Pas de possibilitée pour enlever save defense

Bonjour,

Tu vas télécharger ComBoFix et enregistre le sur ton bureau ( important pour la suite )
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

# Désactive les protections résidentes de ton ordinateur ( antivirus, antispyware et parefeu )
# Branche tes différents supports amovibles ( clés USB, disque dur externe ) sans les ouvrir.

# Lance Combofix.exe et suis les invites.
# Il te sera demandé d’installer la console de récupération.
Important. Fais le absolument.

Il est possible que ComBoFix redémarre l’ordinateur pour supprimer certains fichiers.

# Une fois le scan fini, un rapport va apparaitre.

Copie/colle ce rapport dans ta prochaine réponse.

Note : Si tu ne le trouves pas, il est à C:\ComboFix.txt.

A+

ComboFix 09-08-29.01 - le bucheron 30/08/2009 11:12.1.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3062.1740 [GMT 2:00]
Running from: c:\users\le bucheron\Desktop\ComboFix.exe
AV: Antivirus BitDefender *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
SP: BitDefender AntiSpam *enabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2037928779-3974962898-245950913-500
c:\windows\10039not-5-vzrus465.bin
c:\windows\10685w9zm450.cpl
c:\windows\108zv9rus457.exe
c:\windows\1154not59-vzrus69a.bin
c:\windows\1175495rm4z8.bin
c:\windows\1195vizus3db.dll
c:\windows\12184t5o975z.bin
c:\windows\1222hacktool95z.ocx
c:\windows\1254addw95e22z4.exe
c:\windows\12591sp5mz9t2d.cpl
c:\windows\128not9a-virusz57.bin
c:\windows\12917not5a-vizuseb9.bin
c:\windows\12958v5rzs189.exe
c:\windows\13011spa5bot92z.cpl
c:\windows\131z795cktool67a.bin
c:\windows\13551w9rm21z.exe
c:\windows\1361zwor5c29.exe
c:\windows\13805spzmbot5099.dll
c:\windows\13z305acktool9e3.dll
c:\windows\13z595ot-a-virus574.cpl
c:\windows\141zs5yware1958.ocx
c:\windows\14c95own9oader3142z.bin
c:\windows\1534sparsz28719.ocx
c:\windows\15413wormzfa9.cpl
c:\windows\15434not-a-v9rus58z.cpl
c:\windows\1563v5rzs597.bin
c:\windows\1584zspambo5490.ocx
c:\windows\15885virusz1c9.bin
c:\windows\15920not-a-v5ruz64a.bin
c:\windows\15949t59j24z.ocx
c:\windows\15956trojz97.dll
c:\windows\166z9h9ckt5ol32c.exe
c:\windows\16783spa5bzt9e.ocx
c:\windows\16c4ad5war97z7.ocx
c:\windows\17358wz9m6ca.ocx
c:\windows\17916t9oj5az5.cpl
c:\windows\17933spambot98z5.bin
c:\windows\181505pa9bot1z9.exe
c:\windows\187589ot-a-zirus152.exe
c:\windows\189269roz615.ocx
c:\windows\18959szy58b.dll
c:\windows\18d5pywarez093.bin
c:\windows\1915baczdoor9448.dll
c:\windows\1931troj6z59.bin
c:\windows\19919not-a-virzs755.ocx
c:\windows\19d4zackdoor5795.ocx
c:\windows\19z41ha9ktoo5399.cpl
c:\windows\1a2895r159z.bin
c:\windows\1c07spywar59z13.cpl
c:\windows\1c379pyware32z15.cpl
c:\windows\1cb7threa91z052.exe
c:\windows\1d2cba5kdoorz595.dll
c:\windows\1de2sparz92596.ocx
c:\windows\1efezdd9are1625.dll
c:\windows\1fz5vir9598.bin
c:\windows\1z059hackto5l199.cpl
c:\windows\1z675tro5979.exe
c:\windows\1z692wor5619.exe
c:\windows\1z8c9hrea5580.cpl
c:\windows\1z94troj759.exe
c:\windows\209395i9zs697.cpl
c:\windows\211835pz319.exe
c:\windows\217035ackto9z664.ocx
c:\windows\2195hack5ooz689.dll
c:\windows\219zs9ar5e719.exe
c:\windows\21e859ief1z46.bin
c:\windows\21z29n5t-a-virus364.cpl
c:\windows\22539zi5us3ce.ocx
c:\windows\23496not-a-v5rus4ez.ocx
c:\windows\23558v5rus19z.exe
c:\windows\23566nz9-a-virus609.ocx
c:\windows\235bsz9rse3032.ocx
c:\windows\23fbt9ie51z12.ocx
c:\windows\244zot-5-v9rus365.ocx
c:\windows\245zot-a9v5rus165.bin
c:\windows\251819izus7df.exe
c:\windows\25198worz555.exe
c:\windows\25568no9za-v5rus4f1.cpl
c:\windows\256259arsz636.cpl
c:\windows\25692zot-a-9irus665.bin
c:\windows\25806sza5bot429.cpl
c:\windows\25915hacktoolzc0.cpl
c:\windows\25921zo9m5f5.dll
c:\windows\2599tzoj75a.bin
c:\windows\25z09spy9e2.bin
c:\windows\25z9worm17a.bin
c:\windows\26690s9amzot4fb5.ocx
c:\windows\26779zro539.cpl
c:\windows\26ddvirz599.dll
c:\windows\26z59sp971c.exe
c:\windows\2717z5ackt9ol47.exe
c:\windows\27415vz9us375.cpl
c:\windows\275169ot-a-virzs68a.cpl
c:\windows\27958troj589z.dll
c:\windows\27968troj95z.cpl
c:\windows\28191zirus645.cpl
c:\windows\2835znot-a-viru94a1.bin
c:\windows\2840downl9ad5z2030.dll
c:\windows\28499v5rus10z.exe
c:\windows\28acthizf9995.cpl
c:\windows\28zfbackdo9r1500.exe
c:\windows\2910spz1859.cpl
c:\windows\292z9ha5ktool317.exe
c:\windows\29357vi95sz13.bin
c:\windows\293z2sp9mbo5194.cpl
