Tazebama

Merci d'avance .
j'ai téléchargé combofix et je t'envoie le rapport :

ComboFix 10-01-04.01 - tttt 07/01/2010 18:48:42.1.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.479.164 [GMT 0:00]
Lancé depuis: d:\documents and settings\tttt\Bureau\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\1utbfd.bat
D:\2.bat
D:\2fiy.bat
D:\8.bat
D:\a2h2.com
D:\autorun.inf
D:\cv22.cmd
D:\dbrxubcw.com
d:\docume~1\tttt\LOCALS~1\Temp\cvasds0.dll
d:\docume~1\tttt\LOCALS~1\Temp\E_N4
d:\docume~1\tttt\LOCALS~1\Temp\E_N4\cnvpe.fne
d:\docume~1\tttt\LOCALS~1\Temp\E_N4\dp1.fne
d:\docume~1\tttt\LOCALS~1\Temp\E_N4\eAPI.fne
d:\docume~1\tttt\LOCALS~1\Temp\E_N4\HtmlView.fne
d:\docume~1\tttt\LOCALS~1\Temp\E_N4\internet.fne
d:\docume~1\tttt\LOCALS~1\Temp\E_N4\krnln.fnr
d:\docume~1\tttt\LOCALS~1\Temp\E_N4\shell.fne
d:\docume~1\tttt\LOCALS~1\Temp\E_N4\spec.fne
d:\documents and settings\tttt\Application Data\tazebama
D:\gi2ky.exe
D:\hl80c6b1.com
D:\i.com
D:\i6g6x.cmd
D:\jeorels.cmd
D:\m0vnonh.bat
D:\n.com
D:\o.exe
D:\opgde.exe
D:\pook.com
d:\program files\Search Settings
d:\program files\Search Settings\kb127\SearchSettings.dll
d:\program files\Search Settings\kb127\SearchSettingsRes409.dll
d:\program files\Search Settings\SearchSettings.exe
D:\qphdin.com
D:\qxty9be.cmd
D:\u.com
d:\windows\system32\0211661f-7d83-ebd2-b772-d6f37d7bc29a.dll
d:\windows\system32\264670
d:\windows\system32\264670\1737d5.txt
d:\windows\system32\264670\6d434a.txt
d:\windows\system32\6f4279d4-8d24-8b5f-5c0f-a28fecc238f9.exe
d:\windows\system32\ckvo.exe
d:\windows\system32\ckvo0.dll
d:\windows\system32\ckvo1.dll
d:\windows\system32\nmdfgds1.dll
d:\windows\system32\temp1.exe
d:\windows\system32\temp2.exe
d:\windows\ufdata2000.log
D:\xdw.com
D:\zPharaoh.exe
E:\1utbfd.bat
E:\2.bat
E:\2fiy.bat
E:\8.bat
E:\a2h2.com
E:\autorun.inf
E:\cv22.cmd
E:\dbrxubcw.com
E:\gi2ky.exe
E:\hl80c6b1.com
E:\i.com
E:\i6g6x.cmd
E:\jeorels.cmd
E:\m0vnonh.bat
E:\n.com
E:\o.exe
E:\opgde.exe
E:\pook.com
E:\qphdin.com
E:\qxty9be.cmd
E:\u.com
E:\xdw.com
E:\zPharaoh.exe
F:\1utbfd.bat
F:\2.bat
F:\2fiy.bat
F:\8.bat
F:\a2h2.com
F:\Autorun.inf
F:\cv22.cmd
F:\dbrxubcw.com
F:\gi2ky.exe
F:\i.com
F:\i6g6x.cmd
F:\jeorels.cmd
F:\m0vnonh.bat
F:\n.com
F:\opgde.exe
F:\pook.com
F:\qphdin.com
F:\qxty9be.cmd
F:\u.com
F:\xdw.com
F:\zPharaoh.exe
L:\1utbfd.bat
L:\2.bat
L:\2fiy.bat
L:\8.bat
L:\a2h2.com
L:\Autorun.inf
L:\cv22.cmd
L:\dbrxubcw.com
L:\gi2ky.exe
L:\hl80c6b1.com
L:\i.com
L:\i6g6x.cmd
L:\jeorels.cmd
L:\m0vnonh.bat
L:\n.com
L:\o.exe
L:\opgde.exe
L:\pook.com
L:\qphdin.com
L:\qxty9be.cmd
L:\u.com
L:\xdw.com
L:\zPharaoh.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ASC3360PR
-------\Legacy_AVPSYS
-------\Service_asc3360pr
-------\Service_AVPsys


