Alureon-CY

Je confirme, il me fait des logs vides et un message disant qu'il n'y a pas eu de modif.

Même plantage-redémarrage que précédemment ("PVE.cfxxe a cessé de fonctionner").

Quarantine path: \??\C:\Users\Benoit\Desktop\avz4\avz4\Quarantine\2009-09-18\
QuarantineFile \??\C:\Windows\system32\Drivers\gasfkyircnrcqe.sys - succeeded
Delete File \systemroot\system32\drivers\gasfkyircnrcqe.sys - succeeded
Delete Service & File gasfkyjipxbmhq - failed (0xC0000022)
-- End --


Mais des gasf*(.dll), avast m'en a annoncé pas mal.

ComboFix 09-09-17.04 - Benoit 18/09/2009 14:54.1.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.32.1036.18.3070.1725 [GMT 2:00]
Lancé depuis: c:\users\Benoit\Desktop\ComboFix.exe
SP: Lavasoft Ad-Watch Live! *enabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: SUPERAntiSpyware *enabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
[i] ADS - Windows: deleted 48 bytes in 1 streams. /i

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\InfoSat.txt
C:\Muestras
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ASETRES.EXE
c:\users\Benoit\AppData\Roaming\inst.exe
c:\windows\system32\drivers\gasfkytqxtfrxs.sys
c:\windows\system32\gasfkybjvpywcu.dll
c:\windows\system32\gasfkycbqkbtpd.dll
c:\windows\system32\gasfkyfitnxpji.dat
c:\windows\system32\gasfkyfqyexaos.dll
c:\windows\system32\gasfkyfsipwxsm.dll
c:\windows\system32\gasfkymytwqxeu.dll
c:\windows\system32\gasfkyoxmiufps.dll
c:\windows\system32\gasfkypxesqinj.dll
c:\windows\system32\gasfkyqdaxpfeq.dll
c:\windows\system32\gasfkyqupfetrt.dat
c:\windows\system32\gasfkysfqxiiri.dll
c:\windows\system32\gasfkyuiiqsvwu.dll
c:\windows\system32\gasfkyviktssjn.dll
c:\windows\system32\gasfkyyncfwbce.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SK9OU0S
-------\Legacy_SROSA
-------\Service_gasfkyjipxbmhq


((((((((((((((((((((((((((((( Fichiers créés du 2009-08-18 au 2009-09-18 ))))))))))))))))))))))))))))))))))))
.

2009-09-18 13:05 . 2009-09-18 13:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-09-18 10:46 . 2009-09-18 10:48 -------- d-----w- C:\tib
2009-09-18 09:02 . 2009-09-18 09:02 -------- d-----w- C:\%APPDATA%
2009-09-18 08:54 . 2009-09-18 08:54 -------- d-----w- c:\program files\CCleaner
2009-09-18 08:45 . 2009-09-18 08:45 -------- d-----w- C:\GenProc
2009-09-18 08:33 . 2009-09-18 08:33 -------- d-----w- C:\rsit
2009-09-18 08:28 . 2009-09-18 08:30 -------- d-----w- C:\ToolBar SD
2009-09-18 07:26 . 2009-07-28 14:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-09-18 07:26 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-18 07:26 . 2009-09-18 07:26 -------- d-----w- c:\programdata\Avira
2009-09-17 21:54 . 2009-09-17 21:54 -------- d-----w- c:\program files\Avira
2009-09-17 12:25 . 2009-09-17 12:25 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2009-09-17 12:25 . 2009-09-18 07:08 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-09-17 12:25 . 2009-09-17 12:25 -------- d-----w- c:\users\Benoit\AppData\Roaming\SUPERAntiSpyware.com
2009-09-17 11:31 . 2009-09-17 11:31 -------- d-----w- c:\users\Benoit\AppData\Roaming\Babylon
2009-09-17 11:31 . 2009-09-17 11:31 -------- d-----w- c:\programdata\Babylon
2009-09-09 12:17 . 2009-09-09 12:17 -------- d-----w- c:\users\Benoit\AppData\Roaming\gtk-2.0
2009-09-09 12:17 . 2009-09-09 12:17 -------- d-----w- c:\users\Benoit\.thumbnails
2009-09-09 08:21 . 2009-09-09 12:19 -------- d-----w- c:\users\Benoit\.gimp-2.6
2009-09-09 08:21 . 2009-09-09 08:21 -------- d-----w- c:\program files\GIMP
2009-09-02 22:31 . 2009-08-28 12:39 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-09-02 22:31 . 2009-08-28 10:15 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 20:25 . 2009-01-22 12:28 290816 ----a-w- c:\windows\system32\decdll.dll
2009-08-29 20:25 . 2009-08-29 20:25 -------- d-----w- c:\program files\Free Video Converter
2009-08-26 08:04 . 2009-06-22 10:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-08-22 09:58 . 2009-08-22 09:58 -------- d-----w- c:\program files\AVI Trimmer
2009-08-22 09:58 . 2009-08-22 09:58 -------- d-----w- c:\program files\Common Files\Solveig Multimedia
2009-08-20 12:51 . 2009-08-20 12:51 -------- d-----w- c:\program files\QuickTime
2009-08-20 12:51 . 2009-08-20 12:51 -------- d-----w- c:\programdata\Apple Computer