c:\windows\29559worz4b9.cpl
c:\windows\295z4troj966.ocx
c:\windows\295zspyware3050.cpl
c:\windows\29869s5yzf7.exe
c:\windows\2992spy555z.dll
c:\windows\29d2d5znloader243.ocx
c:\windows\2c03backdooz25095.bin
c:\windows\2c03dow5zoader9104.cpl
c:\windows\2c0add95re497z.ocx
c:\windows\2c485ownloa9ez1705.bin
c:\windows\2c95vir1z09.exe
c:\windows\2d09spar5z2760.exe
c:\windows\2e19zpyware2995.bin
c:\windows\2ed5thiez32479.ocx
c:\windows\2fc9sp5zare9031.cpl
c:\windows\2z1259roj4ac5.ocx
c:\windows\2z171t9o540d.ocx
c:\windows\2z7055orm936.dll
c:\windows\302895ackto9l60z.dll
c:\windows\3079zt9oj445.ocx
c:\windows\30fdbaczdoo59189.exe
c:\windows\31140vir9522z.bin
c:\windows\31z19tr9j3565.dll
c:\windows\3231backdozr5394.exe
c:\windows\32325spambzt5bd9.cpl
c:\windows\3235zvir9591.bin
c:\windows\3469viruzd5.exe
c:\windows\3541th9eat116z8.bin
c:\windows\3559vzr2169.cpl
c:\windows\356b9ownlzader1694.ocx
c:\windows\3579ownloade51380z.exe
c:\windows\35838wz9m245.bin
c:\windows\3585not-azv9rusb5.exe
c:\windows\3593addwarez8815.dll
c:\windows\3593doznloade92108.bin
c:\windows\35db9ackd5zr392.exe
c:\windows\36a8viz23559.ocx
c:\windows\37069py58z5.bin
c:\windows\3714spyw95z2950.bin
c:\windows\3b39backdoo5169z.ocx
c:\windows\3b59sparse1909z.bin
c:\windows\3b5eadd9are1816z.ocx
c:\windows\3cat9iez24505.cpl
c:\windows\3cd5a9dwarz2025.exe
c:\windows\3cdz9pyware1659.dll
c:\windows\3efcszy5are30749.bin
c:\windows\3fe059iez2129.exe
c:\windows\3ff659reat86z0.ocx
c:\windows\3z24v9r485.ocx
c:\windows\3z586v5rus7c9.exe
c:\windows\3z635t9oj419.cpl
c:\windows\402f9teaz557.ocx
c:\windows\41495pyzare1978.bin
c:\windows\418czackdo9r5375.cpl
c:\windows\41d4sp9w5re3181z.bin
c:\windows\41z75hief9147.bin
c:\windows\42439hreat326z25.bin
c:\windows\42b7b5ckdooz22749.exe
c:\windows\4305thr5zt29899.exe
c:\windows\4314ziru95ac.cpl
c:\windows\4381s5z9a2.dll
c:\windows\4404thzef5990.bin
c:\windows\44a5zhre9t27530.dll
c:\windows\44bdt5zeat9269.exe
c:\windows\454z9hreat2263.bin
c:\windows\4576no9-a-vi5us2b0z.dll
c:\windows\45c6d5znload9r1710.cpl
c:\windows\45devzr9575.bin
c:\windows\4633s5ambo945fz.bin
c:\windows\4a6athr5az33299.cpl
c:\windows\4a9esparse597z.dll
c:\windows\4acaspyw9rez553.exe
c:\windows\4az6addw95e987.cpl
c:\windows\4bbzdow5loader3099.bin
c:\windows\4bbzthr9at78825.bin
c:\windows\4c49backdooz15275.exe
c:\windows\4c5fspywaze1497.cpl
c:\windows\4c5spywzr91424.dll
c:\windows\4ca5spy5a9ez489.ocx
c:\windows\4debaddw95e19z3.dll
c:\windows\4e32vir3z95.dll
c:\windows\4fzf9parse965.exe
c:\windows\4z19vir11975.ocx
c:\windows\505zdownl9ader2640.bin
c:\windows\50e8bazkdoor4095.exe
c:\windows\50z2downloader9564.ocx
c:\windows\512z0spy1ed9.dll
c:\windows\5148zs9ambot7d5.bin
c:\windows\51be5t9al169z.ocx
c:\windows\51e95pywzre2733.cpl
c:\windows\51fcdo9nzoader2874.exe
c:\windows\52z2virus591.exe
c:\windows\53079t5al1z19.exe
c:\windows\534299orm20z.exe
c:\windows\53579virzs6e49.ocx
c:\windows\539bdownloadzr32265.bin
c:\windows\53zes9arse490.bin
c:\windows\54370hackt9zl1b1.exe
c:\windows\5457vir9z2b6.cpl
c:\windows\54z99spambot2a0.cpl
c:\windows\55057spamb9t3bz.cpl
c:\windows\55541szy9db.ocx
c:\windows\5569spz1f1.bin
c:\windows\5595backdzo93191.dll
c:\windows\5598tzreat14665.ocx
c:\windows\55a59teaz3149.exe
c:\windows\55abthreat251z89.dll
c:\windows\55addw9re2885z.cpl
c:\windows\55c6dow9loadzr5398.bin
c:\windows\55zbspyware895.dll
c:\windows\5642zworm4b39.bin
c:\windows\5655z5dwar965.ocx
c:\windows\5677t9oj5a0z.ocx
c:\windows\5699addware1z97.exe
c:\windows\578dadd9are3z58.ocx
c:\windows\57988virusz15.dll
c:\windows\57deba9kdoor1190z.cpl
c:\windows\57z1not-a9v5rus4d1.exe
c:\windows\5828trz9572.cpl
c:\windows\582fs9ezl1452.ocx
c:\windows\58339not-a-viruz756.ocx
c:\windows\58abz5ars91108.cpl
c:\windows\590espazse517.cpl
c:\windows\59129zpy784.exe
c:\windows\59165parse1z2.dll
c:\windows\59248spambot1bz.exe
c:\windows\59269tzoj59.ocx
c:\windows\592z89irus71d.dll
c:\windows\5939tzief26545.cpl
c:\windows\5959download5r1z31.dll
c:\windows\596zvi5479.exe
c:\windows\5976noz-a-vir9s6a0.exe
c:\windows\59b9sparsz2244.ocx
c:\windows\59bbstea92z98.cpl
c:\windows\59des9azs51900.bin
c:\windows\59f9vir1z79.ocx
c:\windows\59fa5hiez55.dll
c:\windows\5c38zpywar93259.ocx
c:\windows\5dd5sparz91942.dll
c:\windows\5e97thzeat19839.exe
c:\windows\5f08z5ckdoor26029.dll
c:\windows\5fb7tzr9at18395.cpl
c:\windows\5fbste9z55.bin
c:\windows\5z01spy30d9.ocx
c:\windows\5z957worm99.ocx
