Infecté par total security

Lance ZHPFix depuis le raccourci qui est sur ton bureau .

▶ Une fois l'outil ouvert , clique sur le bouton [ H ] ( "coller les ligne Helper" ) .

▶ Dans l'encadré principal , copie-colle tout le texte qui se trouve en citation :

O44 - LFC:Last File Created 07/10/2009 - 14:14:15 ---A- C:\Windows\System32\ESQULzxspectrum

▶ Clique sur le bouton [ OK ] .

ben c'est pas possible à réaliser apparemment il me dit que le fichier est en quarantaine j'ai peut être fait une mauvaise manip ? Sans doute avec tout se que tu me dis de faire j'ai du melanger des trucs.......

AV: Norton 360 *On-access scanning enabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}
SP: Norton 360 *enabled* (Updated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\windows\DUMP5724.tmp"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\TSUninstall
c:\program files\Common Files\TSUninstall\Uninstall.lnk
c:\program files\TS
c:\windows\DUMP5724.tmp

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-09-27 au 2009-10-27 ))))))))))))))))))))))))))))))))))))
.

2009-10-27 15:01 . 2009-10-27 15:01 -------- d-----w- c:\users\Public\AppData\Local\temp
2009-10-27 15:01 . 2009-10-27 15:01 -------- d-----w- c:\users\prince noir\AppData\Local\temp
2009-10-27 15:01 . 2009-10-27 15:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-26 09:03 . 2009-10-26 18:17 -------- d-----w- C:\ComboFix
2009-10-26 07:29 . 2009-10-26 07:52 -------- d-----w- c:\program files\ZHPDiag
2009-10-25 21:17 . 2009-10-25 22:19 -------- d-----w- c:\windows\system32\eu-ES
2009-10-25 21:17 . 2009-10-25 22:19 -------- d-----w- c:\windows\system32\ca-ES
2009-10-25 21:17 . 2009-10-25 22:19 -------- d-----w- c:\windows\system32\vi-VN
2009-10-25 20:25 . 2009-10-25 20:25 -------- d-----w- c:\windows\system32\EventProviders
2009-10-25 20:24 . 2009-10-26 07:12 -------- d-----w- C:\1ce0bd34783c305027617fd8b7
2009-10-25 20:07 . 2009-10-25 20:07 -------- d-----w- c:\users\prince noir\AppData\Roaming\Malwarebytes
2009-10-25 20:07 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-25 20:07 . 2009-10-25 20:07 -------- d-----w- c:\programdata\Malwarebytes
2009-10-25 20:07 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-25 20:07 . 2009-10-25 20:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-18 19:14 . 2009-10-18 19:14 653560 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-10-13 19:37 . 2006-11-02 09:46 59904 ----a-w- c:\windows\system32\msasn1.dll
2009-10-13 19:37 . 2009-09-14 09:44 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-13 19:37 . 2009-04-02 12:37 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-09 18:31 . 2009-09-15 10:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-10-09 18:31 . 2009-09-15 10:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-10-09 18:31 . 2009-09-15 10:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-10-09 18:31 . 2009-09-15 10:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-10-09 18:31 . 2009-09-15 10:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-10-09 18:31 . 2009-09-15 10:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-10-09 18:31 . 2009-09-15 10:55 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-10-04 20:49 . 2009-10-04 20:49 -------- d-----w- c:\program files\Alwil Software
2009-10-04 19:24 . 2009-06-15 15:21 499712 ----a-w- c:\windows\system32\kerberos.dll
2009-10-04 19:24 . 2009-06-15 15:22 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-04 19:24 . 2009-06-15 15:24 175104 ----a-w- c:\windows\system32\wdigest.dll
2009-10-04 19:24 . 2009-06-15 15:24 270848 ----a-w- c:\windows\system32\schannel.dll
2009-10-04 19:24 . 2009-06-15 15:23 1256448 ----a-w- c:\windows\system32\lsasrv.dll
2009-10-04 19:24 . 2009-06-15 18:20 439896 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-10-04 19:24 . 2009-06-15 15:24 72704 ----a-w- c:\windows\system32\secur32.dll
2009-10-04 19:24 . 2009-06-15 12:57 9728 ----a-w- c:\windows\system32\lsass.exe
2009-09-28 09:50 . 2009-09-28 09:50 -------- d-----w- c:\windows\Sun

