gros problème de virus

Question

Bonjour à tous,

J'ai vraiment un gros problème. J'ai de plus en plus de mal à aller sur le net. Mon modem se déconnecte régulièrement tout seul. Internet explorer s'éteint tout seul. Je ne peux plus accéder à Google et utiliser la barre d'adresse devient de jour en jour plus difficile. J'ai installé spybot qui me trouver des choses comme virtumonde et smitfraud. En faisant quelques recherches, j'ai bien compris que pour se débarasser d'un cheval de troie, il ne suffisait pas d'effacer ces fichiers. 
Quelqu'un peut-il m'aider? J'ai besoin de mon PC pour on travail.

eZula · Answer

Bonjour, 

télécharge GenProc http://www.genproc.com/GenProc.exe 

double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre

Fabien · Answer

merci beaucoup d'avoir répondu!
J'ai lancé GenProc, mais n'ai pas eu de rapport, mais une fiche d'aide. Dois-je faire ce qu'ils me disent?

eZula · Answer

peux-tu justement poster ce rapport ?

Fabien · Answer

Ok, le voilà! Désolé, j'ai un peu de mal à comprendre.

Rapport GenProc 2.591 [5] - 15/06/2009 à 15:39:32  
@ Windows Vista "CSDVersion" does not exist - Mode normal
@ Internet Explorer (7.0.6000.16757) [Navigateur par défaut]

# Etape 1/ Télécharge :
 
- CCleaner https://www.ccleaner.com/ccleaner/download (FileHippo). Ce logiciel va permettre de supprimer tous les fichiers temporaires. Lance-le et clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. Ferme le programme.

- Toolbar-S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 (Team IDN) sur ton Bureau.

- ComboFix http://download.bleepingcomputer.com/sUBs/ComboFix.exe (sUBs) sur ton Bureau.

- SmitfraudFix http://siri.urz.free.fr/Fix/SmitfraudFix.exe (S!Ri). Double-clique sur le fichier "smitfraudfix.exe" et choisis l'option 1 ; il va lister tous les éléments nuisibles dans un rapport : poste-le maintenant et passe à la suite.

- MSNFix http://sosvirus.changelog.fr/MSNFix.zip (!aur3n7) et décompresse-le sur le Bureau.


 Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/  ; Choisis ta session courante *** Fabien *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[5]" sur ton bureau).


# Etape 2/ 

 Lance Toolbar-S&D situé sur le Bureau.
 Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression.

# Etape 3/ 

 Double-clique sur le fichier "SmitfraudFix.exe" et choisis l'option 2, réponds oui à tout et laisse-le procéder. Sauvegarde le rapport sur ton bureau.

# Etape 4/ 

Lance le fichier MSNFix.bat qui se trouve dans le dossier MSNfix, sur le bureau.
- Exécute l'option R.
- Si l'infection est détectée, exécute l'option N.
- Sauvegarde ce rapport sur ton bureau.

# Etape 5/ 

 Double clique sur combofix.exe et suis les instructions. Attention de ne pas utiliser ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne au risque de figer l'ordinateur.

# Etape 6/ 

 Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 7/ 

 Redémarre normalement et poste, dans la même réponse : 

- Le contenu du rapport Combofix.txt situé dans C:\ ; 
- Le contenu du rapport rapport.txt situé sur le Bureau ; 
- Le contenu du rapport msnfix.txt situé dans C:\Windows ; 
- Le contenu du rapport TB.txt situé dans C:\ ; 
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ;
- Un nouveau rapport GenProc ;

 Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com 
----------------------------------------------------------------------

~~ Arguments de la procédure ~~


# Détections [4] GenProc 2.591 15/06/2009 à 15:37:33 
Toolbar:le 15/06/2009 à 15:37:53 "C:\Users\Fabien\AppData\Local\Temp\ICD1.tmp" 
Vundo:le 15/06/2009 à 15:37:53 RegExp 
Smitfraud:le 15/06/2009 à 15:37:55 "C:\Program Files\podmena" 
MSNFix:le 15/06/2009 à 15:38:09 "C:\Windows\System32\mcrh.tmp" 

# Détections [5] GenProc 2.591 15/06/2009 à 15:39:35 
Toolbar:le 15/06/2009 à 15:39:54 "C:\Users\Fabien\AppData\Local\Temp\ICD1.tmp" 
Vundo:le 15/06/2009 à 15:39:54 RegExp 
Smitfraud:le 15/06/2009 à 15:39:56 "C:\Program Files\podmena" 
MSNFix:le 15/06/2009 à 15:40:08 "C:\Windows\System32\mcrh.tmp" 

~~ Fin à 15:40:31 ~~

eZula · Answer

vas-y suis la procédure

Fabien · Answer

Voilà le premier rapport de SmitFraudFix: 

SmitFraudFix v2.422

Scan done at 16:11:13,94, 15/06/2009
Run from C:\Users\Fabien\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Windows\System32undll32.exe
C:\Windows\freddy46.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\ehome\ehsched.exe
C:\Windows\system32	askeng.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\WScript.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Fabien\Desktop\SmitfraudFix\Policies.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

C:\Windows\ld09.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Fabien


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Fabien\AppData\Local\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Fabien\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Fabien\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 

C:\Program Files\podmena\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
 
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="Windows\system32\zezojare.dll C:\Windows\system32\lugatepo.dll C:\Windows\system32\ C:\Windows\system32\husenafe.dll c:\windows\system32\ C:\Windows\system32\hidisuza.dll"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\Windows\system32\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]




»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Connexion réseau Intel(R) PRO/100
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{E979B515-44FB-4373-9F50-9FF1D8B03666}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E979B515-44FB-4373-9F50-9FF1D8B03666}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{E979B515-44FB-4373-9F50-9FF1D8B03666}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

Fabien · Answer

Voilà, c'est fait! Il n'y a qu'Msnfix que je n'ai pas pu lancer à cause d'un message d'erreur.

Rapport Combofix:

ComboFix 09-06-14.02 - Fabien 15/06/2009 17:05.1 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.33.1036.18.1022.639 [GMT 2:00]
Lancé depuis: c:\users\Fabien\Documents\Mes fichiers reçus\ComboFix.exe
AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *disabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\progra~2\Microsoft\Network\Downloader\qmgr0.dat
c:\progra~2\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\gayubowu.dll
c:\windows\system32\gogaduso.dll
c:\windows\system32\jutovofa.dll
c:\windows\system32\lokoyimi.dll
c:\windows\system32\remowoka.dll
c:\windows\system32\rewufufu.dll
c:\windows\system32\tifakapu.dll
c:\windows\system32\vjjypnyd.exe
c:\windows\system32\zarebeba.dll
c:\windows\system32\zifisehe.dll
c:\users\Fabien\AppData\Roaming\Microsoft\Windows\lsass.exe
c:\users\Fabien\AppData\Roaming\unobi.dll
c:\windows\freddy46.exe
c:\windows\system32\AbLnmUvw.ini
c:\windows\system32\afoyewuf.ini
c:\windows\system32\anotahan.ini
c:\windows\system32\anuwihub.ini
c:\windows\system32\aretipum.ini
c:\windows\system32\aruvufeg.ini
c:\windows\system32\asitelig.ini
c:\windows\system32\asiwuyol.ini
c:\windows\system32\axaxooiy.ini
c:\windows\system32\ayakozup.ini
c:\windows\system32\azelelof.ini
c:\windows\system32\bajibuli.dll
c:\windows\system32\behehuhi.dll
c:\windows\system32\bewihafe.dll
c:\windows\system32\beyewowa.dll
c:\windows\system32\bLVFhNpo.ini
c:\windows\system32\bufesine.dll
c:\windows\system32\byXOgfEw.dll
c:\windows\system32\cdcrthif.ini
c:\windows\System32\dLSCdfii.ini
c:\windows\System32\dLSCdfii.ini2
c:\windows\system32\DNWENqru.ini
c:\windows\system32\dokakuru.dll
c:\windows\system32\efcCuSMe.dll
c:\windows\system32\elupekaw.ini
c:\windows\system32\emqjryqm.ini
c:\windows\system32\eMSuCcfe.ini
c:\windows\system32\enisefub.ini
c:\windows\system32\epatalik.ini
c:\windows\system32\epijitar.ini
c:\windows\system32\epujubak.ini
c:\windows\system32\evodamim.ini
c:\windows\system32\fapalogo.dll
c:\windows\system32\fenofaki.dll
c:\windows\system32\fopijunu.dll
c:\windows\system32\fsgchosx.ini
c:\windows\system32\fuhaleke.dll
c:\windows\system32\gayubowu.dll
c:\windows\system32\gitadodi.dll
c:\windows\system32\godidusa.dll
c:\windows\system32\gogaduso.dll
c:\windows\system32\gukejibu.dll
c:\windows\system32\hajajepo.dll
c:\windows\system32\hgGvssQJ.dll
c:\windows\system32\hidisuza.dll
c:\windows\system32\ibupejim.ini
c:\windows\system32\ihudajil.ini
c:\windows\system32\ihuheheb.ini
c:\windows\system32\iifdCSLd.dll
c:\windows\system32\ijehehiv.ini
c:\windows\system32\imarayel.ini
c:\windows\system32\iniwonug.ini
c:\windows\system32\irefinuw.ini
c:\windows\system32\irevivos.ini
c:\windows\system32\ireyojig.ini
c:\windows\system32\iruzafum.ini
c:\windows\system32\iserosas.ini
c:\windows\system32\isewiliv.ini
c:\windows\system32\itubuzeh.ini
c:\windows\system32\iwodogaz.ini
c:\windows\system32\iyavefas.ini
c:\windows\system32\izuzemak.ini
c:\windows\system32\jevasowa.dll
c:\windows\system32\khfCRkLe.dll
c:\windows\system32\khfFYopp.dll
c:\windows\system32\libukifu.dll
c:\windows\system32\lkdtnssg.ini
c:\windows\system32\lUwHOnpo.ini
c:\windows\system32\milutafu.dll
c:\windows\system32\mufazuri.dll
c:\windows\system32\muturebe.dll
c:\windows\system32\nahatona.dll
c:\windows\system32\NTEKUDMp.ini
c:\windows\system32\ogisuwew.ini
c:\windows\system32\ogososuw.ini
c:\windows\system32\ohakesem.ini
c:\windows\system32\okuyupif.ini
c:\windows\system32\omuvivoj.ini
c:\windows\system32\opNhFVLb.dll
c:\windows\system32\opnOHwUl.dll
c:\windows\system32\osehetug.ini
c:\windows\system32\otepewon.ini
c:\windows\system32\owibatup.ini
c:\windows\system32\oyeyotol.ini
c:\windows\system32\pawehuhe.dll
c:\windows\system32\penitoro.dll
c:\windows\system32\pMDUKETN.dll
c:\windows\system32\ponovisi.dll
c:\windows\system32\pwblphrt.dll
c:\windows\system32\qomkkJDW.dll
c:\windows\system32\remowoka.dll
c:\windows\system32\rewufufu.dll
c:\windows\system32\ritibiji.dll
c:\windows\system32\rubelupe.dll
c:\windows\system32\segudedu.dll
c:\windows\system32\soviveri.dll
c:\windows\system32\tevaziva.dll
c:\windows\system32\tewehipo.dll
c:\windows\system32\tifakapu.dll
c:\windows\system32\tosilihu.dll
c:\windows\system32\trhplbwp.ini
c:\windows\system32\tuvUlmNf.dll
c:\windows\system32\unujipof.ini
c:\windows\system32\urqNEWND.dll
c:\windows\system32\urqPfFyx.dll
c:\windows\system32\uwizeyiw.ini
c:\windows\system32\uyuhediy.ini
c:\windows\system32\vegapaye.dll
c:\windows\system32\vhxdidmh.ini
c:\windows\system32\viwafinu.dll
c:\windows\system32\wapoyali.dll
c:\windows\system32\wEfgOXyb.ini
c:\windows\system32\weheyepe.dll
c:\windows\system32\wuniferi.dll
c:\windows\system32\wusosogo.dll
c:\windows\system32\wvUmnLbA.dll
c:\windows\system32\xsohcgsf.dll
c:\windows\system32\xxyyyyxX.dll
c:\windows\system32\Xxyyyyxx.ini
c:\windows\system32\yovalono.dll
c:\windows\system32\zagodowi.dll
c:\windows\system32\zarebeba.dll
c:\windows\system32\zifisehe.dll
D:\Desktop.ini
.
---- Exécution préalable -------
.