c:\windows\60a8zpy9are5579.dll
c:\windows\6243dowzloa5e91859.bin
c:\windows\625edownloader99z5.exe
c:\windows\626spamb592az.ocx
c:\windows\6275p999z.ocx
c:\windows\629595y495z.bin
c:\windows\64d459zrse1897.bin
c:\windows\65f5b5zkd9or1543.dll
c:\windows\6795wor96z8.exe
c:\windows\69715zr547.cpl
c:\windows\6993hacktoo532z.cpl
c:\windows\69bfdownzo5der600.bin
c:\windows\69d5d95nloadez797.bin
c:\windows\69z8v5r377.cpl
c:\windows\6c54thief9750z.dll
c:\windows\6d00sparze98255.bin
c:\windows\6d29spywar5z59.exe
c:\windows\6z14thief29905.ocx
c:\windows\6z95threat25808.cpl
c:\windows\70559ownloader168z.ocx
c:\windows\70769i5us60z.cpl
c:\windows\709adzwa5e8099.dll
c:\windows\7135th95fz900.dll
c:\windows\7249spazbot5ae.exe
c:\windows\72b9sp95arz1907.ocx
c:\windows\72fz9ddw5re1431.dll
c:\windows\72z9spyware2535.ocx
c:\windows\739ddow59oazer3190.dll
c:\windows\74b8spar9e25z6.dll
c:\windows\752bdow5l9aderz4.exe
c:\windows\757d9wnlo5dzr2845.bin
c:\windows\75f9d5wnloader3z69.cpl
c:\windows\765z9hief2152.ocx
c:\windows\7767zr95564.dll
c:\windows\7862z9y257.exe
c:\windows\7982virus52z.bin
c:\windows\79f9ztea52729.ocx
c:\windows\79v5r1495z.ocx
c:\windows\79z8spywar5623.bin
c:\windows\7a5et9iez2100.dll
c:\windows\7b9caddwa9e18z55.dll
c:\windows\7cz2download9r1357.ocx
c:\windows\7d50backdzo5399.exe
c:\windows\7dzbackdo9r5911.dll
c:\windows\7e72sp9w5rez502.bin
c:\windows\7f99spa5ze9511.dll
c:\windows\7z35hief9216.ocx
c:\windows\7z93t5ief1330.bin
c:\windows\7za9b9c5door3240.dll
c:\windows\8372n95-a-vizus190.cpl
c:\windows\83ab9ckdoo5z105.cpl
c:\windows\87659rzj7a2.ocx
c:\windows\885backd5o91557z.bin
c:\windows\88z4spambo53d9.cpl
c:\windows\8945zp5980.ocx
c:\windows\90932not-a-vzrus635.dll
c:\windows\909aad5ware58z.exe
c:\windows\91497vz5us299.exe
c:\windows\915d5hreat14z56.ocx
c:\windows\915z6sp5441.exe
c:\windows\928fspywarez65.cpl
c:\windows\92943viruz95.exe
c:\windows\92avi5z359.exe
c:\windows\93911tzoj575.exe
c:\windows\9445szam9ot5e1.ocx
c:\windows\94660vizus554.exe
c:\windows\9542zvirus349.ocx
c:\windows\95553spy44z.exe
c:\windows\9557thiefz935.ocx
c:\windows\9560azdw5re890.ocx
c:\windows\95cc5hreatz8696.ocx
c:\windows\95fdthreat2245z.exe
c:\windows\9757spyware26z5.ocx
c:\windows\9771hzcktool615.ocx
c:\windows\97zdvir2155.ocx
c:\windows\98130vizus5c5.dll
c:\windows\9826s5z49a.bin
c:\windows\98a1spywarez539.cpl
c:\windows\99089pambot5z3.ocx
c:\windows\9940t95j7z0.bin
c:\windows\9989virus4za5.dll
c:\windows\9a945hief1651z.ocx
c:\windows\9a9es5ezl2919.dll
c:\windows\9bbfthreatz56235.exe
c:\windows\9d9cthr5at22159z.ocx
c:\windows\9e5fvir3175z.cpl
c:\windows\9f5fsteal4z1.ocx
c:\windows\9fbt5ief28z3.cpl
c:\windows\9z4bvir654.cpl
c:\windows\a88thre9t19z605.ocx
c:\windows\b6cd9wnlozde53016.exe
c:\windows\c41bzck9oor21725.ocx
c:\windows\c58sparsz2397.exe
c:\windows\c63spyz9re1571.exe
c:\windows\c9zdownload5r1175.cpl
c:\windows\ez85ir12929.dll
c:\windows\fc9b5ckdoor1z80.bin
c:\windows\system32\10391not-a-vir9z5fd.bin
c:\windows\system32\1042worm695z.exe
c:\windows\system32\10449tro5zac.dll
c:\windows\system32\10725hacktoo957dz.dll
c:\windows\system32\1135v9r2956z.cpl
c:\windows\system32\11699hacktoo92fz5.exe
c:\windows\system32\1189ad5wzre599.cpl
c:\windows\system32\12211vir5s9z7.exe
c:\windows\system32\124905ot-z-virus777.cpl
c:\windows\system32\12533viru95cez.dll
c:\windows\system32\12865viruz5ef9.dll
c:\windows\system32\12885spam95z1d3.cpl
c:\windows\system32\13989virusz5c9.dll
c:\windows\system32\1398spy3z5.exe
c:\windows\system32\13b7spyzare3975.exe
c:\windows\system32\14060hackt5oz4569.cpl
c:\windows\system32\147219za5botc8.exe
c:\windows\system32\14765hac5tz9l378.ocx
c:\windows\system32\14855not5a-vzrus9de.bin
c:\windows\system32\14z95worm392.bin
c:\windows\system32\150709orm454z.bin
c:\windows\system32\151bdoznloade92394.exe
c:\windows\system32\151z0sp9mbot6a8.bin
c:\windows\system32\1541zspambot9eb.dll
c:\windows\system32\15470spambot69z.cpl
c:\windows\system32\15526wzrm98c5.cpl
c:\windows\system32\155389izus193.exe
c:\windows\system32\1571sp9ware23z5.bin
c:\windows\system32\1589bzckdoor4095.dll
c:\windows\system32\15935trzj96d.exe
c:\windows\system32\159z8tro945e.exe
c:\windows\system32\15b5downloader79z9.exe
c:\windows\system32\16612sp9mbozf95.bin
c:\windows\system32\16763zpa59ot568.bin
c:\windows\system32\174fspyzare590.ocx
c:\windows\system32\180z6n5t-a-9irus131.dll
c:\windows\system32\18529szy659.ocx
