Infecté par WinBlueSoft? Résolu

Question

Bonjour, voila je pense être infecté par WinblueSoft mais je n'en suis pas sûr à 100%.

J'ai cherché sur le forum et les symptômes présentés par d'autres "infectés" ne sont pas exactement les mêmes.

Voila, mon PC est vraiment ralenti, la connexion est beaucoup plus lente...

Je reçois des popups, des messages de WinBlueSoft qui m'indique que je suis infecté par 735 fichiers (après installation).

Je voudrai installer Anti-Malware... mais l'installation plante pendant "Extraction de fichiers" et il m'est donc impossible de l'éliminer!! 
Lorsque je démarre mon pc, on me dit que je n'ai pas d'antivirus alors qu'il est activé, hier c'était le pare-feu qui était désactivé tout seul, etc...


J'espère de tout coeur que vous pourrez m'aider car je suis vraiment à cour d'idées!
Bonne soirée à tous et merci d'avance!

Utilisateur anonyme · Answer

Bonjour

Télécharge Malwarebytes anti malware ici  
http://www.malwarebytes.org/mbam.php
 
* Installe le (choisis bien "français" ; ne modifie pas les paramètres d'installe ) et mets le à jour . 

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : https://www.malekal.com/tutorial-aboutbuster/ 

* Potasse le tuto pour te familiariser avec le prg : 

https://forum.pcastuces.com/sujet.asp?f=31&s=3 

(cela dis, il est très simple d’utilisation). 

relance malwarebytes en suivant scrupuleusement ces consignes : 

! Déconnecte toi et ferme toutes applications en cours ! 

* Lance Malwarebyte's . 

Fais un examen dit "Complet" . 

--> Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ). 
--> à la fin tu cliques sur "résultat" . 
--> Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " . 

Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le ! 


Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

loulou92 · Answer

Le problème est que je ne peux pas l'installer puisqu'il plante pendant l'installation!

loulou92 · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Loulouu at 2009-06-28 21:35:36
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 109 GB (73%) free of 150 GB
Total RAM: 3071 MB (91% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:35:43, on 28/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Documents and Settings\Loulouu\Bureau\RSIT.exe
C:\Program Files	rend micro\Loulouu.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinBlueSoft] C:\Program Files\WinBlueSoft Software\WinBlueSoft\WinBlueSoft.exe -min
O4 - HKCU\..\Run: [] C:\DOCUME~1\Loulouu\LOCALS~1\Temp\sjq4zdwy.exe
O4 - HKCU\..\Run: [hsf7husjnfg98gi498aejhiugjkdg4] C:\DOCUME~1\Loulouu\LOCALS~1\Temp\sjq4zdwy.exe
O4 - HKCU\..\Run: [kell] C:\program Files\Manson\liser.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [setup2.exe] C:\WINDOWS\system32\setup2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NDAS Device Management.lnk = C:\Program Files\NDAS\System
dasmgmt.exe
O8 - Extra context menu item: &Tout télécharger avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{A5CB6A7C-8216-4D00-9C82-88C55AEA9AFB}: NameServer = 85.255.112.192,85.255.112.25
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB26ABAD-A854-4F43-8985-FB6982946E58}: NameServer = 85.255.112.192,85.255.112.25
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.192,85.255.112.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.192,85.255.112.25
O20 - AppInit_DLLs: c:\progra~1\Manson\liser.dll
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: jryjdrtjj6sjjyh4rthgdf80 - Unknown owner - C:\WINDOWS\jryjdrtjj6sjjyh4rthgdf81.exe (file missing)
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NDAS Service (ndassvc) - XIMETA, Inc. - C:\Program Files\NDAS\System
dassvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: sopidkc  Service (sopidkc) - Unknown owner - C:\WINDOWS\system32\sopidkc.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

loulou92 · Answer

info.txt logfile of random's system information tool 1.06 2009-06-28 21:35:45

======Uninstall list======

-->MsiExec /X{A7E07C2B-2220-4415-87E3-784D5814BC93}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Apple Mobile Device Support-->MsiExec.exe /I{659B48CD-0608-4ED5-94C0-0B6C87114F10}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
AusLogics Disk Defrag-->"C:\Program Files\Auslogics\AusLogics Disk Defrag\unins000.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Counter-Strike: Source-->"C:\Program Files\Steam\steam.exe" steam://uninstall/240
FlashGet 1.9.6.1073-->C:\Program Files\FlashGet\uninst.exe
FMEurope_Update_Live_3-->C:\Program Files\sports Interactive\Football Manager 2009\data\db\uninstall.exe
Football Manager 2009-->"C:\Program Files\Sports Interactive\Football Manager 2009\Uninstall_Football Manager 2009\Désinstaller Football Manager 2009.exe"
GUILD WARS-->"C:\Program Files\GUILD WARS\Gw.exe" -uninstall
Hamachi 1.0.2.5-->C:\Program Files\Hamachi\uninstall.exe
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Photosmart, Officejet and Deskjet 7.0.A-->C:\Program Files\HP\Digital Imaging\{3A316611-45D1-429C-AA26-B71259C44689}\setup\hpzscr01.exe -datfile hposcr11.dat
HP Photosmart, Officejet and Deskjet 7.0.A-->C:\Program Files\HP\Digital Imaging\{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}\setup\hpzscr01.exe -datfile hposcr11.dat
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
iTunes-->MsiExec.exe /I{CC5702D7-86E2-45A8-99D7-E8B976ADCC56}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
La Bataille pour la Terre du Milieu(tm)-->C:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\EAUninstall.exe
LastChaos-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{99A37AC7-E724-4621-B167-500B5A52B69C}\setup.exe" -l0x9  -removeonly
Les Sims™ 3-->"C:\Program Files\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\Sims3Setup.exe" -runfromtemp -l0x040c -removeonly
LimeWire 5.1.2-->"C:\Program Files\LimeWire\uninstall.exe"
Ma-Config.com-->MsiExec.exe /X{8AFB8FC4-3EBA-4C67-943F-CF43DB2180F1}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{72AD53CC-CCC0-3757-8480-9EE176866A7C}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 French Language Pack-->MsiExec.exe /X{E3C080B0-23F5-49AF-89F8-8E8DBC89E659}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{0BD83598-C2EF-3343-847B-7D2E84599128}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Corporation-->MsiExec.exe /I{7B08D306-7266-4647-A926-2F78817ED1E0}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft WSE 3.0 Runtime-->MsiExec.exe /X{E3E71D07-CD27-46CB-8448-16D4FB29AA13}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB968220)-->"C:\WINDOWS\ie8updates\KB968220-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Module de prise en charge linguistique du français de Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 French Language Pack\setup.exe
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.0.11)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
NDAS Software 3.10.1230-->MsiExec.exe /X{D9A34305-A7E3-4FDE-ADDA-B7DFD264080A}
Nero - Burning Rom-->MsiExec.exe /X{A4D7B764-4140-11D4-88EB-0050DA3579C0}
NVIDIA Drivers-->C:\WINDOWS\system32
vuninst.exe UninstallGUI
NVIDIA PhysX v8.09.04-->MsiExec.exe /X{A7E07C2B-2220-4415-87E3-784D5814BC93}
PokerTH-->C:\Program Files\PokerTH\uninstall.exe
QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
Rappelz-->"C:\Program Files\gPotato.eu\Rappelz\unins000.exe"
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c  -removeonly
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB960003)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F04F8702-18D0-458D-921E-146FB7CD38CF}
Security Update for Microsoft Office Excel 2007 (KB959997)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {9EAC3AEC-5C81-4856-A05B-DE9DC236D740}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
Security Update for Outlook 2007 (KB946983)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {66B9496E-C0C3-4065-9868-85CCA92126C3}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Serif WebPlus X2 Ressources-->MsiExec.exe /I{05BC428A-F2A5-4E11-8130-10C3237FD67B}
Serif WebPlus X2-->MsiExec.exe /I{8829E394-87E1-41C0-BCED-9B47F7C6DCDD}
Skype™ 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Spyware Terminator-->"C:\Program Files\Spyware Terminator\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Office 2007 (KB934391)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B3091818-7C56-4C45-BE7D-CA23027A5EA5}
Update for Outlook 2007 Junk Email Filter (kb970012)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {DC4A962B-9EC2-469C-BC9C-87312ADAEE81}
VIA Gestionnaire de périphériques de plate-forme-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169} 
Videora iPod Converter 4.04-->C:\Program Files\Red Kawa\Video Converter App\uninstaller.exe
VLC media player 0.9.9-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows Presentation Foundation Language Pack (FRA)-->MsiExec.exe /X{6901DD22-527A-41EF-9059-E81FEDE9E494}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

======Security center information======

AV: Antivirus BitDefender  (disabled)
AV: AntiVir Desktop
FW: Pare-feu BitDefender  (disabled)

======System event log======

Computer Name: LOULOU
Event Code: 7036
Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : en cours d'exécution.

Record Number: 10814
Source Name: Service Control Manager
Time Written: 20090524231048.000000+120
Event Type: Informations
User: 

Computer Name: LOULOU
Event Code: 7036
Message: Le service NLA (Network Location Awareness) est entré dans l'état : en cours d'exécution.

Record Number: 10813
Source Name: Service Control Manager
Time Written: 20090524231048.000000+120
Event Type: Informations
User: 

Computer Name: LOULOU
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service NLA (Network Location Awareness).

Record Number: 10812
Source Name: Service Control Manager
Time Written: 20090524231048.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: LOULOU
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service COM de gravage de CD IMAPI.

Record Number: 10811
Source Name: Service Control Manager
Time Written: 20090524231048.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: LOULOU
Event Code: 7036
Message: Le service Service de l’iPod est entré dans l'état : en cours d'exécution.

Record Number: 10810
Source Name: Service Control Manager
Time Written: 20090524231048.000000+120
Event Type: Informations
User: 

=====Application event log=====

Computer Name: LOULOU
Event Code: 101
Message: msnmsgr (3516) Le moteur de base de données est arrêté.

Record Number: 4159
Source Name: ESENT
Time Written: 20090321220819.000000+060
Event Type: Informations
User: 

Computer Name: LOULOU
Event Code: 103
Message: msnmsgr (3516) \.\C:\Documents and Settings\Loulouu\Local Settings\Application Data\Microsoft\Messenger\loulouu_@hotmail.fr\SharingMetadata\Working\database_FA5C_B4AE_5CB4_66D3\dfsr.db: Le moteur de base de données a arrêté une instance (0).

Record Number: 4158
Source Name: ESENT
Time Written: 20090321220819.000000+060
Event Type: Informations
User: 

Computer Name: LOULOU
Event Code: 102
Message: msnmsgr (3516) \.\C:\Documents and Settings\Loulouu\Local Settings\Application Data\Microsoft\Messenger\loulouu_@hotmail.fr\SharingMetadata\Working\database_FA5C_B4AE_5CB4_66D3\dfsr.db: Le moteur de base de données a démarré une nouvelle instance (0).

Record Number: 4157
Source Name: ESENT
Time Written: 20090321220749.000000+060
Event Type: Informations
User: 

Computer Name: LOULOU
Event Code: 100
Message: msnmsgr (3516) Le moteur de base de données 5.01.2600.5512 est démarré.

Record Number: 4156
Source Name: ESENT
Time Written: 20090321220749.000000+060
Event Type: Informations
User: 

Computer Name: LOULOU
Event Code: 12001
Message: 
Record Number: 4155
Source Name: usnjsvc
Time Written: 20090321220746.000000+060
Event Type: 
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=1707
"NUMBER_OF_PROCESSORS"=4
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"SAFEBOOT_OPTION"=NETWORK

-----------------EOF-----------------

loulou92 · Answer

Alors?

loulou92 · Answer

J'ai réussi à démarrer Malwarebytes.

J'ai enlevé environ 40 infections.
Vous voulez les rapports? 

Je ne peux démarrer mon pc normalement, après le chargement de Windows XP, écran noir, je ne vois que le curseur de la souris que je peux déplacer.

Comment puis-je être sûr que mon pc est maintenant sain à 100%?

loulou92 · Answer

Désolé... En fait ça re-fonctionne en "mode normal", je reçois toujours quelques popups, et dans C:/ 
il y a des fichiers bizarre comme "ehphcnlj", "niqe", "1555326675"....

Qu'est-ce que c'est? 
Lors des analyses avec Malwarebytes il y a toujours 1 infection trouvée qui est un trojan, rapport: 

Malwarebytes' Anti-Malware 1.38
Version de la base de données: 2297
Windows 5.1.2600 Service Pack 3

29/06/2009 15:13:06
mbam-log-2009-06-29 (15-13-06).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 152835
Temps écoulé: 12 minute(s), 0 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\MSIVXcount (Trojan.Agent) -> Delete on reboot.