----- BITS: Il y a peut-être des sites infectés -----

hxxp://winupdateconnect.net
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_PODMENADRV

((((((((((((((((((((((((((((( Fichiers créés du 2009-05-15 au 2009-06-15 ))))))))))))))))))))))))))))))))))))
.

2009-06-15 14:35 . 2009-06-15 14:35 35 ----a-w- c:\users\Fabien\AppData\Roaming\SetValue.bat
2009-06-15 14:31 . 2009-06-15 14:33 -------- d-----w- C:\ToolBar SD
2009-06-15 14:02 . 2009-06-15 14:02 -------- d-----w- c:\program files\CCleaner
2009-06-15 13:15 . 2009-06-15 13:37 -------- d-----w- C:\GenProc
2009-06-15 10:27 . 2009-06-15 10:27 1 ---h--w- c:\windows\bf23567.dat
2009-06-15 10:27 . 2009-06-15 10:27 2 ---h--w- c:\windows\zaponce53198.dat
2009-06-15 10:27 . 2009-06-15 10:27 2 ---h--w- c:\windows\zaponce53290.dat
2009-06-15 10:26 . 2009-06-15 10:26 159 ----a-w- C:\d45.bat
2009-06-15 10:26 . 2009-06-15 10:26 49152 ----a-w- c:\windows\system32\xbfwfpjb.dll
2009-06-12 18:01 . 2009-06-12 18:01 49152 ----a-w- c:\windows\system32\nodlynrs.dll
2009-06-11 21:18 . 2009-06-11 21:18 64512 --sh--w- c:\users\Fabien\AppData\Roaming\Microsoft\Windows\iexplorer.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-15 15:05 . 2007-02-13 00:35 689846 ----a-w- c:\windows\system32\perfh00C.dat
2009-06-15 15:05 . 2007-02-13 00:35 116988 ----a-w- c:\windows\system32\perfc00C.dat
2009-06-15 14:51 . 2008-02-09 12:36 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-15 14:49 . 2008-02-09 12:36 -------- d-----w- c:\progra~2\Spybot - Search & Destroy
2009-06-15 14:35 . 2009-06-15 14:35 691 ----a-w- c:\users\Fabien\AppData\Roaming\GetValue.vbs
2009-06-15 10:27 . 2009-03-15 10:26 48640 --sha-w- c:\windows\system32\vuvuwofi.dll
2009-06-15 10:26 . 2009-03-15 10:26 87040 --sha-w- c:\windows\system32\sinodisi.dll
2009-06-15 10:26 . 2009-03-15 10:26 15360 --sha-w- c:\windows\system32\vusilina.exe
2009-06-15 10:26 . 2009-03-15 10:26 79872 --sha-w- c:\windows\system32\nowepeto.dll
2009-06-13 11:48 . 2009-03-13 11:48 88064 --sha-w- c:\windows\system32\notosujo.dll
2009-06-13 11:48 . 2009-03-13 11:48 79872 ------w- c:\windows\system32\wakepule.dll
2009-06-12 18:02 . 2009-06-12 18:02 121 --sh--w- c:\windows\system32\ebikuyuz.tmp
2009-06-12 18:01 . 2009-03-12 18:01 79872 --sha-w- c:\windows\system32\zuyukibe.dll
2009-06-06 00:09 . 2009-06-06 00:09 36352 ----a-w- c:\progra~2\proto.dll
2009-05-11 15:50 . 2009-05-11 09:36 -------- d-----w- c:\progra~2\NOS
2009-05-11 15:50 . 2009-05-11 09:36 -------- d-----w- c:\program files\NOS
2009-05-11 09:42 . 2007-08-18 00:36 -------- d-----w- c:\program files\Common Files\Adobe
2007-08-16 00:11 . 2007-08-16 00:11 22 --sha-w- c:\windows\SMINST\HPCD.sys
2009-03-15 10:28 . 2009-03-15 10:28 48640 --sha-w- c:\windows\System32\duredidi.dll
2009-01-13 00:16 . 1601-01-01 00:12 64145 --sha-w- c:\windows\System32\fagometo.dll
2009-01-19 22:24 . 1601-01-01 00:12 64157 --sha-w- c:\windows\System32\fuzoyalu.dll
1601-01-01 00:12 . 1601-01-01 00:12 64157 --sha-w- c:\windows\System32\heravole.dll
2009-01-16 23:29 . 1601-01-01 00:12 63598 --sha-w- c:\windows\System32\jemukuwo.dll
2009-03-04 00:40 . 1601-01-01 00:12 70963 --sha-w- c:\windows\System32\jinuwayi.dll
2009-01-08 23:12 . 1601-01-01 00:12 90295 --sha-w- c:\windows\System32\jovivumo.dll
2009-03-15 10:26 . 2009-03-15 10:26 49152 --sha-w- c:\windows\System32\juvoroke.dll.tmp
2009-01-14 18:50 . 1601-01-01 00:12 86656 --sha-w- c:\windows\System32\kilatape.dll
2009-01-28 00:19 . 1601-01-01 00:12 64686 --sha-w- c:\windows\System32\kokakiva.dll
2009-01-23 02:39 . 1601-01-01 00:12 63690 --sha-w- c:\windows\System32\korumore.dll
2009-03-15 10:26 . 2009-03-15 10:26 49152 --sha-w- c:\windows\System32\likebowa.dll.tmp
2009-03-15 10:26 . 2009-03-15 10:26 49152 --sha-w- c:\windows\System32\mejiyuwo.dll.tmp
1601-01-01 00:12 . 1601-01-01 00:12 69408 --sha-w- c:\windows\System32\nukiyofi.dll
2009-02-02 13:39 . 1601-01-01 00:12 64223 --sha-w- c:\windows\System32\piyiliwa.dll
1601-01-01 00:12 . 1601-01-01 00:12 69408 --sha-w- c:\windows\System32\rosovoti.dll
1601-01-01 00:12 . 1601-01-01 00:12 69408 --sha-w- c:\windows\System32\varabefa.dll
2008-09-16 10:48 . 2008-09-16 10:48 18432 --sha-w- c:\windows\System32\yapipije.dll
2009-03-15 10:28 . 2009-03-15 10:28 48640 --sha-w- c:\windows\System32\yarobefe.dll
2009-01-09 23:33 . 1601-01-01 00:12 69408 --sha-w- c:\windows\System32\yohabinu.dll
2009-01-08 11:12 . 1601-01-01 00:12 90360 --sha-w- c:\windows\System32\zasiyugi.dll
2009-01-09 23:33 . 1601-01-01 00:12 90315 --sha-w- c:\windows\System32\zilolilo.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bd2d68b3-98bc-4d00-8ff0-1c8f3edfea37}]
2009-03-15 10:28 48640 --sha-w- c:\windows\System32\duredidi.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-10 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]
"DiskChk help"="c:\programdata\proto.dll" [2009-06-06 36352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 115816]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2006-10-26 22696]
"hpqSRMon"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-22 198160]
"d8195c32"="c:\windows\system32\nowepeto.dll" [2009-06-15 79872]
"kokevejoti"="c:\windows\system32\yarobefe.dll" [2009-03-15 48640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-24 44136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

c:\users\Fabien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Outil de d‚tection de support Picture Motion Browser.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-4-20 368640]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ cli c:\windows\system32\zezojare.dll c:\windows\system32\lugatepo.dll c:\windows\system32\husenafe.dll c:\windows\system32\hidisuza.dll
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\iifdCSLd