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-27 14:51 . 2006-11-02 15:48 672322 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-27 14:51 . 2006-11-02 15:48 124434 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-27 11:09 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-10-27 10:51 . 2009-03-08 14:44 -------- d-----w- c:\programdata\Google Updater
2009-10-09 18:12 . 2008-03-25 12:20 -------- d-----w- c:\programdata\Symantec
2009-10-09 18:12 . 2007-04-22 01:11 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-09-28 09:34 . 2007-04-22 01:49 -------- d-----w- c:\program files\Google
2009-09-25 08:56 . 2009-02-05 12:13 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-24 08:31 . 2009-09-24 08:30 -------- d-----w- c:\program files\Windows Live
2009-09-24 08:30 . 2009-09-24 08:30 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-19 12:39 . 2009-09-16 11:28 -------- d-----w- c:\program files\Microsoft
2009-09-16 11:29 . 2007-04-22 01:24 -------- d-----w- c:\program files\MSN Messenger
2009-09-16 11:07 . 2009-09-16 11:07 -------- d-----w- c:\program files\Common Files\Windows Live
2009-09-13 11:55 . 2009-09-13 11:55 -------- d-----w- c:\program files\NavX
2009-09-05 17:48 . 2009-08-11 12:23 -------- d-----w- c:\program files\Iminent
2009-08-28 12:39 . 2009-09-24 13:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 10:15 . 2009-09-24 13:40 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-14 17:07 . 2009-09-24 13:46 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-24 13:46 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-24 13:46 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-24 13:46 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-24 13:46 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-24 13:46 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-24 13:46 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-24 13:46 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-24 13:46 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-24 13:46 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-07 08:04 . 2009-08-11 12:23 2456344 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\IMBoosterSetup.exe
2009-08-04 17:52 . 2009-08-04 17:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\9E97A83F\928B7CFE\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\38028398\48553E6A\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\F8E33052\AAAD2BC2\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\F0CE22AE\E012AF0A\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\A2D0D8C9\1FA51BA4\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\930656A1\BC7D9E7A\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\3F5E3EEC\1BB86D51\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 691200 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\D3E408D\AA2AC949\Iminent.Booster.UI.dll
2009-08-04 12:31 . 2009-08-11 12:21 197120 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\90707029\AA2AC949\Iminent.Windows.dll
2009-08-04 12:31 . 2009-08-11 12:21 182784 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\EC9AEE9D\AA2AC949\Iminent.Workflow.dll
2009-08-04 12:31 . 2009-08-11 12:21 282624 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\426DA447\AA2AC949\Iminent.Business.XmlSerializers.dll
2009-08-04 12:31 . 2009-08-11 12:21 94720 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\74360055\AA2AC949\Iminent.Business.dll
2009-08-04 12:30 . 2009-08-11 12:21 177152 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\D704ADB9\AA2AC949\Iminent.WinCore.Aim.Plugin.dll
2009-08-04 12:30 . 2009-08-11 12:21 9216 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\94A15D79\AA2AC949\Iminent.WinCore.Aim.Proxy.dll
2009-08-04 12:30 . 2009-08-11 12:21 99840 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\54ADB14A\AA2AC949\Iminent.LinkToContent.dll
2009-08-04 12:30 . 2009-08-11 12:21 97792 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\45DC9FB6\AA2AC949\Iminent.WinCore.WLM.PresenceHook.dll
2009-08-04 12:30 . 2009-08-11 12:21 229376 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\646BB144\AA2AC949\Iminent.WinCore.WLM.dll
2009-08-04 12:30 . 2009-08-11 12:21 167424 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\AEBB6988\AA2AC949\Iminent.WinCore.Yahoo.dll
2009-08-04 12:29 . 2009-08-11 12:21 13312 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\6563E87F\AA2AC949\FlvEncoder.exe
2009-08-04 12:29 . 2009-08-11 12:21 42496 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\CE6A9334\AA2AC949\Iminent.WinCore.WLM.WinEvents.dll
2009-08-04 12:29 . 2009-08-11 12:21 76800 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\6219B256\AA2AC949\Iminent.Windows.AxHost.dll
2008-01-20 12:54 . 2008-01-20 12:54 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-10-26_18.32.11 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-04-22 00:55 . 2009-10-26 17:41 59600 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2007-04-22 00:55 . 2009-10-27 14:48 59600 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2007-09-26 17:21 . 2009-10-27 14:48 14190 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3447421046-3472872243-1551488221-1000_UserData.bin
- 2007-09-26 16:58 . 2009-10-26 17:42 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-09-26 16:58 . 2009-10-27 14:46 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-09-26 16:58 . 2009-10-26 17:42 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-09-26 16:58 . 2009-10-27 14:46 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-10-27 14:45 . 2009-10-27 14:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-10-27 14:45 . 2009-10-27 14:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 13:05 . 2009-10-27 14:48 112422 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 10:33 . 2009-10-27 14:51 590082 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-10-27 14:51 102094 c:\windows\System32\perfc009.dat
+ 2009-07-11 11:51 . 2009-10-27 14:25 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-11 11:51 . 2009-10-26 18:13 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2007-09-26 16:58 . 2009-10-27 14:46 114688 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-09-26 16:58 . 2009-10-26 17:42 114688 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2006-11-02 10:22 . 2009-10-25 20:14 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2006-11-02 10:22 . 2009-10-27 11:36 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2009-05-03 08:19 . 2009-10-27 11:35 264123733 c:\windows\winsxs\ManifestCache\6.0.6002.18005_001c11ba_blobs.bin
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346de098-61f9-4b42-89da-6dfba7091bb6}]
2009-07-15 08:09 2224152 ----a-w- c:\program files\IMBooster4web-en\tbIMBo.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6E9BAAF-53CD-4575-967B-2AF710A7D21F}]
2009-08-04 12:30 99840 ----a-w- c:\program files\Iminent\IMBooster\Iminent.LinkToContent.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{346de098-61f9-4b42-89da-6dfba7091bb6}"= "c:\program files\IMBooster4web-en\tbIMBo.dll" [2009-07-15 2224152]

