 15:41 -------- d-----w C:\SDFix
2009-05-24 08:17 . 2005-07-26 04:39 60416 ------w c:\windows\system32\dllcache\colbact.dll
2009-05-24 08:17 . 2009-03-06 14:46 286208 ------w c:\windows\system32\dllcache\pdh.dll
2009-05-24 08:17 . 2009-02-09 10:20 473088 ------w c:\windows\system32\dllcache\fastprox.dll
2009-05-24 08:17 . 2009-02-06 16:54 35328 ------w c:\windows\system32\dllcache\sc.exe
2009-05-24 08:17 . 2009-02-06 16:39 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-24 08:17 . 2009-02-09 10:20 685056 ------w c:\windows\system32\dllcache\advapi32.dll
2009-05-24 08:17 . 2009-02-09 10:20 399360 ------w c:\windows\system32\dllcache\rpcss.dll
2009-05-24 08:17 . 2009-02-09 10:08 111104 ------w c:\windows\system32\dllcache\services.exe
2009-05-24 08:17 . 2009-02-09 10:20 739840 ------w c:\windows\system32\dllcache\ntdll.dll
2009-05-24 08:17 . 2009-02-09 10:20 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-24 08:16 . 2008-12-16 12:49 351232 ------w c:\windows\system32\dllcache\winhttp.dll
2009-05-24 08:16 . 2008-04-21 21:27 219136 ------w c:\windows\system32\dllcache\wordpad.exe
2009-05-24 00:12 . 2009-05-24 00:12 -------- d-----w c:\program files\Trend Micro
2009-05-23 08:15 . 2009-05-25 01:40 -------- d-----w c:\windows\system32\fr-fr
2009-05-22 23:56 . 2009-05-22 23:56 -------- d-----w c:\program files\ToniArts
2009-05-22 19:42 . 2009-05-22 19:42 -------- d-----w c:\documents and settings\solo & kad\Application Data\Yahoo!
2009-05-22 19:42 . 2009-05-22 19:52 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-22 19:42 . 2009-05-22 19:42 -------- d-----w c:\program files\Yahoo!
2009-05-16 21:07 . 2009-05-16 21:07 133 ----a-w c:\documents and settings\solo & kad\Local Settings\Application Data\fusioncache.dat
2009-05-16 21:07 . 2009-05-16 21:07 -------- d-----w c:\documents and settings\solo & kad\Local Settings\Application Data\ApplicationHistory
2009-05-12 22:26 . 2009-05-12 22:26 -------- d-----w c:\program files\Vilma
2009-05-12 21:06 . 2009-05-28 21:57 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-12 21:06 . 2009-05-28 21:57 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-12 18:38 . 2009-05-12 18:38 -------- d-----w c:\documents and settings\solo & kad\Application Data\Malwarebytes
2009-05-12 18:38 . 2009-05-26 11:19 19096 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-12 18:38 . 2009-05-26 11:20 40160 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-12 18:38 . 2009-05-31 20:53 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-12 18:38 . 2009-05-12 18:38 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-11 20:33 . 2009-05-16 14:36 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-28 16:42 . 2002-09-10 10:36 77468 ----a-w c:\windows\system32\perfc00C.dat
2009-05-28 16:42 . 2002-09-10 10:36 473864 ----a-w c:\windows\system32\perfh00C.dat
2009-05-27 17:50 . 2003-03-22 09:58 57904 ----a-w c:\documents and settings\solo & kad\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-23 00:26 . 2003-01-15 07:08 -------- d-----w c:\program files\DesignPro 2000
2009-05-23 00:24 . 2007-04-30 22:45 -------- d-----w c:\program files\adslTV
2009-05-23 00:24 . 2003-03-27 21:16 -------- d-----w c:\program files\Fichiers communs\Symantec Shared
2009-05-23 00:21 . 2005-11-15 18:18 -------- d-----w c:\program files\BitComet
2009-05-22 23:56 . 2003-01-15 06:55 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-22 17:43 . 2003-03-27 21:16 -------- d-----w c:\program files\Symantec
2009-05-21 21:43 . 2004-07-21 21:06 10022 --sha-w c:\windows\system32\KGyGaAvL.sys
2009-04-13 22:33 . 2009-04-13 22:33 -------- d-----w c:\program files\Bonjour
2009-04-13 22:31 . 2009-04-13 22:29 -------- d-----w c:\program files\QuickTime
2009-04-06 21:14 . 2009-03-18 23:22 -------- d-----w c:\program files\QuickTime(2)
2009-04-06 21:14 . 2009-03-18 22:49 -------- d-----w c:\program files\Apple Software Update
2009-03-26 13:23 . 2009-04-13 22:23 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-03-26 13:23 . 2007-10-03 16:57 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-06 14:46 . 2004-05-03 06:59 286208 ----a-w c:\windows\system32\pdh.dll
2009-01-14 21:37 . 2006-03-31 21:13 67696 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2009-01-14 21:37 . 2006-03-31 21:13 54376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2009-01-14 21:37 . 2008-05-09 11:50 34952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2009-01-14 21:37 . 2008-05-09 11:50 46720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2009-01-14 21:37 . 2006-03-31 21:13 172144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2001-07-25 192568]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"EM_EXEC"="c:\progra~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2002-01-28 35328]
"ACTIVBOARD"="c:\apps\ActivBoard\MMKeybd.exe" [2002-06-19 262144]
"ActivSurf"="c:\apps\ActivSurf\4448364\Program\backweb-4448364.exe" [2003-01-15 16384]
"RemoteControl"="c:\windows\System32\rmctrl.exe" [2000-10-16 110592]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-12-14 532480]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-12-14 290816]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2006-09-13 177880]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 206232]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 251200]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2003-12-13 225325]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-19 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancer l'utilitaire d'enregistrement.lnk - c:\program files\WiFiConnector\NintendoWFCReg.exe [2006-2-6 1155072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\MsgPlusLoader.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\APPS\\ActivSurf\\4448364\\Program\\backWeb-4448364.exe"= c:\\apps\\ActivSurf\\4448364\\Program\\backweb-4448364.exe
"c:\\Documents and Settings\\solo & kad\\Mes documents\\mircfr\\mircfr\\mirc.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\SPSSInc\\Statistics17\\statistics.com"=
"c:\\Program Files\\SPSSInc\\Statistics17\\statistics.exe"=
"c:\\Program Files\\SPSSInc\\Statistics17\\SPSSWinWrapIDE.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\WINDOWS\\System32\\rmctrl.exe"=
"c:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=
"c:\\Program Files\\Logitech\\Video\\FxSvr2.exe"=
"c:\\Apps\\ActivBoard\\OSD.exe"=
"c:\\Program Files\\Logitech\\Video\\LogiTray.exe"=
"c:\\WINDOWS\\system32\\netsh.exe"=
"c:\\Apps\\ActivBoard\\MMKeybd.exe"=
"c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"=
"c:\\divtools\\unzip\\unzip.exe"=
"c:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIBVE.EXE"=
"c:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe"=
"c:\\Apps\\ActivBoard\\TrayMon.exe"=
"c:\\Program Files\\Fichiers communs\\Real\\Update_OB\\rnathchk.exe"=
"c:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe"=
"c:\\Program Files\\Microsoft Money\\System\\urlmap.exe"=
"c:\\Program Files\\Virtual CD v4 SDK\\system\\vcsplay.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\QuickTime\\QTTask.exe"=
"c:\\WINDOWS\\system32\\LVCOMSX.EXE"= c:\\WINDOWS\\system32\\LVComsX.exe
"c:\\apps\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe"=
"c:\\WINDOWS\\system32\\wuauclt.exe"=
"c:\\Documents and Settings\\solo & kad\\Bureau\\OTMoveIt3.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jucheck.exe"=
"c:\\WINDOWS\\PEV.exe"=
"c:\\WINDOWS\\system32\\CF12546.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7593:TCP"= 7593:TCP:BitComet 7593 TCP
"7593:UDP"= 7593:UDP:BitComet 7593 UDP
"18207:TCP"= 18207:TCP:NortonAV
"14790:TCP"= 14790:TCP:NortonAV
"17053:TCP"= 17053:TCP:NortonAV
"16428:TCP"= 16428:TCP:NortonAV
"12094:TCP"= 12094:TCP:NortonAV
"16161:TCP"= 16161:TCP:NortonAV
"15154:TCP"= 15154:TCP:NortonAV
"17769:TCP"= 17769:TCP:NortonAV
"18615:TCP"= 18615:TCP:NortonAV
"17099:TCP"= 17099:TCP:NortonAV
"16624:TCP"= 16624:TCP:NortonAV
"14042:TCP"= 14042:TCP:NortonAV
"13501:TCP"= 13501:TCP:NortonAV
"12666:TCP"= 12666:TCP:NortonAV
"16570:TCP"= 16570:TCP:NortonAV
"17502:TCP"= 17502:TCP:NortonAV
"15401:TCP"= 15401:TCP:NortonAV
"13048:TCP"= 13048:TCP:NortonAV
"14708:TCP"= 14708:TCP:NortonAV
"12292:TCP"= 12292:TCP:NortonAV
"14257:TCP"= 14257:TCP:NortonAV
"16535:TCP"= 16535:TCP:NortonAV
"18739:TCP"= 18739:TCP:NortonAV
"12163:TCP"= 12163:TCP:NortonAV
"18148:TCP"= 18148:TCP:NortonAV
"17868:TCP"= 17868:TCP:NortonAV
"12943:TCP"= 12943:TCP:NortonAV
"16101:TCP"= 16101:TCP:NortonAV
"16251:TCP"= 16251:TCP:NortonAV
"16753:TCP"= 16753:TCP:NortonAV
"15336:TCP"= 15336:TCP:NortonAV
"18647:TCP"= 18647:TCP:NortonAV
"12632:TCP"= 12632:TCP:NortonAV
"15170:TCP"= 15170:TCP:NortonAV
"17090:TCP"= 17090:TCP:NortonAV
"15836:TCP"= 15836:TCP:NortonAV
"17166:TCP"= 17166:TCP:NortonAV
"15233:TCP"= 15233:TCP:NortonAV
"16990:TCP"= 16990:TCP:NortonAV
"17075:TCP"= 17075:TCP:NortonAV
"12489:TCP"= 12489:TCP:NortonAV
"12933:TCP"= 12933:TCP:NortonAV
"14226:TCP"= 14226:TCP:NortonAV
"15048:TCP"= 15048:TCP:NortonAV
"15247:TCP"= 15247:TCP:NortonAV
"16454:TCP"= 16454:TCP:NortonAV
"14550:TCP"= 14550:TCP:NortonAV
"13250:TCP"= 13250:TCP:NortonAV
"15433:TCP"= 15433:TCP:NortonAV
"15524:TCP"= 15524:TCP:NortonAV
"17694:TCP"= 17694:TCP:NortonAV
"12374:TCP"= 12374:TCP:NortonAV
"14274:TCP"= 14274:TCP:NortonAV
"16379:TCP"= 16379:TCP:NortonAV
"16610:TCP"= 16610:TCP:NortonAV
"16062:TCP"= 16062:TCP:NortonAV
"14002:TCP"= 14002:TCP:NortonAV
"17939:TCP"= 17939:TCP:NortonAV
"16422:TCP"= 16422:TCP:NortonAV
"15837:TCP"= 15837:TCP:NortonAV
"12238:TCP"= 12238:TCP:NortonAV
"12756:TCP"= 12756:TCP:NortonAV
"14745:TCP"= 14745:TCP:NortonAV
"12059:TCP"= 12059:TCP:NortonAV
"13540:TCP"= 13540:TCP:NortonAV
"14504:TCP"= 14504:TCP:NortonAV
"16185:TCP"= 16185:TCP:NortonAV
"17627:TCP"= 17627:TCP:NortonAV
"18380:TCP"= 18380:TCP:NortonAV
"18906:TCP"= 18906:TCP:NortonAV
"13762:TCP"= 13762:TCP:NortonAV
"14045:TCP"= 14045:TCP:NortonAV
"12887:TCP"= 12887:TCP:NortonAV
"12719:TCP"= 12719:TCP:NortonAV
"17875:TCP"= 17875:TCP:NortonAV
"18757:TCP"= 18757:TCP:NortonAV
"1851:TCP"= 1851:TCP:saeztun