Comment puis-je m'assurer que mon pc est sain? etc...

loulou92 · Answer

Rapport WORT:

===== Rapport WareOut Removal Tool ===== 
 
version 3.2 
 
analyse effectuée le 29/06/2009 à 19:13:16,98 
 
Résultats de l'analyse : 
======================== 
 
~~~~ Recherche d'infections dans C:\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Program Files\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\WINDOWS\system\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\WINDOWS\system32\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\WINDOWS\system32\drivers\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Documents and Settings\Loulouu\Application Data\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Documents and Settings\Loulouu\Bureau\ ~~~~ 
 
 
~~~~ Recherche de détournement de DNS ~~~~ 
 
 
 
~~~~ Recherche du Rootkit kd???.exe ~~~~ 
 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    System	REG_SZ	

 
 
~~~~ Recherche d'infections dans C:\DOCUME~1\Loulouu\LOCALS~1\Temp\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Documents and Settings\Loulouu\Start Menu\Programs\ ~~~~ 
 
 
~~~~ Nettoyage du registre ~~~~ 
 
 
~~~~ Tentative de réparation des entrées suivantes: ~~~~ 
 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] = "System" 
 
[HKLM\SYSTEM\CurrentControlSet\Services\Windows Tribute Service] 
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_Windows Tribute Service] 
 
~~~~ Vérification: ~~~~ 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    System	REG_SZ	

 
 
_________________________________ 
 
développé par http://pc-system.fr 
_________________________________ 


Rapport RSIT:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Loulouu at 2009-06-29 19:16:10
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 109 GB (73%) free of 150 GB
Total RAM: 3071 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:16:11, on 29/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\vVX1000.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NDAS\System
dasmgmt.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\NDAS\System
dassvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\Loulouu\Bureau\RSIT.exe
C:\Program Files	rend micro\Loulouu.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\parisaintgermain.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NDAS Device Management.lnk = C:\Program Files\NDAS\System
dasmgmt.exe
O8 - Extra context menu item: &Tout télécharger avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: jryjdrtjj6sjjyh4rthgdf80 - Unknown owner - C:\WINDOWS\jryjdrtjj6sjjyh4rthgdf81.exe (file missing)
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NDAS Service (ndassvc) - XIMETA, Inc. - C:\Program Files\NDAS\System
dassvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

loulou92 · Answer

Je reçois toujours des pop-ups et des messages de WinblueSoft me disant que je suis infecté.
Mais je ne l'installe plus, bien entendu!

Que puis-je faire?

loulou92 · Answer

Je précise que j'ai eu pas mal de messages d'erreurs du style "Image...." En redémarrant mon pc, une application s'est démarrée toute seule (Steam). All processes killed ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== LoadLibrary failed for C:\WINDOWS\913d5wnloader56z.dll C:\WINDOWS\913d5wnloader56z.dll NOT unregistered. C:\WINDOWS\913d5wnloader56z.dll moved successfully. LoadLibrary failed for C:\WINDOWS\536z2sp91e9.dll C:\WINDOWS\536z2sp91e9.dll NOT unregistered. C:\WINDOWS\536z2sp91e9.dll moved successfully. C:\WINDOWS\45z6a5dw9re2218.exe moved successfully. LoadLibrary failed for C:\WINDOWS\system32\3769vir1955z.dll C:\WINDOWS\system32\3769vir1955z.dll NOT unregistered. C:\WINDOWS\system32\3769vir1955z.dll moved successfully. LoadLibrary failed for C:\WINDOWS\system32\2937v5z394.dll C:\WINDOWS\system32\2937v5z394.dll NOT unregistered. C:\WINDOWS\system32\2937v5z394.dll moved successfully. LoadLibrary failed for C:\WINDOWS\system32\5831tzo5941.dll C:\WINDOWS\system32\5831tzo5941.dll NOT unregistered. C:\WINDOWS\system32\5831tzo5941.dll moved successfully. C:\WINDOWS\system32\49cbthze5199.exe moved successfully. C:\WINDOWS\5fd4zp9ware3157.exe moved successfully. C:\WINDOWS\185z2vi9us2e3.exe moved successfully. LoadLibrary failed for C:\WINDOWS\2z855virus799.dll C:\WINDOWS\2z855virus799.dll NOT unregistered. C:\WINDOWS\2z855virus799.dll moved successfully. LoadLibrary failed for C:\WINDOWS\system32\259879orz39c.dll C:\WINDOWS\system32\259879orz39c.dll NOT unregistered. C:\WINDOWS\system32\259879orz39c.dll moved successfully. C:\WINDOWS\system32\42z5spy519.exe moved successfully. LoadLibrary failed for C:\WINDOWS\system32\4893threaz20553.dll C:\WINDOWS\system32\4893threaz20553.dll NOT unregistered. C:\WINDOWS\system32\4893threaz20553.dll moved successfully. C:\WINDOWS\system32\99dsteal19z95.exe moved successfully. LoadLibrary failed for C:\WINDOWS\2zc1threa539655.dll C:\WINDOWS\2zc1threa539655.dll NOT unregistered. C:\WINDOWS\2zc1threa539655.dll moved successfully. LoadLibrary failed for C:\WINDOWS\system32\70z9ad9ware549.dll C:\WINDOWS\system32\70z9ad9ware549.dll NOT unregistered. C:\WINDOWS\system32\70z9ad9ware549.dll moved successfully. LoadLibrary failed for C:\WINDOWS\2362sz59se1609.dll C:\WINDOWS\2362sz59se1609.dll NOT unregistered. C:\WINDOWS\2362sz59se1609.dll moved successfully. C:\WINDOWS\59z35ir2834.exe moved successfully. C:\WINDOWS\system32\8z725orm52c9.exe moved successfully. Error: Unable to interpret <:\WINDOWS\system32\2067zhacktool1995.dll> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <:\WINDOWS\c95s9ealz764.dll> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 279294 bytes User: Loulouu ->Temp folder emptied: 9587080 bytes ->Temporary Internet Files folder emptied: 1136742 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 32235289 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 3738702 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2821610 bytes %systemroot%\System32 .tmp files removed: 3072 bytes Windows Temp folder emptied: 4897251 bytes RecycleBin emptied: 50760 bytes Total Files Cleaned = 52,25 mb OTM by OldTimer - Version 3.0.0.2 log created on 06292009_205807 Files moved on Reboot... Registry entries deleted on Reboot...

loulou92 · Answer

Rapport après passage de Ccleaner:

Malwarebytes' Anti-Malware 1.38
Version de la base de données: 2352
Windows 5.1.2600 Service Pack 3

29/06/2009 21:19:50
mbam-log-2009-06-29 (21-19-50).txt

Type de recherche: Examen rapide
Eléments examinés: 85429
Temps écoulé: 49 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d76ab2a1-00f3-42bd-f434-00bbc39c8953} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\jryjdrtjj6sjjyh4rthgdf80 (Trojan.Downloader) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\MSIVXcount (Trojan.Agent) -> Delete on reboot.

loulou92 · Answer

Oui, j'ai bien fait Ccleaner.

Rapport RSIT:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Loulouu at 2009-06-29 21:30:35
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 109 GB (73%) free of 150 GB
Total RAM: 3071 MB (84% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:30:36, on 29/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\vVX1000.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NDAS\System
dasmgmt.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\NDAS\System
dassvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Steam\Steam.exe
C:\Documents and Settings\Loulouu\Bureau\RSIT.exe
C:\Program Files	rend micro\Loulouu.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\parisaintgermain.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NDAS Device Management.lnk = C:\Program Files\NDAS\System
dasmgmt.exe
O8 - Extra context menu item: &Tout télécharger avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NDAS Service (ndassvc) - XIMETA, Inc. - C:\Program Files\NDAS\System
dassvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

loulou92 · Answer

On me met "Scan Error" donc impossible d'effectuer le scan!

loulou92 · Answer

Lorsque je le renomme en "combo-fix", il est inutilisable et lorsque qu'il est en "ComboFix.exe" il ne démarre pas...
Pourtant dans Processus du gestionnaire de tâches, le programme est bien présent.

loulou92 · Answer

[ Rapport ToolsCleaner version 2.3.7 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\WareOut Removal Tool.bat: trouvé !
C:\_OTM: trouvé !
C:\Rsit: trouvé !
C:\WORT: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Loulouu\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Loulouu\Bureau\OTM.exe: trouvé !
C:\Documents and Settings\Loulouu\Bureau\Rsit.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\hijackthis.log: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

---------------------------------
--> Suppression: 

C:\WareOut Removal Tool.bat: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Loulouu\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Loulouu\Bureau\OTM.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Documents and Settings\Loulouu\Bureau\Rsit.exe: supprimé !
C:\Program Files\Trend Micro\hijackthis.log: supprimé !
C:\_OTM: supprimé !
C:\Rsit: supprimé !
C:\WORT: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Rapport de ComboFix à venir.

loulou92 · Answer

ComboFix 09-07-01.01 - Loulouu 01/07/2009 22:43.1 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.3071.2708 [GMT 2:00]
Lancé depuis: c:\documents and settings\Loulouu\Bureau\dfrbvdfvbdf.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Antivirus BitDefender  *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: Pare-feu BitDefender  *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\ehphcnlj.exe
C:\evgjolq.exe
C:\ixubu.exe
C:
iqe.exe
c:\windows\1025s9ywzre2127.ocx
c:\windows\10579wor55z7.exe
c:\windows\10619spambzt553.exe
c:\windows\1100tro955z.cpl
c:\windows\113z3spy593.ocx
c:\windows\11594zro535b.ocx
c:\windows\11779pars5z752.exe
c:\windows\12356sp56z9.bin
c:\windows\1259stezl1992.bin
c:\windows\12789wz5m562.dll
c:\windows\1310azdwar92548.ocx
c:\windows\133095azktool9d.ocx
c:\windows\13391spy595z.exe
c:\windows\13529nzt-5-vi9us361.bin
c:\windows\13900hacz5ool693.ocx
c:\windows\139ethi5z1781.exe
c:\windows\139stezl1056.cpl
c:\windows\14232wo958z.cpl
c:\windows\1425zwo9m720.bin
c:\windows\14b9viz795.dll
c:\windows\15006hackt9zl5645.exe
c:\windows\15013woz5119.dll
c:\windows\1502not-5-vir9sz8b.exe
c:\windows\1520downzoader2595.exe
c:\windows\15529wzrm195.cpl
c:\windows\155dvir924z.ocx
c:\windows\15a3stezl9988.bin
c:\windows\16abdownload5r2199z.bin
c:\windows\17339t5zj159.bin
c:\windows\174z3vir9s54.dll
c:\windows\17595zpy41c.cpl
c:\windows\17726no5-a-v9rus5z5.ocx