((((((((((((((((((((((((((((( Fichiers créés du 2009-12-07 au 2010-01-07 ))))))))))))))))))))))))))))))))))))
.

2010-01-07 00:43 . 2010-01-07 01:30 -------- d-----w- D:\UsbFix
2010-01-07 00:28 . 2010-01-07 00:28 -------- d-----w- d:\program files\Trend Micro
2010-01-07 00:00 . 2010-01-07 00:20 -------- d-----w- d:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-01-06 21:25 . 2010-01-07 18:24 32768 ----a-w- d:\documents and settings\tazebama.dll
2009-12-19 23:34 . 2009-12-19 23:34 -------- d-----w- d:\documents and settings\tttt\Application Data\Nokia
2009-12-14 20:47 . 2009-12-23 11:15 -------- d--h--w- d:\windows\system32\F92E22
2009-12-14 20:47 . 2009-12-23 11:15 -------- d--h--w- d:\windows\system32\30D620
2009-12-14 20:47 . 2009-12-14 21:02 -------- d--h--w- d:\windows\system32\FF07AB
2009-12-14 13:04 . 2009-12-14 13:04 32 --sha-w- d:\windows\system32\drivers\fidbox2.dat
2009-12-14 13:04 . 2009-12-14 13:04 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
2009-12-13 21:53 . 2009-12-13 22:02 -------- d-----w- d:\documents and settings\tttt\Application Data\Usenet.nl
2009-12-12 11:51 . 2009-12-12 11:51 -------- d-----w- d:\documents and settings\tttt\Application Data\PC Suite
2009-12-12 11:49 . 2009-12-12 11:49 -------- d-----w- d:\program files\Nokia
2009-12-12 11:48 . 2009-12-12 11:48 -------- d-----w- d:\program files\DIFX
2009-12-12 11:48 . 2008-08-26 10:26 18816 ----a-w- d:\windows\system32\drivers\pccsmcfd.sys
2009-12-12 11:48 . 2009-12-12 11:48 -------- d-----w- d:\program files\PC Connectivity Solution
2009-12-12 10:39 . 2009-12-12 10:39 -------- d-----w- d:\program files\MSBuild
2009-12-12 10:34 . 2009-12-18 10:12 -------- d-----w- d:\windows\system32\XPSViewer
2009-12-12 10:34 . 2009-12-12 10:34 -------- d-----w- d:\program files\Reference Assemblies
2009-12-12 10:33 . 2008-07-06 12:06 89088 ----a-w- d:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-12 10:33 . 2006-06-29 13:07 14048 ------w- d:\windows\system32\spmsg2.dll
2009-12-10 19:51 . 2009-12-10 19:51 -------- d-----w- d:\documents and settings\NetworkService\Local Settings\Application Data\Search_USA
2009-12-10 19:51 . 2009-12-10 19:51 -------- d-----w- d:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-12-10 14:49 . 2009-12-10 14:49 -------- d-----w- d:\documents and settings\tttt\Application Data\Apple Computer
2009-12-10 14:44 . 2009-12-10 14:45 -------- d-----w- d:\program files\QuickTime
2009-12-10 14:44 . 2009-12-10 14:44 -------- d-----w- d:\documents and settings\All Users\Application Data\Apple Computer
2009-12-10 14:43 . 2009-12-10 14:43 32572720 ----a-w- d:\program files\QuickTimeInstaller.exe
2009-12-10 03:17 . 2009-12-10 03:17 -------- d-----w- d:\program files\MP4 Player
2009-12-10 03:17 . 2009-12-10 03:17 1116717 ----a-w- d:\program files\mp4PlayerSetup.exe
2009-12-10 03:03 . 2009-12-10 03:03 -------- d-----w- d:\program files\Fichiers communs\xing shared
2009-12-10 02:42 . 2009-12-10 02:43 560152 ----a-w- d:\program files\RealPlayerSPGold_fr.exe