[HKEY_CLASSES_ROOT\clsid\{346de098-61f9-4b42-89da-6dfba7091bb6}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{346DE098-61F9-4B42-89DA-6DFBA7091BB6}"= "c:\program files\IMBooster4web-en\tbIMBo.dll" [2009-07-15 2224152]

[HKEY_CLASSES_ROOT\clsid\{346de098-61f9-4b42-89da-6dfba7091bb6}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Lancement rapide d'Adobe Reader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"="
"
"FirewallOverride"="
"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [09/10/2009 19:31 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [09/10/2009 19:31 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [09/10/2009 19:31 53328]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [13/01/2009 18:00 604488]
R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\System32\drivers\R5U870FLx86.sys [18/12/2006 23:31 73472]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\System32\drivers\R5U870FUx86.sys [18/12/2006 23:31 43904]
S2 gupdate1c99ffcc38da2f0;Service Google Update (gupdate1c99ffcc38da2f0);c:\program files\Google\Update\GoogleUpdate.exe [08/03/2009 15:47 133104]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - mbr

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2009-10-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-09-26 18:56]

2009-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-08 14:46]

2009-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-08 14:46]

2009-10-27 c:\windows\Tasks\User_Feed_Synchronization-{05D45C05-ABF7-4DAF-8F95-76C6F65359AD}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]

2009-10-27 c:\windows\Tasks\User_Feed_Synchronization-{B98FE6DB-9E8F-4EBF-8697-30CC13B32FA7}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://neufportail.fr/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=73&bd=Pavilion&pf=laptop
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: {E82AB4DD-FD0A-461A-9324-1A9A9D3528A3} = 86.64.145.148 84.103.237.148
.

**************************************************************************
Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés:

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-10-27 16:04
ComboFix-quarantined-files.txt 2009-10-27 15:04
ComboFix2.txt 2009-10-26 18:38

Avant-CF: 34 261 053 440 octets libres
Après-CF: 34 100 994 048 octets libres

- - End Of File - - E7698879F00BCBF6FE567E02943C7AB3

ComboFix 09-10-30.01 - prince noir 31/10/2009 11:53.4.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.1013.258 [GMT 1:00]
Lancé depuis: c:\users\prince noir\Desktop\moi.exe
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((( Fichiers créés du 2009-09-28 au 2009-10-31 ))))))))))))))))))))))))))))))))))))
.

