TOTAL SECURITY 4.52

salut t'inquiete pas c'est la nouvelle mode cette m*******

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent

▶ Télécharge List&Kill'em et enregistre-le sur ton bureau

Il ne necessite pas d'installation

▶double clic (clic droit "executer en tant qu'administrateur" pour Vista) pour lancer le scan

choisis la langue puis choisis l'option 1 = Mode Recherche

▶laisse travailler l'outil

le rapport va s'afficher , une fois le scan fini

▶▶▶▶▶▶▶ ATTENTION : Efface ton adresse IP stp !!!!

ici :

[121]: KB973815 - Update
[122]: KB973869 - Update
[123]: XpsEPSC
Carte(s) r‚seau: 4 carte(s) r‚seau install‚e(s).
[01]: Bluetooth PAN Network Adapter
Nom de la connexion : Connexion au r‚seau local 2
tat : Support d‚connect‚
[02]: Intel(R) PRO/1000 CT Network Connection
Nom de la connexion : Connexion au r‚seau local
DHCP activ‚ : Non
Adresse(s) IP
[01] : 192.168.0.11
[03]: VirtualBox Host-Only Ethernet Adapter
Nom de la connexion : VirtualBox Host-Only Network
DHCP activ‚ : Non
Adresse(s) IP
[01] : 192.168.56.1
[04]: VirtualBox Host-Only Ethernet Adapter
Nom de la connexion : VirtualBox Host-Only Network #2
DHCP activ‚ : Non
Adresse(s) IP
[01] : 192.168.217.1

Nom de l'image PIDÿ Nom de la sessio Num‚ro d Utilisation
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 16 Ko
System 4 Console 0 244 Ko
smss.exe 916 Console 0 400 Ko
csrss.exe 972 Console 0 4ÿ456 Ko
winlogon.exe 996 Console 0 3ÿ536 Ko

▶colle le contenu dans ta prochaine réponse

Merci,

je vais tenter ce que tu me demandes. Par contre, je suis débutante en informatique, donc, je dois faire quoi pour "effacer mon adresse IP", ainsi que tu me le demandes ?

sur le rapport , à l'endroit indiqué tu effaceras les chiffers marqués en gras (les tiens seront differents)

Dans le rapport, je ne vois pas mon ad IPP...???

êt bien poste alors :)

Voilà :

List'em by g3n-h@ckm@n 1.0.2.8

updated on 22.08.2009 ::::: 11.40

Microsoft Windows XP [version 5.1.2600]

22/08/2009 21:09:05,29

Infections :
==========

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
"C:\program files\Fichiers communs\uninstall information"
"C:\program files\WinPCap"
"C:\program files\WinPCap"
"C:\program files\WinPCap\rpcapd.exe"
"C:\program files\WinPCap\rpcapd.exe"
"C:\WINDOWS\jautoexp.dat"
"C:\WINDOWS\system32\drivers\npf.sys"
"C:\WINDOWS\system32\Packet.dll"
"C:\WINDOWS\system32\pthreadVC.dll"
C:\WINDOWS\System32\SET79.tmp
C:\WINDOWS\System32\SET7E.tmp
"C:\WINDOWS\system32\WanPacket.dll"
"C:\WINDOWS\system32\wpcap.dll"
"C:\Documents and Settings\ISABELLE\Application Data\wiaserva.log"
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\A~NSISu_.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\B33C11F5-3A11-4f1e-85E4-C3CABE52C369.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\Install_Messenger.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\Install_WLMessenger.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\PDSetup0fd9.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\PDSetup5865.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\setup_wm.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\wlsetup-cvr.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\xpinstall.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\ytb.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\TMP91.tmp
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\tmpC.tmp

¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

HKLM\Software\Microsoft\Windows\CurrentVersion\Run "NeroCheck"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\ControlSet001\Services\npf
HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\ControlSet002\Services\npf
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\CurrentControlSet\Services\npf

¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

12066874.EXE-03C93C0C.pf
AAWSERVICE.EXE-3B93EBA3.pf
AAWTRAY.EXE-1858AE3F.pf
ACRORD32.EXE-3A1F13AE.pf
AD-AWARE.EXE-3122AD3A.pf
AD-AWAREADMIN.EXE-102E374C.pf
ADOBE_UPDATER.EXE-32E1E9B7.pf
ALG.EXE-0F138680.pf
AOLAGENT.EXE-0D9ED086.pf
AOLDIAL.EXE-223600B2.pf
AOLLOAD.EXE-05C5C091.pf
AOLSOFTWARE.EXE-0DE80764.pf
AOLSP SCHEDULER.EXE-19FD71F1.pf
AU_.EXE-2AB5462E.pf
AVCENTER.EXE-1A970FA0.pf
AVCONFIG.EXE-1ECA67AD.pf
AVGNT.EXE-200FEF40.pf
AVGUARD.EXE-27095CE7.pf
AVICAP38.EXE-272ED24D.pf
AVIRA_ANTIVIR_PERSONAL_FREE.E-0366A159.pf
AVSCAN.EXE-07FC469C.pf
AVWSC.EXE-0283F9DD.pf
BTHCI834.EXE-23263AD6.pf
CCLEANER.EXE-0BCE437C.pf
CCSETUP222.EXE-2D57FADE.pf
CLEANMGR.EXE-1F86EA8E.pf
CMD.EXE-087B4001.pf
CTFMON.EXE-0E17969B.pf
DEFRAG.EXE-273F131E.pf
DFRGNTFS.EXE-269967DF.pf
DRWTSN32.EXE-2B4B52AC.pf
DUMPREP.EXE-1B46F901.pf
DWWIN.EXE-30875ADC.pf
EXCEL.EXE-1C75F8D6.pf
EXPLORER.EXE-082F38A9.pf
E_FAMTABE.EXE-00EC7EBB.pf
E_FARNABE.EXE-246CCB40.pf
E_FPREABE.EXE-05EF8F23.pf
FACT.EXE-3082479B.pf
FIREFOX.EXE-28641590.pf
GRPCONV.EXE-111CD845.pf
GUARDGUI.EXE-00ECD849.pf
HELPER.EXE-0415776D.pf
HELPSVC.EXE-2878DDA2.pf
HIJACKTHIS.EXE-2B2D6B91.pf
IEXPLORE.EXE-27122324.pf
IKOWIN32.EXE-1B728605.pf
IMAPI.EXE-0BF740A4.pf
INCD.EXE-0A3D304D.pf
INSTALL.EXE-3AC7CD8F.pf
IPCONFIG.EXE-2395F30B.pf
IS-3ENTO.TMP-028EDD51.pf
Layout.ini
LOGON.SCR-151EFAEA.pf
LOGONUI.EXE-0AF22957.pf
MAPISP32.EXE-141E6AA9.pf
MISE-A-JOUR-LIVESEARCH.EXE-20BBCE30.pf
MSIEXEC.EXE-2F8A8CAE.pf
MSMSGS.EXE-2B6052DE.pf
MSN6.EXE-2001F6AE.pf
MSNMSGR.EXE-030AB647.pf
MSPUB.EXE-0DBB14AE.pf
MVC.EXE-143674E8.pf
NEROCHECK.EXE-092C6DFA.pf
NET.EXE-01A53C2F.pf
NET1.EXE-029B9DB4.pf
NOTEPAD.EXE-336351A9.pf
NOTIFICATION-LIVESEARCH.EXE-29F88077.pf
NS95.TMP-21787A9C.pf
NS96.TMP-185313A4.pf
NTOSBOOT-B00DFAAD.pf
NWIZ.EXE-2D0F9FBC.pf
OSA9.EXE-27CD7DB8.pf
OUTLOOK.EXE-179DEC04.pf
OUTLOOK.EXE-3784AE71.pf
POWERPNT.EXE-17CE3F4E.pf
PRESETUP.EXE-12C8F418.pf
QSB.EXE-07408328.pf
QTTASK.EXE-342507FB.pf
READER_SL.EXE-2B4EA1CB.pf
REALPLAY.EXE-1BF219BD.pf
REGSVR32.EXE-25EEFE2F.pf
RSTRUI.EXE-03C49A96.pf
RUNDLL32.EXE-171401FB.pf
RUNDLL32.EXE-188DF14E.pf
RUNDLL32.EXE-19B3AED6.pf
RUNDLL32.EXE-1BC55A4F.pf
RUNDLL32.EXE-1EFB9777.pf
RUNDLL32.EXE-2047740D.pf
RUNDLL32.EXE-22C680B6.pf
RUNDLL32.EXE-26C2C861.pf
RUNDLL32.EXE-2905E326.pf
RUNDLL32.EXE-2B626000.pf
RUNDLL32.EXE-2BF3472E.pf
RUNDLL32.EXE-2CBA7525.pf
RUNDLL32.EXE-383267D7.pf
RUNDLL32.EXE-3AF42246.pf
RUNDLL32.EXE-3B5273A8.pf
RUNDLL32.EXE-3F22660F.pf
RUNDLL32.EXE-451FC2C0.pf
RUNONCE.EXE-2803F297.pf
SCHED.EXE-030F29E1.pf
SETUP.EXE-10AC2738.pf
SETUP.EXE-2B770139.pf
SETUP_WM.EXE-3135CBD6.pf
SVCHOST.EXE-3530F672.pf
TASKMGR.EXE-20256C55.pf
TMP91.TMP-18C23D89.pf
UNINST.EXE-0A20C808.pf
UNSECAPP.EXE-1A95A33B.pf
UPDATE.EXE-2577D203.pf
UPDATER.EXE-0E28B6A4.pf
USERINIT.EXE-30B18140.pf
VADERETRO_MGR.EXE-1AFFE160.pf
VCREDIST_X86.EXE-2A6F0DB0.pf
VERCLSID.EXE-3667BD89.pf
VRMOREGISTER.EXE-185AE039.pf
WGATRAY.EXE-0ED38BED.pf
WINWORD.EXE-10D55173.pf
WLCOMM.EXE-04AE9009.pf
WMIPRVSE.EXE-28F301A9.pf
WMPLAYER.EXE-18DDEFA3.pf
WMPLAYER.EXE-18DDEFA5.pf
WPV001250826839.EXE-07739A10.pf
WSCNTFY.EXE-1B24F5EB.pf
WUAUCLT.EXE-399A8E72.pf
WUDFHOST.EXE-215E7549.pf
XCSYNCML.EXE-23D9360B.pf
_EX-08.EXE-2630CB5F.pf
_EX-68.EXE-08054179.pf