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-18 13:07 . 2009-05-31 15:22 48318 ----a-w- c:\programdata\nvModes.dat
2009-09-18 12:49 . 2009-02-16 01:20 -------- d-----w- c:\users\Benoit\AppData\Roaming\MailWasherPro
2009-09-18 09:21 . 2009-03-28 13:03 -------- d-----w- c:\program files\Common Files\Softwin
2009-09-18 09:20 . 2009-03-28 13:09 81984 ----a-w- c:\windows\system32\bdod.bin
2009-09-17 21:39 . 2009-03-15 13:22 -------- d-----w- c:\programdata\Google Updater
2009-09-17 12:25 . 2009-05-31 15:18 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-14 18:50 . 2008-01-21 08:40 669328 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-14 18:50 . 2008-01-21 08:40 123350 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-10 04:53 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-08-30 18:25 . 2009-02-16 11:01 -------- d-----w- c:\program files\Java
2009-08-23 09:47 . 2009-03-26 15:30 -------- d-----w- c:\program files\Spybot SD
2009-08-20 14:11 . 2008-03-21 11:10 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-19 21:57 . 2009-03-15 13:22 -------- d-----w- c:\program files\Google
2009-08-19 21:57 . 2009-07-18 19:05 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-08-17 16:10 . 2009-03-28 09:04 1279456 ----a-w- c:\windows\system32\aswBoot.exe
2009-08-17 16:05 . 2009-03-28 09:04 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-08-17 16:05 . 2009-03-28 09:04 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-08-17 16:05 . 2009-03-28 09:04 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-08-17 16:04 . 2009-03-28 09:04 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-08-17 16:04 . 2009-03-28 09:04 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-08-17 16:02 . 2009-03-28 09:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-08-14 17:07 . 2009-09-09 05:37 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-09 05:37 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-09 05:37 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-09 05:37 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-09 05:37 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-09 05:37 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-09 05:37 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-09 05:37 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-09 05:37 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-09 05:37 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-03 10:59 . 2009-06-22 10:58 25440 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\savapibridge.dll
2009-08-03 10:59 . 2009-06-22 10:58 1630560 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Resources.dll
2009-08-03 10:59 . 2009-06-22 10:58 2353480 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-07-26 02:27 . 2009-02-12 15:12 73840 ----a-w- c:\users\Benoit\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-26 02:25 . 2009-03-26 08:54 -------- d-----w- c:\program files\Pinnacle
2009-07-25 11:17 . 2009-03-30 10:29 -------- d-----w- c:\users\Benoit\AppData\Roaming\proDAD
2009-07-25 11:14 . 2009-07-25 11:14 -------- d-----w- c:\users\Benoit\AppData\Roaming\InstallShield
2009-07-25 11:11 . 2009-02-27 11:14 -------- d-----w- c:\program files\AVS4YOU
2009-07-25 03:23 . 2009-02-17 07:05 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-23 16:06 . 2009-07-23 16:06 -------- d--h--w- c:\program files\Common Files\InternalLib
2009-07-21 21:52 . 2009-07-29 17:27 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 17:27 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 17:27 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 17:27 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-18 19:17 . 2009-02-17 20:28 1356 ----a-w- c:\users\Benoit\AppData\Local\d3d9caps.dat
2009-07-17 14:35 . 2009-08-12 04:04 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-14 13:00 . 2009-08-12 04:04 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-14 12:59 . 2009-08-12 04:04 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-14 12:58 . 2009-08-12 04:04 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-07-14 10:59 . 2009-08-12 04:04 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-07-12 06:58 . 2009-07-12 06:58 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-07-12 06:58 . 2009-07-12 06:58 47360 ----a-w- c:\users\Benoit\AppData\Roaming\pcouffin.sys
2009-07-11 19:32 . 2009-09-09 05:37 513024 ----a-w- c:\windows\system32\wlansvc.dll
2009-07-11 19:32 . 2009-09-09 05:37 302592 ----a-w- c:\windows\system32\wlansec.dll
2009-07-11 19:32 . 2009-09-09 05:37 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2009-07-11 19:29 . 2009-09-09 05:37 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2009-07-06 11:03 . 2009-06-01 10:59 84832 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-07-06 07:36 . 2009-07-06 07:36 35712 ----a-w- c:\windows\system32\drivers\a38usb.sys
2009-07-06 07:36 . 2009-07-06 07:36 110592 ----a-w- c:\windows\system32\usbr38.dll
2009-06-29 11:06 . 2009-06-22 10:58 314712 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\threatwork.exe
2009-06-29 11:06 . 2009-06-22 10:58 169312 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\lavamessage.dll
2009-06-29 11:06 . 2009-06-22 10:58 348496 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\lavalicense.dll
2009-06-29 11:05 . 2009-06-22 10:58 298336 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2009-06-29 11:02 . 2009-06-01 10:58 246128 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-06-29 11:02 . 2009-06-01 10:58 40288 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-06-29 11:02 . 2009-06-22 10:58 85352 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Drivers\32\AAWDriverTool.exe
2009-06-29 11:02 . 2009-06-22 10:58 664424 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-06-29 11:01 . 2009-06-22 10:58 563064 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-06-29 11:01 . 2009-06-22 10:58 566632 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-06-29 11:00 . 2009-06-22 10:58 629072 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AAWWSC.exe
2009-06-29 11:00 . 2009-06-22 10:58 520024 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-06-29 11:00 . 2009-06-22 10:58 1029456 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AAWService.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-03-04 22:38 121392 ----a-w- c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"Gadwin PrintScreen"="c:\program files\Gadwin Systems\PrintScreen\PrintScreen.exe" [2008-12-09 495616]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-09-18 1998576]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"PCMMediaSharing"="c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe" [2008-01-25 204908]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2008-06-06 203296]
"diagnostics"="c:\program files\Thomson\ST330\diagnostics\diagnostics.exe" [2009-02-15 557149]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2005-09-25 155648]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2005-09-25 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-29 520024]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 57344]
"USB2Check"="c:\windows\system32\PCLECoInst.dll" [2006-11-06 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-30 13781536]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-19 198160]
"beid"="c:\program files\Belgium Identity Card\beid35gui.exe" [2009-06-04 2056192]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-03-26 5369856]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-2-22 113664]
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2008-3-21 535336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3488268135-2175185307-3815600139-1000]
"EnableNotificationsRef"=dword:00000004