2009-10-31 11:05 . 2009-10-31 11:05 -------- d-----w- c:\users\Public\AppData\Local\temp
2009-10-31 11:05 . 2009-10-31 11:05 -------- d-----w- c:\users\prince noir\AppData\Local\temp
2009-10-31 11:05 . 2009-10-31 11:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-31 10:40 . 2008-01-19 07:41 28728 ----a-w- c:\windows\system32\drivers\msahci.sys
2009-10-29 12:24 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-29 12:24 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-29 12:24 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-29 12:24 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-29 12:23 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-29 12:23 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-29 12:23 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-29 12:23 . 2009-08-06 18:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-29 12:23 . 2009-08-06 17:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-28 10:39 . 2009-10-28 10:40 -------- d-----w- C:\ToolBar SD
2009-10-28 10:03 . 2009-09-10 15:21 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-28 10:03 . 2009-09-10 15:21 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-26 07:29 . 2009-10-26 07:52 -------- d-----w- c:\program files\ZHPDiag
2009-10-25 21:17 . 2009-10-25 22:19 -------- d-----w- c:\windows\system32\eu-ES
2009-10-25 21:17 . 2009-10-25 22:19 -------- d-----w- c:\windows\system32\ca-ES
2009-10-25 21:17 . 2009-10-25 22:19 -------- d-----w- c:\windows\system32\vi-VN
2009-10-25 20:25 . 2009-10-25 20:25 -------- d-----w- c:\windows\system32\EventProviders
2009-10-25 20:24 . 2009-10-26 07:12 -------- d-----w- C:\1ce0bd34783c305027617fd8b7
2009-10-25 20:07 . 2009-10-25 20:07 -------- d-----w- c:\users\prince noir\AppData\Roaming\Malwarebytes
2009-10-25 20:07 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-25 20:07 . 2009-10-25 20:07 -------- d-----w- c:\programdata\Malwarebytes
2009-10-25 20:07 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-25 20:07 . 2009-10-25 20:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-18 19:14 . 2009-10-18 19:14 653560 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-10-13 19:37 . 2006-11-02 09:46 59904 ----a-w- c:\windows\system32\msasn1.dll
2009-10-13 19:37 . 2009-09-14 09:44 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-13 19:37 . 2009-04-02 12:37 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-09 18:31 . 2009-09-15 10:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-10-09 18:31 . 2009-09-15 10:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-10-09 18:31 . 2009-09-15 10:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-10-09 18:31 . 2009-09-15 10:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-10-09 18:31 . 2009-09-15 10:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-10-09 18:31 . 2009-09-15 10:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-10-09 18:31 . 2009-09-15 10:55 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-10-04 20:49 . 2009-10-04 20:49 -------- d-----w- c:\program files\Alwil Software
2009-10-04 19:24 . 2009-06-15 15:21 499712 ----a-w- c:\windows\system32\kerberos.dll
2009-10-04 19:24 . 2009-06-15 15:22 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-04 19:24 . 2009-06-15 15:24 175104 ----a-w- c:\windows\system32\wdigest.dll
2009-10-04 19:24 . 2009-06-15 15:24 270848 ----a-w- c:\windows\system32\schannel.dll
2009-10-04 19:24 . 2009-06-15 15:23 1256448 ----a-w- c:\windows\system32\lsasrv.dll
2009-10-04 19:24 . 2009-06-15 18:20 439896 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-10-04 19:24 . 2009-06-15 15:24 72704 ----a-w- c:\windows\system32\secur32.dll
2009-10-04 19:24 . 2009-06-15 12:57 9728 ----a-w- c:\windows\system32\lsass.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-31 07:33 . 2009-03-08 14:44 -------- d-----w- c:\programdata\Google Updater
2009-10-31 07:22 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-10-29 07:25 . 2006-11-02 15:48 672322 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-29 07:25 . 2006-11-02 15:48 124434 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-28 10:44 . 2008-03-25 12:20 -------- d-----w- c:\programdata\Symantec
2009-10-28 10:44 . 2007-04-22 01:11 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-10-28 10:44 . 2008-03-25 12:37 -------- d-----w- c:\users\prince noir\AppData\Roaming\Symantec
2009-10-27 22:07 . 2009-01-13 16:59 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-09-28 09:34 . 2007-04-22 01:49 -------- d-----w- c:\program files\Google
2009-09-25 08:56 . 2009-02-05 12:13 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-24 08:31 . 2009-09-24 08:30 -------- d-----w- c:\program files\Windows Live
2009-09-24 08:30 . 2009-09-24 08:30 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-19 12:39 . 2009-09-16 11:28 -------- d-----w- c:\program files\Microsoft
2009-09-16 11:29 . 2007-04-22 01:24 -------- d-----w- c:\program files\MSN Messenger
2009-09-16 11:07 . 2009-09-16 11:07 -------- d-----w- c:\program files\Common Files\Windows Live
2009-09-13 11:55 . 2009-09-13 11:55 -------- d-----w- c:\program files\NavX
2009-09-05 17:48 . 2009-08-11 12:23 -------- d-----w- c:\program files\Iminent
2009-08-28 12:39 . 2009-09-24 13:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 10:15 . 2009-09-24 13:40 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-14 17:07 . 2009-09-24 13:46 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-24 13:46 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-24 13:46 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-24 13:46 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-24 13:46 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-24 13:46 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-24 13:46 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-24 13:46 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-24 13:46 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-24 13:46 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-07 08:04 . 2009-08-11 12:23 2456344 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\IMBoosterSetup.exe
2009-08-04 17:52 . 2009-08-04 17:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\9E97A83F\928B7CFE\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\38028398\48553E6A\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\F8E33052\AAAD2BC2\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\F0CE22AE\E012AF0A\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\A2D0D8C9\1FA51BA4\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\930656A1\BC7D9E7A\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\3F5E3EEC\1BB86D51\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 691200 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\D3E408D\AA2AC949\Iminent.Booster.UI.dll
2009-08-04 12:31 . 2009-08-11 12:21 197120 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\90707029\AA2AC949\Iminent.Windows.dll
2009-08-04 12:31 . 2009-08-11 12:21 182784 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\EC9AEE9D\AA2AC949\Iminent.Workflow.dll
2009-08-04 12:31 . 2009-08-11 12:21 282624 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\426DA447\AA2AC949\Iminent.Business.XmlSerializers.dll
2009-08-04 12:31 . 2009-08-11 12:21 94720 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\74360055\AA2AC949\Iminent.Business.dll
2009-08-04 12:30 . 2009-08-11 12:21 177152 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\D704ADB9\AA2AC949\Iminent.WinCore.Aim.Plugin.dll
2009-08-04 12:30 . 2009-08-11 12:21 9216 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\94A15D79\AA2AC949\Iminent.WinCore.Aim.Proxy.dll
2009-08-04 12:30 . 2009-08-11 12:21 99840 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\54ADB14A\AA2AC949\Iminent.LinkToContent.dll
2009-08-04 12:30 . 2009-08-11 12:21 97792 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\45DC9FB6\AA2AC949\Iminent.WinCore.WLM.PresenceHook.dll
2009-08-04 12:30 . 2009-08-11 12:21 229376 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\646BB144\AA2AC949\Iminent.WinCore.WLM.dll
2009-08-04 12:30 . 2009-08-11 12:21 167424 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\AEBB6988\AA2AC949\Iminent.WinCore.Yahoo.dll
2009-08-04 12:29 . 2009-08-11 12:21 13312 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\6563E87F\AA2AC949\FlvEncoder.exe
2009-08-04 12:29 . 2009-08-11 12:21 42496 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\CE6A9334\AA2AC949\Iminent.WinCore.WLM.WinEvents.dll
2009-08-04 12:29 . 2009-08-11 12:21 76800 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\6219B256\AA2AC949\Iminent.Windows.AxHost.dll
2008-01-20 12:54 . 2008-01-20 12:54 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346de098-61f9-4b42-89da-6dfba7091bb6}]
2009-07-15 08:09 2224152 ----a-w- c:\program files\IMBooster4web-en\tbIMBo.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6E9BAAF-53CD-4575-967B-2AF710A7D21F}]
2009-08-04 12:30 99840 ----a-w- c:\program files\Iminent\IMBooster\Iminent.LinkToContent.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{346de098-61f9-4b42-89da-6dfba7091bb6}"= "c:\program files\IMBooster4web-en\tbIMBo.dll" [2009-07-15 2224152]

