Infecté par Conficker - Page 2

C'est pas fini alors n'ose pas t'en aller comme sa !

Voila celui de Microsoft :

https://www.microsoft.com/fr-fr/security

Le tuto :

https://support.microsoft.com/en-us/help/891716/deploy-windows-malicious-software-removal-tool-in-an-enterprise-enviro

=====

N'oublie pas de lancer un examen avec Malwarebyte's et m'envoyer le rapport :

https://forums.commentcamarche.net/forum/affich-16145571-infecte-par-conficker?page=2#21

ok

j'ai un probleme apres la mise a jour . Lors de l'installation j'ai eu une erreur

C:\program files\Malwarebytes'Anti-Malware\mbam.dll
Une erreur est survenue lors du remplacement d'un fichier existant:
DeleteFile a échoué ; code 5.
Accés reffusé.

Abondonner Recommencer Ignorer

As tu d'abord exécuté l'outil contre Conficker ?

https://forums.commentcamarche.net/forum/affich-16145571-infecte-par-conficker?page=2#24

j'ai d'abbord executé kido removal tool je suis allé le chercher sur telecharger.com

Tu la lancer OUI ou NON ? Il a fait son boulot ?

oui il a fait son boulout et j'ai redémaré du coup le message de svchost apparait encore

alors qu'est ce que je vais faire maintenant

Essaye en mode sans échec (seulement pour la MAJ) l'analyse en mode normale...

j'ai reassayé et cette fois ça marche . je viens de commencer l'analyse

OK, n'oublie pas d'envoyer le rapport à la fin...

voila le rapport mbam

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3563
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

14/01/2010 22:47:49
mbam-log-2010-01-14 (22-47-49).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 163421
Temps écoulé: 1 hour(s), 22 minute(s), 44 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\XPROTECTOR (Backdoor.Trojan) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\meteorite (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Administrateur\Bureau\eBooster uploded by m-bourne startimes2\patch\eboostr.v3.0.build.491-patch.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\PCNetSoftware\RAC Server\rac.server.3.3.1-patch-icu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Universal Share Downloader\Reconnecter\Tele2box.exe (Trojan.StartPage) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ckl009.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\d3dx10d.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\maintrysups.exe (Trojan.Agent) -> Quarantined and deleted successfully.

OK,

1°/

Vide la qurantaine de Malwarebyte's :

> Lance Malwarebyte's
> Onglet quarantaine
> Supprimer tout

2°/

▶ Télécharge DDS.scr de sUBs Sur le bureau.:

▶ L'outil ne nécessite pas d'installation.

▶ Lance-le en cliquant sur l'icône dds.scr

▶ Cette fenêtre DOS va apparaitre:

▶ Le scan ne doit pas dépasser trois minutes.
▶ Un premier rapport va s'ouvrir que tu enregistreras sous DDS.txt par défaut sur le bureau.
▶ Il te sera demandé si tu veux faire le scan optionnel.
▶ Accepte par Oui
▶ Un nouveau rapport s'ouvre que tu enregistres sous Attach.txt sur le bureau.
▶ Tu ne le fourniras que si nécessaire.
▶ Poste le rapport DDS.txt

DDS (Ver_09-12-01.01) - NTFSx86
Run by Administrateur at 23:10:08,06 on 14/01/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.247.95 [GMT 0:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\PCNetSoftware\RAC Server\RACs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
D:\DJiNN\utdefender.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\CCleaner\ccleaner.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Documents and Settings\Administrateur\Bureau\dds.scr