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{0590D135-20CF-4616-83A2-B4D64D7A7ADC}"= c:\program files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live
"{40F60C6C-DD8E-40B8-AB34-5061C567E010}"= c:\program files\Acer Arcade Live\Acer DVDivine\Acer DVDivine.exe:Acer DVDivine
"{EC714915-D3A6-43D3-B785-23155F4ED9A6}"= c:\program files\Acer Arcade Live\Acer HomeMedia\Acer HomeMedia.exe:Acer HomeMedia
"{8FB6D042-3CF4-407D-A2E9-A1CE05C41456}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Acer HomeMedia Connect.exe:Acer HomeMedia Connect
"{542BA28B-703D-48DB-B83F-94E757E578BF}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:Acer HomeMedia Connect Service
"{B34DAF09-668F-41FD-94EB-A7A892360F5C}"= c:\program files\Acer Arcade Live\Acer SlideShow DVD\Acer SlideShow DVD.exe:Acer SlideShow DVD
"{A924C65E-76C0-4E34-9E09-9FC3F7E6691A}"= c:\program files\Acer Arcade Live\Acer VideoMagician\Acer VideoMagician.exe:Acer VideoMagician
"{F051E17E-51EF-4830-B367-F6DA497077E5}"= c:\program files\Acer Arcade Live\Acer HomeMedia Trial Creator\Acer HomeMedia Trial Creator.exe:Acer HomeMedia Trial Creator
"{F158742F-48F9-4833-8369-7CBA8CC22457}"= c:\program files\Acer Arcade Live\Acer DV Magician\Acer DV Magician.exe:Acer DV Magician
"{8395E389-1529-4E85-9B07-6EAB09AB92C0}"= UDP:c:\users\Benoit\AppData\Local\Temp\Installer.exe:SpeedTouch Home Install Wizard
"{1FB351B9-0D2A-4734-90A9-1E1D13DF16DA}"= TCP:c:\users\Benoit\AppData\Local\Temp\Installer.exe:SpeedTouch Home Install Wizard
"{1AF2D2CF-E89E-44DC-A97F-781F672709E2}"= UDP:h:\sthiwv\stInstall.exe:SpeedTouch Home Install Wizard
"{91176656-8D2C-4EFF-86A6-DB49643C9CF7}"= TCP:h:\sthiwv\stInstall.exe:SpeedTouch Home Install Wizard
"{07192DEC-439A-4DBA-BF9D-A5DDEFF13AA8}"= UDP:c:\program files\Thomson\ST330\service\st330service.exe:ST330 service
"{E2A5857D-5864-4483-A1F8-64EA89340D16}"= TCP:c:\program files\Thomson\ST330\service\st330service.exe:ST330 service
"TCP Query User{F9A795DF-DD1C-48B0-B5A2-2F5F8260EA38}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{A5F1BDF1-5B6B-42D6-9216-2ED9BD7EB0A5}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{CA75E8AB-DCF7-4D8B-9245-589CA698155C}c:\\program files\\tale of tales\\the endless forest 3\\forestviewer.exe"= UDP:c:\program files\tale of tales\the endless forest 3\forestviewer.exe:ForestViewer
"UDP Query User{7A403F75-2C01-442A-9990-204F6D820EBB}c:\\program files\\tale of tales\\the endless forest 3\\forestviewer.exe"= TCP:c:\program files\tale of tales\the endless forest 3\forestviewer.exe:ForestViewer
"TCP Query User{3D01DB23-E439-45FE-A216-F277D1201F10}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
"UDP Query User{4E8C5A7B-8276-4344-A9A8-2AACCD6DFE3C}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
"{1A71C1C2-130E-4709-B4EE-EE496D9B5463}"= UDP:c:\program files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{DE7C7766-0F1A-4066-B735-3777E912B093}"= TCP:c:\program files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{14E749F5-A3DC-4561-812E-A089DF90DD5F}"= UDP:c:\program files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{64218170-CBA2-4A96-B9A0-BB9AEB2C380C}"= TCP:c:\program files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{2CF9EF73-AB43-4C5E-B899-DAC8EF316212}"= UDP:c:\program files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{18F41CBC-F492-490C-AF1D-70AC41400DE4}"= TCP:c:\program files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{BB058F28-86D9-4798-8F48-463F6E3A6D1E}"= UDP:c:\program files\Pinnacle\Studio 11\programs\umi.exe:umi
"{A49686F7-D5AF-4534-B443-234E9DE9910B}"= TCP:c:\program files\Pinnacle\Studio 11\programs\umi.exe:umi