c:\windows\17959spz655.exe
c:\windows\17996spazbot584.exe
c:\windows\17z69worm5f5.cpl
c:\windows\180z1tro97c5.exe
c:\windows\18659hac5tooz5f9.ocx
c:\windows\18829spy5z09.cpl
c:\windows\18eesz59l391.dll
c:\windows\19078zir5s296.exe
c:\windows\1915stezl321.cpl
c:\windows\1921szy559.dll
c:\windows\19286spamb5tdaz.bin
c:\windows\19328spam5ot68z9.dll
c:\windows\19369s5y5ecz.exe
c:\windows\1945t9iez1089.bin
c:\windows\1955zteal185.bin
c:\windows\1958zw9rm52d.exe
c:\windows\19614vzru915d.cpl
c:\windows\19665tzoj493.ocx
c:\windows\19779szy4a05.exe
c:\windows\19889ha5ktool335z.bin
c:\windows\19b2dow5lozder266.bin
c:\windows\19d1stzal589.bin
c:\windows\19z57spambo94f2.ocx
c:\windows\1abbbz9kdo5r2598.ocx
c:\windows\1z126wor95.bin
c:\windows\1z128virus359.dll
c:\windows\1z309spy5b59.dll
c:\windows\1z3859orm357.exe
c:\windows\1z39backdoor2865.dll
c:\windows\1z595hacktool15e.ocx
c:\windows\1z775spambo953b.cpl
c:\windows\206a9ddwa5ez491.dll
c:\windows\207489oz-a-virus35d.bin
c:\windows\20ecthreaz19695.cpl
c:\windows\2128z5roj919.cpl
c:\windows\22254szy57a9.cpl
c:\windows\22283z5r9s6e3.bin
c:\windows\22500not-a-5zrus293.cpl
c:\windows\22504z5y67b9.exe
c:\windows\2259ztro965.ocx
c:\windows\226599irzs51.bin
c:\windows\22935spzmbot69a.dll
c:\windows\22b0t9iez1735.bin
c:\windows\2414z9ot-5-virus3ab.ocx
c:\windows\2429ba5kdoor11z1.exe
c:\windows\245179irus53z.dll
c:\windows\2479hacktool6z5.ocx
c:\windows\2514thizf5559.exe
c:\windows\253zspy6a79.ocx
c:\windows\25458wo59zdd.dll
c:\windows\255z7troj9f5.bin
c:\windows\25695hacktooz7c9.bin
c:\windows\257189orm3d6z.bin
c:\windows\258859ot-azvirus64f.ocx
c:\windows\2599hzckto5l71f.bin
c:\windows\25z85troj19b.ocx
c:\windows\25z94virus195.ocx
c:\windows\26873zorm259.exe
c:\windows\26971ha5ktooz225.dll
c:\windows\274129acz5ool2bd.cpl
c:\windows\27542h9cktool3z8.cpl
c:\windows\275z0virus1bb9.ocx
c:\windows\277z0wor9755.bin
c:\windows\27eedownl9ade52z32.bin
c:\windows\28115szambot5909.exe
c:\windows\2863spzware11905.bin
c:\windows\28ecspar9ez158.cpl
c:\windows\29043zorm225.dll
c:\windows\29056trzj256.ocx
c:\windows\2909v5r1z50.dll
c:\windows\291979zy5bd.dll
c:\windows\29256hazkto5l199.exe
c:\windows\2934t9rea5z437.ocx
c:\windows\2950zhackt59lfb.ocx
c:\windows\29644spazbot59a5.dll
c:\windows\29645zroj493.cpl
c:\windows\296z0wor95d5.exe
c:\windows\29faddware541z.ocx
c:\windows\29zb5teal292.ocx
c:\windows\2abbspzw95e1973.exe
c:\windows\2b2zadd9are586.cpl
c:\windows\2b8edownlozde917415.ocx
c:\windows\2c53adzware90155.exe
c:\windows\2e9fba5kdoor2z75.bin
c:\windows\2ecfzteal1956.bin
c:\windows\2z2895acktool6fe.ocx
c:\windows\2z559virus5089.bin
c:\windows\2z580w9rm393.ocx
c:\windows\2z959spya2.exe
c:\windows\307759pz492.cpl
c:\windows\3089threz9197625.ocx
c:\windows\314z95orm691.dll
c:\windows\31548zor9755.exe
c:\windows\316289pzmbot565.bin
c:\windows\3167sp97z5.ocx
c:\windows\324eszars531199.exe
c:\windows\3254z59ambot5c8.dll
c:\windows\32567w5r9z88.cpl
c:\windows\327z15or9532.cpl
c:\windows\333z9ir5020.ocx
c:\windows\334zw9rm253.exe
c:\windows\339ds9yzare7745.ocx
c:\windows\33e1spywaz91715.cpl
c:\windows\349d5hreat1188z.ocx
c:\windows\34ead5wnloz9er479.ocx
c:\windows\3507zs9ye5.exe
c:\windows\3517z9rm429.cpl
c:\windows\3535downloade91z73.ocx
c:\windows\3559zir72.cpl
c:\windows\3573tzreat97535.cpl
c:\windows\35z1thief1179.bin
c:\windows\3745spa9boz7c9.exe
c:\windows\37fftzr95t32020.cpl
c:\windows\37z5vi9us589.bin
c:\windows\388bthi5z19219.dll
c:\windows\38fbsp59se167z.cpl
c:\windows\3950vi59s131z.ocx
c:\windows\3957spz5s9155.bin
c:\windows\395espazse770.bin
c:\windows\3972vir58z9.ocx
c:\windows\397daddz9re2357.cpl
c:\windows\39abbac5zoo91587.bin
c:\windows\3ae9v5z1656.cpl
c:\windows\3c46sp9ware3z5.cpl
c:\windows\3dz8spar9e7955.bin
c:\windows\3e519zr2509.cpl
c:\windows\3fbz59r3134.cpl
c:\windows\3z519i54.bin
c:\windows\3z907vi5us5e9.dll
c:\windows\4065vi9uszed.dll
c:\windows\41955orm7z9.bin
c:\windows\4685dow95oader30z9.cpl
c:\windows\49345ot-a-9irus42az.bin
c:\windows\49775py7cbz.ocx
c:\windows\49865i9647z.cpl
c:\windows\49b2z5arse1491.ocx
c:\windows\4ad59ack5oorz547.exe
c:\windows\4b559tezl2650.exe
c:\windows\4b5cdownload5977z.dll
c:\windows\4b9czteal29295.cpl
c:\windows\4e505z9nloader2588.cpl
c:\windows\4e98spywarz854.bin
c:\windows\4z52spy359.ocx
c:\windows\5005zroj693.ocx
c:\windows\5019sparze594.exe
c:\windows\5058hacktzol91b.bin
c:\windows\50995virus6az.cpl
c:\windows\509bt5rzat31119.exe
c:\windows\50eathr5at3z369.bin
c:\windows\50fzstea52497.bin
c:\windows\5102not-a9virus633z.dll
c:\windows\51209viru91cz.ocx
c:\windows\5133wormz799.bin
c:\windows\5156bzckdoo91039.bin
c:\windows\51923t9oj2zb.dll
c:\windows\51e5zt9al2645.ocx
c:\windows\52117t9ojdz.cpl
c:\windows\52167not-azvir9s2c7.exe
c:\windows\52224noz-a-viru9612.bin
c:\windows\523zw9rm2b45.cpl
c:\windows\53524hackto9l698z.exe
c:\windows\5421z59eat17857.dll
c:\windows\5440zi9u563e.dll
c:\windows\5460steal1z94.cpl
c:\windows\5588zspambo9587.cpl
c:\windows\5589virzs5b5.dll
c:\windows\5595spyware6z5.ocx
c:\windows\55d1zi9956.ocx
c:\windows\55d4virz99.exe
c:\windows\55e8z9r2963.exe
c:\windows\56356s9y7d6z.cpl
c:\windows\57626zroj195.exe
c:\windows\5779no95a-virusdz.bin
c:\windows\5789ownzoader256.dll
c:\windows\5797zteal2245.cpl
c:\windows\5799sparze54.bin
c:\windows\57zcvir91425.exe
c:\windows\583asp9rse15z8.ocx
c:\windows\583czparse1974.ocx
c:\windows\58700t9oza1.bin
c:\windows\58e6thief26z49.bin
c:\windows\58edspazse899.ocx
c:\windows\58f89ownl5aderz121.ocx
c:\windows\5921trzj374.dll
c:\windows\593bs9arsez420.bin
c:\windows\59560troj59bz.bin
c:\windows\595bstezl823.dll
c:\windows\59791vzrus6a9.ocx
c:\windows\5994vir9s25fz.ocx
c:\windows\599zvir9s95.exe
c:\windows\59ffdownloadz51956.dll
c:\windows\59zcsparse1725.ocx
c:\windows\5a9fsp5rze808.cpl
c:\windows\5b1ba9kd5oz3009.exe
c:\windows\5b5viz195.exe
c:\windows\5c48szars51996.bin
c:\windows\5c6b9tezl557.cpl
c:\windows\5dc6spzr5e9893.ocx
c:\windows\5e7095zware3118.cpl
c:\windows\5e9cstzal2133.ocx
c:\windows\5ez9spyware2596.exe
c:\windows\5f97downloadzr5174.bin
c:\windows\5fdba5dware30z09.dll
c:\windows\5zasparse3499.dll
c:\windows\6201v5r9z5b8.cpl
c:\windows\625fdownloadzr98775.cpl
c:\windows\6295sp5rse39z0.cpl
c:\windows\645295zeat17770.dll
c:\windows\64a5pa9sez001.dll
c:\windows\64fdownloade5909z.bin
c:\windows\6539sp5rsz2549.cpl
c:\windows\65efs9arse169z.dll
c:\windows\66f25z9al2072.dll
c:\windows\67495irzs328.dll
c:\windows\6755zorm190.dll
c:\windows\6792thzef2295.bin
c:\windows\67f9spar5z2911.bin
c:\windows\6896thzef2517.cpl
c:\windows\6938zpars5295.dll
c:\windows\6948hzcktoo9522.cpl
c:\windows\698ez5r664.dll
c:\windows\69z5vir2210.exe
c:\windows\6f9dza5kdoor271.cpl
c:\windows\6z589orm1a8.cpl
c:\windows\72zcspar95867.bin
c:\windows\73679hreat59z63.bin
c:\windows\7415downl9aderz301.ocx
c:\windows\74455zie9632.cpl
c:\windows\7460s5yware19z8.exe
c:\windows\74b195zal2718.bin
c:\windows\7514zirus9b8.bin
c:\windows\7539doznload5r1726.ocx
c:\windows\7574ba9kdzor567.dll
c:\windows\75e2spywa9e1z575.exe
c:\windows\760zs59mbot554.exe
c:\windows\7707ste592559z.cpl
c:\windows\7753thzea972615.cpl
c:\windows\782d5parse27z9.exe
c:\windows\78downlo9dez561.bin
c:\windows\78z59ddware92.exe
c:\windows\7902addware53z29.cpl
c:\windows\791zaddw5re1120.bin
c:\windows\7a4cbazkdo5r1109.ocx
c:\windows\7a5az59ware854.exe
c:\windows\7aeabackd9or143z5.exe
c:\windows\7af2t95ef2709z.dll
c:\windows\7afstzal5922.exe
c:\windows\7b45ba9kdoo512z5.bin
c:\windows\7d9vir16z15.bin
c:\windows\7e3dstez59903.dll
c:\windows\7f19spy5ar94z0.dll
c:\windows\80not5a-v9ruz21.exe
c:\windows\8170no9-5-viruz770.cpl
c:\windows\891not-5-9izus5f9.exe
c:\windows\8c5b9ckdzor3248.cpl
c:\windows\8z5st9al2256.dll
c:\windows\907z0worm549.bin
c:\windows\9094s5zmbot7d9.dll
c:\windows\90z1thi5f1306.ocx
c:\windows\9193virz345.exe
c:\windows\9195vzr55.cpl
c:\windows\92286hac5tool4e8z.cpl
c:\windows\922cdoznl5ader2513.cpl
c:\windows\9383downzo5der171.dll
c:\windows\951trzj701.exe
c:\windows\958zvirus755.cpl
c:\windows\959stzal1723.bin
c:\windows\95cfthrezt45055.cpl
c:\windows\9831s5942z.exe
c:\windows\990z59y7c6.exe
c:\windows\9955vir297z.dll
c:\windows\99590vizus553.bin
c:\windows\9969ro55z5.bin
c:\windows\9975szambo959d5.cpl
c:\windows\99940wzr54a5.ocx
c:\windows\99szy591.ocx
c:\windows\9b6zvir11495.bin
c:\windows\9bf5zir3252.cpl
c:\windows\9d40spazse2159.exe
c:\windows\9ezsp5ware2353.cpl
c:\windows\9f20zpywar5991.exe
c:\windows\9f5steal1389z.exe
c:\windows\9zfdthreat109835.cpl
c:\windows\b95zpyware581.bin
c:\windows\b96threat19005z.cpl
c:\windows\b9fadd5are1396z.exe
c:\windows\c95s9ealz764.dll
c:\windows\cd5z9eal2525.exe
c:\windows\ce05ddware9096z.cpl
c:\windows\d91bac5dzor774.ocx
c:\windows\dcb9ddza5e1166.cpl
c:\windows\e99thie52129z.dll
c:\windows\ea09pywar52z97.cpl
c:\windows\Install.txt
c:\windows\system32\10551tz9j652.bin
c:\windows\system32\10c59hie5165z.cpl
c:\windows\system32\11009wz5m5a7.cpl
c:\windows\system32\11053spazbot2519.bin
c:\windows\system32\11097notza-vi5us999.ocx
c:\windows\system32\114eba9kdoor4z5.dll
c:\windows\system32\115579orm36z.cpl
c:\windows\system32\11585irus5z9.exe
c:\windows\system32\12093t5o967z.ocx
c:\windows\system32\12259wozm37e5.cpl
c:\windows\system32\12791spazbot3165.bin
c:\windows\system32\129d5pzware2563.ocx
c:\windows\system32\12c85iz905.dll
c:\windows\system32\12z9downlo5der685.cpl
c:\windows\system32\13552not-a-vir9z4c0.bin
c:\windows\system32\13555wo9m2z6.cpl
c:\windows\system32\1396thief599z.cpl
c:\windows\system32\146e9o5nloader85z.ocx
c:\windows\system32\14705zp951d.exe
c:\windows\system32\147z95i9us159.ocx
c:\windows\system32\148195zc9tool284.ocx
c:\windows\system32\14928s5azbotbf.bin
c:\windows\system32\149z39pamb5t391.bin
c:\windows\system32\15396spamzot3ff.cpl
c:\windows\system32\15715wor956z.ocx
c:\windows\system32\15889spz58b9.exe
c:\windows\system32\159599otza-virus2df.ocx
c:\windows\system32\15993hacktzol6a1.exe
c:\windows\system32\15bzthief339.dll
c:\windows\system32\15eastezl8289.ocx
c:\windows\system32\162995orm2ez.bin
c:\windows\system32\16513h5cztoo9511.cpl
c:\windows\system32\16557hazkto9l510.dll
c:\windows\system32\1681vir59z15.cpl
c:\windows\system32\16z37v95us92.bin
c:\windows\system32\177z0hackto9l59b.exe
c:\windows\system32\17994worz9fa5.cpl
c:\windows\system32\181z5ir20139.cpl
c:\windows\system32\18795wzrm12a.exe
c:\windows\system32\188z2sp9m5ot5ac.exe
c:\windows\system32\19199zpambot5f.ocx
c:\windows\system32\1929vzr5122.ocx
c:\windows\system32\1938spars5z09.bin
c:\windows\system32\19524spy499z.bin
c:\windows\system32\195z6virus335.cpl
c:\windows\system32\1964addzar53119.exe
c:\windows\system32\199519izus5ba.ocx
c:\windows\system32\19993vizu51ff.dll
c:\windows\system32\1a8es5arze549.bin
c:\windows\system32\1c55spyware8z99.exe
c:\windows\system32\1c9cvi5119z.exe