c:\windows\system32\18755vzrus4fc9.cpl
c:\windows\system32\18z66tr9j3c75.ocx
c:\windows\system32\19063ha5ztool49b.ocx
c:\windows\system32\1906z9acktoo5329.ocx
c:\windows\system32\190z5ownloader1470.exe
c:\windows\system32\1911not9a-ziru559c.exe
c:\windows\system32\19144vir9sz5f.bin
c:\windows\system32\1915addware93z25.cpl
c:\windows\system32\191995acktool15bz.exe
c:\windows\system32\19516woz54ed.exe
c:\windows\system32\19552vi9us54z.ocx
c:\windows\system32\19793za5kto9l226.cpl
c:\windows\system32\1979tzief22455.ocx
c:\windows\system32\19822hacktool52z9.ocx
c:\windows\system32\198zno5-a-virus13a.exe
c:\windows\system32\19939zroj59.ocx
c:\windows\system32\19965szy1c9.dll
c:\windows\system32\199z4s9y145.bin
c:\windows\system32\19c8d5znloader2337.exe
c:\windows\system32\19f5zddware13029.ocx
c:\windows\system32\1b3av9z458.bin
c:\windows\system32\1c62spyw5r9132z.cpl
c:\windows\system32\1e7dthrzat5922.bin
c:\windows\system32\1f7dsp9rs5448z.bin
c:\windows\system32\1z045hac9tool518.cpl
c:\windows\system32\1z2589pambot580.exe
c:\windows\system32\1z493sp925.dll
c:\windows\system32\1z942s5am9ot2f3.ocx
c:\windows\system32\20285wzrm5569.exe
c:\windows\system32\20311z9rm52.exe
c:\windows\system32\2094zvirus539.cpl
c:\windows\system32\20z73s9y575.cpl
c:\windows\system32\21306v59us73dz.ocx
c:\windows\system32\2137hac9zoo5f.bin
c:\windows\system32\218z9hackto5l47a.dll
c:\windows\system32\21z89hackto5l5d0.cpl
c:\windows\system32\22095zir9s501.ocx
c:\windows\system32\223z5pywar92425.bin
c:\windows\system32\2295tzreat4396.dll
c:\windows\system32\22d9szarse20599.cpl
c:\windows\system32\22z669i5us75.ocx
c:\windows\system32\2309z9r5j3fb.dll
c:\windows\system32\2369do5nlzader3915.bin
c:\windows\system32\23825not-9-virusz8f.bin
c:\windows\system32\24095rojz21.exe
c:\windows\system32\24537spz9aa.bin
c:\windows\system32\24881not5a-vzrus95.ocx
c:\windows\system32\25095troj4c3z.ocx
c:\windows\system32\25194vzrus595.dll
c:\windows\system32\2520ztroj99c.cpl
c:\windows\system32\2555w9rm2az.cpl
c:\windows\system32\25645virusz379.dll
c:\windows\system32\256ba5k9oor244z.bin
c:\windows\system32\2582steaz2791.ocx
c:\windows\system32\26269h9ck5ooz3c8.exe
c:\windows\system32\26369zp55c2.ocx
c:\windows\system32\26392hacktoz92ee5.exe
c:\windows\system32\26550notza9virus731.bin
c:\windows\system32\271945ot-a-virus45fz.bin
c:\windows\system32\27610wor97z5.dll
c:\windows\system32\27906hack5ozl663.bin
c:\windows\system32\27f89zyw5re1593.ocx
c:\windows\system32\28045not5a-vizu937f.exe
c:\windows\system32\28276troj7z59.ocx
c:\windows\system32\28598worm23z.bin
c:\windows\system32\28665not-a-9zrus595.exe
c:\windows\system32\28680no5-a-9iruszb3.bin
c:\windows\system32\28964spam95tz00.bin
c:\windows\system32\28z12n5t-a9virus506.dll
c:\windows\system32\29090nz5-a-virus29d.exe
c:\windows\system32\29227sp5mbzt63d.dll
c:\windows\system32\29259viruz557.exe
c:\windows\system32\2925spaz5e101.exe
c:\windows\system32\2939viz3552.exe
c:\windows\system32\29428tzo52b9.exe
c:\windows\system32\29589spambotz61.ocx
c:\windows\system32\2993zorm7795.cpl
c:\windows\system32\29942w5rz22a.exe
c:\windows\system32\2ac6sparsz2955.cpl
c:\windows\system32\2b3f9iz2579.exe
c:\windows\system32\2b66backd5o9z95.exe
c:\windows\system32\2b6fb5ckdzo9114.bin
c:\windows\system32\2cezv95752.bin
c:\windows\system32\2d05dowzload9r3203.dll
c:\windows\system32\2f599pyzare2366.bin
c:\windows\system32\2z939spambot5ae.cpl
c:\windows\system32\2z9abackdoo5389.dll
c:\windows\system32\2z9spa5se2139.exe
c:\windows\system32\30769zr5j9ce.exe
c:\windows\system32\30920h5cktoz97df.bin
c:\windows\system32\31008not-a-viruz592.ocx
c:\windows\system32\31568hack9ozl254.cpl
c:\windows\system32\31995trzjc15.cpl
c:\windows\system32\32199vi5us6z3.cpl
c:\windows\system32\342fad5wzre2906.bin
c:\windows\system32\34a8sz5war9347.exe
c:\windows\system32\350dza5k9oor405.bin
c:\windows\system32\35edvzr20499.ocx
c:\windows\system32\35z9ir20545.dll
c:\windows\system32\389bthreatz0855.exe
c:\windows\system32\3929virzs65f.ocx
c:\windows\system32\3999vir53z.exe
c:\windows\system32\39c6zt9al185.exe
c:\windows\system32\3b55zhief2592.dll
c:\windows\system32\3b99backdzor3522.ocx
c:\windows\system32\3cf7spz9ar5353.cpl
c:\windows\system32\3dd9addw5rez883.bin
c:\windows\system32\3fc5t9ze52573.bin
c:\windows\system32\407dzpyware98955.exe
c:\windows\system32\4173spa9zot6585.cpl
c:\windows\system32\4194zir1495.dll