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"="0x00000000"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7FCB15C6-544E-42C3-9639-F1B98CFBC9E3}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{F51F28BA-C749-441E-928C-7F71568F443C}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{66AD1444-6292-4AFB-8C8B-2E55176980B6}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{9E46C892-C381-471D-A5A3-A882D3F259D8}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{D5F25E60-B4D9-4C1F-99FB-4F562602DD22}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{AB8DCD38-8B28-45B2-ADCA-3B7A0A531C43}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{978DAB7C-36DC-478E-A2AA-4849ADA6C9F3}"= TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{57E18C90-B5BC-4341-A4EB-B334ABF5DFAC}"= TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"{DA32E4A8-6933-4ED9-935C-102CA939FABB}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{BFAC95B7-D21C-40C2-9498-D0255545EC59}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{C6D18486-E2CA-4C1E-8ADE-670948973EC0}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{6685C2CD-F647-4D3D-BEC1-CDE8A4C74712}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{A0BDE0F0-AFE9-4F17-8BAF-D429F3548F14}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{9D411EA8-A787-402E-9282-33FA150B6DB2}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{FA876251-B1DF-41D7-9F1B-A7DE1EB4E2A2}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{D1E4D924-30F7-4C92-84AE-37C0351FEACD}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\RM.exe:Render Manager
"{B66913C6-A24E-4F61-940B-054BC382F66A}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\RM.exe:Render Manager
"{938A2BDD-3F2E-43A8-8E6D-21A662AC980C}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe:PMSRegisterFile
"{953927E5-467D-4A1B-99F6-DE4E4B8001D9}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe:PMSRegisterFile
"{CA76CAA4-16D6-4791-8702-6C6656C7E551}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\umi.exe:umi
"{488EBCBB-4807-4009-8DD6-08304551D3C0}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\umi.exe:umi
"{0C7D58DE-329A-4510-9098-8D1DFBD0D031}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:Pinnacle VideoSpin
"{EDE46553-398E-46D8-9449-DD44C8428A5D}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:Pinnacle VideoSpin
"{CC1AF634-8068-404C-A867-44073ECDC11E}"= c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqpse.exe:hpqpse.exe
"{34EDF4B9-01BB-4537-8941-DFE4FAB2B494}"= c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe:hpqphotocrm.exe
"{C2F38C95-5672-4B1D-94E2-0193143D9DE4}"= c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqsudi.exe:hpqsudi.exe
"{C52BF869-3DB9-4132-B188-3AF810F93122}"= c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqpsapp.exe:hpqpsapp.exe
"{DBB924A5-E868-411E-B7EE-164DFC9E76D1}"= UDP:c:\windows\explorer.exe:explorer
"{7410D6FF-AB7D-43A3-8A62-4BC586AB085D}"= UDP:c:\windows\explorer.exe:explorer
"{6C086872-28FE-44F7-BAF4-8357A7A927B6}"= TCP:c:\windows\explorer.exe:explorer
"{2902AA97-0145-4147-8C5A-95B2361F6B41}"= TCP:c:\windows\explorer.exe:explorer
"{B70D112B-A663-4098-AAE0-F28587612E6D}"= UDP:c:\windows\System32\LogonUI.exe:LogonUI
"{08704D2C-6ADB-4240-8B89-99DFD2FD4804}"= TCP:c:\windows\System32\LogonUI.exe:LogonUI
"{9B298B83-12BB-4E42-A847-A534DAF1E59D}"= UDP:c:\windows\System32\wininit.exe:wininit
"{43149129-F1E1-48EF-926C-ECA3E395B2A5}"= TCP:c:\windows\System32\wininit.exe:wininit
"{71DE8898-07E7-4E47-A48A-7FD34BD348F1}"= UDP:c:\windows\System32\winlogon.exe:winlogon
"{62E84DCD-7FD9-464A-BA8C-A4C6B8DCF2CE}"= TCP:c:\windows\System32\winlogon.exe:winlogon
"{8C789DA9-D081-4B6D-B90D-6A6833740215}"= UDP:c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe:DQLWinService
"{355856DE-6E93-43B0-A235-6567F1E14472}"= UDP:c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe:DQLWinService
"{2A6C76F7-F974-4835-8CBD-08CE1DDAE968}"= TCP:c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe:DQLWinService
"{F7206B98-5293-42B9-ABB8-0DCCF5A3A8BF}"= TCP:c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe:DQLWinService
"{E0B5625E-75A9-4115-BFB4-43E8344EAAE7}"= UDP:c:\windows\System32\rundll32.exe:rundll32
"{D9685FB5-21C7-4BC5-8C7A-76A697CE13EA}"= TCP:c:\windows\System32\rundll32.exe:rundll32
"{474801FC-0F79-4F09-9951-ACA0AC097D69}"= UDP:c:\windows\System32\dllhost.exe:DllHost
"{E4892649-B2B1-4083-9266-5C8E0908DAF0}"= TCP:c:\windows\System32\dllhost.exe:DllHost
"{1932A6E7-5944-432C-9F4D-40BF0DC2ACFF}"= UDP:c:\program files\Spybot - Search & Destroy\TeaTimer.exe:TeaTimer
"{474E175A-C6D1-4242-926D-97E8FBB18C5D}"= UDP:c:\program files\Windows Sidebar\sidebar.exe:sidebar
"{CB6A8863-280A-4E68-905D-B18BDEB6FDDA}"= TCP:c:\program files\Windows Sidebar\sidebar.exe:sidebar
"{A997AA06-213A-4186-BCFC-31378075424C}"= TCP:c:\program files\Spybot - Search & Destroy\TeaTimer.exe:TeaTimer
"{22FB3E6B-E290-4557-A2D1-2BC0479B9D66}"= UDP:c:\program files\Symantec\LiveUpdate\ALUNOTIFY.EXE:ALUNOTIFY
"{DC78DFF4-F187-416E-98C3-8C1C26946B85}"= TCP:c:\program files\Symantec\LiveUpdate\ALUNOTIFY.EXE:ALUNOTIFY
"{96E09998-C984-4ABA-AB9B-8EADA0A10CDD}"= UDP:c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe:SPUVolumeWatcher
"{8210732C-9C8D-42C8-8349-EC1EA2AEF175}"= UDP:c:\windows\System32\taskeng.exe:taskeng
"{D737B2F7-CA72-434F-AA93-29A13D92C531}"= TCP:c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe:SPUVolumeWatcher
"{FBC55D43-EFA4-4659-95FC-BAC2B1D74CE2}"= TCP:c:\windows\System32\taskeng.exe:taskeng
"{EF3BC7FC-127D-41D8-8A8D-B95EEF9D2C50}"= UDP:c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe:SPUVolumeWatcher
"{FAAD5CAF-22F0-4D45-94B3-CC0F8F14892B}"= TCP:c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe:SPUVolumeWatcher
"{89CAD5EA-1B09-4626-8AA4-672C458D7E10}"= UDP:c:\windows\System32\msfeedssync.exe:msfeedssync
"{0255F71A-DE97-4D43-B24D-7269E7D54DE9}"= TCP:c:\windows\System32\msfeedssync.exe:msfeedssync
"{2106F6DD-7AF8-40B9-8E1E-A9CBCFC0C3AD}"= UDP:c:\windows\System32\dwm.exe:Dwm
"{53A3117A-D389-47ED-952C-B4048203CF8A}"= TCP:c:\windows\System32\dwm.exe:Dwm
"{2F655F81-689B-408C-AC69-50815AE6117B}"= UDP:c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe:AppSvc32
"{8D087F90-23AC-4F78-B047-2690F5C8E0F8}"= UDP:c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe:AppSvc32
"{0C7F0C03-49B0-4986-B9D8-D498E05E795E}"= TCP:c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe:AppSvc32
"{9F37F5BF-EA3A-40D0-8A98-52C962F8E3C5}"= TCP:c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe:AppSvc32
"{70AB662E-42C4-4DE7-B49E-06C782B8282B}"= UDP:c:\windows\System32\spoolsv.exe:spoolsv
"{45753029-BEB9-4FBA-9B2E-444689347A73}"= TCP:c:\windows\System32\spoolsv.exe:spoolsv
"{67E01EBA-E09E-4484-AA66-56C1C149012A}"= UDP:c:\windows\ehome\ehmsas.exe:ehmsas
"{B701033B-7AA3-4DF2-A0AB-A77C67409B8B}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\tools\IntelDHReconfSvc.exe:IntelDHReconfSvc
"{A36000BF-71A7-4801-9171-5356D587941B}"= TCP:c:\windows\ehome\ehmsas.exe:ehmsas
"{DF34A455-3E18-4311-862C-FF2EE3CD8E5C}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\tools\IntelDHReconfSvc.exe:IntelDHReconfSvc
"{B43D8953-D9D1-4FCC-8B93-EACBA4435A2F}"= UDP:c:\windows\System32\lsass.exe:lsass
"{63856AED-BEFB-4E02-9EDB-5FCBDBC81F14}"= UDP:c:\windows\System32\lsass.exe:lsass
"{90EE695F-3F6A-420A-9B11-5FCEC15ED813}"= TCP:c:\windows\System32\lsass.exe:lsass
"{70459C57-53A7-40D4-BE23-79C4D7FE0835}"= TCP:c:\windows\System32\lsass.exe:lsass
"{CD06C842-29E5-4AF1-A83A-DD823C26FDE3}"= UDP:c:\program files\MSN Messenger\usnsvc.exe:usnsvc
"{5626C65E-2D5D-4216-8C81-E51DB1DB7BD6}"= UDP:c:\program files\MSN Messenger\usnsvc.exe:usnsvc
"{8EA01207-21EA-4D84-8D89-6FE53FD4DA88}"= TCP:c:\program files\MSN Messenger\usnsvc.exe:usnsvc
"{7152330C-1682-4787-8BCD-8A2EA0EF7626}"= TCP:c:\program files\MSN Messenger\usnsvc.exe:usnsvc
"{2BE426BF-59C6-4DC6-AFD4-9906DB533A80}"= UDP:c:\windows\System32\services.exe:services
"{47109013-E7A3-4D3E-AEA3-1F57818B5717}"= TCP:c:\windows\System32\services.exe:services
"{7480A5AE-D680-4FB9-9791-96E41520D335}"= UDP:c:\windows\System32\SearchIndexer.exe:SearchIndexer
"{8523A369-B081-4800-8A29-9FE35CF5085C}"= TCP:c:\windows\System32\SearchIndexer.exe:SearchIndexer
"{2A7A767D-8882-457A-9394-9F2E9A21DEA2}"= UDP:c:\program files\Services en ligne\yahoo\WizLink.exe:WizLink
"{B896E493-9715-4007-83E8-E2A6A9C7F918}"= UDP:c:\program files\Services en ligne\yahoo\WizLink.exe:WizLink
"{ABECF909-7324-4B06-B12D-A60D83473251}"= TCP:c:\program files\Services en ligne\yahoo\WizLink.exe:WizLink
"{D9EC7104-4FFD-4F2D-91CB-5A6437C6DD3E}"= TCP:c:\program files\Services en ligne\yahoo\WizLink.exe:WizLink
"{46C51F94-A96E-4DB5-87C3-F4AB5DE0184B}"= UDP:c:\program files\Windows Media Player\wmplayer.exe:wmplayer
"{0F3E4916-0FDD-40CF-8465-6E7F9702A2F8}"= TCP:c:\program files\Windows Media Player\wmplayer.exe:wmplayer
"{4EA7C05E-B989-4A53-8633-7F8DCD322E2F}"= UDP:c:\windows\ehome\ehtray.exe:ehtray
"{83E4CA1C-9BA8-4799-AB43-DD06766D4EFF}"= UDP:c:\windows\ehome\ehtray.exe:ehtray
"{7D84C423-1E4D-4C37-B787-DD127BFCF5AF}"= TCP:c:\windows\ehome\ehtray.exe:ehtray
"{51822105-098A-4F83-A79C-982D5214449A}"= TCP:c:\windows\ehome\ehtray.exe:ehtray
"{A5BC6DF8-7A03-4A76-B5CF-1F97A5EB2DAA}"= UDP:c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe:ALUSchedulerSvc
"{91E5D25F-E6B5-4309-AE87-065257151F33}"= TCP:c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe:ALUSchedulerSvc
"{29C53A8E-B149-4BCE-AF76-3A8D51B70E14}"= UDP:c:\program files\Common Files\Symantec Shared\ccSvcHst.exe:ccSvcHst
"{804241E7-8446-475A-B4D9-8023AE20EEE1}"= UDP:c:\program files\Common Files\Symantec Shared\ccSvcHst.exe:ccSvcHst
"{459E25AC-B7A8-44EB-80AA-39EE6088137D}"= UDP:c:\program files\Common Files\Real\Update_OB\realsched.exe:realsched
"{DFA52230-17E1-41D8-BE60-7510C5702329}"= TCP:c:\program files\Common Files\Real\Update_OB\realsched.exe:realsched
"{16847F96-AE6E-40D0-9027-29E89FDBDC75}"= UDP:c:\program files\Common Files\LightScribe\LSSrvc.exe:LSSrvc
"{1BD8E5E6-0DF1-404F-8821-3F2DECA5FD21}"= UDP:c:\program files\Common Files\LightScribe\LSSrvc.exe:LSSrvc
"{17B4CBF2-9534-4082-B463-B9F181EFEB7D}"= TCP:c:\program files\Common Files\LightScribe\LSSrvc.exe:LSSrvc
"{A3382283-4E67-4844-AEB0-D0DD10521EE9}"= TCP:c:\program files\Common Files\LightScribe\LSSrvc.exe:LSSrvc
"{3B19E4C4-9F86-4E66-87BB-4FF9B3FE65AB}"= UDP:c:\windows\System32\wermgr.exe:wermgr
"{983ECCB2-F39A-4459-A90B-DAB67240FA44}"= TCP:c:\windows\System32\wermgr.exe:wermgr
"{854ED5E7-CE9A-4671-9A6A-7063ABC9C869}"= UDP:c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe:GoogleToolbarNotifier
"{7F0BD547-9322-448F-A93E-47AFA8EB9A91}"= TCP:c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe:GoogleToolbarNotifier
"{23235B13-62D2-48A4-924B-C05BB0AFFD9B}"= UDP:c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe:symlcsvc
"{281634BF-6F4B-4A05-B3B9-CAC96385C285}"= UDP:c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe:symlcsvc
"{EF26BD8C-1D17-4B28-84D3-BE703F57D4ED}"= TCP:c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe:symlcsvc
"{A454313D-62ED-4E6B-BA10-519AA40EE08C}"= TCP:c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe:symlcsvc
"{8240DB0A-19E8-4576-855C-ECE337359CA7}"= UDP:c:\program files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe:HpqSRmon
"{B94BA447-ABCE-4BC8-85A7-BE52CE5DCD1F}"= TCP:c:\program files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe:HpqSRmon
"{28FD5C0C-E5EA-4A72-8606-78C82920DB13}"= UDP:c:\windows\System32\mobsync.exe:mobsync
"{9D1CC360-11B8-4943-84D0-2F509766E240}"= TCP:c:\windows\System32\mobsync.exe:mobsync
"{2E7A2E52-9487-4BE1-8F6B-7EFD73ACE58F}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\tools\IntelDHSvcConf.exe:IntelDHSvcConf
"{40754A59-044A-4214-99BC-2BA8A5916A7E}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\tools\IntelDHSvcConf.exe:IntelDHSvcConf
"{F96E84BD-E4C7-4C5F-8C01-2E42F0444B19}"= UDP:c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe:PIFSvc
"{E6DEB72D-6870-4BA2-9FA4-2F344ECD04B6}"= TCP:c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe:PIFSvc
"{03D47536-3B32-48AD-B713-A409D1F4CBC7}"= UDP:c:\program files\Common Files\Symantec Shared\ccApp.exe:ccApp
"{4C515D3D-151B-4E2E-A37B-2D382FB73F3A}"= TCP:c:\program files\Common Files\Symantec Shared\ccApp.exe:ccApp
"{FD98EEA3-81A8-42C1-A7FF-EE02C3F0DCD8}"= UDP:c:\program files\Spybot - Search & Destroy\SDWinSec.exe:SDWinSec
"{519AAE9A-6131-4A33-8817-2850FBFB92D9}"= TCP:c:\program files\Spybot - Search & Destroy\SDWinSec.exe:SDWinSec
"{A7EDD512-FF6E-4C75-BF6D-1C5AA2E5D0B7}"= UDP:c:\program files\Common Files\microsoft shared\Windows Live\WLLoginProxy.exe:WLLoginProxy
"{8018AD6E-4979-467E-BA2D-0212069DA56D}"= TCP:c:\program files\Common Files\microsoft shared\Windows Live\WLLoginProxy.exe:WLLoginProxy
"{0CD1BA95-F18D-4487-9FD9-97EBF08EAB92}"= UDP:c:\windows\System32\WerFault.exe:WerFault
"{376B27C1-FBD3-4DC8-B272-D4916A942B83}"= TCP:c:\windows\System32\WerFault.exe:WerFault