c:\windows\system32\1d65threat9515z.ocx
c:\windows\system32\1dzft9i5f438.ocx
c:\windows\system32\1f95backzoo5260.bin
c:\windows\system32\1z00thief9560.dll
c:\windows\system32\1z02spa9bo525a.exe
c:\windows\system32\1z1295orm191.cpl
c:\windows\system32\1zed5wnloade92258.dll
c:\windows\system32\2067zhacktool1995.dll
c:\windows\system32\20b7do59loaderz947.exe
c:\windows\system32\21120not-a-v9rus25z.ocx
c:\windows\system32\21155not-azvir9s73e.ocx
c:\windows\system32\21529zorm1eb.ocx
c:\windows\system32\215359zoj55e.cpl
c:\windows\system32\21618z9r5s29f.bin
c:\windows\system32\21c6downlo9der1z25.bin
c:\windows\system32\22712no9-a-5iruz6e6.cpl
c:\windows\system32\2274v9r5248z.cpl
c:\windows\system32\23005not9z-vi5us19a.bin
c:\windows\system32\234575pambot999z.exe
c:\windows\system32\23539vir9sz49.bin
c:\windows\system32\23938zo9m3b65.cpl
c:\windows\system32\23982hackt5olz429.exe
c:\windows\system32\24212worz59d.dll
c:\windows\system32\244879pambot2zc5.exe
c:\windows\system32\24520not-a9virus6z0.bin
c:\windows\system32\24934not5azvirus6cb.exe
c:\windows\system32\24971spambz59db.bin
c:\windows\system32\24993not-a5virzs127.bin
c:\windows\system32\250z0spambo96b9.dll
c:\windows\system32\25405s95mboz206.ocx
c:\windows\system32\2562threat29z43.exe
c:\windows\system32\25631n9t-a-vizus3c9.ocx
c:\windows\system32\25751spa9bzt7b8.bin
c:\windows\system32\2575w5r9z8e.exe
c:\windows\system32\258569ro51z5.cpl
c:\windows\system32\25919w5rm2a9z.ocx
c:\windows\system32\25955sp9mbztb0.exe
c:\windows\system32\25960hacktooz286.cpl
c:\windows\system32\25965ddwzre1882.ocx
c:\windows\system32\2597addwzre335.cpl
c:\windows\system32\25c5thiz9953.bin
c:\windows\system32\2605spy9arz444.dll
c:\windows\system32\26c7baczdo9r15555.dll
c:\windows\system32\27159h5cktooz920.dll
c:\windows\system32\27789virusz58.exe
c:\windows\system32\278spy5arz694.cpl
c:\windows\system32\28056t95z190.cpl
c:\windows\system32\28195wor97z0.cpl
c:\windows\system32\28238hac5to9l2f0z.bin
c:\windows\system32\285fthrzat25499.exe
c:\windows\system32\286495z9513.dll
c:\windows\system32\28z7downlo9d5r3135.exe
c:\windows\system32\28z815roj1059.exe
c:\windows\system32\290z19pamb5t7ec.ocx
c:\windows\system32\29156vi5u9zeb.bin
c:\windows\system32\29372nzt-95virus1f4.cpl
c:\windows\system32\2997wo5m28z.ocx
c:\windows\system32\2a06thi9519z2.bin
c:\windows\system32\2a9eaddwz5e9819.dll
c:\windows\system32\2b3bt9izf1569.dll
c:\windows\system32\2cb9zteal5993.exe
c:\windows\system32\2cf7t5reat2z419.bin
c:\windows\system32\2df5s9ywarz244.ocx
c:\windows\system32\2fb9s5az9e1861.cpl
c:\windows\system32\2z155hreat12329.exe
c:\windows\system32\2z21b95kdoor338.dll
c:\windows\system32\2z585sp93c3.ocx
c:\windows\system32\2z94dow5loader753.bin
c:\windows\system32\2zf5s9arse1830.bin
c:\windows\system32\30412zo5-a-virus96d.bin
c:\windows\system32\3058add5aze2198.cpl
c:\windows\system32\3099vir5z24.cpl
c:\windows\system32\3155virzs985.ocx
c:\windows\system32\31715wor945z.exe
c:\windows\system32\31952h9cktoolz8.dll
c:\windows\system32\32041s593z6.bin
c:\windows\system32\32133t5oj49z.ocx
c:\windows\system32\322z1hack9o5l75b.bin
c:\windows\system32\3239zv5rus65e.cpl
c:\windows\system32\32649not-a5viruz4f3.cpl
c:\windows\system32\32952worm6b4z.bin
c:\windows\system32\32z72tro57759.ocx
c:\windows\system32\3394vir595z.cpl
c:\windows\system32\34z6d5wnloa9er2755.ocx
c:\windows\system32\35350worm72z9.bin
c:\windows\system32\35445ac9tool527z.exe
c:\windows\system32\35595zorm7d2.dll
c:\windows\system32\355abzckd9or3146.cpl
c:\windows\system32\356steal199z.ocx
c:\windows\system32\359evzr1979.cpl
c:\windows\system32\359sparse11z2.cpl
c:\windows\system32\371eszar5e16759.exe
c:\windows\system32\3727d5wnload9r1617z.exe
c:\windows\system32\3757backdzor9817.cpl
c:\windows\system32\377fdownl95der1z64.exe
c:\windows\system32\3915spambot7c2z.ocx
c:\windows\system32\393w5r92bcz.cpl
c:\windows\system32\395dzhief3073.cpl
c:\windows\system32\39z3v5rus531.bin
c:\windows\system32\3c2bzc59oor2842.bin
c:\windows\system32\3c579pzrse495.exe
c:\windows\system32\3c5edow9loaderz185.exe
c:\windows\system32\3d79tzi5f84.exe
c:\windows\system32\3da1down5zader9968.bin
c:\windows\system32\3e0e9ack5ozr107.ocx
c:\windows\system32\3z79vir9s65.cpl
c:\windows\system32\4033tro59zd.dll
c:\windows\system32\4123down9oadez5749.bin
c:\windows\system32\41zd9pyware5431.dll
c:\windows\system32\4258backdooz2999.cpl
c:\windows\system32\429fste5l1311z.exe
c:\windows\system32\43ezad5wa9e79.bin
c:\windows\system32\445zspy9are30665.exe
c:\windows\system32\4461h5ckto9l53z.ocx
c:\windows\system32\451fsz5al9395.bin
c:\windows\system32\4551virz3329.ocx
c:\windows\system32\455aspzwar92735.bin
c:\windows\system32\457bthre9t2z509.dll
c:\windows\system32\4585th9ef97z.ocx
c:\windows\system32\4591s597z8.cpl
c:\windows\system32\45fzs95al2679.cpl
c:\windows\system32\45fzsteal1579.exe
c:\windows\system32\4695not95-viruszc5.exe
c:\windows\system32\46e75tealz519.exe
c:\windows\system32\4759threz930362.cpl
c:\windows\system32\4869no5-a-zirus1599.bin
c:\windows\system32\4907vi59z97.bin
c:\windows\system32\4983sp52zf9.bin
c:\windows\system32\499ds5arse123z.exe
c:\windows\system32\49a5downloazer199.bin
c:\windows\system32\49b0addwzre14535.ocx
c:\windows\system32\49zfv5r1017.exe
c:\windows\system32\4a15addwarz2955.cpl
c:\windows\system32\4a3cspa5ze30699.bin
c:\windows\system32\4ac6vi92z59.ocx
c:\windows\system32\4az55ac9door661.bin
c:\windows\system32\4czddown9oader1365.dll
c:\windows\system32\4dz2s9ea5325.exe
c:\windows\system32\4e5spywzre2095.ocx
c:\windows\system32\4z1t59ef1569.dll
c:\windows\system32\4z22troj65d9.cpl
c:\windows\system32\4z979ddware2450.ocx
c:\windows\system32\5075thrzat56509.dll
c:\windows\system32\509cvirz1785.exe
c:\windows\system32\511f9zief934.ocx
c:\windows\system32\51275acktozl791.cpl
c:\windows\system32\51z7st9al2571.dll
c:\windows\system32\520b9ddware4z.dll
c:\windows\system32\52268v9rzs531.dll
c:\windows\system32\5248viz9039.ocx
c:\windows\system32\52b5tzreat15795.ocx
c:\windows\system32\52edt5ief3z439.bin
c:\windows\system32\5322v9r130z.bin
c:\windows\system32\53965ownloadz92952.exe
c:\windows\system32\54121s9y53z.exe
c:\windows\system32\542cb9ckdozr1357.bin
c:\windows\system32\5450viz5s179.bin
c:\windows\system32\5465a9dwzre1284.bin
c:\windows\system32\5499spywaze5987.ocx
c:\windows\system32\54z7st5al914.bin
c:\windows\system32\55299tea51013z.ocx
c:\windows\system32\552th9zat18122.exe
c:\windows\system32\5562thze9265.bin
c:\windows\system32\5595szea92699.ocx
c:\windows\system32\559espzware3906.ocx
c:\windows\system32\55ca9parsez2.dll
c:\windows\system32\55z0vir1998.cpl
c:\windows\system32\5679zac5door9099.cpl
c:\windows\system32\570z2worm977.bin
c:\windows\system32\57115hac9tozl12.exe
c:\windows\system32\57159not-a-virzs4b9.cpl
c:\windows\system32\5810zown9oader2153.dll
c:\windows\system32\5909baczdoo5410.bin
c:\windows\system32\5911z5rusc9.bin
c:\windows\system32\5915vizus3af.dll
c:\windows\system32\5994vi5us710z.dll
c:\windows\system32\5998viruz49c.ocx
c:\windows\system32\59aadownloazer194.bin
c:\windows\system32\59z1w5r9658.exe
c:\windows\system32\59zspy2705.ocx
c:\windows\system32\5a3cvi925z6.exe
c:\windows\system32\5a9threat17z6.exe
c:\windows\system32\5abzthre9t17850.bin
c:\windows\system32\5azaspyw9re3252.dll
c:\windows\system32\5b459irz26.exe
c:\windows\system32\5b5ethreaz15769.bin
c:\windows\system32\5c7fz9a5se2220.bin
c:\windows\system32\5cz1addwar92324.cpl
c:\windows\system32\5d42do9nlzader2362.cpl
c:\windows\system32\5d46szeal5199.dll
c:\windows\system32\5d59ba9kzoor105.exe
c:\windows\system32\5dfadzware947.cpl
c:\windows\system32\5e53th9eat54z4.cpl
c:\windows\system32\5z05stea98145.cpl
c:\windows\system32\5z599ackd5or3066.bin
c:\windows\system32\5z9bstea59060.dll
c:\windows\system32\5zaadd9are3154.dll
c:\windows\system32\5zav9r2250.cpl
c:\windows\system32\5zfespyw9r51881.bin
c:\windows\system32\6021hackt5ol19ez.cpl
c:\windows\system32\60225ozm2f9.ocx
c:\windows\system32\6036hazkt5ol2d59.exe
c:\windows\system32\6061stzal97455.ocx
c:\windows\system32\6086ad9warez215.dll
c:\windows\system32\6107downloadz915645.exe
c:\windows\system32\6195zparse264.dll
c:\windows\system32\61f9tz5ef18949.exe
c:\windows\system32\62fzsteal9925.bin
c:\windows\system32\6395thre5z90265.ocx
c:\windows\system32\645fs9eal2625z.exe
c:\windows\system32\6499stezl31355.dll
c:\windows\system32\6588zpy9are1558.ocx
c:\windows\system32\6589threaz8439.dll
c:\windows\system32\65faddwzre1937.cpl
c:\windows\system32\6697thzef445.ocx
c:\windows\system32\6750addwaz5479.ocx
c:\windows\system32\6894t5zjb0.bin
c:\windows\system32\6968dzwnloader5569.ocx
c:\windows\system32\69fzdownlo5der1395.ocx
c:\windows\system32\6b45do9nloaderz032.bin
c:\windows\system32\6b95szyware509.dll
c:\windows\system32\6bzfstea51229.exe
c:\windows\system32\6c59zir2194.ocx
c:\windows\system32\6fbzthreat90355.dll
c:\windows\system32\6fd95irz78.dll
c:\windows\system32\6fz6threat230295.exe
c:\windows\system32\6z6threat15953.bin
c:\windows\system32\6z915roj540.ocx
c:\windows\system32\7129sp59arz1706.bin
c:\windows\system32\71c5adz95re635.ocx
c:\windows\system32\730et5rea97z4.exe
c:\windows\system32\743ddownlz9d5r2197.cpl
c:\windows\system32\7490s5ambotz199.dll
c:\windows\system32\7503d9wz5oader2761.cpl
c:\windows\system32\7559tzief11359.dll
c:\windows\system32\7563spz9se1609.dll
c:\windows\system32\7597szambot745.exe
c:\windows\system32\7617thie5169z.dll
c:\windows\system32\7692virus65z.dll
c:\windows\system32\7708dow5loaderz93.dll
c:\windows\system32\79595ir2355z.exe
c:\windows\system32\79azsp5rse1433.ocx
c:\windows\system32\79fds5ezl1248.ocx
c:\windows\system32\79z95ackdoor385.ocx
c:\windows\system32\79z9thief5143.cpl
c:\windows\system32\79zdbackdoor2859.exe
c:\windows\system32\7b5fstea9z344.dll
c:\windows\system32\7befz9dware18535.bin
c:\windows\system32\7c79downloadzr5571.exe
c:\windows\system32\7df7downlo5ze9361.cpl
c:\windows\system32\8546v5ru9609z.exe
c:\windows\system32\9015nzt-a-v5ru97dd.bin
c:\windows\system32\9055zroj3a9.exe
c:\windows\system32\905azkt9ol686.ocx
c:\windows\system32\921virus265z.cpl
c:\windows\system32\92z25ackto9lb8.cpl
c:\windows\system32\935bsteal12z5.exe
c:\windows\system32\9369s9amb5tze2.dll
c:\windows\system32\93702not5a-viruszd.ocx
c:\windows\system32\93942not-z-viru5768.ocx
c:\windows\system32\946z9spy245.dll
c:\windows\system32\954downloadez3294.cpl
c:\windows\system32\9571zir985.bin
c:\windows\system32\957zvir2906.bin
c:\windows\system32\958z2worm63f.bin
c:\windows\system32\95cvir2z10.bin
c:\windows\system32\97z59py258.exe
c:\windows\system32\982sp9m5oz652.exe
c:\windows\system32\98797nz5-a-virus751.bin
c:\windows\system32\991zspam5ot45b.dll
c:\windows\system32\996zthief5015.exe
c:\windows\system32\99755zormb5.cpl