R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\FWDRV.SYS [19/03/2004 17:15 147456]
R1 msikbd2k;Multimedia Keyboard Filter Driver;c:\windows\system32\drivers\Msikbd2k.sys [15/01/2003 09:03 6656]
R3 STAC97NA;SigmaTel 3D Environmental Audio;c:\windows\system32\drivers\stac97na.sys [01/01/1980 01:00 296179]
R3 STAC97NH;STAC97NH;c:\windows\system32\drivers\stac97nh.sys [01/01/1980 01:00 231983]
S0 ommq;ommq;c:\windows\system32\drivers\mhhpuiv.sys --> c:\windows\system32\drivers\mhhpuiv.sys [?]
S3 adiusbae;USB ADSL LAN Adapter;c:\windows\system32\DRIVERS\adiusbae.sys --> c:\windows\system32\DRIVERS\adiusbae.sys [?]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.sys [18/06/2004 11:00 25244]
S3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\drivers\fbxusb32.sys [13/05/2005 19:00 21344]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - ABP470N5
*Deregistered* - aawservice
*Deregistered* - abp470n5
*Deregistered* - Apple Mobile Device
*Deregistered* - AudioSrv
*Deregistered* - BITS
*Deregistered* - Browser
*Deregistered* - BthServ
*Deregistered* - C-DillaCdaC11BA
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTPFilter
*Deregistered* - JavaQuickStarterService
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MDM
*Deregistered* - Netman
*Deregistered* - nhksrv
*Deregistered* - Nla
*Deregistered* - NVSvc
*Deregistered* - PolicyAgent
*Deregistered* - ProtectedStorage
*Deregistered* - RasAuto
*Deregistered* - RasMan
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SLService
*Deregistered* - Spooler
*Deregistered* - srservice
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - sym_hi
*Deregistered* - sym_u3
*Deregistered* - SYMTDI
*Deregistered* - SymWSC
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TosIde
*Deregistered* - TrkWks
*Deregistered* - ultra
*Deregistered* - Update
*Deregistered* - upnphost
*Deregistered* - vcsmpdrv
*Deregistered* - VCSSecS
*Deregistered* - VgaSave
*Deregistered* - viaagp
*Deregistered* - ViaIde
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - WmiApSrv
*Deregistered* - WS2IFSL
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - c:\apps\IECustom\script.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1EA1F119-9BCB-4B95-84BB-2B49D00CE9DE} - hxxp://messenger.zonenxt.msn-int.com/binary/MessengerStatsClient.cab
DPF: {8731163E-77B9-4F91-9122-F112521C28AF} - hxxp://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab
DPF: {BEC31341-BE4C-4358-B79B-B89A5FCF8885} - hxxp://messenger.zonenxt.msn-int.com/binary/MineSweeper.cab
DPF: {E3CE3CB2-A027-469F-9073-B9440036174F} - hxxp://messenger.zonenxt.msn-int.com/binary/Checkers.cab
FF - ProfilePath - c:\documents and settings\solo & kad\Application Data\Mozilla\Firefox\Profiles\36a4s2zn.default\
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-01 21:31
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1907411925-840360825-1460304000-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@SACL=
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\apps\ActivBoard\nhksrv.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\slserv.exe
c:\program files\Virtual CD v4 SDK\System\vcssecs.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\apps\ActivBoard\Traymon.exe
c:\apps\ActivBoard\osd.exe
c:\program files\Fichiers communs\Real\Update_OB\rnathchk.exe
c:\windows\system32\LVCOMSX.EXE
c:\program files\Logitech\Video\FxSvr2.exe
.
**************************************************************************
.
Heure de fin: 2009-06-01 22:13 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-01 20:13
ComboFix2.txt 2009-05-30 19:07
ComboFix3.txt 2009-05-28 23:22
ComboFix4.txt 2009-05-24 22:25
ComboFix5.txt 2009-05-30 19:54