2009-12-09 21:04 . 2009-12-09 21:04 -------- d-----w- d:\program files\Fichiers communs\Apple
2009-12-09 21:04 . 2009-12-09 21:04 -------- d-----w- d:\documents and settings\tttt\Local Settings\Application Data\Apple
2009-12-09 21:03 . 2009-12-09 21:03 -------- d-----w- d:\program files\Apple Software Update
2009-12-09 21:03 . 2009-12-09 21:03 -------- d-----w- d:\documents and settings\All Users\Application Data\Apple
2009-12-09 21:03 . 2009-12-09 21:03 -------- d-----w- d:\documents and settings\tttt\Local Settings\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-07 00:00 . 2008-10-26 22:20 -------- d-----w- d:\program files\Yahoo!
2010-01-03 10:14 . 2008-08-29 19:33 664 ----a-w- d:\windows\system32\d3d9caps.dat
2009-12-19 23:25 . 2008-07-25 19:18 44704 ----a-w- d:\documents and settings\tttt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-19 22:44 . 2004-08-05 12:00 80748 ----a-w- d:\windows\system32\perfc00C.dat
2009-12-19 22:44 . 2004-08-05 12:00 500900 ----a-w- d:\windows\system32\perfh00C.dat
2009-12-14 21:24 . 2008-07-25 20:42 -------- d-----w- d:\program files\Google
2009-12-14 13:04 . 2009-12-14 13:04 32 --sha-w- d:\windows\system32\drivers\fidbox2.idx
2009-12-14 13:04 . 2009-12-14 13:04 32 --sha-w- d:\windows\system32\drivers\fidbox.idx
2009-12-10 21:39 . 2009-10-18 20:11 -------- d-----w- d:\documents and settings\tttt\Application Data\Skype
2009-12-10 18:39 . 2008-10-09 20:48 -------- d-----w- d:\documents and settings\tttt\Application Data\skypePM
2009-12-10 03:04 . 2008-07-25 20:39 -------- d-----w- d:\program files\Fichiers communs\Real
2009-12-06 01:16 . 2009-12-06 01:04 -------- d-----w- d:\program files\Search_USA
2009-12-06 01:04 . 2008-10-27 01:51 -------- d-----w- d:\program files\Conduit
2009-11-24 14:45 . 2009-11-24 14:45 -------- d-----w- d:\program files\Fichiers communs\Cisco Systems
2009-10-29 07:44 . 2004-08-05 12:00 832512 ----a-w- d:\windows\system32\wininet.dll
2009-10-29 07:44 . 2004-08-05 12:00 78336 ----a-w- d:\windows\system32\ieencode.dll
2009-10-29 07:44 . 2004-08-05 12:00 17408 ------w- d:\windows\system32\corpol.dll
2009-10-24 11:22 . 2008-08-01 13:16 348160 ----a-w- d:\windows\system32\msvcr71.dll
2009-10-24 11:22 . 2008-08-28 18:13 499712 ----a-w- d:\windows\system32\msvcp71.dll
2009-10-21 05:39 . 2004-08-05 12:00 75776 ----a-w- d:\windows\system32\strmfilt.dll
2009-10-21 05:39 . 2004-08-05 12:00 25088 ----a-w- d:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-05 12:00 265728 ----a-w- d:\windows\system32\drivers\http.sys
2009-10-13 10:33 . 2004-08-05 12:00 271360 ----a-w- d:\windows\system32\oakley.dll
2009-10-12 13:39 . 2004-08-05 12:00 79872 ----a-w- d:\windows\system32\raschap.dll
2009-10-12 13:39 . 2004-08-05 12:00 150528 ----a-w- d:\windows\system32\rastls.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{48405d3d-2674-4cd8-b1ef-9a719443bd3f}"= "d:\program files\Search_USA\tbSea1.dll" [2009-12-06 2166296]