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Ferme toutes tes fenetres(y compris internet et windows live messenger) , puis :

▶ Relance List&Kill'em comme tu as fait pour l'option 1 (soit en clic droit pour vista),

mais cette fois-ci :

▶ choisis l'option 2 = Mode Destruction

laisse travailler l'outil

apres les verifications , un rapport va s'ouvrir.

▶ ferme-le.

un deuxieme rapport va s'ouvrir ,

▶ colle son contenu dans ta reponse

Et revoilà !

Kill'em by g3n-h@ckm@n 1.0.2.8

updated on 22.08.2009 ::::: 11.40

Microsoft Windows XP [version 5.1.2600]

22/08/2009 22:37:01,65

Fichiers analysés :
=================

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

"C:\WINDOWS\jautoexp.dat"
"C:\WINDOWS\system32\drivers\npf.sys"
"C:\WINDOWS\system32\Packet.dll"
"C:\WINDOWS\system32\pthreadVC.dll"
C:\WINDOWS\System32\SET79.tmp
C:\WINDOWS\System32\SET7E.tmp
"C:\WINDOWS\system32\WanPacket.dll"
"C:\WINDOWS\system32\wpcap.dll"
"C:\Documents and Settings\ISABELLE\Application Data\wiaserva.log"
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\A~NSISu_.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\B33C11F5-3A11-4f1e-85E4-C3CABE52C369.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\Install_Messenger.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\Install_WLMessenger.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\PDSetup0fd9.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\PDSetup5865.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\setup_wm.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\wlsetup-cvr.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\xpinstall.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\ytb.exe
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\TMP91.tmp
C:\Documents and Settings\ISABELLE\LOCAL Settings\Temp\tmpC.tmp

¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers :

Quarantaine :

A~NSISu_.exe.Kill'em
B33C11F5-3A11-4f1e-85E4-C3CABE52C369.exe.Kill'em
Install_Messenger.exe.Kill'em
Install_WLMessenger.exe.Kill'em
jautoexp.dat.Kill'em
npf.sys.Kill'em
Packet.dll.Kill'em
PDSetup0fd9.exe.Kill'em
PDSetup5865.exe.Kill'em
pthreadVC.dll.Kill'em
SET79.tmp.Kill'em
SET7E.tmp.Kill'em
setup_wm.exe.Kill'em
TMP91.tmp.Kill'em
tmpC.tmp.Kill'em
WanPacket.dll.Kill'em
wiaserva.log.Kill'em
wlsetup-cvr.exe.Kill'em
wpcap.dll.Kill'em
xpinstall.exe.Kill'em
ytb.exe.Kill'em

¤¤¤¤¤¤¤¤¤¤ Verification :

Infections :
==========

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

HKLM\Software\Microsoft\Windows\CurrentVersion\Run "NeroCheck"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\ControlSet001\Services\npf
HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\ControlSet002\Services\npf
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\CurrentControlSet\Services\npf

¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

Layout.ini
NTOSBOOT-B00DFAAD.pf

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Télécharge OTL de OLDTimer

▶ enregistre le sur ton Bureau.

▶ Double clic sur OTL.exe pour le lancer.

▶Copie la liste qui se trouve en gras ci-dessous,

▶ colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NPF]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npf]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_NPF]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\npf]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\Legacy_npf]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npf]

:commands
[emptytemp]
[reboot]


▶ Clique sur RunFix pour lancer la suppression.