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
"DoNotAllowExceptions"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

S1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20070718.002\IDSvix86.sys [19/07/2007 15:21 212280]
S2 DQLWinService;DQLWinService;c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [03/09/2006 11:32 208896]
S2 IntelDHSvcConf;Intel DH Service;c:\program files\Intel\IntelDH\Intel Media Server\tools\IntelDHSvcConf.exe [10/05/2006 10:13 29696]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [25/07/2007 11:15 106808]
S3 MODRC;DiBcom Infrared Receiver;c:\windows\System32\drivers\modrc.sys [01/04/2008 17:49 13824]
S3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [24/10/2006 07:40 37008]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - COMHOST
*NewlyCreated* - ECACHE

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{061B4178-6C2C-4C72-AD92-F2A1A2AB8F4E} - (no file)
BHO-{104CD824-8B39-480A-9157-8AF4DC911F8F} - (no file)
BHO-{2DA5C4D8-7CC7-43B5-A60F-1C31D671272E} - (no file)
BHO-{51676694-B364-4670-96FC-6648B54AD831} - (no file)
BHO-{631EDFDC-F8ED-4DDF-A304-04267996D11A} - c:\windows\system32\iifdCSLd.dll
BHO-{6B71EBDE-3793-4174-B47A-D40320452BA9} - (no file)
BHO-{833A008C-27D9-4E3F-9A3D-61AF032AF742} - (no file)
BHO-{85B26C5F-CF21-4E3B-9D11-C686131B7F4D} - (no file)
BHO-{BB23E516-8935-41E3-A1CE-94FD9C4DDB93} - (no file)
BHO-{D84252E8-FAC7-44B4-9ED1-4A7891A7A289} - (no file)
BHO-{DB08202F-3699-45B6-A145-350DD003F33E} - (no file)
BHO-{DC27D06B-6321-453D-85A0-809C5236C415} - (no file)
BHO-{E28ECF3B-AD59-4DE6-8E0D-E033A03BCCDC} - (no file)
HKCU-Run-PMCLoader - c:\program files\Pinnacle\TVCenter Pro\PMCLoader.exe
HKCU-Run-Lsass Service - c:\users\Fabien\AppData\Roaming\Microsoft\Windows\lsass.exe
HKLM-Run-sysfbtray - c:\windows\freddy46.exe
HKLM-RunOnce-<NO NAME> - (no file)

.
------- Examen supplémentaire -------
.
mWindow Title =
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-15 17:16
Windows 6.0.6000 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\HelpPane.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Heure de fin: 2009-06-15 17:19 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-15 15:19

Avant-CF: 252 344 586 240 octets libres
Après-CF: 252 188 753 920 octets libres

458 --- E O F --- 2008-12-01 22:25

Rapport SmitFraudfix:

SmitFraudFix v2.422

Scan done at 16:35:19,95, 15/06/2009
Run from C:\Users\Fabien\Documents\Mes fichiers re‡us\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost
::1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
...