============== Pseudo HJT Report ===============

uWindow Title = Windows Internet Explorer
uURLSearchHooks: H - No File
uWindows: run=c:\windows\system32\scvhost.exe
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {00000000-5736-4205-0008-F7ED0776FB27} - No File
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [USB Threat Defender] "d:\djinn\utdefender.exe" /b
uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [Smapp] c:\program files\analog devices\soundmax\SMTray.exe
mRun: [DrvLsnr] c:\program files\analog devices\soundmax\DrvLsnr.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"
mRunOnce: [WIAWizardMenu] RUNDLL32.EXE c:\windows\system32\sti_ci.dll,WiaCreateWizardMenu
mRunServices: [Generic Host Process] c:\windows\system32\scvhost.exe
mExplorerRun: [Generic Host Process] c:\windows\system32\scvhost.exe
StartupFolder: c:\docume~1\admini~1\menudm~1\progra~1\dmarra~1\transbar.lnk - c:\windows\bricopacks\vista inspirat 2\transbar\TransBar.exe
StartupFolder: c:\docume~1\admini~1\menudm~1\progra~1\dmarra~1\ubericon.lnk - c:\windows\bricopacks\vista inspirat 2\ubericon\UberIcon Manager.exe
uPolicies-explorer: NoWindowsUpdate = 0 (0x0)
uPolicies-explorer: NoViewOnDrive = 0 (0x0)
uPolicies-explorer: HonorAutoRunSetting = 0 (0x0)
mPolicies-explorer: NoWindowsUpdate = 0 (0x0)
mPolicies-explorer: NoViewOnDrive = 0 (0x0)
IE: &NeoTrace It! - c:\progra~1\neotra~1\NTXcontext.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Télécharger avec IDM - c:\program files\internet download manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\internet download manager\IEGetAll.htm
IE: {E59EB121-F339-4851-A3BA-FE49C35617C2} - c:\program files\icq6.5\ICQ.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
LSP: c:\program files\avira\antivir desktop\avsda.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\fichie~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
Notify: RACServerLogon - RACServerLogon2.dll
LSA: Authentication Packages = msv1_0 nwprovau
mASetup: {15FB8F0F-A66C-D1D0-3AF5-6C7D694A67A2} - c:\program files\bifrost\server.exe s

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\76n0mnyw.default\
FF - component: c:\documents and settings\administrateur\application data\idm\idmmzcc3\components\idmmzcc.dll
FF - component: c:\documents and settings\administrateur\application data\mozilla\firefox\profiles\76n0mnyw.default\extensions\playbox@toolbar\components\toolbarhomewmp.dll
FF - plugin: c:\documents and settings\administrateur\application data\mozilla\firefox\profiles\76n0mnyw.default\extensions\technicianconsole@logmeinrescue.com\platform\winnt\plugins\npRescue.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-12-19 11608]
R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\avira\antivir desktop\avmailc.exe [2009-12-19 194817]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\avira\antivir desktop\sched.exe [2009-12-19 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-12-19 185089]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\avira\antivir desktop\avwebgrd.exe [2009-12-19 434945]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-12-19 56816]
R2 RACDriver;RAC driver;c:\program files\pcnetsoftware\rac server\RACDriver.sys [2010-1-13 8208]
S2 bdtclznj;Security Network;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
S2 hmwqlfjq;System Security;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
S2 mrkjyhavd;Installer Universal;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
S3 FlyPCI;FlyPCI;c:\windows\system32\drivers\FlyPCI.sys [2009-12-13 4134]
S3 JiurlPortHide;JiurlPortHide; [x]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-12-11 238960]
S3 VMHybrid;VMHybrid service;c:\windows\system32\drivers\vmhybrid.sys --> c:\windows\system32\drivers\VMHybrid.sys [?]