J'ai fait ce demandé dans le dernier message (OTL).
ON m'a demandé de redémarrer ; ce que j'ai fait.
Au redémarrage, total sécurity se lance toujours tout seul et j'ai eu cette boite de message :

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
Process firefox.exe killed successfully!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NeroCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NPF\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npf\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_NPF\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\npf\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\Legacy_npf\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npf\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: aolextras

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: ISABELLE
->Temp folder emptied: 190892082 bytes
->Temporary Internet Files folder emptied: 428546 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 68126724 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33237 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1139202 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
Windows Temp folder emptied: 6661749 bytes
RecycleBin emptied: 32768 bytes

Total Files Cleaned = 255,06 mb

OTL by OldTimer - Version 3.0.10.7 log created on 08222009_231651

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

▶ Double clic sur OTL.exe pour le lancer.

▶ Coche les 2 cases Lop et Purity

▶ Coche la case devant scan all users

▶ règle-le sur "60 Days"

▶ dans la colonne de gauche , mets tout sur all

▶Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

▶▶▶ NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : https://www.cjoint.com/

▶ Clique sur Parcourir et cherche le fichier ci-dessus.

▶ Clique sur Ouvrir.

▶ Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

▶ Copie ce lien dans ta réponse.

Tu feras la meme chose avec le "Extra.txt".

Voilà pour otl.txt : https://www.cjoint.com/?iwx3mu4iVI

et pour extra.txt : https://www.cjoint.com/?iwx6hvRadI

/!\ ATTENTION SUIVRE SCRUPULEUSEMENT A LA LETTRE CES INDICATIONS/!\

▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe"

_________________________________________________________________
>Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.<
>>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<<
=====================================================</gras>

▶ On va utiliser ComboFix.exe. Rends toi sur cette page web pour obtenir les liens de téléchargement, ainsi que des instructions pour exécuter l'outil:

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Avant d'utiliser ComboFix :
______________________________________________________________________
>> referme les fenêtres de tous les programmes en cours.
>> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
>>la protection en temps réel de ton Antivirus et de tes Antispywares,
>>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°

▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!!

▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

>> Reviens sur le forum, et

▶ copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

Voilà le contenu du message :

ComboFix 09-08-22.06 - ISABELLE 23/08/2009 0:43.1.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.255.130 [GMT 2:00]
Running from: c:\documents and settings\ISABELLE\Bureau\Isabelle.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\12066874
c:\documents and settings\All Users\Application Data\12066874\12066874
c:\documents and settings\All Users\Application Data\12066874\12066874.exe
c:\documents and settings\All Users\Application Data\12066874\pc12066874ins
c:\documents and settings\ISABELLE\Application Data\wiaserva.log
c:\windows\Installer\4014d.msi
c:\windows\Installer\40176.msi
c:\windows\Installer\76833.msi
c:\windows\Installer\7685c.msi
c:\windows\Readme.txt
c:\windows\System32\amr_cpl2.exe
c:\windows\system32\drivers\15b9d875.sys
c:\windows\system32\drivers\f26f74ce.sys
c:\windows\system32\sqlite3.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_15b9d875
-------\Service_f26f74ce

((((((((((((((((((((((((( Files Created from 2009-07-22 to 2009-08-22 )))))))))))))))))))))))))))))))
.