c:\windows\system32\9999spy53z.bin
c:\windows\system32\999vzrus591.dll
c:\windows\system32\9a27vir50z0.bin
c:\windows\system32\9f49addzare1252.dll
c:\windows\system32\9z40hack5ool3fc.bin
c:\windows\system32\9z510virus158.ocx
c:\windows\system32\baadownlza9er9665.ocx
c:\windows\system32\bc3spar9e5605z.cpl
c:\windows\system32\ce4viz5819.dll
c:\windows\system32\cfdt5zef3299.bin
c:\windows\system32\d2zbackd9or507.dll
c:\windows\system32\drivers\MSIVXktliqpvmboqxmuyxwgixxuwylyprqrws.sys
c:\windows\system32\drivers\SKYNETkqcqucyu.sys
c:\windows\system32\e55addwzre1196.bin
c:\windows\system32\f90spar5z605.ocx
c:\windows\system32\fea9pyw5ze3041.dll
c:\windows\system32\Install.txt
c:\windows\system32\MSIVXfwbloscpbimlfytwtkbobnaqjporkfbf.dll
c:\windows\system32\MSIVXipjncltetmppxsehrecrqhkwpaficunq.dll
c:\windows\system32\Plugins
c:\windows\system32\Plugins\Mime.ini
c:\windows\system32\Plugins\MozillaEdit.exe
c:\windows\system32\Plugins\NPLeechGet.dll
c:\windows\system32\SKYNETfowdplsp.dll
c:\windows\system32\SKYNETljsttmoj.dll
c:\windows\system32\SKYNETmkhasrkv.dat
c:\windows\system32\SKYNETnrduemtn.dat
c:\windows\system32\z045thi9f1115.bin
c:\windows\system32\z09959pambot5c0.cpl
c:\windows\system32\z159threat1922.exe
c:\windows\system32\z279hacktool6ea5.dll
c:\windows\system32\z3762spa9b5t102.dll
c:\windows\system32\z6753sp5mbot9cc.exe
c:\windows\system32\z6dft9reat8205.dll
c:\windows\system32\z75539orm134.cpl
c:\windows\system32\z789threat246845.bin
c:\windows\system32\z9336worm59a.cpl
c:\windows\system32\z938spy1665.cpl
c:\windows\system32\z9c9spar5e2738.bin
c:\windows\system32\zac0sp9ware5748.cpl
c:\windows\system32\zd2fdownloader35979.exe
c:\windows\system32\ze3caddware9435.dll
c:\windows\system32\zf59backdoor395.ocx
c:\windows\system32\zf9b5ir2907.bin
c:\windows\z1554virus549.cpl
c:\windows\z196spywa5e1449.cpl
c:\windows\z3810spa9b5t4ec.cpl
c:\windows\z402vi9us1335.bin
c:\windows\z453not-a-virus94.dll
c:\windows\z5229worm447.exe
c:\windows\z5593hackt59l4fd.dll
c:\windows\z571thi5f9.dll
c:\windows\z5e3a9dware7045.bin
c:\windows\z6405spamb9tbd.dll
c:\windows\z659thie53008.exe
c:\windows\z672hack9o5l151.dll
c:\windows\z68at5ief9734.dll
c:\windows\z69not9a-vi5us326.exe
c:\windows\z6cspyw5r93181.bin
c:\windows\z8916hac5tool2e0.bin
c:\windows\z934worm26b5.bin
c:\windows\z9535spy5b1.cpl
c:\windows\z9680worm2315.bin
c:\windows\za83add5are1593.ocx
c:\windows\zab6spar5e2959.cpl
c:\windows\zc3addware25589.dll
c:\windows\zea4addw5re9392.exe
c:\windows\zf5dsp59se920.bin
c:\windows\zfd19t5al1315.exe

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSIVXserv.sys
-------\Service_SKYNETbnswtdrv
-------\Legacy_MSNCACHE
-------\Legacy_MSUPDATE
-------\Legacy_SOPIDKC


(((((((((((((((((((((((((((((   Fichiers créés du 2009-06-01 au 2009-07-01  ))))))))))))))))))))))))))))))))))))
.

2009-09-16 09:38 . 2009-09-16 09:38	6528	----a-w-	c:\windows\system32\z459wormda.bin
2009-06-29 20:15 . 2009-07-01 20:36	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\Spyware Terminator
2009-06-29 20:15 . 2009-06-29 20:15	6144	----a-w-	c:\documents and settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe
2009-06-29 20:15 . 2009-06-29 20:15	5632	----a-w-	c:\documents and settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys
2009-06-29 20:15 . 2009-06-29 20:15	142592	----a-w-	c:\windows\system32\drivers\sp_rsdrv2.sys
2009-06-29 20:15 . 2009-07-01 18:53	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spyware Terminator
2009-06-29 19:59 . 2009-06-29 20:10	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-29 19:34 . 2009-06-29 19:34	--------	d-----w-	c:\program files\CCleaner
2009-06-29 15:54 . 2009-06-29 15:54	--------	d--h--w-	c:\windows\PIF
2009-06-29 12:41 . 2009-06-29 12:41	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\Malwarebytes
2009-06-29 12:31 . 2009-06-17 09:27	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-29 12:31 . 2009-06-29 12:40	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-06-29 12:31 . 2009-06-29 12:31	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-29 12:31 . 2009-06-17 09:27	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-06-28 17:57 . 2009-07-01 20:29	--------	d-----w-	c:\program files\Trend Micro
2009-06-28 12:30 . 2009-06-28 12:30	167376	----a-w-	c:\documents and settings\Loulouu\Application Data\Mozilla\Firefox\Profiles\d7lhpm4f.default\FlashGot.exe
2009-06-28 10:19 . 2009-06-28 10:19	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\Auslogics
2009-06-28 10:19 . 2009-06-28 10:19	--------	d-----w-	c:\program files\Auslogics
2009-06-27 17:47 . 2009-06-27 17:47	--------	d-sh--w-	c:\windows\system32\config\systemprofile\PrivacIE
2009-06-18 21:24 . 2009-06-18 21:24	--------	d-----w-	c:\program files\Eidos Interactive
2009-06-16 10:35 . 2009-06-16 10:35	--------	d-----r-	c:\documents and settings\LocalService\Favoris
2009-06-16 10:35 . 2009-06-16 10:35	--------	d-sh--w-	c:\documents and settings\LocalService\IETldCache
2009-06-15 17:21 . 2009-06-15 17:21	4	----a-w-	c:\windows\info147.sys
2009-06-15 17:21 . 2009-06-15 17:21	--------	d-----w-	c:\program files\Fichiers communs\Totem Shared
2009-06-10 19:14 . 2009-04-30 21:16	12800	-c----w-	c:\windows\system32\dllcache\xpshims.dll
2009-06-10 19:14 . 2009-04-30 21:16	246272	-c----w-	c:\windows\system32\dllcache\ieproxy.dll
2009-06-09 19:01 . 2009-06-09 19:01	--------	d-----w-	c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2009-06-09 17:05 . 2009-06-09 17:05	--------	d-----w-	c:\program files\Electronic Arts
2009-06-09 16:56 . 2009-06-09 16:56	--------	d-----w-	c:\documents and settings\All Users\Application Data\Electronic Arts
2009-06-09 16:31 . 2009-06-09 16:31	10134	----a-r-	c:\documents and settings\Loulouu\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-06-09 16:31 . 2008-09-05 00:22	447752	----a-r-	c:\windows\system32\vp6vfw.dll
2009-06-09 16:31 . 2009-06-09 16:31	--------	d-----w-	c:\program files\Microsoft WSE
2009-06-06 14:36 . 2009-06-07 09:34	--------	d-----w-	c:\program files\DAEMON Tools Lite
2009-06-04 19:49 . 2009-06-04 21:24	--------	d-----w-	c:\program files\ElcomSoft
2009-06-04 19:18 . 2009-06-29 19:46	--------	d-----w-	c:\program files\Microsoft Works
2009-06-04 19:18 . 2009-06-04 19:18	--------	d-----w-	c:\program files\Microsoft.NET
2009-06-04 19:16 . 2009-06-04 19:16	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2009-06-04 19:15 . 2009-06-04 19:18	--------	d-----w-	c:\windows\SHELLNEW
2009-06-04 19:15 . 2009-06-04 19:15	--------	d-----w-	c:\documents and settings\Loulouu\Local Settings\Application Data\Microsoft Help
2009-06-04 19:15 . 2009-06-30 19:04	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-06-04 19:14 . 2009-06-04 19:14	--------	d--h--r-	C:\MSOCache
2009-06-04 14:43 . 2009-06-04 14:43	--------	d-----w-	c:\program files\iPod
2009-06-04 14:43 . 2009-06-04 14:43	--------	d-----w-	c:\program files\iTunes
2009-06-04 14:42 . 2009-06-04 14:42	--------	d-----w-	c:\program files\QuickTime
2009-06-04 14:40 . 2009-06-04 14:40	75048	----a-w-	c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-01 20:35 . 2008-12-13 11:58	--------	d-----w-	c:\program files\FlashGet
2009-06-29 20:15 . 2009-05-12 21:37	--------	d-----w-	c:\program files\Spyware Terminator
2009-06-29 20:02 . 2008-12-09 18:52	--------	d-----w-	c:\program files\Steam
2009-06-29 19:54 . 2008-12-07 22:43	90744	----a-w-	c:\documents and settings\Loulouu\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-29 15:55 . 2004-08-05 12:00	81626	----a-w-	c:\windows\system32\perfc00C.dat
2009-06-29 15:55 . 2004-08-05 12:00	503656	----a-w-	c:\windows\system32\perfh00C.dat
2009-06-27 17:52 . 2008-11-06 23:15	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\DNA
2009-06-27 16:02 . 2008-11-06 23:15	--------	d-----w-	c:\program files\DNA
2009-06-26 19:40 . 2008-12-27 16:20	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\LimeWire
2009-06-15 20:20 . 2008-12-21 10:51	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\dvdcss
2009-06-09 17:05 . 2008-12-11 14:37	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-06-04 19:18 . 2008-12-10 21:11	--------	d-----w-	c:\program files\MSBuild
2009-06-04 14:43 . 2008-12-09 20:19	--------	d-----w-	c:\program files\Fichiers communs\Apple
2009-05-29 12:21 . 2009-05-29 12:21	--------	d-----w-	c:\program files\MSXML 4.0
2009-05-29 11:36 . 2009-03-16 21:13	2060288	----a-w-	c:\windows\system32\usbaaplrc.dll
2009-05-29 11:36 . 2008-12-09 20:20	39424	----a-w-	c:\windows\system32\drivers\usbaapl.sys
2009-05-28 19:21 . 2009-05-28 19:21	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\Serif
2009-05-28 19:07 . 2009-05-28 19:07	--------	d-----w-	c:\program files\Serif
2009-05-28 19:04 . 2009-05-28 17:21	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\DAEMON Tools Lite
2009-05-28 19:03 . 2009-05-28 19:03	--------	d-----w-	c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-05-28 17:21 . 2009-05-27 08:41	721904	----a-w-	c:\windows\system32\drivers\sptd.sys
2009-05-27 15:01 . 2009-05-27 15:01	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\DAEMON Tools Pro
2009-05-25 20:24 . 2009-05-25 19:33	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\vlc
2009-05-22 14:33 . 2008-11-06 23:23	--------	d-----w-	c:\program files\Messenger Plus! Live
2009-05-13 05:04 . 2004-08-05 12:00	915456	----a-w-	c:\windows\system32\wininet.dll
2009-05-12 19:39 . 2009-05-12 19:39	--------	d-----w-	c:\program files\Avira
2009-05-12 19:39 . 2009-05-12 17:05	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-05-12 19:33 . 2009-05-12 17:46	81984	----a-w-	c:\windows\system32\bdod.bin
2009-05-12 17:42 . 2009-05-12 17:41	--------	d-----w-	c:\program files\Fichiers communs\BitDefender
2009-05-12 17:05 . 2009-05-11 17:09	--------	d-----w-	c:\program files\WinRAR(2)
2009-05-12 17:04 . 2009-05-12 16:54	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira(2)
2009-05-12 13:30 . 2009-05-12 13:30	--------	d-----w-	c:\documents and settings\All Users\Application Data\ESET
2009-05-11 17:04 . 2008-12-09 17:50	--------	d-----w-	c:\documents and settings\All Users\Application Data\WinZip
2009-05-07 15:33 . 2004-08-05 12:00	348672	----a-w-	c:\windows\system32\localspl.dll
2009-04-25 10:45 . 2008-12-14 16:09	410984	----a-w-	c:\windows\system32\deploytk.dll
2009-04-25 10:45 . 2009-04-05 12:51	152576	----a-w-	c:\documents and settings\Loulouu\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-19 19:50 . 2004-08-05 12:00	1847296	----a-w-	c:\windows\system32\win32k.sys
2009-04-15 14:53 . 2004-08-05 12:00	585216	----a-w-	c:\windows\system32pcrt4.dll