=============== Created Last 30 ================

2010-01-14 18:07:58 0 d-----w- c:\windows\ServicePackFiles
2010-01-14 16:58:17 0 d-----w- c:\windows\system32\CatRoot_bak
2010-01-14 16:49:58 272768 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-01-14 16:49:58 272768 ------w- c:\windows\system32\drivers\bthport.sys
2010-01-14 16:49:06 82432 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-01-14 16:47:45 128512 -c----w- c:\windows\system32\dllcache\dhtmled.ocx
2010-01-14 16:46:35 202752 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-01-14 16:46:33 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-14 16:46:29 333184 -c----w- c:\windows\system32\dllcache\srv.sys
2010-01-14 16:46:25 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-01-14 16:46:23 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-01-14 16:46:14 683520 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-14 16:45:57 2138112 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-14 16:45:56 2182400 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-01-14 16:45:56 2059776 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-01-14 16:45:55 2017792 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-14 16:45:42 655872 -c----w- c:\windows\system32\dllcache\mstscax.dll
2010-01-14 16:45:37 351232 -c----w- c:\windows\system32\dllcache\winhttp.dll
2010-01-14 16:45:34 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-01-14 16:38:10 0 d-----w- c:\windows\system32\PreInstall
2010-01-14 16:37:58 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2010-01-14 16:36:57 1196000 -c----w- c:\windows\system32\dllcache\sysmain.sdb
2010-01-14 16:36:51 470528 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-14 16:25:05 294912 -c----w- c:\windows\system32\dllcache\msctf.dll
2010-01-14 16:13:26 0 d-----w- c:\windows\system32\SoftwareDistribution
2010-01-14 15:52:20 0 d-sha-r- C:\autorun.inf
2010-01-14 14:55:17 0 d-----w- C:\UsbFix
2010-01-14 14:42:49 0 d-----w- c:\program files\trend micro
2010-01-14 14:35:40 0 d-----w- c:\docume~1\admini~1\applic~1\BitDefender Deployment Tool
2010-01-14 14:33:25 0 d-----w- c:\program files\BitDefender
2010-01-14 14:32:13 0 d-----w- c:\program files\fichiers communs\BitDefender
2010-01-13 22:18:12 0 d-----w- c:\docume~1\admini~1\applic~1\Malwarebytes
2010-01-13 22:18:02 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-13 22:18:00 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-13 22:18:00 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-13 22:18:00 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-13 18:21:54 57344 ----a-w- c:\windows\system32\RACServerLogon2.dll
2010-01-13 18:21:44 57344 ----a-w- c:\windows\system32\RACServerLogon.dll
2010-01-13 18:21:42 0 d-----w- c:\program files\PCNetSoftware
2010-01-13 17:53:45 357376 ----a-w- c:\program files\regsearch.exe
2010-01-13 17:50:33 434 --sha-r- c:\documents and settings\administrateur\ntuser.pol
2010-01-13 16:56:37 0 d-----w- c:\program files\AWinstall
2010-01-13 14:58:12 0 d-----w- C:\Lyrics