2009-08-22 22:59 . 2009-08-22 22:59 -------- d-----w- c:\documents and settings\All Users\Application Data\13049184
2009-08-22 22:59 . 2009-08-22 22:59 699936 ----a-w- c:\documents and settings\All Users\Application Data\13049184\13049184.exe
2009-08-22 21:16 . 2009-08-22 21:16 -------- d-----w- C:\_OTL
2009-08-22 20:37 . 2009-08-22 20:40 -------- d-----w- C:\Kill'em
2009-08-22 12:05 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-01 15:41 . 2009-08-01 16:14 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-08-01 15:41 . 2009-08-01 16:14 -------- d-----w- c:\program files\NOS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-06 17:59 . 2004-08-11 14:47 -------- d-----w- c:\documents and settings\ISABELLE\Application Data\MSN6
2009-08-01 16:02 . 2005-04-05 16:08 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-06-29 15:57 . 2004-12-07 18:17 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 15:57 . 2004-08-19 23:09 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-29 15:57 . 2002-08-30 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-06-16 14:40 . 2002-08-30 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2002-08-30 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-06 18:22 . 2009-06-06 18:22 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\lsdelete.exe
2009-06-06 18:22 . 2009-05-07 21:43 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-06-06 18:21 . 2009-06-06 18:21 64160 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Drivers\32\lbd.sys
2009-06-06 18:21 . 2009-05-07 20:32 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-03 19:10 . 2002-08-30 12:00 1297408 ----a-w- c:\windows\system32\quartz.dll
2008-12-16 18:12 . 2005-05-23 15:32 186170 ------r- c:\program files\Fichiers communs\capesnpn.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QSB"="c:\program files\Company\Quick Start Button\QSB.exe" [2002-03-08 548864]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" [X]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2002-12-12 1183744]
"AOLSAV"="c:\progra~1\TECHCI~1\AOLSAV\AOLAgent.exe" [2004-11-10 80384]
"AOLDialer"="c:\program files\Fichiers communs\AOL\ACS\AOLDial.exe" [2004-04-08 496752]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-06-02 98304]
"445f8c738a6d"="c:\windows\System32\avicap38.exe" [2004-10-21 32768]
"XCSyncML"="c:\windows\system32\XCSyncML.exe" [2005-07-14 135168]
"HostManager"="c:\program files\Fichiers communs\AOL\1132762218\ee\AOLSoftware.exe" [2006-06-23 50760]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2006-11-06 26112]
"VadeRetro Outlook"="c:\program files\Goto Software\Vade Retro\VrMoRegister.exe" [2008-02-20 87552]
"VadeRetro Desktop"="c:\program files\Goto Software\Vade Retro\Vaderetro_Mgr.exe" [2008-04-10 1054208]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-07-31 520024]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"PromoReg"="c:\windows\Temp\_ex-08.exe" [2009-08-22 400384]
"13049184"="c:\documents and settings\All Users\Application Data\13049184\13049184.exe" [2009-08-22 699936]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2002-09-21 372736]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\ISABELLE\Menu D‚marrer\Programmes\D‚marrage\
ikowin32.exe [2008-4-14 30208]
Outil de notification Live Search.lnk - c:\documents and settings\ISABELLE\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe [2008-10-4 143360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"c:\\Program Files\\NEC\\NEC Mobile Suite\\CommsService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\Temp\\_ex-08.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list]
"53:UDP"= 53:UDP:Promo
"80:TCP"= 80:TCP:Promo
.
Contents of the 'Scheduled Tasks' folder

2009-08-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 08:45]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-KAZAA - c:\program files\Kazaa\kazaa.exe
HKLM-Run-a9cbef35e48f - c:\windows\system32\bthci834.exe
HKLM-Run-12066874 - c:\documents and settings\All Users\Application Data\12066874\12066874.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.fr/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://search.scourweb.net/nph-search.cgi?partner=wesb1&look=sbar1_srchbtn
uSearchURL,(Default) = hxxp://search.scourweb.net/nph-search.cgi?partner=wesrch1&look=stmpl1&kw=
IE: &Recherche AOL Toolbar - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: teleir_cert - hxxps://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} - hxxp://mypixmania.com/fr/fr/importer/MypixUploader.cab
DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} - hxxp://www.mypixmania.com/fr/fr/tools/activex/fpu.cab
DPF: {8EC69950-F299-40AC-A004-3BF5176F8F7B} - hxxp://www.checkspy.com/fr/FlowScan.cab
FF - ProfilePath - c:\documents and settings\ISABELLE\Application Data\Mozilla\Firefox\Profiles\scxm4ucd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA2&q=
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-23 00:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AOLSAV = c:\progra~1\TECHCI~1\AOLSAV\AOLAgent.exe?exe???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3376)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\AAWService.exe
c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\slserv.exe
c:\windows\wanmpsvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\documents and settings\ISABELLE\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
c:\program files\Fichiers communs\AOL\1132762218\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
.
**************************************************************************
.
Completion time: 2009-08-22 1:24 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-22 23:23

Pre-Run: 27 827 535 872 octets libres
Post-Run: 27 741 798 400 octets libres

166 --- E O F --- 2009-07-29 09:10

__________________________________________________________
=>/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement cet ordinateur,<=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=====|
---------------------------------------------------------------

Toujours avec toutes les protections désactivées, fais ceci :

▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

----------------------------------------------------------
File::
c:\windows\Temp\_ex-08.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"445f8c738a6d"=-
"PromoReg"=-
"13049184"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\WINDOWS\Temp\_ex-08.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list]
"53:UDP"=-
"80:TCP"=-

Folder::
c:\documents and settings\All Users\Application Data\13049184
------------------------------------------------------------------

▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
▶ Quitte le Bloc Notes

▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) Comme ceci

▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

Bonjour !
Voilà le nouveau rapport :

ComboFix 09-08-22.06 - ISABELLE 23/08/2009 12:28.2.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.255.141 [GMT 2:00]
Running from: c:\documents and settings\ISABELLE\Bureau\Isabelle.exe
Command switches used :: c:\documents and settings\ISABELLE\Bureau\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\windows\Temp\_ex-08.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\13049184
c:\documents and settings\All Users\Application Data\13049184\13049184
c:\documents and settings\All Users\Application Data\13049184\13049184.exe
c:\documents and settings\All Users\Application Data\13049184\pc13049184ins
c:\documents and settings\ISABELLE\Application Data\wiaserva.log
c:\windows\system32\drivers\15e5e44e.sys
c:\windows\system32\drivers\247408b0.sys
c:\windows\Temp\_ex-08.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_15e5e44e
-------\Service_247408b0

((((((((((((((((((((((((( Files Created from 2009-07-23 to 2009-08-23 )))))))))))))))))))))))))))))))
.