c:\windows\system32\430zhac5tool990.exe
c:\windows\system32\438sparz5589.ocx
c:\windows\system32\43a5thzef16949.ocx
c:\windows\system32\4465bzck9oor3257.bin
c:\windows\system32\4493zddw5re208.ocx
c:\windows\system32\456bt9izf3159.cpl
c:\windows\system32\4713ste9z5690.bin
c:\windows\system32\47dz5t9al1786.cpl
c:\windows\system32\47f4azdwa9e5312.bin
c:\windows\system32\47zdb9ckdoor1425.exe
c:\windows\system32\484fba9kdzor375.cpl
c:\windows\system32\4934spywa5z1999.bin
c:\windows\system32\493csp5rs9z343.exe
c:\windows\system32\4952thzef10.dll
c:\windows\system32\4988add9ar5218z.exe
c:\windows\system32\499zwo5m4b7.exe
c:\windows\system32\49c8th5ezt10401.cpl
c:\windows\system32\49zstea53205.bin
c:\windows\system32\4aczsteal7935.ocx
c:\windows\system32\4ba05ackdo9r8z0.ocx
c:\windows\system32\4d3d5zeal16369.bin
c:\windows\system32\4d5fz9r1190.exe
c:\windows\system32\4e50thr9at17885z.bin
c:\windows\system32\4z195py72e.exe
c:\windows\system32\500not-azvirus4e9.ocx
c:\windows\system32\5054thzeat9429.cpl
c:\windows\system32\50667wozm259.ocx
c:\windows\system32\509zorm79.exe
c:\windows\system32\50b8th9ez2722.cpl
c:\windows\system32\51c9th9eat5842z.bin
c:\windows\system32\5363ad9ware2405z.exe
c:\windows\system32\53d0thr9z519681.ocx
c:\windows\system32\5435dzwn9oader3189.dll
c:\windows\system32\543z9not-9-virus40e.exe
c:\windows\system32\5501spywarz1922.exe
c:\windows\system32\5527hackzoo91b9.bin
c:\windows\system32\554thre9tz4862.cpl
c:\windows\system32\5551spazs91359.bin
c:\windows\system32\5558stealz495.exe
c:\windows\system32\558az9ckd5or1278.dll
c:\windows\system32\559369pamboz6b4.ocx
c:\windows\system32\5595szarse3115.exe
c:\windows\system32\5599troj53z.cpl
c:\windows\system32\563179izus55.bin
c:\windows\system32\5692worm516z.cpl
c:\windows\system32\56bdoznload5r1981.dll
c:\windows\system32\56zdbackdoo9759.dll
c:\windows\system32\58193worm6ez.bin
c:\windows\system32\5850tr9j4z7.bin
c:\windows\system32\585zspyware2509.bin
c:\windows\system32\5931z9roj7e0.bin
c:\windows\system32\5936zhacktool179.ocx
c:\windows\system32\593ztroj1e9.exe
c:\windows\system32\594zs9arse2055.cpl
c:\windows\system32\597zvir5144.ocx
c:\windows\system32\59azspyware976.dll
c:\windows\system32\59e8zpywar59139.ocx
c:\windows\system32\5acbviz5946.ocx
c:\windows\system32\5c99spyware2z35.ocx
c:\windows\system32\5d52thi9f9z7.exe
c:\windows\system32\5d88backdo5rz197.cpl
c:\windows\system32\5dz29ackdoor994.cpl
c:\windows\system32\5dze5ackd9or3010.dll
c:\windows\system32\5e6z9ir2904.exe
c:\windows\system32\5e8badd5z9e93.bin
c:\windows\system32\5eaad59arez806.exe
c:\windows\system32\5ee99hi5z2561.dll
c:\windows\system32\5fa7threat9z773.exe
c:\windows\system32\5z545spam9ot4c9.dll
c:\windows\system32\60b1back5oo92z71.exe
c:\windows\system32\60f5stzal1895.dll
c:\windows\system32\6137viz95750.ocx
c:\windows\system32\6160bac59oor1z44.exe
c:\windows\system32\6230s5yw9re934z.bin
c:\windows\system32\62bcthrz9t12509.dll
c:\windows\system32\62f6th5e9t9z03.exe
c:\windows\system32\6392sp5mbot5ze.bin
c:\windows\system32\6599zteal322.dll
c:\windows\system32\6629s5zrse896.exe
c:\windows\system32\662fzpy9are5531.dll
c:\windows\system32\665es5ar9ez121.ocx
c:\windows\system32\66a7zp5ware1479.bin
c:\windows\system32\673btzi59411.dll
c:\windows\system32\676zthr9at100935.ocx
c:\windows\system32\6775zhief28509.ocx
c:\windows\system32\693zspyw59e602.ocx
c:\windows\system32\6959v5ruz6c9.ocx
c:\windows\system32\695zthief1665.cpl
c:\windows\system32\6a61bz9kdoo52651.bin
c:\windows\system32\6a82v9r35z.bin
c:\windows\system32\6b6zvi5293.cpl
c:\windows\system32\6d99dzwnloade52839.dll
c:\windows\system32\6e179zdwar5859.ocx
c:\windows\system32\6e89addware589z.ocx
c:\windows\system32\6f9zdow5loader1959.bin
c:\windows\system32\6ff2backdo5z21799.exe
c:\windows\system32\6z12ba59door1063.exe
c:\windows\system32\708dt5rez931411.ocx
c:\windows\system32\70dzdow9l5ader2313.cpl
c:\windows\system32\7310th9e52z6.bin
c:\windows\system32\73a5addz9re985.ocx
c:\windows\system32\74d7do9nlozder1353.bin
c:\windows\system32\7526addwarz3975.cpl
c:\windows\system32\75b0steal1059z.ocx
c:\windows\system32\762w59m541z.cpl
c:\windows\system32\76b0spazs515369.ocx
c:\windows\system32\775dstezl291.bin
c:\windows\system32\7794sz5ware765.cpl
c:\windows\system32\789zthi5f25299.cpl
c:\windows\system32\78b9threa5z119.ocx
c:\windows\system32\790ezddw9r52469.cpl
c:\windows\system32\79c7thr5zt27945.dll