2009-03-05 16:08 . 2009-05-12 17:45	49664	----a-w-	c:\program files\mozilla firefox\components\FFComm.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2009-06-29 3055616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"VX1000"="c:\windows\vVX1000.exe" [2006-06-29 707376]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-25 148888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-05-30 292136]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-06-29 2174464]
"nwiz"="nwiz.exe" - c:\windows\system32
wiz.exe [2008-10-07 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
NDAS Device Management.lnk - c:\program files\NDAS\System
dasmgmt.exe [2005-5-24 179200]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages	REG_MULTI_SZ   	msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\WINDOWS\system32\usmt\migwiz.exe"=
"c:\Program Files\Mozilla Firefox\firefox.exe"=
"c:\Program Files\DNA\btdna.exe"=
"c:\Program Files\Sports Interactive\Football Manager 2009\fm.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\FlashGet\flashget.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"=
"c:\Program Files\LimeWire\LimeWire.exe"=
"c:\Program Files\Steam\steamapps\neitge\counter-strike source\hl2.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\game.dat"=
"c:\Program Files\PokerTH\pokerth.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\WINDOWS\system32\dpvsetup.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=
"c:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\patchget.dat"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 lpx;LPX Protocol;c:\windows\system32\drivers\lpx.sys [24/05/2005 10:02 109184]
R1 lfsfilt;Lean File Sharing;c:\windows\system32\drivers\lfsfilt.sys [25/12/2008 14:15 120704]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [29/06/2009 22:15 142592]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [12/05/2009 21:39 108289]
R3 ndasbus;NDAS Bus Driver;c:\windows\system32\drivers
dasbus.sys [24/05/2005 10:02 39168]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [11/12/2008 17:18 878976]
S3 FileObjInfo;STFileDriver;c:\documents and settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys [29/06/2009 22:15 5632]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [24/01/2009 15:46 216232]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32undll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-06-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://google.fr/
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Settings,ProxyOverride = *.local
IE: &Tout télécharger avec FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Télécharger avec FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Loulouu\Application Data\Mozilla\Firefox\Profiles\d7lhpm4f.default\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - plugin: c:\program files\ma-config.com
phardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pbittorrent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-01 22:49
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(2756)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32undll32.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\NDAS\System
dassvc.exe
c:\windows\system32
vsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Heure de fin: 2009-07-01 22:51 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-07-01 20:51

Avant-CF: 113 382 055 936 octets libres
Après-CF: 113 292 660 736 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

961	--- E O F ---	2009-06-30 19:04


Je précise qu'il m'a demandé d'installer un truc assez bizarre de Windows qu'il a téléchargé et installé lui même.
En redémarrant mon PC, il m'a changé mon fond d'écran par exemple.

Que pensez-vous de tout ça?

loulou92 · Answer

ComboFix 09-07-02.02 - Loulouu 03/07/2009 12:53.2 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.3071.2680 [GMT 2:00]
Lancé depuis: c:\documents and settings\Loulouu\Bureau\dfrbvdfvbdf.exe
Commutateurs utilisés :: c:\documents and settings\Loulouu\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Antivirus BitDefender  *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: Pare-feu BitDefender  *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
 * Un nouveau point de restauration a été créé

FILE ::
"c:\windows\info147.sys"
"c:\windows\system32\z459wormda.bin"
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\info147.sys
c:\windows\system32\z459wormda.bin

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-06-03 au 2009-07-03  ))))))))))))))))))))))))))))))))))))
.

2009-07-03 10:32 . 2009-07-03 10:32	167376	----a-w-	c:\documents and settings\Loulouu\Application Data\Mozilla\Firefox\Profiles\d7lhpm4f.default\FlashGot.exe
2009-06-29 20:15 . 2009-07-01 21:00	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\Spyware Terminator
2009-06-29 20:15 . 2009-06-29 20:15	6144	----a-w-	c:\documents and settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe
2009-06-29 20:15 . 2009-06-29 20:15	5632	----a-w-	c:\documents and settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys
2009-06-29 20:15 . 2009-06-29 20:15	142592	----a-w-	c:\windows\system32\drivers\sp_rsdrv2.sys
2009-06-29 20:15 . 2009-07-03 10:12	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spyware Terminator
2009-06-29 19:59 . 2009-06-29 20:10	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-29 19:34 . 2009-06-29 19:34	--------	d-----w-	c:\program files\CCleaner
2009-06-29 15:54 . 2009-06-29 15:54	--------	d--h--w-	c:\windows\PIF
2009-06-29 12:41 . 2009-06-29 12:41	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\Malwarebytes
2009-06-29 12:31 . 2009-06-17 09:27	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-29 12:31 . 2009-06-29 12:40	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-06-29 12:31 . 2009-06-29 12:31	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-29 12:31 . 2009-06-17 09:27	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-06-28 17:57 . 2009-07-02 10:13	--------	d-----w-	c:\program files\Trend Micro
2009-06-28 10:19 . 2009-06-28 10:19	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\Auslogics
2009-06-28 10:19 . 2009-06-28 10:19	--------	d-----w-	c:\program files\Auslogics
2009-06-27 17:47 . 2009-06-27 17:47	--------	d-sh--w-	c:\windows\system32\config\systemprofile\PrivacIE
2009-06-18 21:24 . 2009-06-18 21:24	--------	d-----w-	c:\program files\Eidos Interactive
2009-06-16 10:35 . 2009-06-16 10:35	--------	d-----r-	c:\documents and settings\LocalService\Favoris
2009-06-16 10:35 . 2009-06-16 10:35	--------	d-sh--w-	c:\documents and settings\LocalService\IETldCache
2009-06-15 17:21 . 2009-06-15 17:21	--------	d-----w-	c:\program files\Fichiers communs\Totem Shared
2009-06-10 19:14 . 2009-04-30 21:16	12800	-c----w-	c:\windows\system32\dllcache\xpshims.dll
2009-06-10 19:14 . 2009-04-30 21:16	246272	-c----w-	c:\windows\system32\dllcache\ieproxy.dll
2009-06-09 19:01 . 2009-06-09 19:01	--------	d-----w-	c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2009-06-09 17:05 . 2009-06-09 17:05	--------	d-----w-	c:\program files\Electronic Arts
2009-06-09 16:56 . 2009-06-09 16:56	--------	d-----w-	c:\documents and settings\All Users\Application Data\Electronic Arts
2009-06-09 16:31 . 2009-06-09 16:31	10134	----a-r-	c:\documents and settings\Loulouu\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-06-09 16:31 . 2008-09-05 00:22	447752	----a-r-	c:\windows\system32\vp6vfw.dll
2009-06-09 16:31 . 2009-06-09 16:31	--------	d-----w-	c:\program files\Microsoft WSE
2009-06-06 14:36 . 2009-06-07 09:34	--------	d-----w-	c:\program files\DAEMON Tools Lite
2009-06-04 19:49 . 2009-06-04 21:24	--------	d-----w-	c:\program files\ElcomSoft
2009-06-04 19:18 . 2009-06-29 19:46	--------	d-----w-	c:\program files\Microsoft Works
2009-06-04 19:18 . 2009-06-04 19:18	--------	d-----w-	c:\program files\Microsoft.NET
2009-06-04 19:16 . 2009-06-04 19:16	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2009-06-04 19:15 . 2009-06-04 19:18	--------	d-----w-	c:\windows\SHELLNEW
2009-06-04 19:15 . 2009-06-04 19:15	--------	d-----w-	c:\documents and settings\Loulouu\Local Settings\Application Data\Microsoft Help
2009-06-04 19:15 . 2009-06-30 19:04	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-06-04 19:14 . 2009-06-04 19:14	--------	d--h--r-	C:\MSOCache
2009-06-04 14:43 . 2009-06-04 14:43	--------	d-----w-	c:\program files\iPod
2009-06-04 14:43 . 2009-06-04 14:43	--------	d-----w-	c:\program files\iTunes
2009-06-04 14:42 . 2009-06-04 14:42	--------	d-----w-	c:\program files\QuickTime
2009-06-04 14:40 . 2009-06-04 14:40	75048	----a-w-	c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-03 10:51 . 2008-12-13 11:58	--------	d-----w-	c:\program files\FlashGet
2009-07-02 17:15 . 2008-12-09 18:52	--------	d-----w-	c:\program files\Steam
2009-06-29 20:15 . 2009-05-12 21:37	--------	d-----w-	c:\program files\Spyware Terminator
2009-06-29 19:54 . 2008-12-07 22:43	90744	----a-w-	c:\documents and settings\Loulouu\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-29 15:55 . 2004-08-05 12:00	81626	----a-w-	c:\windows\system32\perfc00C.dat
2009-06-29 15:55 . 2004-08-05 12:00	503656	----a-w-	c:\windows\system32\perfh00C.dat
2009-06-27 17:52 . 2008-11-06 23:15	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\DNA
2009-06-27 16:02 . 2008-11-06 23:15	--------	d-----w-	c:\program files\DNA
2009-06-26 19:40 . 2008-12-27 16:20	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\LimeWire
2009-06-15 20:20 . 2008-12-21 10:51	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\dvdcss
2009-06-09 17:05 . 2008-12-11 14:37	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-06-04 19:18 . 2008-12-10 21:11	--------	d-----w-	c:\program files\MSBuild
2009-06-04 14:43 . 2008-12-09 20:19	--------	d-----w-	c:\program files\Fichiers communs\Apple
2009-05-29 12:21 . 2009-05-29 12:21	--------	d-----w-	c:\program files\MSXML 4.0
2009-05-29 11:36 . 2009-03-16 21:13	2060288	----a-w-	c:\windows\system32\usbaaplrc.dll
2009-05-29 11:36 . 2008-12-09 20:20	39424	----a-w-	c:\windows\system32\drivers\usbaapl.sys
2009-05-28 19:21 . 2009-05-28 19:21	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\Serif
2009-05-28 19:07 . 2009-05-28 19:07	--------	d-----w-	c:\program files\Serif
2009-05-28 19:04 . 2009-05-28 17:21	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\DAEMON Tools Lite
2009-05-28 19:03 . 2009-05-28 19:03	--------	d-----w-	c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-05-28 17:21 . 2009-05-27 08:41	721904	----a-w-	c:\windows\system32\drivers\sptd.sys
2009-05-27 15:01 . 2009-05-27 15:01	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\DAEMON Tools Pro
2009-05-25 20:24 . 2009-05-25 19:33	--------	d-----w-	c:\documents and settings\Loulouu\Application Data\vlc