2009-08-22 21:16 . 2009-08-22 21:16 -------- d-----w- C:\_OTL
2009-08-22 20:37 . 2009-08-22 20:40 -------- d-----w- C:\Kill'em
2009-08-22 12:05 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-01 15:41 . 2009-08-01 16:14 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-08-01 15:41 . 2009-08-01 16:14 -------- d-----w- c:\program files\NOS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-23 10:55 . 2009-08-23 10:46 92544 ----a-w- c:\windows\system32\drivers\37c3efe9.sys
2009-08-23 10:47 . 2009-08-23 10:46 -------- d-----w- c:\documents and settings\All Users\Application Data\14520604
2009-08-23 10:46 . 2009-08-23 10:46 699936 ----a-w- c:\documents and settings\All Users\Application Data\14520604\14520604.exe
2009-08-06 17:59 . 2004-08-11 14:47 -------- d-----w- c:\documents and settings\ISABELLE\Application Data\MSN6
2009-08-01 16:02 . 2005-04-05 16:08 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-06-29 15:57 . 2004-12-07 18:17 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 15:57 . 2004-08-19 23:09 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-29 15:57 . 2002-08-30 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-06-16 14:40 . 2002-08-30 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2002-08-30 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-06 18:22 . 2009-06-06 18:22 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\lsdelete.exe
2009-06-06 18:22 . 2009-05-07 21:43 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-06-06 18:21 . 2009-06-06 18:21 64160 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Drivers\32\lbd.sys
2009-06-06 18:21 . 2009-05-07 20:32 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-03 19:10 . 2002-08-30 12:00 1297408 ----a-w- c:\windows\system32\quartz.dll
2008-12-16 18:12 . 2005-05-23 15:32 186170 ------r- c:\program files\Fichiers communs\capesnpn.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-08-22_22.59.09 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-23 10:45 . 2009-08-23 10:45 11264 c:\windows\temp\wpv731250826839.exe
+ 2009-08-23 10:45 . 2009-08-23 10:45 154790 c:\windows\temp\wpv621250563654.exe
+ 2009-08-23 10:45 . 2009-08-23 10:45 194022 c:\windows\temp\wpv181250847886.exe
+ 2009-08-23 10:46 . 2009-08-23 10:46 401408 c:\windows\temp\_ex-08.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QSB"="c:\program files\Company\Quick Start Button\QSB.exe" [2002-03-08 548864]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" [X]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2002-12-12 1183744]
"AOLSAV"="c:\progra~1\TECHCI~1\AOLSAV\AOLAgent.exe" [2004-11-10 80384]
"AOLDialer"="c:\program files\Fichiers communs\AOL\ACS\AOLDial.exe" [2004-04-08 496752]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-06-02 98304]
"XCSyncML"="c:\windows\system32\XCSyncML.exe" [2005-07-14 135168]
"HostManager"="c:\program files\Fichiers communs\AOL\1132762218\ee\AOLSoftware.exe" [2006-06-23 50760]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2006-11-06 26112]
"VadeRetro Outlook"="c:\program files\Goto Software\Vade Retro\VrMoRegister.exe" [2008-02-20 87552]
"VadeRetro Desktop"="c:\program files\Goto Software\Vade Retro\Vaderetro_Mgr.exe" [2008-04-10 1054208]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-07-31 520024]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"PromoReg"="c:\windows\Temp\_ex-08.exe" [2009-08-23 401408]
"14520604"="c:\documents and settings\All Users\Application Data\14520604\14520604.exe" [2009-08-23 699936]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2002-09-21 372736]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\ISABELLE\Menu D‚marrer\Programmes\D‚marrage\
ikowin32.exe [2008-4-14 30208]
Outil de notification Live Search.lnk - c:\documents and settings\ISABELLE\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe [2008-10-4 143360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"c:\\Program Files\\NEC\\NEC Mobile Suite\\CommsService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\Temp\\_ex-08.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list]
"80:TCP"= 80:TCP:Promo
"53:UDP"= 53:UDP:Promo
.
Contents of the 'Scheduled Tasks' folder