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\Windows\ld09.exe Deleted
C:\Program Files\podmena\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{E979B515-44FB-4373-9F50-9FF1D8B03666}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E979B515-44FB-4373-9F50-9FF1D8B03666}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{E979B515-44FB-4373-9F50-9FF1D8B03666}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

»»»»»»»»»»»»»»»»»»»»»»»» RK.2

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Rapport ToolBar:

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6000 )
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) D CPU 3.00GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Fabien ( Administrator )
BOOT : Fail-safe boot
Antivirus : Norton Internet Security 2007 (Activated)
Firewall : Norton Internet Security 2007 (Activated)
C:\ (Local Disk) - NTFS - Total:292 Go (Free:234 Go)
D:\ (Local Disk) - NTFS - Total:5 Go (Free:0 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 15/06/2009|16:32 )

[ UAC => 0 ]
C:\Users\Fabien\AppData\Local\Temp\ICD1.tmp

-----------\\ SUPPRESSION

Supprime! - C:\Users\Fabien\AppData\Roaming\MICROS~1\Windows\Cookies\fabien@7search[2].txt
Supprime! - C:\Users\Fabien\AppData\Local\Temp\ICD1.tmp

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://fr.yahoo.com/"
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/"
"Default_Page_URL"="https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

--------------------\\ Recherche d'autres infections

C:\Windows\system32\dLSCdfii.ini
C:\Windows\system32\dLSCdfii.ini2
C:\Windows\system32\iifdCSLd.dll
[b]==> VUNDO <==/b

[ UAC => 1 ]

1 - "C:\ToolBar SD\TB_1.txt" - 15/06/2009|16:33 - Option : [2]

-----------\\ Fin du rapport a 16:33:13,14

Nouveau rapport HiJackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:56:24, on 04/12/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16757)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {B7924756-402E-440B-B3F0-4CA3EA508AF0} - C:\Windows\system32\iifdCSLd.dll
O2 - BHO: (no name) - {DC27D06B-6321-453D-85A0-809C5236C415} - (no file)
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "c:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ddcBUlJb.dll,#1
O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe
O4 - HKLM\..\Run: [d8195c32] rundll32.exe "C:\Windows\system32\fihtrcdc.dll",b
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [PMCLoader] C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe -checktasks
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

eZula · Answer

désactiver le Tea-Timer de Spybot http://ww11.genproc.com/spybot/spybot.html

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

File::
c:\windows\system32\xbfwfpjb.dll
c:\windows\system32
odlynrs.dll
c:\users\Fabien\AppData\Roaming\Microso­ft\Windows\iexplorer.exe
c:\windows\system32\vuvuwofi.dll
c:\windows\system32\sinodisi.dll
c:\windows\system32\vusilina.exe
c:\windows\system32
owepeto.dll
c:\windows\system32
otosujo.dll
c:\windows\system32\wakepule.dll
c:\windows\system32\ebikuyuz.tmp
c:\windows\system32\zuyukibe.dll
c:\progra~2\proto.dll
c:\windows\System32\duredidi.dll
c:\windows\System32\fagometo.dll
c:\windows\System32\fuzoyalu.dll
c:\windows\System32\heravole.dll
c:\windows\System32\jemukuwo.dll
c:\windows\System32\jinuwayi.dll
c:\windows\System32\jovivumo.dll
c:\windows\System32\juvoroke.dll.tmp
c:\windows\System32\kilatape.dll
c:\windows\System32\kokakiva.dll
c:\windows\System32\korumore.dll
c:\windows\System32\likebowa.dll.tmp
c:\windows\System32\mejiyuwo.dll.tmp
c:\windows\System32
ukiyofi.dll
c:\windows\System32\piyiliwa.dll
c:\windows\System32osovoti.dll
c:\windows\System32\varabefa.dll
c:\windows\System32\yapipije.dll
c:\windows\System32\yarobefe.dll
c:\windows\System32\yohabinu.dll
c:\windows\System32\zasiyugi.dll
c:\windows\System32\zilolilo.dll 
c:\windows\System32\duredidi.dll
c:\windows\system32
owepeto.dll
c:\windows\system32\yarobefe.dll
c:\windows\system32\zezojare.dll
c:\windows\system32\lugatepo.dll
c:\windows\system32\husenafe.dll
c:\windows\system32\hidisuza.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bd2d68b3-98bc-4d00-8ff0-1c8f3edfea37}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DiskChk help"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"d8195c32"=-
"kokevejoti"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusDisableNotify"="0x00000001"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000000

Enregistre ce fichier sous le nom CFScript

[*]Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture [img]http://apu.mabul.org/up/apu/2008/08/12/img-191202xzrpd.gif/img
[*]Une fenêtre bleue va apparaître : au message "Type 1 to continue, or 2 to abort", tape 1 puis valide.
[*]Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal.
Ne touche à rien tant que le scan n'est pas terminé.
[*]Une fois le scan achevé, un rapport va s'afficher : poste son contenu.
[*]Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Fabien · Answer

Voilà:

ComboFix 09-06-14.02 - Fabien 15/06/2009 19:56.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6000.0.1252.33.1036.18.1022.478 [GMT 2:00]
Lancé depuis: c:\users\Fabien\Documents\Mes fichiers reçus\ComboFix.exe
Commutateurs utilisés :: c:\users\Fabien\Desktop\CFScript.txt
AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\progra~2\proto.dll"
"c:\users\Fabien\AppData\Roaming\Microsoft\Windows\iexplorer.exe"
"c:\windows\System32\duredidi.dll"
"c:\windows\system32\ebikuyuz.tmp"
"c:\windows\System32\fagometo.dll"
"c:\windows\System32\fuzoyalu.dll"
"c:\windows\System32\heravole.dll"
"c:\windows\system32\hidisuza.dll"
"c:\windows\system32\husenafe.dll"
"c:\windows\System32\jemukuwo.dll"
"c:\windows\System32\jinuwayi.dll"
"c:\windows\System32\jovivumo.dll"
"c:\windows\System32\juvoroke.dll.tmp"
"c:\windows\System32\kilatape.dll"
"c:\windows\System32\kokakiva.dll"
"c:\windows\System32\korumore.dll"
"c:\windows\System32\likebowa.dll.tmp"
"c:\windows\system32\lugatepo.dll"
"c:\windows\System32\mejiyuwo.dll.tmp"
"c:\windows\system32
odlynrs.dll"
"c:\windows\system32
otosujo.dll"
"c:\windows\system32
owepeto.dll"
"c:\windows\System32
ukiyofi.dll"
"c:\windows\System32\piyiliwa.dll"
"c:\windows\System32osovoti.dll"
"c:\windows\system32\sinodisi.dll"
"c:\windows\System32\varabefa.dll"
"c:\windows\system32\vusilina.exe"
"c:\windows\system32\vuvuwofi.dll"
"c:\windows\system32\wakepule.dll"
"c:\windows\system32\xbfwfpjb.dll"
"c:\windows\System32\yapipije.dll"
"c:\windows\System32\yarobefe.dll"
"c:\windows\System32\yohabinu.dll"
"c:\windows\System32\zasiyugi.dll"
"c:\windows\system32\zezojare.dll"
"c:\windows\System32\zilolilo.dll"
"c:\windows\system32\zuyukibe.dll"
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\progra~2\proto.dll
c:\users\Fabien\AppData\Roaming\Microsoft\Windows\iexplorer.exe
c:\windows\System32\duredidi.dll
c:\windows\system32\ebikuyuz.tmp
c:\windows\System32\fagometo.dll
c:\windows\System32\fuzoyalu.dll
c:\windows\System32\heravole.dll
c:\windows\System32\jemukuwo.dll
c:\windows\System32\jinuwayi.dll
c:\windows\System32\jovivumo.dll
c:\windows\System32\juvoroke.dll.tmp
c:\windows\System32\kilatape.dll
c:\windows\System32\kokakiva.dll
c:\windows\System32\korumore.dll
c:\windows\System32\likebowa.dll.tmp
c:\windows\System32\mejiyuwo.dll.tmp
c:\windows\system32
odlynrs.dll
c:\windows\system32
otosujo.dll
c:\windows\system32
owepeto.dll
c:\windows\System32
ukiyofi.dll
c:\windows\system32\otepewon.ini
c:\windows\System32\piyiliwa.dll
c:\windows\System32osovoti.dll
c:\windows\system32\sinodisi.dll
c:\windows\System32\varabefa.dll
c:\windows\system32\vusilina.exe
c:\windows\system32\vuvuwofi.dll
c:\windows\system32\wakepule.dll
c:\windows\system32\xbfwfpjb.dll
c:\windows\System32\yapipije.dll
c:\windows\system32\yarobefe.dll
c:\windows\System32\yohabinu.dll
c:\windows\System32\zasiyugi.dll
c:\windows\System32\zilolilo.dll
c:\windows\system32\zuyukibe.dll

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-05-15 au 2009-06-15  ))))))))))))))))))))))))))))))))))))
.