Avant-CF: 7 108 489 216 octets libres
Après-CF: 6 987 599 872 octets libres

412 --- E O F --- 2009-05-31 18:08
0
Réponse 106 / 233
gen-hackman

---> Télécharge et installe CCleaner (N'installe pas la Yahoo Toolbar) :

* Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage.
* Ensuite, choisis Registre, puis Chercher des erreurs. Une fois terminé, répare toutes les erreurs tant de fois qu il en trouve a l analyse
* Veille a ce que dans les options le reglage soit au demarrage de windows et réglé sur "effacement securisé" 35 passes (guttman)
__________________________________________________
ensuite relances rsit stp
0
Réponse 107 / 233
Ororo Messages postés 115 Statut Membre

Voici le rapport log.txt de RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by solo & kad at 2009-06-01 23:20:41
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 7 GB (9%) free of 74 GB
Total RAM: 255 MB (23% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:20:57, on 01/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Apps\ActivBoard\nhksrv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Apps\ActivBoard\MMKeybd.exe
C:\WINDOWS\System32\rmctrl.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Apps\ActivBoard\TrayMon.exe
C:\Apps\ActivBoard\OSD.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\rnathchk.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\explorer.exe
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winptwb.exe
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winmytb.exe
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\vdjai.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Documents and Settings\solo & kad\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\solo & kad.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe
O4 - HKLM\..\Run: [ActivSurf] C:\apps\ActivSurf\4448364\Program\backweb-4448364.exe
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\System32\rmctrl.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MoneyAgent] ""C:\Program Files\Microsoft Money\System\Money Express.exe""
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {1EA1F119-9BCB-4B95-84BB-2B49D00CE9DE} (MessengerStatsClient Class) - http://messenger.zonenxt.msn-int.com/binary/MessengerStatsClient.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.gocyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {BEC31341-BE4C-4358-B79B-B89A5FCF8885} (Minesweeper Flags Class) - http://messenger.zonenxt.msn-int.com/binary/MineSweeper.cab
O16 - DPF: {E3CE3CB2-A027-469F-9073-B9440036174F} (Checkers Class) - http://messenger.zonenxt.msn-int.com/binary/Checkers.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by1fd.bay1.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\MsgPlusLoader.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Unknown owner - C:\Program Files\Norton Internet Security\SymProxySvc.exe (file missing)
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
0
Réponse 108 / 233
gen-hackman

bon il est encore là .. :(

j'ai envoyé un help
0
Réponse 109 / 233
gen-hackman

On va retenter un script comme ca :