2009-08-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 08:45]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.fr/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://search.scourweb.net/nph-search.cgi?partner=wesb1&look=sbar1_srchbtn
uSearchURL,(Default) = hxxp://search.scourweb.net/nph-search.cgi?partner=wesrch1&look=stmpl1&kw=
IE: &Recherche AOL Toolbar - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: teleir_cert - hxxps://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} - hxxp://mypixmania.com/fr/fr/importer/MypixUploader.cab
DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} - hxxp://www.mypixmania.com/fr/fr/tools/activex/fpu.cab
DPF: {8EC69950-F299-40AC-A004-3BF5176F8F7B} - hxxp://www.checkspy.com/fr/FlowScan.cab
FF - ProfilePath - c:\documents and settings\ISABELLE\Application Data\Mozilla\Firefox\Profiles\scxm4ucd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA2&q=
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-23 12:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AOLSAV = c:\progra~1\TECHCI~1\AOLSAV\AOLAgent.exe?exe???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\37c3efe9]
"ImagePath"="\SystemRoot\System32\drivers\37c3efe9.sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3040)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\AAWService.exe
c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\slserv.exe
c:\windows\wanmpsvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\program files\Fichiers communs\AOL\1132762218\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
c:\documents and settings\ISABELLE\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
.
**************************************************************************
.
Completion time: 2009-08-23 13:11 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-23 11:11
ComboFix2.txt 2009-08-22 23:24

Pre-Run: 27 733 327 872 octets libres
Post-Run: 27 718 152 192 octets libres

169 --- E O F --- 2009-07-29 09:10

__________________________________________________________
=>/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement cet ordinateur,<=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=====|
---------------------------------------------------------------

Toujours avec toutes les protections désactivées, fais ceci :

▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

----------------------------------------------------------
KillAll::

Collet::[4]
c:\windows\system32\drivers\37c3efe9.sys
c:\windows\temp\wpv731250826839.exe
c:\windows\temp\wpv621250563654.exe
c:\windows\temp\wpv181250847886.exe

File::
c:\windows\temp\_ex-08.exe
c:\documents and settings\ISABELLE\Menu D‚marrer\Programmes\D‚marrage\ikowin32.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PromoReg"=-
"14520604"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"c:\WINDOWS\Temp\_ex-08.exe"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list]
"80:TCP"=-
"53:UDP"=-

Folder::
c:\documents and settings\All Users\Application Data\14520604

Driver::
37c3efe9

Rootkit::
c:\windows\system32\drivers\37c3efe9.sys
------------------------------------------------------------------

▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
▶ Quitte le Bloc Notes

▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) Comme ceci

▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

Voilà le nouveau rapport. Par contre petite précision pour info (au cas où), avant la réalisation du rapport par Combofix, mon PC redémarre...

ComboFix 09-08-22.06 - ISABELLE 23/08/2009 14:07.3.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.255.135 [GMT 2:00]
Running from: c:\documents and settings\ISABELLE\Bureau\Isabelle.exe
Command switches used :: c:\documents and settings\ISABELLE\Bureau\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\documents and settings\ISABELLE\Menu D‚marrer\Programmes\D‚marrage\ikowin32.exe"
"c:\windows\temp\_ex-08.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\14520604
c:\documents and settings\All Users\Application Data\14520604\14520604
c:\documents and settings\All Users\Application Data\14520604\14520604.exe
c:\documents and settings\All Users\Application Data\14520604\pc14520604ins
c:\documents and settings\ISABELLE\Application Data\wiaserva.log
c:\windows\temp\_ex-08.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_37c3efe9

((((((((((((((((((((((((( Files Created from 2009-07-23 to 2009-08-23 )))))))))))))))))))))))))))))))
.