2009-06-15 15:19 . 2009-06-15 18:07	--------	d-----w-	c:\users\Fabien\AppData\Local	emp
2009-06-15 14:35 . 2009-06-15 14:35	35	----a-w-	c:\users\Fabien\AppData\Roaming\SetValue.bat
2009-06-15 14:31 . 2009-06-15 14:33	--------	d-----w-	C:\ToolBar SD
2009-06-15 14:02 . 2009-06-15 14:02	--------	d-----w-	c:\program files\CCleaner
2009-06-15 13:15 . 2009-06-15 13:37	--------	d-----w-	C:\GenProc
2009-06-15 10:27 . 2009-06-15 10:27	1	---h--w-	c:\windows\bf23567.dat
2009-06-15 10:27 . 2009-06-15 10:27	2	---h--w-	c:\windows\zaponce53198.dat
2009-06-15 10:27 . 2009-06-15 10:27	2	---h--w-	c:\windows\zaponce53290.dat
2009-06-15 10:26 . 2009-06-15 10:26	159	----a-w-	C:\d45.bat

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-15 17:49 . 2007-02-13 00:35	690594	----a-w-	c:\windows\system32\perfh00C.dat
2009-06-15 17:49 . 2007-02-13 00:35	117366	----a-w-	c:\windows\system32\perfc00C.dat
2009-06-15 14:51 . 2008-02-09 12:36	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2009-06-15 14:49 . 2008-02-09 12:36	--------	d-----w-	c:\progra~2\Spybot - Search & Destroy
2009-06-15 14:35 . 2009-06-15 14:35	691	----a-w-	c:\users\Fabien\AppData\Roaming\GetValue.vbs
2009-05-11 15:50 . 2009-05-11 09:36	--------	d-----w-	c:\progra~2\NOS
2009-05-11 15:50 . 2009-05-11 09:36	--------	d-----w-	c:\program files\NOS
2009-05-11 09:42 . 2007-08-18 00:36	--------	d-----w-	c:\program files\Common Files\Adobe
2007-08-16 00:11 . 2007-08-16 00:11	22	--sha-w-	c:\windows\SMINST\HPCD.sys
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-10 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 115816]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2006-10-26 22696]
"hpqSRMon"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"TkBellExe"="c:\program files\Common Files\Real\Update_OBealsched.exe" [2009-03-22 198160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-24 44136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