2010-01-13 14:55:26 0 d-----w- c:\program files\Minilyrics
2010-01-13 12:51:36 0 d-----w- c:\program files\NeoTrace Express
2010-01-13 12:36:46 114688 ----a-w- c:\windows\system32\btcamvideosource.dll
2010-01-13 12:36:45 0 d-----w- c:\program files\Mobiola Web Camera 2 for S60 3rd Edition
2010-01-12 22:54:18 101 ----a-w- c:\windows\system32\lncom_.exe.bat
2010-01-12 21:17:13 0 d-----w- c:\windows\system32\language
2010-01-12 21:17:12 0 d-----w- c:\windows\system32\Images
2010-01-12 21:17:12 0 d-----w- c:\windows\system32\Download
2010-01-12 20:50:48 0 d-----w- c:\program files\UPX Shell
2010-01-12 19:46:59 41888 ----a-w- c:\windows\system32\drivers\Oreans.sys
2010-01-12 19:46:26 0 d-----w- c:\docume~1\admini~1\applic~1\MimarSinan
2010-01-12 14:03:20 0 d-----w- c:\docume~1\admini~1\applic~1\IconChanger
2010-01-12 14:00:45 0 d-----w- c:\program files\IconChanger
2010-01-11 14:13:03 0 d-----w- c:\docume~1\admini~1\applic~1\LogMeIn Rescue
2010-01-11 14:10:32 0 d-----w- c:\program files\LogMeIn Rescue
2010-01-11 14:02:35 0 d-----w- c:\program files\MSN Password Recovery
2010-01-11 12:19:41 0 d-----w- c:\program files\MyLanViewer
2010-01-10 22:41:35 36864 ----a-w- c:\windows\system32\SDDEVMGR.dll
2010-01-10 21:34:09 356352 ----a-w- c:\windows\bkuninst.exe
2010-01-10 21:34:09 0 d-----w- c:\program files\Hotmail Popper
2010-01-10 21:31:12 0 d-----w- c:\docume~1\admini~1\applic~1\Esteem Technology
2010-01-10 21:30:44 0 d-----w- c:\program files\Break Reminder 3
2010-01-08 20:46:12 1402 ----a-w- c:\windows\AZPR3.INI
2010-01-08 20:46:04 0 d-----w- c:\program files\ElcomSoft
2010-01-08 20:32:08 0 d-----w- c:\docume~1\admini~1\applic~1\Avira
2010-01-08 20:30:12 0 d-----w- c:\program files\SuperScan
2010-01-08 20:08:44 0 d-----w- c:\program files\Power Email Harvester
2010-01-02 10:45:35 0 d-sh--w- C:\found.001
2009-12-28 17:04:13 12288 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-12-27 14:36:00 52263 ----a-w- c:\windows\BricoPackUninst.cmd
2009-12-27 14:35:42 5760054 ----a-w- c:\windows\BricoPack Wallpaper.bmp
2009-12-27 14:32:48 6120 ----a-w- c:\windows\BricoPackFoldersDelete.cmd
2009-12-27 14:32:02 0 d-----w- c:\windows\BricoPacks
2009-12-27 14:16:02 0 d-----w- c:\windows\system32\VIRepair
2009-12-27 13:50:58 0 d-----w- c:\docume~1\admini~1\applic~1\ViStart
2009-12-27 13:50:50 0 d-----w- c:\docume~1\admini~1\applic~1\ViSplore
2009-12-27 13:50:47 0 d-----w- c:\docume~1\admini~1\applic~1\ViGlance
2009-12-27 13:45:35 146412 ----a-w- c:\windows\system32\vilaunch.exe
2009-12-27 13:38:48 78942 ----a-w- c:\windows\Icon_1.ico
2009-12-27 13:38:17 0 d-----w- c:\windows\system32\VITrans
2009-12-27 13:38:16 0 d-----w- C:\VTPFiles
2009-12-27 13:38:15 94208 ----a-w- c:\windows\system32\pskill.exe
2009-12-27 13:38:15 8636 ----a-w- c:\windows\system32\modifype.exe
2009-12-27 13:38:15 69632 ----a-w- c:\windows\system32\moveex.exe
2009-12-27 13:38:15 19968 ----a-w- c:\windows\system32\reico.exe
2009-12-27 13:38:15 111104 ----a-w- c:\windows\system32\Uharc.exe
2009-12-27 13:36:26 20480 ----a-w- c:\windows\system32\scrnrdr.exe