__________________________________________________________
=>/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement cet ordinateur,<=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=====|
---------------------------------------------------------------

Toujours avec toutes les protections désactivées, fais ceci :

• Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
• Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

----------------------------------------------------------
File::
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winptwb.exe
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winmytb.exe
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\vdjai.exe
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windfdbf.exe
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windrlq.exe
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxwjxo.exe
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxrmsjx.exe
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winqdvccg.exe
F:\trqfq.exe
E:\whwv.pif

Driver::
winptwb
winmytb
vdjai
windfdbf
windrlq
winxwjxo
winxrmsjx
winqdvccg
whwv
trqfq

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=""
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=-
"DisableRegistryTools"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\PEV.exe"="C:\WINDOWS\PEV.exe:*:Disabled:ipsec"
"C:\WINDOWS\PEV.exe"=-
"C:\WINDOWS\system32\CF12546.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winptwb.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winptwb.exe:*:Disabled:ipsec"
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winptwb.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windfdbf.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windfdbf.exe:*:Disabled:ipsec"
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windfdbf.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winmytb.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winmytb.exe:*:Disabled:ipsec"
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winmytb.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windrlq.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windrlq.exe:*:Disabled:ipsec"
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\windrlq.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxwjxo.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxwjxo.exe:*:Disabled:ipsec"
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxwjxo.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxrmsjx.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxrmsjx.exe:*:Disabled:ipsec"
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winxrmsjx.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winqdvccg.exe"="C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winqdvccg.exe:*:Disabled:ipsec"
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winqdvccg.exe"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28fefb21-1640-11dd-9bdd-0020ed5dc423}\shell\AutOplAy\command]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28fefb21-1640-11dd-9bdd-0020ed5dc423}\shell\AutoRun\command]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28fefb21-1640-11dd-9bdd-0020ed5dc423}\shell\explOre\command]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28fefb21-1640-11dd-9bdd-0020ed5dc423}\shell\opEn\command]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb36465c-4860-11dd-9c42-0020ed5dc423}\shell\AUtOplAy\command]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb36465c-4860-11dd-9c42-0020ed5dc423}\shell\AutoRun\command]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb36465c-4860-11dd-9c42-0020ed5dc423}\shell\eXplOre\command]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb36465c-4860-11dd-9c42-0020ed5dc423}\shell\opEn\command]
------------------------------------------------------------------

• Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
• Quitte le Bloc Notes

• Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) Comme ceci

• Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
• Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
• Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt
0
Réponse 110 / 233
Ororo Messages postés 115 Statut Membre

Voici le rapport avec CFScript

ComboFix 09-05-30.03 - solo & kad 02/06/2009 1:58.16 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.255.98 [GMT 2:00]
Lancé depuis: c:\documents and settings\solo & kad\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\solo & kad\Bureau\CFScript.txt

FILE ::
"c:\docume~1\SOLO&K~1\LOCALS~1\Temp\vdjai.exe"
"c:\docume~1\SOLO&K~1\LOCALS~1\Temp\windfdbf.exe"
"c:\docume~1\SOLO&K~1\LOCALS~1\Temp\windrlq.exe"
"c:\docume~1\SOLO&K~1\LOCALS~1\Temp\winmytb.exe"
"c:\docume~1\SOLO&K~1\LOCALS~1\Temp\winptwb.exe"
"c:\docume~1\SOLO&K~1\LOCALS~1\Temp\winqdvccg.exe"
"c:\docume~1\SOLO&K~1\LOCALS~1\Temp\winxrmsjx.exe"
"c:\docume~1\SOLO&K~1\LOCALS~1\Temp\winxwjxo.exe"
"E:\whwv.pif"
"F:\trqfq.exe"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
c:\documents and settings\solo & kad\Local Settings\temp\IadHide3.dll
E:\whwv.pif
F:\trqfq.exe
.
---- Exécution préalable -------
.
c:\docume~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
c:\docume~1\SOLO&K~1\LOCALS~1\Temp\vdjai.exe
c:\docume~1\SOLO&K~1\LOCALS~1\Temp\winmytb.exe
c:\docume~1\SOLO&K~1\LOCALS~1\Temp\winptwb.exe
c:\documents and settings\solo & kad\Local Settings\temp\IadHide3.dll
E:\whwv.pif
F:\trqfq.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-05-02 au 2009-06-02 ))))))))))))))))))))))))))))))))))))
.