[HKEY_CLASSES_ROOT\clsid\{346de098-61f9-4b42-89da-6dfba7091bb6}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{346DE098-61F9-4B42-89DA-6DFBA7091BB6}"= "c:\program files\IMBooster4web-en\tbIMBo.dll" [2009-07-15 2224152]

[HKEY_CLASSES_ROOT\clsid\{346de098-61f9-4b42-89da-6dfba7091bb6}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-25 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Lancement rapide d'Adobe Reader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"="
"
"FirewallOverride"="
"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [09/10/2009 19:31 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [09/10/2009 19:31 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [09/10/2009 19:31 53328]
R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\System32\drivers\R5U870FLx86.sys [18/12/2006 23:31 73472]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\System32\drivers\R5U870FUx86.sys [18/12/2006 23:31 43904]
S2 gupdate1c99ffcc38da2f0;Service Google Update (gupdate1c99ffcc38da2f0);c:\program files\Google\Update\GoogleUpdate.exe [08/03/2009 15:47 133104]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - mbr
.
Contenu du dossier 'Tâches planifiées'

2009-10-31 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-09-26 18:56]

2009-10-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-08 14:46]

2009-10-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-08 14:46]

2009-10-31 c:\windows\Tasks\User_Feed_Synchronization-{05D45C05-ABF7-4DAF-8F95-76C6F65359AD}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]

2009-10-31 c:\windows\Tasks\User_Feed_Synchronization-{B98FE6DB-9E8F-4EBF-8697-30CC13B32FA7}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://neufportail.fr/
mWindow Title =
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-31 12:06
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...


c:\windows\TEMP\catchme.dll 53248 bytes executable

Scan terminé avec succès
Fichiers cachés: 1

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-10-31 12:08
ComboFix-quarantined-files.txt 2009-10-31 11:08
ComboFix2.txt 2009-10-28 11:20

Avant-CF: 31 492 947 968 octets libres
Après-CF: 31 414 865 920 octets libres

- - End Of File - - 19719F79654978AF1837D8D85C742D5E

http://www.cijoint.fr/cjlink.php?file=cj200910/cijui10nfk.txt

ComboFix 09-10-30.01 - prince noir 31/10/2009 16:24.6.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.1013.446 [GMT 1:00]
Lancé depuis: c:\users\prince noir\Desktop\moi.exe
Commutateurs utilisés :: c:\users\prince noir\Desktop\CFScript.txt
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((( Fichiers créés du 2009-09-28 au 2009-10-31 ))))))))))))))))))))))))))))))))))))
.