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [27/04/2009 12:58 64160]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [28/03/2009 11:04 114768]
R1 ISODisk;ISODisk;c:\windows\System32\drivers\ISODisk.sys [27/02/2009 12:29 9600]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [4/09/2009 14:50 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/09/2009 14:49 74480]
R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [21/03/2008 13:34 269448]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [28/03/2009 11:04 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [28/03/2009 11:04 53328]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1029456]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot SD\SDWinSec.exe [26/03/2009 17:30 1153368]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [13/02/2009 1:51 42528]
S2 gupdate1c9a5714e0d1af8;Service Google Update (gupdate1c9a5714e0d1af8);c:\program files\Google\Update\GoogleUpdate.exe [15/03/2009 15:24 133104]
S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\System32\drivers\a38usb.sys [6/07/2009 9:36 35712]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [6/11/2007 22:22 34064]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [4/09/2009 14:50 7408]
S3 ST330;ST330;c:\windows\System32\drivers\st330.sys [14/02/2009 14:29 30464]
S3 STBUS;STBUS;c:\windows\System32\drivers\stbus.sys [14/02/2009 14:29 12672]
S3 stppp;Speedtouch PPP Adapter Adapter;c:\windows\System32\drivers\stppp.sys [14/02/2009 14:29 35328]
S3 V0010bVd;Creative WebCam Vista #2;c:\windows\System32\drivers\V0010bVd.sys [15/02/2009 17:01 186551]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-09-14 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 11:01]