2009-06-01 20:56 . 2009-06-01 20:57 -------- d-----w c:\program files\CCleaner
2009-05-30 20:41 . 2009-05-30 20:42 3371383 ----a-w c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-05-26 18:33 . 2009-06-01 21:21 -------- d-----w C:\rsit
2009-05-25 18:28 . 2009-05-25 18:28 -------- d-----w C:\_OTMoveIt
2009-05-25 15:31 . 2009-05-25 15:41 -------- d-----w C:\SDFix
2009-05-24 08:17 . 2005-07-26 04:39 60416 ------w c:\windows\system32\dllcache\colbact.dll
2009-05-24 08:17 . 2009-03-06 14:46 286208 ------w c:\windows\system32\dllcache\pdh.dll
2009-05-24 08:17 . 2009-02-09 10:20 473088 ------w c:\windows\system32\dllcache\fastprox.dll
2009-05-24 08:17 . 2009-02-06 16:54 35328 ------w c:\windows\system32\dllcache\sc.exe
2009-05-24 08:17 . 2009-02-06 16:39 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-24 08:17 . 2009-02-09 10:20 685056 ------w c:\windows\system32\dllcache\advapi32.dll
2009-05-24 08:17 . 2009-02-09 10:20 399360 ------w c:\windows\system32\dllcache\rpcss.dll
2009-05-24 08:17 . 2009-02-09 10:08 111104 ------w c:\windows\system32\dllcache\services.exe
2009-05-24 08:17 . 2009-02-09 10:20 739840 ------w c:\windows\system32\dllcache\ntdll.dll
2009-05-24 08:17 . 2009-02-09 10:20 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-24 08:16 . 2008-12-16 12:49 351232 ------w c:\windows\system32\dllcache\winhttp.dll
2009-05-24 08:16 . 2008-04-21 21:27 219136 ------w c:\windows\system32\dllcache\wordpad.exe
2009-05-24 00:12 . 2009-05-24 00:12 -------- d-----w c:\program files\Trend Micro
2009-05-23 08:15 . 2009-05-25 01:40 -------- d-----w c:\windows\system32\fr-fr
2009-05-22 23:56 . 2009-05-22 23:56 -------- d-----w c:\program files\ToniArts
2009-05-22 19:42 . 2009-05-22 19:42 -------- d-----w c:\documents and settings\solo & kad\Application Data\Yahoo!
2009-05-22 19:42 . 2009-05-22 19:52 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-22 19:42 . 2009-05-22 19:42 -------- d-----w c:\program files\Yahoo!
2009-05-16 21:07 . 2009-05-16 21:07 133 ----a-w c:\documents and settings\solo & kad\Local Settings\Application Data\fusioncache.dat
2009-05-16 21:07 . 2009-05-16 21:07 -------- d-----w c:\documents and settings\solo & kad\Local Settings\Application Data\ApplicationHistory
2009-05-12 22:26 . 2009-05-12 22:26 -------- d-----w c:\program files\Vilma
2009-05-12 21:06 . 2009-05-28 21:57 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-12 21:06 . 2009-05-28 21:57 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-12 18:38 . 2009-05-12 18:38 -------- d-----w c:\documents and settings\solo & kad\Application Data\Malwarebytes
2009-05-12 18:38 . 2009-05-26 11:19 19096 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-12 18:38 . 2009-05-26 11:20 40160 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-12 18:38 . 2009-05-31 20:53 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-12 18:38 . 2009-05-12 18:38 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-11 20:33 . 2009-05-16 14:36 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-28 16:42 . 2002-09-10 10:36 77468 ----a-w c:\windows\system32\perfc00C.dat
2009-05-28 16:42 . 2002-09-10 10:36 473864 ----a-w c:\windows\system32\perfh00C.dat
2009-05-27 17:50 . 2003-03-22 09:58 57904 ----a-w c:\documents and settings\solo & kad\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-23 00:26 . 2003-01-15 07:08 -------- d-----w c:\program files\DesignPro 2000
2009-05-23 00:24 . 2007-04-30 22:45 -------- d-----w c:\program files\adslTV
2009-05-23 00:24 . 2003-03-27 21:16 -------- d-----w c:\program files\Fichiers communs\Symantec Shared
2009-05-23 00:21 . 2005-11-15 18:18 -------- d-----w c:\program files\BitComet
2009-05-22 23:56 . 2003-01-15 06:55 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-22 17:43 . 2003-03-27 21:16 -------- d-----w c:\program files\Symantec
2009-05-21 21:43 . 2004-07-21 21:06 10022 --sha-w c:\windows\system32\KGyGaAvL.sys
2009-04-13 22:33 . 2009-04-13 22:33 -------- d-----w c:\program files\Bonjour
2009-04-13 22:31 . 2009-04-13 22:29 -------- d-----w c:\program files\QuickTime
2009-04-06 21:14 . 2009-03-18 23:22 -------- d-----w c:\program files\QuickTime(2)
2009-04-06 21:14 . 2009-03-18 22:49 -------- d-----w c:\program files\Apple Software Update
2009-03-26 13:23 . 2009-04-13 22:23 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-03-26 13:23 . 2007-10-03 16:57 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-06 14:46 . 2004-05-03 06:59 286208 ----a-w c:\windows\system32\pdh.dll
2009-01-14 21:37 . 2006-03-31 21:13 67696 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2009-01-14 21:37 . 2006-03-31 21:13 54376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2009-01-14 21:37 . 2008-05-09 11:50 34952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2009-01-14 21:37 . 2008-05-09 11:50 46720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2009-01-14 21:37 . 2006-03-31 21:13 172144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-06-01_19.33.13 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-02 00:12 . 2009-06-02 00:12 16384 c:\windows\Temp\Perflib_Perfdata_680.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2001-07-25 192568]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"EM_EXEC"="c:\progra~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2002-01-28 35328]