2009-08-22 21:16 . 2009-08-22 21:16 -------- d-----w- C:\_OTL
2009-08-22 20:37 . 2009-08-22 20:40 -------- d-----w- C:\Kill'em
2009-08-22 12:05 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-01 15:41 . 2009-08-01 16:14 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-08-01 15:41 . 2009-08-01 16:14 -------- d-----w- c:\program files\NOS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-23 12:31 . 2009-08-23 12:24 92544 ----a-w- c:\windows\system32\drivers\1251733c.sys
2009-08-23 12:24 . 2009-08-23 12:23 -------- d-----w- c:\documents and settings\All Users\Application Data\14148764
2009-08-23 12:23 . 2009-08-23 12:23 699936 ----a-w- c:\documents and settings\All Users\Application Data\14148764\14148764.exe
2009-08-06 17:59 . 2004-08-11 14:47 -------- d-----w- c:\documents and settings\ISABELLE\Application Data\MSN6
2009-08-01 16:02 . 2005-04-05 16:08 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-06-29 15:57 . 2004-12-07 18:17 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 15:57 . 2004-08-19 23:09 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-29 15:57 . 2002-08-30 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-06-16 14:40 . 2002-08-30 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2002-08-30 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-06 18:22 . 2009-06-06 18:22 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\lsdelete.exe
2009-06-06 18:22 . 2009-05-07 21:43 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-06-06 18:21 . 2009-06-06 18:21 64160 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Drivers\32\lbd.sys
2009-06-06 18:21 . 2009-05-07 20:32 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-03 19:10 . 2002-08-30 12:00 1297408 ----a-w- c:\windows\system32\quartz.dll
2008-12-16 18:12 . 2005-05-23 15:32 186170 ------r- c:\program files\Fichiers communs\capesnpn.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-08-22_22.59.09 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-23 12:23 . 2009-08-23 12:23 11264 c:\windows\temp\wpv161250826839.exe
+ 2009-08-23 12:23 . 2009-08-23 12:23 154790 c:\windows\temp\wpv971250563654.exe
+ 2009-08-23 12:23 . 2009-08-23 12:23 194022 c:\windows\temp\wpv181250847886.exe
+ 2009-08-23 12:24 . 2009-08-23 12:24 511488 c:\windows\temp\_ex-08.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QSB"="c:\program files\Company\Quick Start Button\QSB.exe" [2002-03-08 548864]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" [X]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2002-12-12 1183744]
"AOLSAV"="c:\progra~1\TECHCI~1\AOLSAV\AOLAgent.exe" [2004-11-10 80384]
"AOLDialer"="c:\program files\Fichiers communs\AOL\ACS\AOLDial.exe" [2004-04-08 496752]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-06-02 98304]
"XCSyncML"="c:\windows\system32\XCSyncML.exe" [2005-07-14 135168]
"HostManager"="c:\program files\Fichiers communs\AOL\1132762218\ee\AOLSoftware.exe" [2006-06-23 50760]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2006-11-06 26112]
"VadeRetro Outlook"="c:\program files\Goto Software\Vade Retro\VrMoRegister.exe" [2008-02-20 87552]
"VadeRetro Desktop"="c:\program files\Goto Software\Vade Retro\Vaderetro_Mgr.exe" [2008-04-10 1054208]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-07-31 520024]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"PromoReg"="c:\windows\Temp\_ex-08.exe" [2009-08-23 511488]
"14148764"="c:\documents and settings\All Users\Application Data\14148764\14148764.exe" [2009-08-23 699936]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2002-09-21 372736]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\ISABELLE\Menu D‚marrer\Programmes\D‚marrage\
ikowin32.exe [2008-4-14 30208]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"c:\\Program Files\\NEC\\NEC Mobile Suite\\CommsService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\Temp\\_ex-08.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list]
"80:TCP"= 80:TCP:Promo
"53:UDP"= 53:UDP:Promo
.
Contents of the 'Scheduled Tasks' folder

2009-08-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 08:45]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.fr/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://search.scourweb.net/nph-search.cgi?partner=wesb1&look=sbar1_srchbtn
uSearchURL,(Default) = hxxp://search.scourweb.net/nph-search.cgi?partner=wesrch1&look=stmpl1&kw=
IE: &Recherche AOL Toolbar - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: teleir_cert - hxxps://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} - hxxp://mypixmania.com/fr/fr/importer/MypixUploader.cab
DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} - hxxp://www.mypixmania.com/fr/fr/tools/activex/fpu.cab
DPF: {8EC69950-F299-40AC-A004-3BF5176F8F7B} - hxxp://www.checkspy.com/fr/FlowScan.cab
FF - ProfilePath - c:\documents and settings\ISABELLE\Application Data\Mozilla\Firefox\Profiles\scxm4ucd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA2&q=
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-23 14:20
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AOLSAV = c:\progra~1\TECHCI~1\AOLSAV\AOLAgent.exe?exe???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

c:\docume~1\ISABELLE\LOCALS~1\Temp\00446011.cmd 174 bytes

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\1251733c]
"ImagePath"="\SystemRoot\System32\drivers\1251733c.sys"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BITS\Security]
@DACL=(02 0000)
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1240)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\AAWService.exe
c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\slserv.exe
c:\windows\wanmpsvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\program files\Fichiers communs\AOL\1132762218\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
c:\documents and settings\ISABELLE\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
c:\documents and settings\ISABELLE\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
.
**************************************************************************
.
Completion time: 2009-08-23 14:47 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-23 12:47
ComboFix2.txt 2009-08-23 11:11
ComboFix3.txt 2009-08-22 23:24

Pre-Run: 27 721 879 552 octets libres
Post-Run: 27 706 019 840 octets libres

175 --- E O F --- 2009-07-29 09:10

as tu la possibilité de supprimer ceci :

c:\documents and settings\ISABELLE\LOCAL Settings\Temp\00446011.cmd

??

Non ; je n'ai pas ce fichier dans ce répertoire