2009-12-27 10:42:15 0 d-----w- c:\program files\ICQ6Toolbar
2009-12-27 10:41:56 0 d-----w- c:\docume~1\alluse~1\applic~1\ICQ
2009-12-27 10:37:53 0 d-----w- c:\program files\ICQ6.5
2009-12-26 23:03:25 0 d-----w- c:\program files\VideoLAN
2009-12-26 19:21:01 0 d-----w- c:\docume~1\admini~1\applic~1\TeamViewer
2009-12-26 19:20:41 0 d-----w- c:\program files\TeamViewer
2009-12-26 19:19:11 0 d-----w- c:\documents and settings\administrateur\temp
2009-12-26 19:01:39 0 d-----w- c:\program files\Internet Download Manager
2009-12-26 18:43:05 0 d-----w- c:\docume~1\admini~1\applic~1\IDM
2009-12-25 21:39:35 0 d-----w- c:\program files\EasyPHP 3.0
2009-12-25 21:05:29 0 d--h--w- c:\windows\system32\GroupPolicy
2009-12-25 18:51:27 219648 -c--a-w- c:\windows\system32\dllcache\uxtheme.dll
2009-12-25 16:09:03 0 d-----w- c:\docume~1\admini~1\applic~1\Passware
2009-12-25 15:52:04 0 d-----w- c:\program files\Unlocker
2009-12-25 15:23:27 0 d-----w- c:\docume~1\admini~1\applic~1\Thinstall
2009-12-24 23:08:23 0 d-----w- c:\program files\UxTheme Multipatcher Fr
2009-12-24 22:43:44 0 d-----w- c:\program files\HDDGURU LLF Tool
2009-12-24 16:33:03 0 d-----w- c:\program files\ophcrack
2009-12-24 13:06:53 0 d-----w- c:\docume~1\admini~1\applic~1\BACS.exe
2009-12-23 23:35:37 74240 ----a-w- c:\windows\system32\DWRCST.EXE
2009-12-23 23:23:37 0 d-----w- c:\docume~1\admini~1\applic~1\DWMRCMSI
2009-12-23 23:14:55 0 d-----w- c:\docume~1\admini~1\applic~1\DameWare Development
2009-12-23 15:26:08 0 d-----w- c:\program files\PhotoInstrument
2009-12-23 13:08:29 9600 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-12-22 12:13:25 0 d-sh--w- C:\found.000
2009-12-21 13:21:48 0 d-----w- c:\program files\ImTOO
2009-12-20 14:55:27 0 d-----w- c:\program files\Sierra
2009-12-20 14:49:28 0 d-----w- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite
2009-12-20 14:48:26 0 d-----w- c:\program files\DAEMON Tools Toolbar
2009-12-20 14:48:17 0 d-----w- c:\program files\DAEMON Tools Lite
2009-12-20 14:48:00 0 d-----w- c:\docume~1\admini~1\applic~1\DAEMON Tools Lite
2009-12-20 13:34:51 0 d-----w- c:\program files\DAEMON Tools Pro
2009-12-20 00:03:42 0 d-----w- c:\program files\3D Driving-School
2009-12-19 22:54:27 0 d-----w- c:\program files\VirtualDJ
2009-12-19 20:39:25 0 d-----w- c:\program files\Avira
2009-12-19 19:15:20 0 d-----w- c:\docume~1\admini~1\applic~1\Xfire
2009-12-19 19:15:01 0 d-----w- c:\program files\Xfire
2009-12-19 18:08:45 0 d-----w- c:\docume~1\alluse~1\applic~1\Avg8
2009-12-19 17:50:48 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-19 17:50:35 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira
2009-12-19 15:53:30 0 d--h--w- C:\$AVG8.VAULT$
2009-12-19 15:37:24 10520 ------w- c:\windows\system32\avgrsstx.dll.install_backup
2009-12-17 12:08:47 0 d-----w- c:\program files\AMT Media Manager
2009-12-17 00:29:07 16224 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-12-17 00:29:06 0 d-----w- c:\program files\Hamachi
2009-12-16 13:24:03 0 d-----w- c:\program files\Activision
2009-12-16 13:19:37 0 d-sh--w- c:\windows\ftpcache