"ACTIVBOARD"="c:\apps\ActivBoard\MMKeybd.exe" [2002-06-19 262144]
"ActivSurf"="c:\apps\ActivSurf\4448364\Program\backweb-4448364.exe" [2003-01-15 16384]
"RemoteControl"="c:\windows\System32\rmctrl.exe" [2000-10-16 110592]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-12-14 532480]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-12-14 290816]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2006-09-13 177880]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 206232]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 251200]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2003-12-13 225325]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-19 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\APPS\\ActivSurf\\4448364\\Program\\backWeb-4448364.exe"= c:\\apps\\ActivSurf\\4448364\\Program\\backweb-4448364.exe
"c:\\Documents and Settings\\solo & kad\\Mes documents\\mircfr\\mircfr\\mirc.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\SPSSInc\\Statistics17\\statistics.com"=
"c:\\Program Files\\SPSSInc\\Statistics17\\statistics.exe"=
"c:\\Program Files\\SPSSInc\\Statistics17\\SPSSWinWrapIDE.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\WINDOWS\\System32\\rmctrl.exe"=
"c:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=
"c:\\Program Files\\Logitech\\Video\\FxSvr2.exe"=
"c:\\Apps\\ActivBoard\\OSD.exe"=
"c:\\Program Files\\Logitech\\Video\\LogiTray.exe"=
"c:\\WINDOWS\\system32\\netsh.exe"=
"c:\\Apps\\ActivBoard\\MMKeybd.exe"=
"c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"=
"c:\\divtools\\unzip\\unzip.exe"=
"c:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIBVE.EXE"=
"c:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe"=
"c:\\Apps\\ActivBoard\\TrayMon.exe"=
"c:\\Program Files\\Fichiers communs\\Real\\Update_OB\\rnathchk.exe"=
"c:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe"=
"c:\\Program Files\\Microsoft Money\\System\\urlmap.exe"=
"c:\\Program Files\\Virtual CD v4 SDK\\system\\vcsplay.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\QuickTime\\QTTask.exe"=
"c:\\WINDOWS\\system32\\LVCOMSX.EXE"= c:\\WINDOWS\\system32\\LVComsX.exe
"c:\\apps\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe"=
"c:\\WINDOWS\\system32\\wuauclt.exe"=
"c:\\Documents and Settings\\solo & kad\\Bureau\\OTMoveIt3.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jucheck.exe"=
"c:\\WINDOWS\\PEV.exe"=
"c:\\PROGRA~1\\MOUSEW~1\\SYSTEM\\EM_EXEC.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7593:TCP"= 7593:TCP:BitComet 7593 TCP
"7593:UDP"= 7593:UDP:BitComet 7593 UDP
"18207:TCP"= 18207:TCP:NortonAV
"14790:TCP"= 14790:TCP:NortonAV
"17053:TCP"= 17053:TCP:NortonAV
"16428:TCP"= 16428:TCP:NortonAV
"12094:TCP"= 12094:TCP:NortonAV
"16161:TCP"= 16161:TCP:NortonAV
"15154:TCP"= 15154:TCP:NortonAV
"17769:TCP"= 17769:TCP:NortonAV
"18615:TCP"= 18615:TCP:NortonAV
"17099:TCP"= 17099:TCP:NortonAV
"16624:TCP"= 16624:TCP:NortonAV
"14042:TCP"= 14042:TCP:NortonAV
"13501:TCP"= 13501:TCP:NortonAV
"12666:TCP"= 12666:TCP:NortonAV
"16570:TCP"= 16570:TCP:NortonAV
"17502:TCP"= 17502:TCP:NortonAV
"15401:TCP"= 15401:TCP:NortonAV
"13048:TCP"= 13048:TCP:NortonAV
"14708:TCP"= 14708:TCP:NortonAV
"12292:TCP"= 12292:TCP:NortonAV
"14257:TCP"= 14257:TCP:NortonAV
"16535:TCP"= 16535:TCP:NortonAV
"18739:TCP"= 18739:TCP:NortonAV
"12163:TCP"= 12163:TCP:NortonAV
"18148:TCP"= 18148:TCP:NortonAV
"17868:TCP"= 17868:TCP:NortonAV
"12943:TCP"= 12943:TCP:NortonAV
"16101:TCP"= 16101:TCP:NortonAV
"16251:TCP"= 16251:TCP:NortonAV
"16753:TCP"= 16753:TCP:NortonAV
"15336:TCP"= 15336:TCP:NortonAV
"18647:TCP"= 18647:TCP:NortonAV
"12632:TCP"= 12632:TCP:NortonAV
"15170:TCP"= 15170:TCP:NortonAV
"17090:TCP"= 17090:TCP:NortonAV
"15836:TCP"= 15836:TCP:NortonAV
"17166:TCP"= 17166:TCP:NortonAV
"15233:TCP"= 15233:TCP:NortonAV
"16990:TCP"= 16990:TCP:NortonAV
"17075:TCP"= 17075:TCP:NortonAV
"12489:TCP"= 12489:TCP:NortonAV
"12933:TCP"= 12933:TCP:NortonAV
"14226:TCP"= 14226:TCP:NortonAV
"15048:TCP"= 15048:TCP:NortonAV
"15247:TCP"= 15247:TCP:NortonAV
"16454:TCP"= 16454:TCP:NortonAV
"14550:TCP"= 14550:TCP:NortonAV
"13250:TCP"= 13250:TCP:NortonAV
"15433:TCP"= 15433:TCP:NortonAV
"15524:TCP"= 15524:TCP:NortonAV
"17694:TCP"= 17694:TCP:NortonAV
"12374:TCP"= 12374:TCP:NortonAV
"14274:TCP"= 14274:TCP:NortonAV
"16379:TCP"= 16379:TCP:NortonAV
"16610:TCP"= 16610:TCP:NortonAV
"16062:TCP"= 16062:TCP:NortonAV
"14002:TCP"= 14002:TCP:NortonAV
"17939:TCP"= 17939:TCP:NortonAV
"16422:TCP"= 16422:TCP:NortonAV
"15837:TCP"= 15837:TCP:NortonAV
"12238:TCP"= 12238:TCP:NortonAV
"12756:TCP"= 12756:TCP:NortonAV
"14745:TCP"= 14745:TCP:NortonAV
"12059:TCP"= 12059:TCP:NortonAV
"13540:TCP"= 13540:TCP:NortonAV
"14504:TCP"= 14504:TCP:NortonAV
"16185:TCP"= 16185:TCP:NortonAV
"17627:TCP"= 17627:TCP:NortonAV
"18380:TCP"= 18380:TCP:NortonAV
"18906:TCP"= 18906:TCP:NortonAV
"13762:TCP"= 13762:TCP:NortonAV
"14045:TCP"= 14045:TCP:NortonAV
"12887:TCP"= 12887:TCP:NortonAV
"12719:TCP"= 12719:TCP:NortonAV
"17875:TCP"= 17875:TCP:NortonAV
"18757:TCP"= 18757:TCP:NortonAV
"1851:TCP"= 1851:TCP:saeztun