c:\windows\system32\79z29parse415.dll
c:\windows\system32\79z6addwar932345.ocx
c:\windows\system32\79z6threat11536.ocx
c:\windows\system32\7a47t95ezt9173.cpl
c:\windows\system32\7a49szeal1655.bin
c:\windows\system32\7aabvzr529.cpl
c:\windows\system32\7ac0do5nloader195z.dll
c:\windows\system32\7b45s9arsz26055.ocx
c:\windows\system32\7b9fspar5ez3.exe
c:\windows\system32\7ccbthrezt93589.exe
c:\windows\system32\7d90back9ooz5015.bin
c:\windows\system32\7ebzownloader23659.cpl
c:\windows\system32\7f1d59zrse596.exe
c:\windows\system32\7zdd5hief3539.ocx
c:\windows\system32\8096hackt9zl6565.dll
c:\windows\system32\809sp9rsez615.exe
c:\windows\system32\851zspy1e9.ocx
c:\windows\system32\8595not-a-viruz3e.cpl
c:\windows\system32\85z0sp5974.exe
c:\windows\system32\883zacktoo5e29.dll
c:\windows\system32\90573virus4z7.exe
c:\windows\system32\90838troj530z.bin
c:\windows\system32\908z6hac5tool1.exe
c:\windows\system32\914fsp5rse198z.ocx
c:\windows\system32\91vzr12195.ocx
c:\windows\system32\92196z5rma9.cpl
c:\windows\system32\9259worm1z9.exe
c:\windows\system32\92z55hacktool73.exe
c:\windows\system32\936ethiez30455.ocx
c:\windows\system32\9500spamb9t3d1z.dll
c:\windows\system32\956czir1050.dll
c:\windows\system32\95875ot-a-virus95z.ocx
c:\windows\system32\959adzware2026.bin
c:\windows\system32\9843s5ezl2806.dll
c:\windows\system32\99223spa5boz54e.dll
c:\windows\system32\993spamboz5d5.dll
c:\windows\system32\9975or969z.bin
c:\windows\system32\9b55i91508z.dll
c:\windows\system32\9f2fzte5l2290.bin
c:\windows\system32\9f325ackdoor2z.cpl
c:\windows\system32\9f8backdoorz591.exe
c:\windows\system32\9ffs9yware7z5.cpl
c:\windows\system32\9z77spyware235.cpl
c:\windows\system32\9z95s9y531.exe
c:\windows\system32\9zc9ste5l658.dll
c:\windows\system32\c5a5ownloader190z.dll
c:\windows\system32\d8cthrezt126519.bin
c:\windows\system32\da5thie99z0.exe
c:\windows\system32\ddthiefz975.bin
c:\windows\system32\e04bac5z9or912.cpl
c:\windows\system32\eba9z5al825.bin
c:\windows\system32\ebac95oor784z.ocx
c:\windows\system32\f25ba9kdoor1523z.cpl
c:\windows\system32\fb99ddwarz5020.dll
c:\windows\system32\s9hs3pwz.exe
c:\windows\system32\tmp.reg
c:\windows\system32\z03f5h9ef1700.ocx
c:\windows\system32\z098spamb9t56a.cpl
c:\windows\system32\z1490s9ambot50e.cpl
c:\windows\system32\z1948sp9mbot5fc.cpl
c:\windows\system32\z395th9ef2679.ocx
c:\windows\system32\z40795py91b.cpl
c:\windows\system32\z429addware556.ocx
c:\windows\system32\z4395not-a-v9rus140.cpl
c:\windows\system32\z46509roj592.cpl
c:\windows\system32\z4cathr95t22979.exe
c:\windows\system32\z5611s9y699.dll
c:\windows\system32\z592worm92.ocx
c:\windows\system32\z5c0threat57469.dll
c:\windows\system32\z7950worm399.cpl
c:\windows\system32\z830spa59e2737.dll
c:\windows\system32\z9350tr9519.dll
c:\windows\system32\z979vir1085.cpl
c:\windows\system32\z9e5back5oor860.cpl
c:\windows\system32\zbe6thr9at19561.exe
c:\windows\system32\zc39spyware9645.exe
c:\windows\system32\zd82spyware91995.ocx
c:\windows\system32\zec9thre5t91611.cpl
c:\windows\system32\zf3ste5l929.cpl
c:\windows\z0930tr5j402.ocx
c:\windows\z097virus25.bin
c:\windows\z10295py42c.dll
c:\windows\z1085v9rus598.ocx
c:\windows\z1429wor5159.exe
c:\windows\z1635hacktool89.dll
c:\windows\z1722hackt9ol35f.exe
c:\windows\z18fd95nloader1207.ocx
c:\windows\z1e0addwar9195.ocx
c:\windows\z21059acktool6cd.ocx
c:\windows\z2359tr5j6ae.exe
c:\windows\z2390worm500.ocx
c:\windows\z24a5teal9970.ocx
c:\windows\z2553s5y963.bin
c:\windows\z255spyw5re25009.bin
c:\windows\z2c5thief509.cpl
c:\windows\z2f2t5ief1669.ocx
c:\windows\z3048not-59virus67b.cpl
c:\windows\z30bv9r2135.ocx
c:\windows\z3491tr5j9a2.cpl
c:\windows\z361spyw9re5798.cpl
c:\windows\z36do5nloader2990.cpl
c:\windows\z4495hacktoo9451.cpl
c:\windows\z5141t9oj219.exe
c:\windows\z55espy9are815.bin
c:\windows\z57bsparse698.dll
c:\windows\z5859hacktool8f9.dll
c:\windows\z61cbackdoor24559.exe
c:\windows\z66955acktool914.bin
c:\windows\z6f9back9oor2865.dll
c:\windows\z7939p5mbot660.ocx
c:\windows\z8258not9a-virus4c15.cpl
c:\windows\z877659ambot532.ocx
c:\windows\z9096spy45.exe
c:\windows\z920b5ckdoor2519.dll
c:\windows\z951v592684.cpl
c:\windows\z998s5y3ff.ocx
c:\windows\za3b5ckdoor2039.cpl
c:\windows\zb3vir96985.exe
c:\windows\zb7e9ownload5r433.ocx
c:\windows\zc43backd95r1776.ocx
c:\windows\zc95spyware2906.bin
c:\windows\zccdsparse9250.ocx
c:\windows\ze76s9arse1659.dll
c:\windows\zf05thi9f1820.dll