2009-10-31 15:33 . 2009-10-31 15:33 -------- d-----w- c:\users\Public\AppData\Local\temp
2009-10-31 15:33 . 2009-10-31 15:33 -------- d-----w- c:\users\prince noir\AppData\Local\temp
2009-10-31 15:33 . 2009-10-31 15:33 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-29 12:24 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-29 12:24 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-29 12:24 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-29 12:24 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-29 12:23 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-29 12:23 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-29 12:23 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-29 12:23 . 2009-08-06 18:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-29 12:23 . 2009-08-06 17:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-28 10:39 . 2009-10-28 10:40 -------- d-----w- C:\ToolBar SD
2009-10-28 10:03 . 2009-09-10 15:21 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-28 10:03 . 2009-09-10 15:21 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-26 07:29 . 2009-10-31 14:32 -------- d-----w- c:\program files\ZHPDiag
2009-10-25 21:17 . 2009-10-25 22:19 -------- d-----w- c:\windows\system32\eu-ES
2009-10-25 21:17 . 2009-10-25 22:19 -------- d-----w- c:\windows\system32\ca-ES
2009-10-25 21:17 . 2009-10-25 22:19 -------- d-----w- c:\windows\system32\vi-VN
2009-10-25 20:25 . 2009-10-25 20:25 -------- d-----w- c:\windows\system32\EventProviders
2009-10-25 20:24 . 2009-10-26 07:12 -------- d-----w- C:\1ce0bd34783c305027617fd8b7
2009-10-25 20:07 . 2009-10-25 20:07 -------- d-----w- c:\users\prince noir\AppData\Roaming\Malwarebytes
2009-10-25 20:07 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-25 20:07 . 2009-10-25 20:07 -------- d-----w- c:\programdata\Malwarebytes
2009-10-25 20:07 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-25 20:07 . 2009-10-25 20:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-18 19:14 . 2009-10-18 19:14 653560 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-10-13 19:37 . 2006-11-02 09:46 59904 ----a-w- c:\windows\system32\msasn1.dll
2009-10-13 19:37 . 2009-09-14 09:44 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-13 19:37 . 2009-04-02 12:37 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-09 18:31 . 2009-09-15 10:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-10-09 18:31 . 2009-09-15 10:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-10-09 18:31 . 2009-09-15 10:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-10-09 18:31 . 2009-09-15 10:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-10-09 18:31 . 2009-09-15 10:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-10-09 18:31 . 2009-09-15 10:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-10-09 18:31 . 2009-09-15 10:55 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-10-04 20:49 . 2009-10-04 20:49 -------- d-----w- c:\program files\Alwil Software
2009-10-04 19:24 . 2009-06-15 15:21 499712 ----a-w- c:\windows\system32\kerberos.dll
2009-10-04 19:24 . 2009-06-15 15:22 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-04 19:24 . 2009-06-15 15:24 175104 ----a-w- c:\windows\system32\wdigest.dll
2009-10-04 19:24 . 2009-06-15 15:24 270848 ----a-w- c:\windows\system32\schannel.dll
2009-10-04 19:24 . 2009-06-15 15:23 1256448 ----a-w- c:\windows\system32\lsasrv.dll
2009-10-04 19:24 . 2009-06-15 18:20 439896 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-10-04 19:24 . 2009-06-15 15:24 72704 ----a-w- c:\windows\system32\secur32.dll
2009-10-04 19:24 . 2009-06-15 12:57 9728 ----a-w- c:\windows\system32\lsass.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-31 12:34 . 2006-11-02 15:48 672322 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-31 12:34 . 2006-11-02 15:48 124434 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-31 07:33 . 2009-03-08 14:44 -------- d-----w- c:\programdata\Google Updater
2009-10-31 07:22 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-10-28 10:44 . 2008-03-25 12:20 -------- d-----w- c:\programdata\Symantec
2009-10-28 10:44 . 2007-04-22 01:11 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-10-28 10:44 . 2008-03-25 12:37 -------- d-----w- c:\users\prince noir\AppData\Roaming\Symantec
2009-10-27 22:07 . 2009-01-13 16:59 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-09-28 09:34 . 2007-04-22 01:49 -------- d-----w- c:\program files\Google
2009-09-25 08:56 . 2009-02-05 12:13 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-24 08:31 . 2009-09-24 08:30 -------- d-----w- c:\program files\Windows Live
2009-09-24 08:30 . 2009-09-24 08:30 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-19 12:39 . 2009-09-16 11:28 -------- d-----w- c:\program files\Microsoft
2009-09-16 11:29 . 2007-04-22 01:24 -------- d-----w- c:\program files\MSN Messenger
2009-09-16 11:07 . 2009-09-16 11:07 -------- d-----w- c:\program files\Common Files\Windows Live
2009-09-13 11:55 . 2009-09-13 11:55 -------- d-----w- c:\program files\NavX
2009-09-05 17:48 . 2009-08-11 12:23 -------- d-----w- c:\program files\Iminent
2009-08-28 12:39 . 2009-09-24 13:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 10:15 . 2009-09-24 13:40 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-14 17:07 . 2009-09-24 13:46 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-24 13:46 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-24 13:46 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-24 13:46 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-24 13:46 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-24 13:46 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-24 13:46 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-24 13:46 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-24 13:46 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-24 13:46 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-07 08:04 . 2009-08-11 12:23 2456344 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\IMBoosterSetup.exe