c:\users\Fabien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Outil de d‚tection de support Picture Motion Browser.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-4-20 368640]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"FilterAdministratorToken"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AntiVirusDisableNotify"="0x00000001"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7FCB15C6-544E-42C3-9639-F1B98CFBC9E3}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{F51F28BA-C749-441E-928C-7F71568F443C}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{66AD1444-6292-4AFB-8C8B-2E55176980B6}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{9E46C892-C381-471D-A5A3-A882D3F259D8}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{D5F25E60-B4D9-4C1F-99FB-4F562602DD22}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{AB8DCD38-8B28-45B2-ADCA-3B7A0A531C43}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{978DAB7C-36DC-478E-A2AA-4849ADA6C9F3}"= TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{57E18C90-B5BC-4341-A4EB-B334ABF5DFAC}"= TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"{DA32E4A8-6933-4ED9-935C-102CA939FABB}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{BFAC95B7-D21C-40C2-9498-D0255545EC59}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{C6D18486-E2CA-4C1E-8ADE-670948973EC0}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{6685C2CD-F647-4D3D-BEC1-CDE8A4C74712}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{A0BDE0F0-AFE9-4F17-8BAF-D429F3548F14}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{9D411EA8-A787-402E-9282-33FA150B6DB2}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{FA876251-B1DF-41D7-9F1B-A7DE1EB4E2A2}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{D1E4D924-30F7-4C92-84AE-37C0351FEACD}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\RM.exe:Render Manager
"{B66913C6-A24E-4F61-940B-054BC382F66A}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\RM.exe:Render Manager
"{938A2BDD-3F2E-43A8-8E6D-21A662AC980C}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe:PMSRegisterFile
"{953927E5-467D-4A1B-99F6-DE4E4B8001D9}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe:PMSRegisterFile
"{CA76CAA4-16D6-4791-8702-6C6656C7E551}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\umi.exe:umi
"{488EBCBB-4807-4009-8DD6-08304551D3C0}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\umi.exe:umi
"{0C7D58DE-329A-4510-9098-8D1DFBD0D031}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:Pinnacle VideoSpin
"{EDE46553-398E-46D8-9449-DD44C8428A5D}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:Pinnacle VideoSpin
"{CC1AF634-8068-404C-A867-44073ECDC11E}"= c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqpse.exe:hpqpse.exe
"{34EDF4B9-01BB-4537-8941-DFE4FAB2B494}"= c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe:hpqphotocrm.exe
"{C2F38C95-5672-4B1D-94E2-0193143D9DE4}"= c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqsudi.exe:hpqsudi.exe
"{C52BF869-3DB9-4132-B188-3AF810F93122}"= c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqpsapp.exe:hpqpsapp.exe
"{DBB924A5-E868-411E-B7EE-164DFC9E76D1}"= UDP:c:\windows\explorer.exe:explorer
"{7410D6FF-AB7D-43A3-8A62-4BC586AB085D}"= UDP:c:\windows\explorer.exe:explorer
"{6C086872-28FE-44F7-BAF4-8357A7A927B6}"= TCP:c:\windows\explorer.exe:explorer
"{2902AA97-0145-4147-8C5A-95B2361F6B41}"= TCP:c:\windows\explorer.exe:explorer
"{B70D112B-A663-4098-AAE0-F28587612E6D}"= UDP:c:\windows\System32\LogonUI.exe:LogonUI
"{08704D2C-6ADB-4240-8B89-99DFD2FD4804}"= TCP:c:\windows\System32\LogonUI.exe:LogonUI
"{9B298B83-12BB-4E42-A847-A534DAF1E59D}"= UDP:c:\windows\System32\wininit.exe:wininit
"{43149129-F1E1-48EF-926C-ECA3E395B2A5}"= TCP:c:\windows\System32\wininit.exe:wininit
"{71DE8898-07E7-4E47-A48A-7FD34BD348F1}"= UDP:c:\windows\System32\winlogon.exe:winlogon
"{62E84DCD-7FD9-464A-BA8C-A4C6B8DCF2CE}"= TCP:c:\windows\System32\winlogon.exe:winlogon
"{8C789DA9-D081-4B6D-B90D-6A6833740215}"= UDP:c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe:DQLWinService
"{355856DE-6E93-43B0-A235-6567F1E14472}"= UDP:c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe:DQLWinService
"{2A6C76F7-F974-4835-8CBD-08CE1DDAE968}"= TCP:c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe:DQLWinService
"{F7206B98-5293-42B9-ABB8-0DCCF5A3A8BF}"= TCP:c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe:DQLWinService
"{E0B5625E-75A9-4115-BFB4-43E8344EAAE7}"= UDP:c:\windows\System32undll32.exe:rundll32
"{D9685FB5-21C7-4BC5-8C7A-76A697CE13EA}"= TCP:c:\windows\System32undll32.exe:rundll32
"{474801FC-0F79-4F09-9951-ACA0AC097D69}"= UDP:c:\windows\System32\dllhost.exe:DllHost
"{E4892649-B2B1-4083-9266-5C8E0908DAF0}"= TCP:c:\windows\System32\dllhost.exe:DllHost
"{1932A6E7-5944-432C-9F4D-40BF0DC2ACFF}"= UDP:c:\program files\Spybot - Search & Destroy\TeaTimer.exe:TeaTimer
"{474E175A-C6D1-4242-926D-97E8FBB18C5D}"= UDP:c:\program files\Windows Sidebar\sidebar.exe:sidebar
"{CB6A8863-280A-4E68-905D-B18BDEB6FDDA}"= TCP:c:\program files\Windows Sidebar\sidebar.exe:sidebar
"{A997AA06-213A-4186-BCFC-31378075424C}"= TCP:c:\program files\Spybot - Search & Destroy\TeaTimer.exe:TeaTimer
"{22FB3E6B-E290-4557-A2D1-2BC0479B9D66}"= UDP:c:\program files\Symantec\LiveUpdate\ALUNOTIFY.EXE:ALUNOTIFY
"{DC78DFF4-F187-416E-98C3-8C1C26946B85}"= TCP:c:\program files\Symantec\LiveUpdate\ALUNOTIFY.EXE:ALUNOTIFY
"{96E09998-C984-4ABA-AB9B-8EADA0A10CDD}"= UDP:c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe:SPUVolumeWatcher
"{8210732C-9C8D-42C8-8349-EC1EA2AEF175}"= UDP:c:\windows\System32	askeng.exe:taskeng
"{D737B2F7-CA72-434F-AA93-29A13D92C531}"= TCP:c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe:SPUVolumeWatcher
"{FBC55D43-EFA4-4659-95FC-BAC2B1D74CE2}"= TCP:c:\windows\System32	askeng.exe:taskeng
"{EF3BC7FC-127D-41D8-8A8D-B95EEF9D2C50}"= UDP:c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe:SPUVolumeWatcher
"{FAAD5CAF-22F0-4D45-94B3-CC0F8F14892B}"= TCP:c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe:SPUVolumeWatcher
"{89CAD5EA-1B09-4626-8AA4-672C458D7E10}"= UDP:c:\windows\System32\msfeedssync.exe:msfeedssync
"{0255F71A-DE97-4D43-B24D-7269E7D54DE9}"= TCP:c:\windows\System32\msfeedssync.exe:msfeedssync
"{2106F6DD-7AF8-40B9-8E1E-A9CBCFC0C3AD}"= UDP:c:\windows\System32\dwm.exe:Dwm
"{53A3117A-D389-47ED-952C-B4048203CF8A}"= TCP:c:\windows\System32\dwm.exe:Dwm
"{2F655F81-689B-408C-AC69-50815AE6117B}"= UDP:c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe:AppSvc32
"{8D087F90-23AC-4F78-B047-2690F5C8E0F8}"= UDP:c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe:AppSvc32
"{0C7F0C03-49B0-4986-B9D8-D498E05E795E}"= TCP:c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe:AppSvc32
"{9F37F5BF-EA3A-40D0-8A98-52C962F8E3C5}"= TCP:c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe:AppSvc32
"{70AB662E-42C4-4DE7-B49E-06C782B8282B}"= UDP:c:\windows\System32\spoolsv.exe:spoolsv
"{45753029-BEB9-4FBA-9B2E-444689347A73}"= TCP:c:\windows\System32\spoolsv.exe:spoolsv
"{67E01EBA-E09E-4484-AA66-56C1C149012A}"= UDP:c:\windows\ehome\ehmsas.exe:ehmsas
"{B701033B-7AA3-4DF2-A0AB-A77C67409B8B}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server	ools\IntelDHReconfSvc.exe:IntelDHReconfSvc
"{A36000BF-71A7-4801-9171-5356D587941B}"= TCP:c:\windows\ehome\ehmsas.exe:ehmsas
"{DF34A455-3E18-4311-862C-FF2EE3CD8E5C}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server	ools\IntelDHReconfSvc.exe:IntelDHReconfSvc
"{B43D8953-D9D1-4FCC-8B93-EACBA4435A2F}"= UDP:c:\windows\System32\lsass.exe:lsass
"{63856AED-BEFB-4E02-9EDB-5FCBDBC81F14}"= UDP:c:\windows\System32\lsass.exe:lsass
"{90EE695F-3F6A-420A-9B11-5FCEC15ED813}"= TCP:c:\windows\System32\lsass.exe:lsass
"{70459C57-53A7-40D4-BE23-79C4D7FE0835}"= TCP:c:\windows\System32\lsass.exe:lsass
"{CD06C842-29E5-4AF1-A83A-DD823C26FDE3}"= UDP:c:\program files\MSN Messenger\usnsvc.exe:usnsvc
"{5626C65E-2D5D-4216-8C81-E51DB1DB7BD6}"= UDP:c:\program files\MSN Messenger\usnsvc.exe:usnsvc
"{8EA01207-21EA-4D84-8D89-6FE53FD4DA88}"= TCP:c:\program files\MSN Messenger\usnsvc.exe:usnsvc
"{7152330C-1682-4787-8BCD-8A2EA0EF7626}"= TCP:c:\program files\MSN Messenger\usnsvc.exe:usnsvc
"{2BE426BF-59C6-4DC6-AFD4-9906DB533A80}"= UDP:c:\windows\System32\services.exe:services
"{47109013-E7A3-4D3E-AEA3-1F57818B5717}"= TCP:c:\windows\System32\services.exe:services
"{7480A5AE-D680-4FB9-9791-96E41520D335}"= UDP:c:\windows\System32\SearchIndexer.exe:SearchIndexer
"{8523A369-B081-4800-8A29-9FE35CF5085C}"= TCP:c:\windows\System32\SearchIndexer.exe:SearchIndexer
"{2A7A767D-8882-457A-9394-9F2E9A21DEA2}"= UDP:c:\program files\Services en ligne\yahoo\WizLink.exe:WizLink
"{B896E493-9715-4007-83E8-E2A6A9C7F918}"= UDP:c:\program files\Services en ligne\yahoo\WizLink.exe:WizLink
"{ABECF909-7324-4B06-B12D-A60D83473251}"= TCP:c:\program files\Services en ligne\yahoo\WizLink.exe:WizLink
"{D9EC7104-4FFD-4F2D-91CB-5A6437C6DD3E}"= TCP:c:\program files\Services en ligne\yahoo\WizLink.exe:WizLink
"{46C51F94-A96E-4DB5-87C3-F4AB5DE0184B}"= UDP:c:\program files\Windows Media Player\wmplayer.exe:wmplayer
"{0F3E4916-0FDD-40CF-8465-6E7F9702A2F8}"= TCP:c:\program files\Windows Media Player\wmplayer.exe:wmplayer
"{4EA7C05E-B989-4A53-8633-7F8DCD322E2F}"= UDP:c:\windows\ehome\ehtray.exe:ehtray
"{83E4CA1C-9BA8-4799-AB43-DD06766D4EFF}"= UDP:c:\windows\ehome\ehtray.exe:ehtray
"{7D84C423-1E4D-4C37-B787-DD127BFCF5AF}"= TCP:c:\windows\ehome\ehtray.exe:ehtray
"{51822105-098A-4F83-A79C-982D5214449A}"= TCP:c:\windows\ehome\ehtray.exe:ehtray
"{A5BC6DF8-7A03-4A76-B5CF-1F97A5EB2DAA}"= UDP:c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe:ALUSchedulerSvc
"{91E5D25F-E6B5-4309-AE87-065257151F33}"= TCP:c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe:ALUSchedulerSvc
"{29C53A8E-B149-4BCE-AF76-3A8D51B70E14}"= UDP:c:\program files\Common Files\Symantec Shared\ccSvcHst.exe:ccSvcHst
"{804241E7-8446-475A-B4D9-8023AE20EEE1}"= UDP:c:\program files\Common Files\Symantec Shared\ccSvcHst.exe:ccSvcHst
"{459E25AC-B7A8-44EB-80AA-39EE6088137D}"= UDP:c:\program files\Common Files\Real\Update_OBealsched.exe:realsched
"{DFA52230-17E1-41D8-BE60-7510C5702329}"= TCP:c:\program files\Common Files\Real\Update_OBealsched.exe:realsched
"{16847F96-AE6E-40D0-9027-29E89FDBDC75}"= UDP:c:\program files\Common Files\LightScribe\LSSrvc.exe:LSSrvc
"{1BD8E5E6-0DF1-404F-8821-3F2DECA5FD21}"= UDP:c:\program files\Common Files\LightScribe\LSSrvc.exe:LSSrvc
"{17B4CBF2-9534-4082-B463-B9F181EFEB7D}"= TCP:c:\program files\Common Files\LightScribe\LSSrvc.exe:LSSrvc
"{A3382283-4E67-4844-AEB0-D0DD10521EE9}"= TCP:c:\program files\Common Files\LightScribe\LSSrvc.exe:LSSrvc
"{3B19E4C4-9F86-4E66-87BB-4FF9B3FE65AB}"= UDP:c:\windows\System32\wermgr.exe:wermgr
"{983ECCB2-F39A-4459-A90B-DAB67240FA44}"= TCP:c:\windows\System32\wermgr.exe:wermgr
"{854ED5E7-CE9A-4671-9A6A-7063ABC9C869}"= UDP:c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe:GoogleToolbarNotifier
"{7F0BD547-9322-448F-A93E-47AFA8EB9A91}"= TCP:c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe:GoogleToolbarNotifier
"{23235B13-62D2-48A4-924B-C05BB0AFFD9B}"= UDP:c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe:symlcsvc
"{281634BF-6F4B-4A05-B3B9-CAC96385C285}"= UDP:c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe:symlcsvc
"{EF26BD8C-1D17-4B28-84D3-BE703F57D4ED}"= TCP:c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe:symlcsvc
"{A454313D-62ED-4E6B-BA10-519AA40EE08C}"= TCP:c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe:symlcsvc
"{8240DB0A-19E8-4576-855C-ECE337359CA7}"= UDP:c:\program files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe:HpqSRmon
"{B94BA447-ABCE-4BC8-85A7-BE52CE5DCD1F}"= TCP:c:\program files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe:HpqSRmon
"{28FD5C0C-E5EA-4A72-8606-78C82920DB13}"= UDP:c:\windows\System32\mobsync.exe:mobsync
"{9D1CC360-11B8-4943-84D0-2F509766E240}"= TCP:c:\windows\System32\mobsync.exe:mobsync
"{2E7A2E52-9487-4BE1-8F6B-7EFD73ACE58F}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server	ools\IntelDHSvcConf.exe:IntelDHSvcConf
"{40754A59-044A-4214-99BC-2BA8A5916A7E}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server	ools\IntelDHSvcConf.exe:IntelDHSvcConf
"{F96E84BD-E4C7-4C5F-8C01-2E42F0444B19}"= UDP:c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe:PIFSvc
"{E6DEB72D-6870-4BA2-9FA4-2F344ECD04B6}"= TCP:c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe:PIFSvc
"{03D47536-3B32-48AD-B713-A409D1F4CBC7}"= UDP:c:\program files\Common Files\Symantec Shared\ccApp.exe:ccApp
"{4C515D3D-151B-4E2E-A37B-2D382FB73F3A}"= TCP:c:\program files\Common Files\Symantec Shared\ccApp.exe:ccApp
"{FD98EEA3-81A8-42C1-A7FF-EE02C3F0DCD8}"= UDP:c:\program files\Spybot - Search & Destroy\SDWinSec.exe:SDWinSec
"{519AAE9A-6131-4A33-8817-2850FBFB92D9}"= TCP:c:\program files\Spybot - Search & Destroy\SDWinSec.exe:SDWinSec
"{A7EDD512-FF6E-4C75-BF6D-1C5AA2E5D0B7}"= UDP:c:\program files\Common Files\microsoft shared\Windows Live\WLLoginProxy.exe:WLLoginProxy
"{8018AD6E-4979-467E-BA2D-0212069DA56D}"= TCP:c:\program files\Common Files\microsoft shared\Windows Live\WLLoginProxy.exe:WLLoginProxy
"{0CD1BA95-F18D-4487-9FD9-97EBF08EAB92}"= UDP:c:\windows\System32\WerFault.exe:WerFault
"{376B27C1-FBD3-4DC8-B272-D4916A942B83}"= TCP:c:\windows\System32\WerFault.exe:WerFault