R0 ommq;ommq;c:\windows\system32\drivers\mhhpuiv.sys [x]
R3 adiusbae;USB ADSL LAN Adapter;c:\windows\system32\DRIVERS\adiusbae.sys [x]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [1999-09-10 25244]
R3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\DRIVERS\fbxusb32.sys [2004-10-20 21344]
R3 V90drv;V90drv;c:\windows\system32\DRIVERS\v90drv.sys [2001-11-29 1432836]
S1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2004-03-19 147456]
S1 msikbd2k;Multimedia Keyboard Filter Driver;c:\windows\system32\DRIVERS\msikbd2k.sys [2001-12-20 6656]
S1 vcsmpdrv;vcsmpdrv;c:\windows\system32\DRIVERS\vcsmpdrv.sys [2002-06-07 49232]
S2 nhksrv;Netropa NHK Server;c:\apps\ActivBoard\nhksrv.exe [2001-08-06 28672]
S2 VCSSecS;Virtual CD v4 Security service (SDK - Version);c:\program files\Virtual CD v4 SDK\system\vcssecs.exe [2002-05-16 139264]
S3 abp470n5;abp470n5;c:\windows\system32\drivers\mfhnjq.sys [x]
S3 STAC97NA;SigmaTel 3D Environmental Audio;c:\windows\system32\drivers\stac97na.sys [2002-09-20 296179]
S3 STAC97NH;STAC97NH;c:\windows\system32\drivers\stac97nh.sys [2002-09-20 231983]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - aawservice
*Deregistered* - abp470n5
*Deregistered* - abp480n5
*Deregistered* - adpu160m
*Deregistered* - AFD
*Deregistered* - agp440
*Deregistered* - agpCPQ
*Deregistered* - Aha154x
*Deregistered* - aic78u2
*Deregistered* - aic78xx
*Deregistered* - AliIde
*Deregistered* - alim1541
*Deregistered* - amdagp
*Deregistered* - amsint
*Deregistered* - Apple Mobile Device
*Deregistered* - Arp1394
*Deregistered* - asc
*Deregistered* - asc3350p
*Deregistered* - asc3550
*Deregistered* - Aspi32
*Deregistered* - AudioSrv
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Browser
*Deregistered* - BthServ
*Deregistered* - C-DillaCdaC11BA
*Deregistered* - cbidf
*Deregistered* - cd20xrnt
*Deregistered* - Cdfs
*Deregistered* - CmdIde
*Deregistered* - Cpqarray
*Deregistered* - CryptSvc
*Deregistered* - dac2w2k
*Deregistered* - dac960nt
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - Dnscache
*Deregistered* - dpti2o
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - fwdrv
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - hpn
*Deregistered* - hpt3xx
*Deregistered* - HTTP
*Deregistered* - HTTPFilter
*Deregistered* - i2omgmt
*Deregistered* - i2omp
*Deregistered* - ini910u
*Deregistered* - IntelIde
*Deregistered* - ip6fw
*Deregistered* - IpFilterDriver
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - JavaQuickStarterService
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - LVUSBSta
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - Mouclass
*Deregistered* - MountMgr
*Deregistered* - mraid35x
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - nhksrv
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - NVSvc
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - perc2
*Deregistered* - perc2hib
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - prodrv06
*Deregistered* - prohlp02
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - ql1080
*Deregistered* - Ql10wnt
*Deregistered* - ql12160
*Deregistered* - ql1240
*Deregistered* - ql1280
*Deregistered* - RasAcd
*Deregistered* - RasAuto
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - sfdrv01
*Deregistered* - sfhlp01
*Deregistered* - sfhlp02
*Deregistered* - sfvfs02
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SLService
*Deregistered* - SlWdmSup
*Deregistered* - Sparrow
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - sym_hi
*Deregistered* - sym_u3
*Deregistered* - symc810
*Deregistered* - symc8xx
*Deregistered* - SYMTDI
*Deregistered* - SymWSC
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TosIde
*Deregistered* - TrkWks
*Deregistered* - ultra
*Deregistered* - Update
*Deregistered* - upnphost
*Deregistered* - vcsmpdrv
*Deregistered* - VCSSecS
*Deregistered* - VgaSave
*Deregistered* - viaagp
*Deregistered* - ViaIde
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - WmiApSrv
*Deregistered* - WS2IFSL
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - c:\apps\IECustom\script.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1EA1F119-9BCB-4B95-84BB-2B49D00CE9DE} - hxxp://messenger.zonenxt.msn-int.com/binary/MessengerStatsClient.cab
DPF: {8731163E-77B9-4F91-9122-F112521C28AF} - hxxp://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab
DPF: {BEC31341-BE4C-4358-B79B-B89A5FCF8885} - hxxp://messenger.zonenxt.msn-int.com/binary/MineSweeper.cab
DPF: {E3CE3CB2-A027-469F-9073-B9440036174F} - hxxp://messenger.zonenxt.msn-int.com/binary/Checkers.cab
FF - ProfilePath - c:\documents and settings\solo & kad\Application Data\Mozilla\Firefox\Profiles\36a4s2zn.default\
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-02 02:15
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1907411925-840360825-1460304000-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@SACL=
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\slserv.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\apps\ActivBoard\Traymon.exe
c:\apps\ActivBoard\osd.exe
c:\program files\Fichiers communs\Real\Update_OB\rnathchk.exe
c:\windows\system32\LVCOMSX.EXE
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\WiFiConnector\NintendoWFCReg.exe
.
**************************************************************************
.
Heure de fin: 2009-06-02 3:00 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-02 01:00
ComboFix2.txt 2009-06-01 20:13
ComboFix3.txt 2009-05-30 19:07
ComboFix4.txt 2009-05-28 23:22
ComboFix5.txt 2009-06-01 22:37