.
((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 )))))))))))))))))))))))))))))))
.

2009-08-30 09:25 . 2009-08-30 09:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-08-29 13:17 . 2009-08-29 13:17 35 ----a-w- c:\users\le bucheron\AppData\Roaming\SetValue.bat
2009-08-29 12:58 . 2009-08-29 12:58 -------- d-----w- c:\program files\trend micro
2009-08-29 12:57 . 2009-08-29 12:58 -------- d-----w- C:\rsit
2009-08-29 11:15 . 2009-08-29 11:15 3942047 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-28 18:03 . 2009-08-28 18:03 -------- d-----w- c:\programdata\WindowsSearch

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-30 08:18 . 2008-05-29 02:02 669566 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-30 08:18 . 2008-05-29 02:02 123556 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-29 18:43 . 2009-01-19 13:30 81984 ----a-w- c:\windows\system32\bdod.bin
2009-08-29 13:17 . 2009-08-29 13:17 691 ----a-w- c:\users\le bucheron\AppData\Roaming\GetValue.vbs
2009-08-29 11:31 . 2009-06-13 22:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-29 08:17 . 2009-02-24 17:57 -------- d-----w- c:\program files\Java
2009-08-28 13:35 . 2009-03-08 14:15 1 ----a-w- c:\users\le bucheron\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-08-03 11:36 . 2009-06-13 22:11 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 11:36 . 2009-06-13 22:11 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-26 12:16 . 2009-07-16 17:40 96 ----a-w- c:\users\le bucheron\AppData\Local\bbwcfat.bat
2009-07-25 03:23 . 2009-02-24 17:57 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-05 08:16 . 2009-03-05 12:30 -------- d-----w- c:\users\le bucheron\AppData\Roaming\dvdcss
2009-07-01 17:16 . 2009-05-31 10:37 -------- d-----w- c:\program files\LG PC Suite II
2009-07-01 17:10 . 2008-05-28 16:32 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-12 23:11 . 2009-02-19 17:36 94 ----a-w- c:\users\le bucheron\AppData\Local\elsbjag.bat
2009-06-13 23:00 . 2008-10-30 16:34 61440 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
2008-05-28 16:54 . 2008-05-28 16:54 122368 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2007-11-28 19:41 . 2008-05-28 16:49 67696 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2007-11-28 19:41 . 2008-05-28 16:49 54376 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2007-11-28 19:41 . 2008-05-28 16:49 34952 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2007-11-28 19:41 . 2008-05-28 16:49 46720 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2007-11-28 19:41 . 2008-05-28 16:49 172144 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2008-02-04 1038136]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-01-14 1688872]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-04-24 251240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-17 102400]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-22 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-22 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-22 133656]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-05-28 29744]
"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]
"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-08-22 782336]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-06-13 69632]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-10-01 4702208]
"Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-08-03 1826816]