==================== Find3M ====================

2010-01-14 22:57:26 69792 ----a-w- c:\windows\system32\perfc00C.dat
2010-01-14 22:57:26 455782 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-13 17:55:21 686 ----a-w- c:\program files\RegSearch.txt
2009-12-19 18:04:22 428032 ----a-w- c:\windows\system32\cmd.exe
2009-12-19 17:40:07 308224 ----a-w- c:\windows\IsUn040c.exe
2009-12-19 16:17:14 118272 ----a-w- c:\windows\system32\calc.exe
2009-12-19 16:17:10 444928 ----a-w- c:\windows\system32\mspaint.exe
2009-12-19 16:17:06 411648 ----a-w- c:\windows\system32\mstsc.exe
2009-12-19 16:17:04 152576 ----a-w- c:\windows\system32\sndvol32.exe
2009-12-19 16:17:00 182272 ----a-w- c:\windows\system32\sndrec32.exe
2009-12-19 16:16:58 1230848 ----a-w- c:\windows\system32\ntbackup.exe
2009-12-19 16:16:54 80896 ----a-w- c:\windows\system32\charmap.exe
2009-12-19 16:13:58 128000 ----a-w- c:\windows\system32\mshearts.exe
2009-12-19 16:13:54 119808 ----a-w- c:\windows\system32\WINmine.exe
2009-12-19 16:13:50 55808 ----a-w- c:\windows\system32\freecell.exe
2009-12-19 16:08:52 57344 ----a-w- c:\windows\system32\sol.exe
2009-12-19 16:08:50 539136 ----a-w- c:\windows\system32\spider.exe
2009-12-19 16:03:33 32768 ----a-w- c:\windows\system32\odbcad32.exe
2009-12-15 12:21:52 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2009-12-06 16:59:28 722416 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-02 19:49:08 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-02 17:41:53 21892 ----a-w- c:\windows\system32\emptyregdb.dat
2009-11-30 19:37:34 41872 ----a-w- c:\windows\system32\xfcodec.dll
2007-06-03 18:35:56 2560 ----a-w- c:\program files\History.txt
2007-06-03 18:31:22 916 ----a-w- c:\program files\Options.txt

============= FINISH: 23:11:09,12 ===============

http://www.cijoint.fr/cjlink.php?file=cj201001/cijacRke4r.txt

tu pourrais me repondre vite s'il te plait parceque je dois partir dans 15min

on va devoir reprendre tout ça demain apres-midi . bonne nuit

Salut,

Pour avancer,
Y a bien du conficker.

Si vous êtes sous Vista Désactivez l'UAC

/!\ ATTENTION SUIVRE SCRUPULEUSEMENT A LA LETTRE CES INDICATIONS /!\

_________________________________________________________________
>>>>>>>>>> ! Le logiciel qui suit n'est pas a utiliser a la légère ! <<<<<<<<<<
> /!\ Ce logiciel est TRÈS PUISSANT et peut causer des dégâts sur ton système /!\ <
>>>>>>>> ! Prends ton temps pour lire les tutoriels et les indications ! <<<<<<<<
=========================================================

==========>>> !! A lire, Impératif !! <<<==========

Fais un clic droit ici

Choisis "Enregistrer la cible du lien..." Au lieu de Combofix.exe -> Tape Moi.exe .

Clique sur "enregistrer" et laisse le téléchargement se faire.

AVANT d'utiliser ComboFix :

▶ /!\ Déconnecte ton PC d'Internet et referme les fenêtres de tous les programmes en cours. /!\
▶ (!) Désactive provisoirement (et seulement le temps de l'utilisation de ComboFix), la protection en temps réel de ton Antivirus et de tes Antispywares et de TOUT tes logiciels de protection (!).
( Tutoriel si besoin )

▶ Double clique sur ComboFix.exe afin de le lancer (Sous Vista: Clique droit et choisir " Exécuter en tant qu'administrateur")

▶ Note :
Sous XP : L'outil va te demander si tu souhaite installer la console de récupération (image) .
Reconnecte toi , Puis clique sur "YES" , et une fois la console installée :
! Déconnecte toi d'internet, (très important) !.

▶ Répond par Oui / Yes au message d'avertissement pour que le programme commence à procéder à l'analyse du pc.

!!!!! NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS, CLAVIER.....) !!!!!

▶ A la fin du scan, il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection, laisse le travailler.

▶ Après le redémarrage du PC, un rapport s'ouvrira dans le Bloc Notes en fin d'analyse,

▶ Réactive toutes tes défenses, reviens sur le forum puis copie et colle le rapport dans ton a ta prochaine réponse.