2009-05-22 14:33 . 2008-11-06 23:23	--------	d-----w-	c:\program files\Messenger Plus! Live
2009-05-13 05:04 . 2004-08-05 12:00	915456	----a-w-	c:\windows\system32\wininet.dll
2009-05-12 19:39 . 2009-05-12 19:39	--------	d-----w-	c:\program files\Avira
2009-05-12 19:39 . 2009-05-12 17:05	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-05-12 19:33 . 2009-05-12 17:46	81984	----a-w-	c:\windows\system32\bdod.bin
2009-05-12 17:42 . 2009-05-12 17:41	--------	d-----w-	c:\program files\Fichiers communs\BitDefender
2009-05-12 17:05 . 2009-05-11 17:09	--------	d-----w-	c:\program files\WinRAR(2)
2009-05-12 17:04 . 2009-05-12 16:54	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira(2)
2009-05-12 13:30 . 2009-05-12 13:30	--------	d-----w-	c:\documents and settings\All Users\Application Data\ESET
2009-05-11 17:04 . 2008-12-09 17:50	--------	d-----w-	c:\documents and settings\All Users\Application Data\WinZip
2009-05-07 15:33 . 2004-08-05 12:00	348672	----a-w-	c:\windows\system32\localspl.dll
2009-04-25 10:45 . 2008-12-14 16:09	410984	----a-w-	c:\windows\system32\deploytk.dll
2009-04-25 10:45 . 2009-04-05 12:51	152576	----a-w-	c:\documents and settings\Loulouu\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-19 19:50 . 2004-08-05 12:00	1847296	----a-w-	c:\windows\system32\win32k.sys
2009-04-15 14:53 . 2004-08-05 12:00	585216	----a-w-	c:\windows\system32pcrt4.dll
2009-03-05 16:08 . 2009-05-12 17:45	49664	----a-w-	c:\program files\mozilla firefox\components\FFComm.dll
.

(((((((((((((((((((((((((((((   SnapShot@2009-07-01_20.50.03   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-03 10:56 . 2009-07-03 10:56	16384              c:\windows	emp\Perflib_Perfdata_1bc.dat
+ 2008-12-29 17:08 . 2008-12-29 17:08	84992              c:\windows\Installer\976a26.msi
+ 2008-07-31 01:01 . 2008-07-31 01:01	30208              c:\windows\Installer\7dd92e.msp
+ 2008-07-30 22:31 . 2008-07-30 22:31	22016              c:\windows\Installer\7dd8f7.msp
+ 2008-07-29 19:07 . 2008-07-29 19:07	23040              c:\windows\Installer\7a3ec4.msp
+ 2009-05-06 18:57 . 2009-05-06 18:57	88576              c:\windows\Installer\77ea24.msi
+ 2009-03-29 18:59 . 2009-03-29 18:59	25088              c:\windows\Installer\1aa99d8.msi
+ 2009-03-29 18:59 . 2009-03-29 18:59	28160              c:\windows\Installer\1aa99c3.msi
+ 2009-03-29 18:58 . 2009-03-29 18:58	83456              c:\windows\Installer\1aa99b1.msi
+ 2009-03-29 18:58 . 2009-03-29 18:58	59904              c:\windows\Installer\1aa99ab.msi
+ 2009-06-04 19:16 . 2009-06-04 19:16	48128              c:\windows\Installer\1226a92.msi
+ 2008-12-10 21:13 . 2004-08-05 12:00	370688              c:\windows\ServicePackFiles\i386\digreqex.msi
+ 2008-12-10 21:13 . 2004-08-05 12:00	868352              c:\windows\ServicePackFiles\i386\digopt.msi
+ 2009-05-06 18:59 . 2009-05-06 18:59	652800              c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs_setup.msi
+ 2008-07-31 02:22 . 2008-07-31 02:22	442880              c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\vs_setup.msi
+ 2006-10-31 08:51 . 2006-10-31 08:51	507904              c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 French Language Pack\vs_setup.msi
+ 2009-05-12 19:37 . 2009-05-12 19:37	228352              c:\windows\Installer\f820.msi
+ 2008-11-06 23:17 . 2008-11-06 23:17	331264              c:\windows\Installer\df13c.msi
+ 2008-12-07 21:41 . 2008-12-07 21:41	265216              c:\windows\Installer\dcd77.msi
+ 2008-12-25 12:15 . 2008-12-25 12:15	705024              c:\windows\Installer\a219d0.msi
+ 2008-12-29 17:08 . 2008-12-29 17:08	795136              c:\windows\Installer\976a20.msi
+ 2008-12-29 17:08 . 2008-12-29 17:08	334336              c:\windows\Installer\976a1a.msi
+ 2009-03-05 20:00 . 2009-03-05 20:00	140288              c:\windows\Installer\8f7b14.msi
+ 2009-05-06 19:03 . 2009-05-06 19:03	438784              c:\windows\Installer\7dd942.msi
+ 2008-07-31 00:35 . 2008-07-31 00:35	184320              c:\windows\Installer\7dd92f.msp
+ 2008-07-31 00:36 . 2008-07-31 00:36	122368              c:\windows\Installer\7dd92d.msp
+ 2008-07-31 00:50 . 2008-07-31 00:50	181760              c:\windows\Installer\7dd92c.msp
+ 2008-07-31 00:56 . 2008-07-31 00:56	104448              c:\windows\Installer\7dd92b.msp
+ 2008-07-31 00:26 . 2008-07-31 00:26	886272              c:\windows\Installer\7dd92a.msp
+ 2009-05-06 19:02 . 2009-05-06 19:02	299008              c:\windows\Installer\7dd928.msi
+ 2008-07-30 22:33 . 2008-07-30 22:33	711168              c:\windows\Installer\7dd8f6.msp
+ 2008-07-30 22:35 . 2008-07-30 22:35	702464              c:\windows\Installer\7dd8f5.msp
+ 2008-07-30 22:37 . 2008-07-30 22:37	513536              c:\windows\Installer\7dd8f4.msp
+ 2008-07-30 22:29 . 2008-07-30 22:29	249856              c:\windows\Installer\7dd8f3.msp
+ 2009-05-06 19:02 . 2009-05-06 19:02	102912              c:\windows\Installer\7dd8f2.msi
+ 2008-12-13 07:58 . 2008-12-13 07:58	754688              c:\windows\Installer\7b6e90.msp
+ 2009-05-06 18:59 . 2009-05-06 18:59	648192              c:\windows\Installer\7b6e6a.msi
+ 2008-07-29 19:23 . 2008-07-29 19:23	250880              c:\windows\Installer\7a3ecd.msp
+ 2008-07-29 19:28 . 2008-07-29 19:28	278016              c:\windows\Installer\7a3ecb.msp
+ 2008-07-29 17:40 . 2008-07-29 17:40	291840              c:\windows\Installer\7a3ec9.msp
+ 2009-05-06 18:59 . 2009-05-06 18:59	137728              c:\windows\Installer\7a3ec3.msi
+ 2008-07-29 15:35 . 2008-07-29 15:35	553472              c:\windows\Installer\77ea29.msp
+ 2008-07-29 15:33 . 2008-07-29 15:33	506368              c:\windows\Installer\77ea27.msp
+ 2008-07-29 15:37 . 2008-07-29 15:37	911360              c:\windows\Installer\77ea26.msp
+ 2009-05-26 16:53 . 2009-05-26 16:53	579072              c:\windows\Installer\543c1.msp
+ 2009-03-18 21:12 . 2009-03-18 21:12	802304              c:\windows\Installer\52369a.msi
+ 2009-05-29 12:21 . 2009-05-29 12:21	432640              c:\windows\Installer\4b4eb.msi
+ 2009-03-05 18:43 . 2009-03-05 18:43	289280              c:\windows\Installer\48e80c.msi
+ 2009-03-20 09:48 . 2009-03-20 09:48	183808              c:\windows\Installer\29b4ef.msp
+ 2008-12-11 17:45 . 2008-12-11 17:45	972800              c:\windows\Installer\26a82f3.msi
+ 2009-02-15 19:55 . 2009-02-15 19:55	836096              c:\windows\Installer\1c7856a.msi
+ 2008-12-10 21:13 . 2008-12-10 21:13	137216              c:\windows\Installer\1ab15c.msi
+ 2008-12-10 21:12 . 2008-12-10 21:12	428544              c:\windows\Installer\1ab156.msi
+ 2009-03-29 18:59 . 2009-03-29 18:59	431104              c:\windows\Installer\1aa99f4.msi
+ 2009-03-29 18:58 . 2009-03-29 18:58	152576              c:\windows\Installer\1aa99b7.msi
+ 2009-03-29 18:58 . 2009-03-29 18:58	107008              c:\windows\Installer\1aa99a5.msi
+ 2009-03-29 18:58 . 2009-03-29 18:58	301056              c:\windows\Installer\1aa999f.msi
+ 2009-06-04 19:17 . 2009-06-04 19:17	504832              c:\windows\Installer\1226ac6.msi
+ 2009-06-04 19:17 . 2009-06-04 19:17	514560              c:\windows\Installer\1226abf.msi
+ 2009-06-04 19:17 . 2009-06-04 19:17	506880              c:\windows\Installer\1226ab9.msi
+ 2009-06-04 19:16 . 2009-06-04 19:16	516608              c:\windows\Installer\1226ab2.msi
+ 2009-06-04 19:16 . 2009-06-04 19:16	513024              c:\windows\Installer\1226aab.msi
+ 2009-06-04 19:16 . 2009-06-04 19:16	513536              c:\windows\Installer\1226aa4.msi
+ 2009-06-04 19:16 . 2009-06-04 19:16	505344              c:\windows\Installer\1226a9e.msi
+ 2004-08-05 12:00 . 2004-08-05 12:00	1355776              c:\windows\system32\webfldrs.msi
+ 2008-12-10 21:13 . 2004-08-05 12:00	1355776              c:\windows\ServicePackFiles\i386\webfldrs.msi
+ 2008-12-10 21:13 . 2004-08-05 12:00	5097984              c:\windows\ServicePackFiles\i386\msnmsgs.msi
+ 2006-10-31 09:10 . 2006-10-31 09:10	4398592              c:\windows\Microsoft.NET\Framework\v3.0\WPF\fr\wpflangpack.msi
+ 2007-03-30 20:20 . 2007-03-30 20:20	5800960              c:\windows\Installer\ad5126.msp
+ 2008-04-11 16:08 . 2008-04-11 16:08	6302720              c:\windows\Installer\ad50ad.msp
+ 2008-04-11 16:48 . 2008-04-11 16:48	6774272              c:\windows\Installer\ad506a.msp
+ 2007-06-01 13:54 . 2007-06-01 13:54	9626624              c:\windows\Installer\ad5053.msp
+ 2008-10-20 08:18 . 2008-10-20 08:18	6474240              c:\windows\Installer\ad503e.msp
+ 2008-12-09 20:20 . 2008-12-09 20:20	1549312              c:\windows\Installer\85105f.msi
+ 2008-07-31 00:43 . 2008-07-31 00:43	3202048              c:\windows\Installer\7dd929.msp
+ 2008-12-13 07:57 . 2008-12-13 07:57	8397824              c:\windows\Installer\7b6e79.msp
+ 2008-07-29 17:26 . 2008-07-29 17:26	1043456              c:\windows\Installer\7a3ecc.msp
+ 2008-07-29 18:37 . 2008-07-29 18:37	2679808              c:\windows\Installer\7a3eca.msp
+ 2008-07-29 19:15 . 2008-07-29 19:15	3697664              c:\windows\Installer\7a3ec8.msp
+ 2008-07-29 17:34 . 2008-07-29 17:34	1448448              c:\windows\Installer\7a3ec7.msp
+ 2008-07-29 18:22 . 2008-07-29 18:22	4137984              c:\windows\Installer\7a3ec6.msp
+ 2008-07-29 17:18 . 2008-07-29 17:18	3376640              c:\windows\Installer\7a3ec5.msp
+ 2008-07-29 15:45 . 2008-07-29 15:45	2543616              c:\windows\Installer\77ea2d.msp
+ 2008-07-29 15:29 . 2008-07-29 15:29	2926080              c:\windows\Installer\77ea2c.msp
+ 2008-07-29 15:41 . 2008-07-29 15:41	6487040              c:\windows\Installer\77ea2b.msp
+ 2008-07-29 15:39 . 2008-07-29 15:39	3403264              c:\windows\Installer\77ea2a.msp
+ 2008-07-29 15:43 . 2008-07-29 15:43	1013248              c:\windows\Installer\77ea28.msp
+ 2008-07-29 15:31 . 2008-07-29 15:31	6083072              c:\windows\Installer\77ea25.msp
+ 2009-04-25 10:45 . 2009-04-25 10:45	1633792              c:\windows\Installer\5f536c.msi
+ 2009-04-02 13:09 . 2009-04-02 13:09	1602048              c:\windows\Installer\555105.msi
+ 2009-05-04 05:46 . 2009-05-04 05:46	8299008              c:\windows\Installer\5441b.msp
+ 2009-05-04 05:47 . 2009-05-04 05:47	9124864              c:\windows\Installer\54405.msp
+ 2009-04-24 10:30 . 2009-04-24 10:30	2583552              c:\windows\Installer\543ef.msp
+ 2009-04-24 10:28 . 2009-04-24 10:28	4450816              c:\windows\Installer\543d8.msp
+ 2009-04-24 10:29 . 2009-04-24 10:29	9013760              c:\windows\Installer\543ad.msp
+ 2009-03-18 21:12 . 2009-03-18 21:12	3967488              c:\windows\Installer\523694.msi
+ 2009-05-28 19:16 . 2009-05-28 19:16	1143808              c:\windows\Installer\3c442.msi
+ 2008-12-09 18:52 . 2008-12-09 18:52	1098752              c:\windows\Installer\34c401.msi