2009-09-18 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-15 07:47]

2009-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-15 13:23]

2009-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-15 13:23]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://fr.fr.acer.yahoo.com
mWindow Title =
FF - ProfilePath - c:\users\Benoit\AppData\Roaming\Mozilla\Firefox\Profiles\vwx85phz.default\
FF - prefs.js: browser.startup.homepage - file:///D:/WEBSITES/internal/internal2009.html
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKLM-Run-Acer Empowering Technology Monitor - c:\acer\Empowering Technology\SysMonitor.exe
HKLM-Run-eDataSecurity Loader - c:\acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
HKLM-Run-Apanel - c:\acersw\config\SetApanel.cmd
HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
HKLM-Run-eRecoveryService - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-18 15:07
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet013\Services\st330service]
"ImagePath"="C:\Program Files/Thomson/ST330/service/st330service.exe -service"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,bb,52,7c,0f,09,
93,26,61,c8,28,51,af,b0,29,a3,98,3a,75,08,70,5b,20,5c,f6,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,84,b5,31,6e,51,
5c,52,e0,71,3b,04,66,8b,46,0d,96,43,ff,d2,29,3c,3b,b1,b4,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,27,52,a8,17,14,
6a,ef,1f,25,da,ec,7e,55,20,c9,26,9b,27,11,9c,53,a4,18,cd,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,a0,7b,90,bc,d4,
6d,f5,10,3e,1e,9e,e0,57,5a,93,61,b5,b5,70,35,ff,d9,02,bd,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,ca,d8,7b,f0,6c,
d1,3d,20,cd,44,cd,b9,a6,33,6c,cd,b2,62,11,5a,c7,a1,f1,13,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,8d,7b,fa,d4,6a,
88,fa,4e,b0,18,ed,a7,3f,8d,37,a4,11,9d,a9,54,c6,e0,3b,3d,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,38,9f,f7,78,f8,
87,9e,e6,31,77,e1,ba,b1,f8,68,02,43,d6,6c,78,e3,b7,96,fd,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,30,51,92,2b,be,
e0,46,f8,83,6c,56,8b,a0,85,96,ab,2f,9c,28,cc,34,b0,f5,88,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,10,ae,54,22,1b,
4e,3b,e8,51,fa,6e,91,28,9e,14,cc,70,8b,73,48,e5,14,04,3a,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,cb,ff,f2,f2,65,
e4,f9,84,b1,cd,45,5a,a8,c4,f8,b9,eb,97,27,e2,6d,1b,a3,65,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,e3,0d,bd,d9,9d,
7e,6e,11,e3,0e,66,d5,eb,bc,2f,6b,82,f7,60,68,65,6a,91,5f,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,22,b8,ea,58,a5,
0b,1a,66,fa,ea,66,7f,d4,3b,6b,70,6b,af,bb,65,a9,38,7f,85,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(3856)
c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\program files\Thomson\ST330\service\st330service.exe
c:\windows\System32\nvvsvc.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Heure de fin: 2009-09-18 15:11 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-09-18 13:11

Avant-CF: 91.029.274.624 octets libres
Après-CF: 90.828.562.432 octets libres

380

Par raccourci mais pas en admin.

double clic / autoriser / voilà

Enfin bon, j'ai fait comme ça. Je n'ai pas fait "exécuter en tant qu'administrateur".

Rapport GenProc 2.627 [5] - ven. 18/09/2009 à 15:38:34
@ Windows Vista Service Pack 1 - Mode normal
@ Internet Explorer (8.0.6001.18813) [Navigateur par défaut]

# Etape 1/ Télécharge :


- rustbfix http://uploads.ejvindh.andymanchesta.com/RustbFix.exe ( (ejvindh) et sauvegarde-le sur ton Bureau.
- Double clique sur rustbfix.exe afin de lancer l'outil.
- Si une infection Rustock.b est détectée, une invite t'indiquera qu'il est nécessaire de redémarrer l'ordi.
- Ce redémarrage pourrait être plus long que d'habitude, et il est possible que deux redémarrages soient requis. Tout cela se fera automatiquement.