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
"DoNotAllowExceptions"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20070718.002\IDSvix86.sys [19/07/2007 15:21 212280]
R2 DQLWinService;DQLWinService;c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [03/09/2006 11:32 208896]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [25/07/2007 11:15 106808]
R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [24/10/2006 07:40 37008]
S2 IntelDHSvcConf;Intel DH Service;c:\program files\Intel\IntelDH\Intel Media Server	ools\IntelDHSvcConf.exe [10/05/2006 10:13 29696]
S3 MODRC;DiBcom Infrared Receiver;c:\windows\System32\drivers\modrc.sys [01/04/2008 17:49 13824]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{061B4178-6C2C-4C72-AD92-F2A1A2AB8F4E} - (no file)
BHO-{104CD824-8B39-480A-9157-8AF4DC911F8F} - (no file)
BHO-{2DA5C4D8-7CC7-43B5-A60F-1C31D671272E} - (no file)
BHO-{51676694-B364-4670-96FC-6648B54AD831} - (no file)
BHO-{631EDFDC-F8ED-4DDF-A304-04267996D11A} - (no file)
BHO-{6B71EBDE-3793-4174-B47A-D40320452BA9} - (no file)
BHO-{833A008C-27D9-4E3F-9A3D-61AF032AF742} - (no file)
BHO-{85B26C5F-CF21-4E3B-9D11-C686131B7F4D} - (no file)
BHO-{BB23E516-8935-41E3-A1CE-94FD9C4DDB93} - (no file)
BHO-{bd2d68b3-98bc-4d00-8ff0-1c8f3edfea37} - (no file)
BHO-{D84252E8-FAC7-44B4-9ED1-4A7891A7A289} - (no file)
BHO-{DB08202F-3699-45B6-A145-350DD003F33E} - (no file)
BHO-{DC27D06B-6321-453D-85A0-809C5236C415} - (no file)
BHO-{E28ECF3B-AD59-4DE6-8E0D-E033A03BCCDC} - (no file)


.
------- Examen supplémentaire -------
.
mWindow Title = 
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-15 20:07
Windows 6.0.6000  NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\windows\System32\WUDFHost.exe
c:\windows\ehome\ehmsas.exe
c:\windows\ehome\ehsched.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\System32\conime.exe
c:\windows\System32\wbem\WMIADAP.exe
c:\progra~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
c:\program files\Symantec\LiveUpdate\AUPDATE.EXE
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Heure de fin: 2009-06-15 20:10 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-06-15 18:09
ComboFix2.txt  2009-06-15 15:19

Avant-CF: 250 543 513 600 octets libres
Après-CF: 250 296 442 880 octets libres

348	--- E O F ---	2009-06-15 15:51

eZula · Answer

Fais ce scan en ligne https://www.micro-astuce.com/securite/NanoScan-Panda.php et poste le rapport entier

Fabien · Answer

Voilà le rapport que j'ai obtenu:

ï»¿;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-06-17 12:07:57
PROTECTIONS: 3
MALWARE: 21
SUSPECTS: 1
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Norton Internet Security                     2007                          Yes       No
Windows Defender                             1.1.1505.0                    No        Yes
Norton Internet Security                     2007                          No        No
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\Low\fabien@247realmedia[1].txt
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\fabien@247realmedia[2].txt
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\fabien@fastclick[2].txt
00147806  Cookie/7search                     TrackingCookie      No        0         Yes            No           C:\ToolBar SD\Backup-TB\Users\Fabien\AppData\Roaming\MICROS~1\Windows\Cookies\fabien@7search[2].txt
00147806  Cookie/7search                     TrackingCookie      No        0         Yes            No           C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@7search[2].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\Low\fabien@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\fabien@xiti[1].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\fabien@serving-sys[1].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\Low\fabien@serving-sys[1].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\fabien@bs.serving-sys[2].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\Low\fabien@bs.serving-sys[1].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\fabien@weborama[2].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\Low\fabien@weborama[1].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\fabien@adtech[1].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\Low\fabien@smartadserver[1].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\fabien@smartadserver[2].txt
00471552  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\Windows\System32\xxyabxYQ.dll
00484705  Application/IEDefender             HackTools           No        0         Yes            No           C:\Qoobox\Quarantine\C\Windows\System32\IEDFix.C.exe.vir
00484705  Application/IEDefender             HackTools           No        0         Yes            No           C:\Users\Fabien\Documents\Mes fichiers reÃ§us\SmitfraudFix\IEDFix.C.exe
00484705  Application/IEDefender             HackTools           No        0         Yes            No           C:\Users\Fabien\Desktop\SmitfraudFix\IEDFix.C.exe
00534591  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\Qoobox\Quarantine\C\Windows\System32\muturebe.dll.vir
00817044  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\Qoobox\Quarantine\C\Windows\System32\jutovofa.dll.vir
00921467  Generic Malware                    Virus/Trojan        No        0         Yes            No           C:\Users\Fabien\Desktop\SmitfraudFix\404Fix.exe
00921467  Generic Malware                    Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\C\Windows\System32\404Fix.exe.vir
00921467  Generic Malware                    Virus/Trojan        No        0         Yes            No           C:\Users\Fabien\Documents\Mes fichiers reÃ§us\SmitfraudFix\404Fix.exe
01380007  Trj/Buzus.AH                       Virus/Trojan        No        1         Yes            No           C:\Qoobox\Quarantine\C\Users\Fabien\AppData\Roaming\Microsoft\Windows\lsass.exe.vir
01445888  Trj/Buzus.AH                       Virus/Trojan        No        1         Yes            No           C:\Qoobox\Quarantine\[4]-Submit_2009-06-15_19.55.42.zip[iexplorer.exe]
01457956  Generic Malware                    Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\[4]-Submit_2009-06-15_19.55.42.zip[xbfwfpjb.dll]
01457956  Generic Malware                    Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\[4]-Submit_2009-06-15_19.55.42.zip[nodlynrs.dll]
03074964  Trj/CI.A                           Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\C\Users\Fabien\AppData\Roaming\unobi.dll.vir
03074964  Trj/CI.A                           Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\C\Windows\System32\vjjypnyd.exe.vir[upd_IE8.upd]
03074964  Trj/CI.A                           Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\C\Windows\freddy46.exe.vir
03074964  Trj/CI.A                           Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\C\Windows\System32\vjjypnyd.exe.vir[upd_IE8.upd]
03074964  Trj/CI.A                           Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\C\Windows\System32\vjjypnyd.exe.vir
03074964  Trj/CI.A                           Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\C
04287566  Generic Trojan                     Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\C\Windows\System32\khfCRkLe.dll.vir
04287566  Generic Trojan                     Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\C\Windows\System32\tuvUlmNf.dll.vir
04345596  Generic Trojan                     Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\C\Windows\System32\xsohcgsf.dll.vir
04362512  Generic Trojan                     Virus/Trojan        No        0         Yes            No           C:\Qoobox\Quarantine\C\Windows\System32\pwblphrt.dll.vir
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Ê—_Òèò¿	ƒ9  
;===================================================================================================================================================================================
No        C:\Users\Fabien\Documents\Mes fichiers reÃ§us\SmitfraudFix.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                        Ê—_Òèò¿	ƒ9  
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Ê—_Òèò¿	ƒ9  
;===================================================================================================================================================================================
;===================================================================================================================================================================================

eZula · Answer

Et où en sont tes problèmes ?

Fabien · Answer

Eh bien, écoute, l'ordinateur tourne mieux. L'ADSL fonctionne bien. Il n'y a plus de déconnexion intempestive. Je peux de nouveau utiliser Google et accéder aux pages que je consulte le plus souvent, ce que je ne pouvais plus faire ces derniers temps. L'ordinateur ne plante plus pour un oui ou pour un non. 
   Par contre, lorsque je veux regarder un DVD, ils bloquent au bout de quelques minutes et les lecteurs ne répondent plus. J'ai essayé d'utiliser Windows media player ou real one player, mais ça donne la même chose. Pour l'instant, mon problème se limite à cela.
   Enfin, c'est déjà super. Ca m'a bien aidé. Merci beaucoup.

eZula · Answer

Essaye de poser la question sur un forum adéquat, fc'est peut être un problème de codecs.

* Pour terminer, utilise ToolsCleaner! (de A.Rothstein et Dj Quiou) http://pc-system.fr/ pour nettoyer les utilitaires téléchargés, 
* Désactive la restauration système, redémarre l'ordinateur, puis réactive-la, en procédant comme indiqué ici  http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20020830101856924

* Lance le nettoyage avec CCleaner régulièrement 
* Visite régulièrement le site http://www.update.microsoft.com/windowsupdate/v6/default.aspx afin d'avoir un système toujours actualisé.
* Utilise hebdomadairement ce petit programme http://alt-shift-return.org/Info/Update_Checker.html pour effectuer tes mises à jour logicielles.
* N'installe jamais un programme sans avoir entièrement lu et compris les termes de son contrat d'utilisation, ou sans être définitivement certain qu'il n'installe pas discrètement un logiciel publicitaire (renseigne-toi sur Google ou sur les forums)
* Préfère l'utilisation de logiciels libres https://fr.wikipedia.org/wiki/Logiciel_libre : ils sont transparents et plus sécurisés, à l'inverse des logiciels propriétaires https://fr.wikipedia.org/wiki/Logiciel_propri%C3%A9taire ; Firefox, Thunderbird, OpenOffice, VLC... en font partie.

* A ce moment là, tu pourras marquer ton sujet "résolu" si tu estimes que c'est le cas 


à+

Gros problème de virus

14 réponses

Discussions similaires

Newsletters