[HKEY_CLASSES_ROOT\clsid\{48405d3d-2674-4cd8-b1ef-9a719443bd3f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{48405d3d-2674-4cd8-b1ef-9a719443bd3f}]
2009-12-06 01:17 2166296 ----a-w- d:\program files\Search_USA\tbSea1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{48405d3d-2674-4cd8-b1ef-9a719443bd3f}"= "d:\program files\Search_USA\tbSea1.dll" [2009-12-06 2166296]

[HKEY_CLASSES_ROOT\clsid\{48405d3d-2674-4cd8-b1ef-9a719443bd3f}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{48405D3D-2674-4CD8-B1EF-9A719443BD3F}"= "d:\program files\Search_USA\tbSea1.dll" [2009-12-06 2166296]

[HKEY_CLASSES_ROOT\clsid\{48405d3d-2674-4cd8-b1ef-9a719443bd3f}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="d:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5821808]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="d:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-05-08 230960]
"UMService"="d:\program files\LG Electronics\Modem USB LG Electronics\UMAService.exe" [2008-05-09 28672]
"MP4 Player"="d:\program files\MP4 Player\mp4Player.exe" [2008-11-06 772096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSPower"="SiSPower.dll" [2006-08-22 49152]
"NeroFilterCheck"="d:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 225280]
"Lexmark 1200 Series"="d:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 131072]
"SoundMan"="SOUNDMAN.EXE" [2006-06-21 577536]
"RavMont"="d:\windows\system32\RavMon.exe" [2005-08-21 131072]
"Adobe Reader Speed Launcher"="f:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 109424]
"MsgCenterExe"="d:\program files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" [2009-12-10 144952]
"578F9A"="d:\windows\system32\32CECA\578F9A.EXE" [2009-11-24 1482694]
"TkBellExe"="d:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-12-10 267792]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2009-11-10 499712]
"66AC46"="d:\windows\system32\FF07AB\66AC46.EXE" [2009-12-14 1482694]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

d:\documents and settings\tttt\Menu D‚marrer\Programmes\D‚marrage\
578F9A.lnk - d:\windows\system32\32CECA\578F9A.EXE [2009-11-24 1482694]
66AC46.lnk - d:\windows\system32\FF07AB\66AC46.EXE [2009-12-14 1482694]
Reboot.exe [2004-10-1 334336]

d:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BlueSoleil.lnk - d:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2008-8-10 1257472]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\french\\setup.exe"=
"d:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Ares\\Ares.exe"=
"d:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\WINDOWS\\system32\\LEXPPS.EXE"=
"d:\\Program Files\\MSN Messenger\\msnmsgr.exe"= d:\\Program Files\\MSN Messenger\\MsnMsgr.Exe
"d:\\Program Files\\MSN Messenger\\livecall.exe"=
"d:\\Program Files\\Fichiers communs\\Ahead\\Lib\\NeroCheck.exe"=
"d:\\WINDOWS\\system32\\RavMon.exe"=
"d:\\Program Files\\Lexmark 1200 Series\\lxczbmgr.exe"=
"d:\\WINDOWS\\system32\\32CECA\\578F9A.EXE"=
"f:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe"=
"d:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe"=
"d:\\Program Files\\Windows Live Toolbar\\msn_sl.exe"=
"d:\\Program Files\\MSN Messenger\\usnsvc.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\Program Files\\Fichiers communs\\Microsoft Shared\\Source Engine\\OSE.EXE"=
"d:\\Program Files\\PC Connectivity Solution\\Transports\\NclUSBSrv.exe"=
"d:\\Program Files\\PC Connectivity Solution\\ServiceLayer.exe"=
"d:\\Program Files\\LG Electronics\\Modem USB LG Electronics\\IEUM.exe"=
"d:\\program files\\real\\realplayer\\RealPlay.exe"=
"d:\\Program Files\\Fichiers communs\\Microsoft Shared\\Windows Live\\WLLoginProxy.exe"=
"d:\\WINDOWS\\system32\\FF07AB\\66AC46.EXE"=
"d:\\Program Files\\Windows Live Toolbar\\MSNTBUP.EXE"=
"d:\\Program Files\\Fichiers communs\\Adobe\\Updater6\\Adobe_Updater.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5000:TCP"= 5000:TCP:AresChatServer