Note :
(Le fichier rapport Combofix.txt , est ensuite automatiquement sauvegardé dans C:\Combofix.txt)

voila le rapport
ComboFix 10-01-14.06 - Administrateur 15/01/2010 12:45:14.1.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.247.78 [GMT 0:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\moi.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrateur\Application Data\onload.exe
c:\program files\ICQ6.5\updates\ICQLRun.exe.91c2e91e127ccb34d0b0bbd8b0533169
c:\windows\system32\download
c:\windows\system32\images
c:\windows\system32\Language
c:\windows\system32\Language\English.ini
c:\windows\system32\msssc.dll
c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_JIURLPORTHIDE
-------\Legacy_XPROTECTOR
-------\Service_JiurlPortHide

((((((((((((((((((((((((((((( Fichiers créés du 2009-12-15 au 2010-01-15 ))))))))))))))))))))))))))))))))))))
.

2010-01-14 18:07 . 2010-01-14 18:07 -------- d-----w- c:\windows\ServicePackFiles
2010-01-14 16:58 . 2010-01-14 22:31 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-01-14 16:49 . 2008-06-14 17:59 272768 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-01-14 16:49 . 2008-06-14 17:59 272768 ------w- c:\windows\system32\drivers\bthport.sys
2010-01-14 16:49 . 2009-10-15 17:21 82432 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-01-14 16:48 . 2009-03-06 14:46 286208 -c----w- c:\windows\system32\dllcache\pdh.dll
2010-01-14 16:48 . 2009-02-09 10:20 473088 -c----w- c:\windows\system32\dllcache\fastprox.dll
2010-01-14 16:48 . 2009-02-06 16:39 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2010-01-14 16:48 . 2005-07-26 04:39 60416 -c----w- c:\windows\system32\dllcache\colbact.dll
2010-01-14 16:48 . 2009-02-09 10:20 399360 -c----w- c:\windows\system32\dllcache\rpcss.dll
2010-01-14 16:48 . 2009-02-09 10:08 111104 -c----w- c:\windows\system32\dllcache\services.exe
2010-01-14 16:48 . 2009-02-06 16:54 35328 -c----w- c:\windows\system32\dllcache\sc.exe
2010-01-14 16:48 . 2009-02-09 10:20 685056 -c----w- c:\windows\system32\dllcache\advapi32.dll
2010-01-14 16:48 . 2009-02-09 10:20 739840 -c----w- c:\windows\system32\dllcache\ntdll.dll
2010-01-14 16:48 . 2009-02-09 10:20 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-01-14 16:48 . 2009-06-21 22:06 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-01-14 16:46 . 2008-05-08 12:28 202752 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-01-14 16:46 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-14 16:46 . 2008-12-11 11:57 333184 -c----w- c:\windows\system32\dllcache\srv.sys
2010-01-14 16:46 . 2008-05-01 14:31 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-01-14 16:46 . 2009-07-10 13:41 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-01-14 16:46 . 2008-04-11 18:51 683520 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-14 16:45 . 2009-08-04 17:05 2138112 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-14 16:45 . 2009-08-04 17:05 2059776 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-01-14 16:45 . 2009-08-04 17:05 2182400 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-01-14 16:45 . 2009-08-04 17:05 2017792 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-14 16:45 . 2009-06-05 07:46 655872 -c----w- c:\windows\system32\dllcache\mstscax.dll
2010-01-14 16:45 . 2008-12-16 12:49 351232 -c----w- c:\windows\system32\dllcache\winhttp.dll