2009-08-04 17:52 . 2009-08-04 17:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\9E97A83F\928B7CFE\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\38028398\48553E6A\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\F8E33052\AAAD2BC2\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\F0CE22AE\E012AF0A\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\A2D0D8C9\1FA51BA4\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\930656A1\BC7D9E7A\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 6144 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\3F5E3EEC\1BB86D51\Iminent.Booster.UI.resources.dll
2009-08-04 12:31 . 2009-08-11 12:21 691200 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\D3E408D\AA2AC949\Iminent.Booster.UI.dll
2009-08-04 12:31 . 2009-08-11 12:21 197120 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\90707029\AA2AC949\Iminent.Windows.dll
2009-08-04 12:31 . 2009-08-11 12:21 182784 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\EC9AEE9D\AA2AC949\Iminent.Workflow.dll
2009-08-04 12:31 . 2009-08-11 12:21 282624 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\426DA447\AA2AC949\Iminent.Business.XmlSerializers.dll
2009-08-04 12:31 . 2009-08-11 12:21 94720 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\74360055\AA2AC949\Iminent.Business.dll
2009-08-04 12:30 . 2009-08-11 12:21 177152 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\D704ADB9\AA2AC949\Iminent.WinCore.Aim.Plugin.dll
2009-08-04 12:30 . 2009-08-11 12:21 9216 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\94A15D79\AA2AC949\Iminent.WinCore.Aim.Proxy.dll
2009-08-04 12:30 . 2009-08-11 12:21 99840 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\54ADB14A\AA2AC949\Iminent.LinkToContent.dll
2009-08-04 12:30 . 2009-08-11 12:21 97792 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\45DC9FB6\AA2AC949\Iminent.WinCore.WLM.PresenceHook.dll
2009-08-04 12:30 . 2009-08-11 12:21 229376 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\646BB144\AA2AC949\Iminent.WinCore.WLM.dll
2009-08-04 12:30 . 2009-08-11 12:21 167424 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\AEBB6988\AA2AC949\Iminent.WinCore.Yahoo.dll
2009-08-04 12:29 . 2009-08-11 12:21 13312 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\6563E87F\AA2AC949\FlvEncoder.exe
2009-08-04 12:29 . 2009-08-11 12:21 42496 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\CE6A9334\AA2AC949\Iminent.WinCore.WLM.WinEvents.dll
2009-08-04 12:29 . 2009-08-11 12:21 76800 ----a-w- c:\programdata\{673514FC-E770-4361-B7E2-0380EB9B62C3}\offline\6219B256\AA2AC949\Iminent.Windows.AxHost.dll
2008-01-20 12:54 . 2008-01-20 12:54 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-10-31_11.06.23 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-10-31 11:06 . 2009-10-31 11:06 53248 c:\windows\temp\catchme.dll
+ 2009-10-31 15:34 . 2009-10-31 15:34 53248 c:\windows\temp\catchme.dll
- 2007-04-22 00:55 . 2009-10-31 07:39 60070 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2007-04-22 00:55 . 2009-10-31 14:31 60070 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2007-09-26 17:21 . 2009-10-31 14:31 14604 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3447421046-3472872243-1551488221-1000_UserData.bin
- 2007-09-26 17:21 . 2009-10-31 10:50 14604 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3447421046-3472872243-1551488221-1000_UserData.bin
- 2009-10-31 10:40 . 2008-01-19 07:41 28728 c:\windows\System32\drivers\msahci.sys
+ 2009-10-31 15:24 . 2008-01-19 07:41 28728 c:\windows\System32\drivers\msahci.sys
- 2008-09-16 11:31 . 2008-01-19 07:41 21560 c:\windows\System32\drivers\atapi.sys
+ 2009-10-31 15:24 . 2008-01-19 07:41 21560 c:\windows\System32\drivers\atapi.sys
+ 2007-09-26 16:58 . 2009-10-31 14:41 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-09-26 16:58 . 2009-10-31 10:47 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-10-28 11:29 . 2009-10-31 14:41 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-10-28 11:29 . 2009-10-31 10:47 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-10-31 14:29 . 2009-10-31 14:29 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-10-31 10:45 . 2009-10-31 10:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-10-31 14:29 . 2009-10-31 14:29 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-10-31 10:45 . 2009-10-31 10:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2007-11-16 12:54 . 2009-10-31 14:44 603626 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2006-11-02 13:05 . 2009-10-31 14:31 112838 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2006-11-02 10:33 . 2009-10-29 07:25 590082 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-10-31 12:34 590082 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-10-31 12:34 102094 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-10-29 07:25 102094 c:\windows\System32\perfc009.dat
+ 2009-07-11 11:51 . 2009-10-31 14:41 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-11 11:51 . 2009-10-29 20:32 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2007-09-26 16:58 . 2009-10-31 10:47 114688 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-09-26 16:58 . 2009-10-31 14:41 114688 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2006-11-02 10:22 . 2009-10-31 10:48 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2006-11-02 10:22 . 2009-10-31 11:31 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346de098-61f9-4b42-89da-6dfba7091bb6}]
2009-07-15 08:09 2224152 ----a-w- c:\program files\IMBooster4web-en\tbIMBo.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6E9BAAF-53CD-4575-967B-2AF710A7D21F}]
2009-08-04 12:30 99840 ----a-w- c:\program files\Iminent\IMBooster\Iminent.LinkToContent.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{346de098-61f9-4b42-89da-6dfba7091bb6}"= "c:\program files\IMBooster4web-en\tbIMBo.dll" [2009-07-15 2224152]