c:\users\le bucheron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-8-2 2760704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"="0x00000000"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{6679C361-2335-45B8-BD9B-DBFA98E4D948}"= Disabled:UDP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{027EA4A0-498D-42D5-8AB0-CCE6E0BC4AD0}"= Disabled:TCP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{349E3958-386C-4728-9CB3-0BA8AFFDC4B3}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{39DBCF53-2E2F-4CE3-B93C-E8716AC7DCF2}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{665864F4-EE64-4E62-B933-88BE4DC68707}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"TCP Query User{9A44E125-4298-4CD8-BF04-4B2B2A876238}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{EE6E6035-9E66-4A00-8F0E-FD0EB67D45C9}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{E840231C-034B-43E0-8531-F567396EDCCD}c:\\windows\\system32\\sys32dll.exe"= UDP:c:\windows\system32\sys32dll.exe:SYS32DLL
"UDP Query User{7EBD0FFC-2FA7-4587-91DE-9449F7AD8D8F}c:\\windows\\system32\\sys32dll.exe"= TCP:c:\windows\system32\sys32dll.exe:SYS32DLL

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS

R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [24/04/2009 13:57 92008]
R3 bdfm;BDFM;c:\windows\System32\drivers\bdfm.sys [18/09/2008 12:09 111112]
S2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [11/09/2007 00:45 124832]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [17/07/2008 13:06 118784]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [15/01/2009 13:46 28224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder

2009-08-30 c:\windows\Tasks\Extension de garantie-le bucheron.job
- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2008-05-28 10:13]

2009-08-30 c:\windows\Tasks\Recovery DVD Creator-le bucheron.job
- c:\program files\Packard Bell\SetupMyPc\MCDCheck.exe [2008-05-28 10:13]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-s9hs3pwz.exe - c:\windows\system32\s9hs3pwz.exe

.
------- Supplementary Scan -------
.
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
FF - ProfilePath -

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.hideGoButton", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "http://sb.google.com/safebrowsing/update?client={moz:client}&appver={moz:version}&");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features=TrustRank&client={moz:client}&appver={moz:version}&");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "http://sb.google.com/safebrowsing/report?");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-30 11:25
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\users\LEBUCH~1\AppData\Local\Temp\catchme.dll 53248 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-08-30 11:28
ComboFix-quarantined-files.txt 2009-08-30 09:28

Pre-Run: 170 350 575 616 octets libres
Post-Run: 170 766 618 624 octets libres

901 --- E O F --- 2009-02-26 15:14

Combofix a fait le travail.
Ton PC doit déjà mieux se comporter.

1/ télécharge AFT Cleaner et enregistre-le sur le bureau.
http://www.atribune.org/ccount/click.php?id=1

Ferme ton navigateur. Double clique sur ATF-Cleaner.exe.
Si Tu as Firefox, clique dans le menu sur ce nom.

Choisis l'option Select All puis valide.

2/ Télécharge Random's System Information Tool (RSIT) de random/random et enregistre le sur ton Bureau.
http://images.malwareremoval.com/random/RSIT.exe

# Double-clique sur " RSIT.exe " pour le lancer .
# dans la fenêtre qui va s’ouvrir choisis 1 month pour l'option "List files/folders created ...".
# clique ensuite sur " Continue " pour lancer l'analyse ...

Si la dernière version de HijackThis n'est pas trouvée sur ton PC, RSIT la téléchargera et te demandera d'accepter la licence.

Attends jusqu’à la fin de l’analyse. deux rapports vont être crées.

# Poste en deux messages le contenu de " log.txt ", et de " info.txt " ( dans la barre des tâches).

Note : Si tu ne les trouves pas,les rapports sont sauvegardés dans le dossier C:\rsit.

A+

merci pour l aide
tout reussis
il me semble que le virus n est plus la
grand merci

Loic12,

J'aurais aimé voir le rapport log.txt ( il se trouve en C:\RSIT ) pour vérifier si il n'y a pas d'autres infections présentes.
il y aurait deux scans à faire ( malwarebytes et un scan en ligne pour vérifier tout cela ). Je t'indiquerais un outil pour cela.

@+

Logfile of random's system information tool 1.06 (written by random/random)
Run by le bucheron at 2009-08-30 11:57:06
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 163 GB (71%) free of 228 GB
Total RAM: 3062 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:57:12, on 30/08/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\conime.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\le bucheron\Desktop\RSIT.exe
C:\Program Files\trend micro\le bucheron.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. https://www.bitdefender.fr/ - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

OK,

Le rapport ne montre pas d'autres infections.

1/ Désinstalle ComboFix :
Démarrer --> exécuter --> tape : ComboFix /u
Supprime également C:\Qoobox et C:\ComboFix si présents.

Attention à cet outil, il n'est pas à utiliser à la légère. Il peut très bien aussi te planter la machne.

Tu pourras lancer Malwarebytes pour verifier ton PC , ainis qu'un scan en ligne :
https://forum.pcastuces.com/kaspersky_online_scanner___tutoriel-f31s26.htm

Tu peux poster les rapports si tu le désires.

@+

Salut ! Je viens pour la première fois sur ce site car j'ai également save defense qui parasite mon ordi ! J'ai essayé la méthodologie indiquée sur ce post mais impossible de m'en débarrasser : combofix ne se lance tout simplement pas ! Donc impossible de virer save defense ! Que faire ?

Merci pour votre aide !

Trolitto,

Il est préférable d'ouvrir son propre sujet pour que quelqu'un te prenne en charge.
En haut de page, clique sur posez votre question.

Salut.

okay c'est fait !