- Suite au(x) redémarrage(s), deux rapports s'ouvriront : (C:\avenger.txt & C:\rustbfix\pelog.txt).
- Poste le contenu de ces deux rapports, ainsi qu'un rapport HijackThis


~~ Arguments de la procédure ~~


# Détections [1] GenProc 2.627 ven. 18/09/2009 à 10:46:00
TDSS:le ven. 18/09/2009 à 10:46:17 PFROP gasfky*

# Détections [2] GenProc 2.627 ven. 18/09/2009 à 15:18:33
Rustock: le ven. 18/09/2009 à 15:18:59 "pe386" present

# Détections [3] GenProc 2.627 ven. 18/09/2009 à 15:24:48
Rustock: le ven. 18/09/2009 à 15:25:13 "pe386" present

# Détections [4] GenProc 2.627 ven. 18/09/2009 à 15:30:19
Rustock: le ven. 18/09/2009 à 15:30:44 "pe386" present

# Détections [5] GenProc 2.627 ven. 18/09/2009 à 15:38:36
Rustock: le ven. 18/09/2009 à 15:39:01 "pe386" present

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à 15:39:01 ~~

[ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\TB.txt: trouvé !
C:\Rustbfix: trouvé !
C:\GenProc: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\GenProc\Genproc.exe: trouvé !
C:\GenProc\Page\GenProc[*].html: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\FindyKill: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FindyKill: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\Rustbfix\avenger.exe: trouvé !
C:\Rustbfix\pelog.txt: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\FindyKill: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\FindyKill: trouvé !
C:\Users\Benoit\AppData\Local\VirtualStore\Program Files\FindyKill: trouvé !
C:\Users\Benoit\Desktop\rustbfix.exe: trouvé !
C:\Users\Benoit\Desktop\Gmer.zip: trouvé !
C:\Users\Benoit\Desktop\ComboFix.exe: trouvé !
C:\Users\Benoit\Desktop\HijackThis.exe: trouvé !
C:\Users\Benoit\Desktop\ToolBarSD.exe: trouvé !
C:\Users\Benoit\Desktop\hijackthis.log: trouvé !
C:\Users\Benoit\Desktop\Rsit.exe: trouvé !
C:\Users\Benoit\Desktop\Bagle\ComboFix.exe: trouvé !
C:\Users\Benoit\Documents\DOCUMENTS XP\Docs\HJTInstall.exe: trouvé !

---------------------------------
--> Suppression:

C:\Rustbfix\avenger.exe: supprimé !
C:\Users\Benoit\Desktop\rustbfix.exe: supprimé !
C:\Users\Benoit\Desktop\Gmer.zip: supprimé !
C:\Users\Benoit\Desktop\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Users\Benoit\Desktop\HijackThis.exe: supprimé !
C:\Users\Benoit\Desktop\ToolBarSD.exe: supprimé !
C:\Users\Benoit\Desktop\Bagle\ComboFix.exe: supprimé !
C:\Users\Benoit\Documents\DOCUMENTS XP\Docs\HJTInstall.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\TB.txt: supprimé !
C:\GenProc\Genproc.exe: supprimé !
C:\GenProc\Page\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\Rustbfix\pelog.txt: supprimé !
C:\Users\Benoit\Desktop\hijackthis.log: supprimé !
C:\Users\Benoit\Desktop\Rsit.exe: supprimé !
C:\Rustbfix: supprimé !
C:\GenProc: supprimé !
C:\Qoobox: supprimé !
C:\Toolbar SD: supprimé !
C:\Rsit: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\FindyKill: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FindyKill: supprimé !
C:\Users\Benoit\AppData\Local\VirtualStore\Program Files\FindyKill: supprimé !

Plantage 2x de Eset à 30% (scan très lent).
Un rootkit éliiminé au premier passage.

C:\Users\Benoit\Desktop\avz4\avz4\Quarantine\2009-09-18\bcqr00001.dta
une variante de Win32/Rootkit.Kryptik.P cheval de troie nettoyé par suppression - mis en quarantaine

J'étais entre deux choses. Quid de ce dernier rapport ?

> dodo, merci Obi-Wan, et suite demain si nécessaire et si vous le voulez bien.

Tout a l'air clean. Merci beaucoup.