[HKEY_CLASSES_ROOT\clsid\{346de098-61f9-4b42-89da-6dfba7091bb6}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{346DE098-61F9-4B42-89DA-6DFBA7091BB6}"= "c:\program files\IMBooster4web-en\tbIMBo.dll" [2009-07-15 2224152]

[HKEY_CLASSES_ROOT\clsid\{346de098-61f9-4b42-89da-6dfba7091bb6}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-25 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Lancement rapide d'Adobe Reader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"="
"
"FirewallOverride"="
"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [09/10/2009 19:31 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [09/10/2009 19:31 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [09/10/2009 19:31 53328]
R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\System32\drivers\R5U870FLx86.sys [18/12/2006 23:31 73472]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\System32\drivers\R5U870FUx86.sys [18/12/2006 23:31 43904]
S2 gupdate1c99ffcc38da2f0;Service Google Update (gupdate1c99ffcc38da2f0);c:\program files\Google\Update\GoogleUpdate.exe [08/03/2009 15:47 133104]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - mbr
.
Contenu du dossier 'Tâches planifiées'

2009-10-31 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-09-26 18:56]

2009-10-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-08 14:46]

2009-10-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-08 14:46]

2009-10-31 c:\windows\Tasks\User_Feed_Synchronization-{05D45C05-ABF7-4DAF-8F95-76C6F65359AD}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]

2009-10-31 c:\windows\Tasks\User_Feed_Synchronization-{B98FE6DB-9E8F-4EBF-8697-30CC13B32FA7}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://neufportail.fr/
mWindow Title =
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-31 16:34
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-10-31 16:36
ComboFix-quarantined-files.txt 2009-10-31 15:36
ComboFix2.txt 2009-10-31 11:29
ComboFix3.txt 2009-10-31 11:08
ComboFix4.txt 2009-10-28 11:20

Avant-CF: 29 112 594 432 octets libres
Après-CF: 29 074 219 008 octets libres

- - End Of File - - 9640EE994026F1A4754F798FAE504FAD

http://www.cijoint.fr/cjlink.php?file=cj200910/cijztR69A0.txt

Est ce que tu crois que ces soucis peuvent etre le problème des non mise à jours..... A chaque fois que je les installes on me dit les mises à jour n'ont pu être installées

voila le rapport avenger,
par contre ton deuxième lien ne fonctionne pas


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: "C:\Windows\System32\ESQULzxspectrum" is not a folder! It may instead be a file.
Deletion of folder "C:\Windows\System32\ESQULzxspectrum" failed!
Status: 0xc0000103 (STATUS_NOT_A_DIRECTORY)
--> use "Files to delete:" instead of "Folders to delete:" to delete an ordinary file


Completed script processing.

*******************

Finished! Terminate.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\Windows\System32\ESQULzxspectrum" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

j'ai un soucis j'arrive pas a t'envoyer l'autre log ça coince au niveau du forum il ne s'envois pas

et oui j'aurais du y penser avant .....


http://www.cijoint.fr/cjlink.php?file=cj200910/cij9NNMENE.txt

http://www.cijoint.fr/cjlink.php?file=cj200910/cijAxYZdiO.txt

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3071
Windows 6.0.6001 Service Pack 1

31/10/2009 22:20:35
mbam-log-2009-10-31 (22-20-29).txt

Type de recherche: Examen rapide
Eléments examinés: 90022
Temps écoulé: 5 minute(s), 9 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 9

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servises (Malware.Trace) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\prince noir\downloads\setup.exe (Rogue.Installer) -> No action taken.
C:\ProgramData\Microsoft\Windows\Start Menu\TS\Computer Scan.lnk (Rogue.TotalSecurity) -> No action taken.
C:\ProgramData\Microsoft\Windows\Start Menu\TS\Help.lnk (Rogue.TotalSecurity) -> No action taken.
C:\ProgramData\Microsoft\Windows\Start Menu\TS\Registration.lnk (Rogue.TotalSecurity) -> No action taken.
C:\ProgramData\Microsoft\Windows\Start Menu\TS\Security Center.lnk (Rogue.TotalSecurity) -> No action taken.
C:\ProgramData\Microsoft\Windows\Start Menu\TS\Settings.lnk (Rogue.TotalSecurity) -> No action taken.
C:\ProgramData\Microsoft\Windows\Start Menu\TS\Total Security.lnk (Rogue.TotalSecurity) -> No action taken.
C:\ProgramData\Microsoft\Windows\Start Menu\TS\Update.lnk (Rogue.TotalSecurity) -> No action taken.
C:\Users\prince noir\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\TS.lnk (Rogue.TotalSecurity) -> No action taken.

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3071
Windows 6.0.6001 Service Pack 1

31/10/2009 22:35:27
mbam-log-2009-10-31 (22-35-27).txt

Type de recherche: Examen rapide
Eléments examinés: 89991
Temps écoulé: 6 minute(s), 6 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

il marche pas ton lien


moi aussi je commence a fatiguer j'espère que c'est bientôt fini

désolé pour cette longue abscence je vais t'envoyer le rapport rapidement

j'ai un soucis avec ton logiciel(Télécharge SF.exe (de C_XX) sur ton bureau) il met pas mal de temps à tourner et j'ai pas de réponse......

Salut

mon problème de net est enfin réglé ! :)

Tu peux faire la suite donc. car je suis disponible

@+