Avant-CF: 6 845 472 768 octets libres
Après-CF: 6 719 897 600 octets libres

511 --- E O F --- 2009-05-31 18:08
0
Réponse 111 / 233
gen-hackman

relances un rsit stp
0
Réponse 112 / 233
Ororo Messages postés 115 Statut Membre

Voici le rapport log.txt de RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by solo & kad at 2009-06-02 03:43:16
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 6 GB (9%) free of 74 GB
Total RAM: 255 MB (31% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:43:18, on 02/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Apps\ActivBoard\nhksrv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Apps\ActivBoard\MMKeybd.exe
C:\apps\ActivSurf\4448364\Program\backweb-4448364.exe
C:\WINDOWS\System32\rmctrl.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Apps\ActivBoard\TrayMon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Apps\ActivBoard\OSD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\rnathchk.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\WINDOWS\explorer.exe
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winouxrq.exe
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winasxipt.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Documents and Settings\solo & kad\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\solo & kad.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe
O4 - HKLM\..\Run: [ActivSurf] C:\apps\ActivSurf\4448364\Program\backweb-4448364.exe
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\System32\rmctrl.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MoneyAgent] ""C:\Program Files\Microsoft Money\System\Money Express.exe""
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {1EA1F119-9BCB-4B95-84BB-2B49D00CE9DE} (MessengerStatsClient Class) - http://messenger.zonenxt.msn-int.com/binary/MessengerStatsClient.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.gocyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {BEC31341-BE4C-4358-B79B-B89A5FCF8885} (Minesweeper Flags Class) - http://messenger.zonenxt.msn-int.com/binary/MineSweeper.cab
O16 - DPF: {E3CE3CB2-A027-469F-9073-B9440036174F} (Checkers Class) - http://messenger.zonenxt.msn-int.com/binary/Checkers.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by1fd.bay1.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Unknown owner - C:\Program Files\Norton Internet Security\SymProxySvc.exe (file missing)
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
0
Réponse 113 / 233
gen-hackman

allez on y croit !!

Desinstalle AD-Aware
Desinstalle Spybot

__________________________________________________________
=>/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement cet ordinateur,<=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=====|
---------------------------------------------------------------

Toujours avec toutes les protections désactivées, fais ceci :

• Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
• Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

----------------------------------------------------------
File::
C:\WINDOWS\PEV.exe
F:\trqfq.exe
E:\whwv.pif

Folder::
C:\Program Files\QuickTime(2)

Driver::
abp470n5
mfhnjq
ommq

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb36465c-4860-11dd-9c42-0020ed5dc423}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28fefb21-1640-11dd-9bdd-0020ed5dc423}]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winouxrq.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\dokti.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winasxipt.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winkwwc.exe"=-
"C:\WINDOWS\PEV.exe"=-
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=-
"DisableRegistryTools"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
"UacDisableNotify"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"FirewallOverride"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"UacDisableNotify"=dword:00000000
----------------------------------------------------------

• Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
• Quitte le Bloc Notes

• Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) Comme ceci

• Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
• Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
• Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt
0
Réponse 114 / 233
Ororo Messages postés 115 Statut Membre

bonjour Gen,

ça n'a pas fonctionné !! Aucun rapport à la racine de C:
En regardant dans le dossier combofix, j'ai trouvé pleins d'applications, de fichiers .dat, .sed
Au final, j'y airemarqué dans ce dossier un bloc-not combofix.txt avec les infos suivantes

ComboFix 09-05-30.03 - solo & kad 02/06/2009 17:43:18.18 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.255.103 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\solo & kad\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\solo & kad\Bureau\CFScript.txt

FILE ::
"C:\WINDOWS\PEV.exe"
"E:\whwv.pif"
"F:\trqfq.exe"
.
0
Réponse 115 / 233
gen-hackman

Désinstalle ComboFix, comme ceci:

Supprime le dossier Qoobox. (il est à la racine de ton disque dur c:\)
Supprime l'application téléchargée sur le bureau (ComboFix.exe)

Fais Démarrer/Exécuter copie-colle la commande suivante puis [OK]

"%userprofile%\Bureau\combofix.exe" /u

Ça désinstallera ComboFix, supprimera les points de restauration système (qui sont infectés) et remettra les options de sécurité de Windows par défaut.

ensuite :

retelecharge-le puis enregistre-le sur ton bureau sous....."moi.exe"

ensuite refais glisser le CFScript.txt sur "moi.exe"

rappel :

File::
C:\WINDOWS\PEV.exe
F:\trqfq.exe
E:\whwv.pif
c:\docume~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
c:\documents and settings\solo & kad\Local Settings\temp\IadHide3.dll

Folder::
C:\Program Files\QuickTime(2)

Driver::
abp470n5
mfhnjq
ommq

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb36465c-4860-11dd-9c42-0020ed5dc423}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28fefb21-1640-11dd-9bdd-0020ed5dc423}]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winouxrq.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\dokti.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winasxipt.exe"=-
"C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\winkwwc.exe"=-
"C:\WINDOWS\PEV.exe"=-
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=-
"DisableRegistryTools"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
"UacDisableNotify"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"FirewallOverride"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"UacDisableNotify"=dword:00000000

des fois qu il fonctionne renommé....
0
Réponse 116 / 233
Ororo Messages postés 115 Statut Membre

Quand je colle "%userprofile%\Bureau\combofix.exe" /u, il y a une message d'erreur disant que windows ne trouve pas...
Faut-il enlever les guillemets ? ou cela vient-il du /u ?
0
Réponse 117 / 233
gen-hackman

supprimes Combofix et c:\Qoobox
0
Réponse 118 / 233
Ororo Messages postés 115 Statut Membre

çayé j'ai supprimé le combofix.exe sur le bureau et Qoobox

Je faisais référence à la remarque suivante :

"%userprofile%\Bureau\combofix.exe" /u

Ça désinstallera ComboFix, supprimera les points de restauration système (qui sont infectés) et remettra les options de sécurité de Windows par défaut.

Vu que l'execution de la commande ne fonctionnait pas, je me demandais si c'était à cause des guillemets ou d'un autre éléments de cette ligne
0
Réponse 119 / 233
gen-hackman

oui je me demande si les guillemets ne sont ps en trop :=)
0
Réponse 120 / 233
Ororo Messages postés 115 Statut Membre

ça ne passe toujours pas sans les guillemets.
"%userprofile%\Bureau\combofix.exe" /u

Est-ce que ça vient du /u ou de l'espace qui est avant ?
0

Newsletters