R0 sptd;sptd;d:\windows\system32\drivers\sptd.sys [27/10/2008 01:48 716272]
R3 UsbEvdoAtc;LGE EVDO USB Serial Port;d:\windows\system32\drivers\lgevdoatc.sys [15/10/2009 22:30 19840]
R3 usbevdobus;LGE EVDO Composite USB Device;d:\windows\system32\drivers\lgevdobus.sys [15/10/2009 22:30 12800]
R3 UsbEvdoDiag;LGE EVDO USB Serial DM Port;d:\windows\system32\drivers\lgevdodiag.sys [15/10/2009 22:30 19840]
R3 USBEVDOModem;LGE EVDO USB Modem;d:\windows\system32\drivers\lgevdomodem.sys [15/10/2009 22:30 21632]
S3 PAC207;SoC PC-Camera Beta3;d:\windows\system32\drivers\pfc027.sys [24/02/2005 12:29 162176]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - ASC3360PR
.
Contenu du dossier 'Tâches planifiées'

2009-12-31 d:\windows\Tasks\AppleSoftwareUpdate.job
- d:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2010-01-06 d:\windows\Tasks\User_Feed_Synchronization-{7FF7F376-9083-4171-A494-5CEA7AD16962}.job
- d:\windows\system32\msfeedssync.exe [2007-08-13 16:36]

2010-01-07 d:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- d:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-09-27 17:39]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.youtube.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://fr.yahoo.com
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
IE: &Windows Live Search - d:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xporter vers Microsoft Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: quran-recitation.info\www
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{742a96ed-ac52-86fe-c108-cd4d06b9d0a0} - d:\windows\system32\0211661f-7d83-ebd2-b772-d6f37d7bc29a.dll
HKLM-Run-SearchSettings - d:\program files\Search Settings\SearchSettings.exe
AddRemove-6f4279d4-8d24-8b5f-5c0f-a28fecc238f9 - d:\windows\system32\6f4279d4-8d24-8b5f-5c0f-a28fecc238f9.exe
AddRemove-Usenet.nl_is1 - j:\psp\GAME\Usenet.nl\unins000.exe
AddRemove-UnityWebPlayer - d:\documents and settings\tttt\Local Settings\Application Data\Unity\WebPlayer\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-07 18:56
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spdq.sys >>UNKNOWN [0x85993938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7516f28
\Driver\ACPI -> ACPI.sys @ 0xf7293cb8
\Driver\atapi -> atapi.sys @ 0xf7228b40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-823518204-606747145-839522115-1003\RemoteAccess\Profile\x *]
"EnableAutodisconnect"=dword:00000001
"EnableExitDisconnect"=dword:00000001
"DisconnectIdleTime"=dword:00000014

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(332)
d:\windows\system32\PortableDeviceApi.dll
d:\windows\system32\eappprxy.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
.
------------------------ Autres processus actifs ------------------------
.
d:\windows\system32\LEXBCES.EXE
d:\windows\system32\LEXPPS.EXE
d:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
d:\windows\System32\PAStiSvc.exe
d:\windows\system32\WgaTray.exe
d:\windows\SOUNDMAN.EXE
d:\program files\Lexmark 1200 Series\lxczbmon.exe
d:\windows\system32\wscntfy.exe
d:\program files\LG Electronics\Modem USB LG Electronics\IEUM.exe
d:\program files\internet explorer\iexplore.exe
d:\program files\real\realplayer\RealPlay.exe
d:\program files\real\realplayer\RealPlay.exe
d:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
d:\program files\Windows Live Toolbar\msn_sl.exe
.
**************************************************************************
.
Heure de fin: 2010-01-07 19:02:25 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-01-07 19:02

Avant-CF: 2 987 130 880 octets libres
Après-CF: 5 235 916 800 octets libres

- - End Of File - - A876472A8989D81E75F299706DCD07B3