+ 2009-04-04 07:06 . 2009-04-04 07:06	4443136              c:\windows\Installer\29b4e4.msp
+ 2009-04-04 15:10 . 2009-04-04 15:10	1282560              c:\windows\Installer\29b4da.msp
+ 2009-04-04 15:10 . 2009-04-04 15:10	7888384              c:\windows\Installer\29b4d2.msp
+ 2009-04-04 15:10 . 2009-04-04 15:10	9926144              c:\windows\Installer\29b4c8.msp
+ 2009-04-04 13:46 . 2009-04-04 13:46	1110528              c:\windows\Installer\29b4b2.msp
+ 2009-06-04 14:43 . 2009-06-04 14:43	4074496              c:\windows\Installer\26e925.msi
+ 2009-06-04 14:42 . 2009-06-04 14:42	8992256              c:\windows\Installer\26e5ef.msi
+ 2009-06-04 14:41 . 2009-06-04 14:41	3295232              c:\windows\Installer\26e359.msi
+ 2009-06-09 16:31 . 2009-06-09 16:31	1013248              c:\windows\Installer\251429.msi
+ 2008-12-10 21:52 . 2008-12-10 21:52	1405952              c:\windows\Installer\239e8.msi
+ 2009-02-10 16:49 . 2009-02-10 16:49	1659392              c:\windows\Installer\20505.msi
+ 2008-12-11 15:18 . 2008-12-11 15:18	2720256              c:\windows\Installer\1e38a97.msi
+ 2009-02-25 17:08 . 2009-02-25 17:08	8311808              c:\windows\Installer\1e32257.msp
+ 2009-03-28 07:50 . 2009-03-28 07:50	5025792              c:\windows\Installer\1e32243.msp
+ 2008-12-10 21:11 . 2008-12-10 21:11	1116160              c:\windows\Installer\1ab13e.msi
+ 2008-12-10 21:09 . 2008-12-10 21:09	1142784              c:\windows\Installer\1ab12c.msi
+ 2009-05-07 07:17 . 2009-05-07 07:17	5026816              c:\windows\Installer\133538c.msp
+ 2009-06-04 19:17 . 2009-06-04 19:17	1657856              c:\windows\Installer\1226adb.msi
+ 2009-06-04 19:17 . 2009-06-04 19:17	1657344              c:\windows\Installer\1226ad4.msi
+ 2009-06-04 19:17 . 2009-06-04 19:17	1666048              c:\windows\Installer\1226acd.msi
+ 2009-06-04 19:16 . 2009-06-04 19:16	2366464              c:\windows\Installer\1226a98.msi
+ 2009-06-04 19:16 . 2009-06-04 19:16	1645568              c:\windows\Installer\1226a89.msi
+ 2009-06-04 19:16 . 2009-06-04 19:16	2027520              c:\windows\Installer\1226a82.msi
+ 2009-06-04 19:15 . 2009-06-04 19:15	1754112              c:\windows\Installer\1226a7b.msi
+ 2009-06-04 19:15 . 2009-06-04 19:15	2418176              c:\windows\Installer\1226a75.msi
+ 2006-10-21 04:58 . 2006-10-21 04:58	11390464              c:\windows\Microsoft.NET\Framework\v3.0\WPF\wpf.msi
+ 2008-08-11 09:51 . 2008-08-11 09:51	15916544              c:\windows\Installer\ad5111.msp
+ 2008-10-20 08:16 . 2008-10-20 08:16	13211648              c:\windows\Installer\ad50fd.msp
+ 2008-01-28 16:10 . 2008-01-28 16:10	14201344              c:\windows\Installer\ad50e6.msp
+ 2008-08-11 09:49 . 2008-08-11 09:49	22457344              c:\windows\Installer\ad50c1.msp
+ 2008-09-24 10:05 . 2008-09-24 10:05	16381440              c:\windows\Installer\ad5094.msp
+ 2009-02-25 17:05 . 2009-02-25 17:05	11840000              c:\windows\Installer\ad5080.msp
+ 2008-12-13 08:21 . 2008-12-13 08:21	10473472              c:\windows\Installer\7b6e84.msp
+ 2009-05-04 05:49 . 2009-05-04 05:49	10955776              c:\windows\Installer\54455.msp
+ 2009-05-28 19:08 . 2009-05-28 19:08	49192448              c:\windows\Installer\3c43e.msi
+ 2009-04-04 15:09 . 2009-04-04 15:09	10874880              c:\windows\Installer\29b4bd.msp
+ 2009-04-04 05:42 . 2009-04-04 05:42	20993024              c:\windows\Installer\29b37a.msp
+ 2009-04-04 05:41 . 2009-04-04 05:41	14085120              c:\windows\Installer\29b36b.msp
+ 2009-03-11 19:57 . 2009-03-11 19:57	16411136              c:\windows\Installer\1d9ea.msi
+ 2009-02-25 17:07 . 2009-02-25 17:07	11646464              c:\windows\Installer\1552246.msp
+ 2009-06-04 19:19 . 2009-06-04 19:19	15830016              c:\windows\Installer\1226ae8.msi
+ 2009-04-04 15:08 . 2009-04-04 15:08	343058432              c:\windows\Installer\29b4a7.msp
.
-- Instantané actualisé --
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"VX1000"="c:\windows\vVX1000.exe" [2006-06-29 707376]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"nwiz"="nwiz.exe" - c:\windows\system32
wiz.exe [2008-10-07 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
NDAS Device Management.lnk - c:\program files\NDAS\System
dasmgmt.exe [2005-5-24 179200]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages	REG_MULTI_SZ   	msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\WINDOWS\system32\usmt\migwiz.exe"=
"c:\Program Files\Mozilla Firefox\firefox.exe"=
"c:\Program Files\DNA\btdna.exe"=
"c:\Program Files\Sports Interactive\Football Manager 2009\fm.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"=
"c:\Program Files\LimeWire\LimeWire.exe"=
"c:\Program Files\Steam\steamapps\neitge\counter-strike source\hl2.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\game.dat"=
"c:\Program Files\PokerTH\pokerth.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\WINDOWS\system32\dpvsetup.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=
"c:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\patchget.dat"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"=
"c:\Program Files\FlashGet\FlashGet.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 lpx;LPX Protocol;c:\windows\system32\drivers\lpx.sys [24/05/2005 10:02 109184]
R1 lfsfilt;Lean File Sharing;c:\windows\system32\drivers\lfsfilt.sys [25/12/2008 14:15 120704]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [29/06/2009 22:15 142592]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [12/05/2009 21:39 108289]
R3 ndasbus;NDAS Bus Driver;c:\windows\system32\drivers
dasbus.sys [24/05/2005 10:02 39168]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [11/12/2008 17:18 878976]
S3 FileObjInfo;STFileDriver;c:\documents and settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys [29/06/2009 22:15 5632]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [24/01/2009 15:46 216232]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32undll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-06-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://google.fr/
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Settings,ProxyOverride = *.local
IE: &Tout télécharger avec FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Télécharger avec FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Loulouu\Application Data\Mozilla\Firefox\Profiles\d7lhpm4f.default\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - plugin: c:\program files\ma-config.com
phardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pbittorrent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-03 12:56
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-73586283-1659004503-725345543-1003\Software\G*e*n*i*e*"!\FM Genie Scout 2009 XE]
"GameDir"="c:\Documents and Settings\Loulouu\Mes documents\Sports Interactive\Football Manager 2009\games"
"ShortlistDir"=""
"ScreenshotsDir"="c:\Documents and Settings\Loulouu\Mes documents\Sports Interactive\Football Manager 2009"
"SaveDir"="c:\Documents and Settings\Loulouu\Mes documents\Sports Interactive\Football Manager 2009\"
"HistoryDir"="d:\FM-Genie-Scout-2009-XE\History Points"
"LangDB"="c:\Program Files\Sports Interactive\Football Manager 2009\data\updates\update-910\db\910\lang_db.dat"
"LastSaveGame"=""
"Language"="English"
"LoadLangDB"=dword:00000001
"CompressHistoryPoints"=dword:00000000
"HighlightedAttributes"=dword:00000000
"MinCondition"=dword:00000050
"SkinName"="Champions League"
"LastUpdateCheck"=dword:00000000
"HighQualityGUI"=dword:00000001
"AutomaticallyUpdateCheck"=dword:00000001
"AdvancedGeneration"=dword:00000000
"TranslateStaffSkills"=dword:00000001
"TranslatePlayerSkills"=dword:00000001
"TranslatePositions"=dword:00000001
"ShowHistory"=dword:00000001
"Version"=dword:00000067
"UniqueID"="C5-E980-E6EF"
"UseProxy"=dword:00000000
"ProxyHost"=""
"ProxyPort"=""
"UseAuthentication"=dword:00000000
"UserName"=""
"UserPassword"=""
"Currency"=dword:00000056
"GraphStep"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(3436)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32undll32.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\NDAS\System
dassvc.exe
c:\windows\system32
vsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Heure de fin: 2009-07-03 12:58 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-07-03 10:58
ComboFix2.txt  2009-07-01 20:51

Avant-CF: 113 116 766 208 octets libres
Après-CF: 113 104 273 408 octets libres

404	--- E O F ---	2009-06-30 19:04

loulou92 · Answer

Malwarebytes' Anti-Malware 1.38
Version de la base de données: 2368
Windows 5.1.2600 Service Pack 3

03/07/2009 18:22:10
mbam-log-2009-07-03 (18-22-10).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 155928
Temps écoulé: 20 minute(s), 12 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

loulou92 · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Loulouu at 2009-07-03 18:23:52
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 108 GB (72%) free of 150 GB
Total RAM: 3071 MB (84% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:23:54, on 03/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NDAS\System
dasmgmt.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\NDAS\System
dassvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Loulouu\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Loulouu.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NDAS Device Management.lnk = C:\Program Files\NDAS\System
dasmgmt.exe
O8 - Extra context menu item: &Tout télécharger avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NDAS Service (ndassvc) - XIMETA, Inc. - C:\Program Files\NDAS\System
dassvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

loulou92 · Answer

En fait j'ai renommé ainsi Combo-fix car il ne démarrait pas! 
C'est aussi simple que ça :)

loulou92 · Answer

J'espère que non...!

Merci pour tout en tout cas, c'est vraiment adorable!

loulou92 · Answer

[ Rapport ToolsCleaner version 2.3.7 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\Qoobox: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Loulouu\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Loulouu\Bureau\Rsit.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Loulouu\Bureau\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\Documents and Settings\Loulouu\Bureau\Rsit.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Qoobox: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Fichiers temporaires nettoyés !
Sauvegarde du registre crée !


Pour l'étape 2), il me suffit juste de réactiver la restauration du système?

loulou92 · Answer

Très bien!

Merci beaucoup !!!!!

(Enfin, je pense....)

Infecté par WinBlueSoft?

23 réponses

Votre réponse

Discussions similaires

Newsletters