2010-01-14 16:45 . 2009-07-31 04:58 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-01-14 16:37 . 2008-07-09 07:40 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2010-01-14 16:36 . 2009-11-21 16:42 470528 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-14 16:26 . 2010-01-14 16:26 1024 ----a-w- c:\documents and settings\Administrateur\Application Data\IDM\DwnlData\Administrateur\WindowsXP-KB835935-SP2-FRA_148\WindowsXP-KB835935-SP2-FRA.exe
2010-01-14 16:25 . 2008-02-26 12:00 294912 -c----w- c:\windows\system32\dllcache\msctf.dll
2010-01-14 16:24 . 2010-01-14 18:28 -------- d--h--w- c:\windows\$hf_mig$
2010-01-14 16:24 . 2008-10-15 16:59 332800 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-01-14 14:55 . 2010-01-14 15:56 -------- d-----w- C:\UsbFix
2010-01-14 14:42 . 2010-01-14 14:51 -------- d-----w- c:\program files\trend micro
2010-01-14 14:42 . 2010-01-14 14:51 -------- d-----w- C:\rsit
2010-01-14 14:35 . 2010-01-14 14:40 -------- d-----w- c:\documents and settings\Administrateur\Application Data\BitDefender Deployment Tool
2010-01-14 14:33 . 2010-01-14 14:33 -------- d-----w- c:\program files\BitDefender
2010-01-14 14:32 . 2010-01-14 14:32 -------- d-----w- c:\program files\Fichiers communs\BitDefender
2010-01-13 22:18 . 2010-01-13 22:18 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes
2010-01-13 22:18 . 2010-01-07 16:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-13 22:18 . 2010-01-14 17:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-13 22:18 . 2010-01-13 22:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-13 22:18 . 2010-01-07 16:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-13 18:21 . 2007-09-11 10:03 57344 ----a-w- c:\windows\system32\RACServerLogon2.dll
2010-01-13 18:21 . 2007-09-11 10:03 57344 ----a-w- c:\windows\system32\RACServerLogon.dll
2010-01-13 18:21 . 2010-01-13 18:21 -------- d-----w- c:\program files\PCNetSoftware
2010-01-13 17:53 . 2008-12-09 06:52 357376 ----a-w- c:\program files\regsearch.exe
2010-01-13 16:56 . 2010-01-13 16:56 -------- d-----w- c:\program files\AWinstall
2010-01-13 14:58 . 2010-01-13 15:03 -------- d-----w- C:\Lyrics
2010-01-13 14:55 . 2010-01-13 15:03 -------- d-----w- c:\program files\Minilyrics
2010-01-13 12:51 . 2010-01-13 12:51 -------- d-----w- c:\program files\NeoTrace Express
2010-01-13 12:36 . 2007-09-20 12:04 114688 ----a-w- c:\windows\system32\btcamvideosource.dll
2010-01-13 12:36 . 2010-01-13 12:37 -------- d-----w- c:\program files\Mobiola Web Camera 2 for S60 3rd Edition
2010-01-12 22:54 . 2010-01-12 22:54 101 ----a-w- c:\windows\system32\lncom_.exe.bat
2010-01-12 20:50 . 2010-01-13 16:07 -------- d-----w- c:\program files\UPX Shell
2010-01-12 19:46 . 2010-01-12 19:46 41888 ----a-w- c:\windows\system32\drivers\Oreans.sys
2010-01-12 19:46 . 2010-01-12 19:46 -------- d-----w- c:\documents and settings\Administrateur\Application Data\MimarSinan
2010-01-12 14:19 . 2010-01-12 14:57 14336 ----a-w- c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\76n0mnyw.default\extensions\playbox@toolbar\components\toolbarhomewmp.dll
2010-01-12 14:03 . 2010-01-12 14:06 -------- d-----w- c:\documents and settings\Administrateur\Application Data\IconChanger
2010-01-12 14:00 . 2010-01-12 14:00 -------- d-----w- c:\program files\IconChanger
2010-01-11 14:13 . 2010-01-11 14:13 -------- d-----w- c:\documents and settings\Administrateur\Application Data\LogMeIn Rescue
2010-01-11 14:02 . 2010-01-11 14:02 -------- d-----w- c:\program files\MSN Password Recovery
2010-01-11 12:19 . 2010-01-11 12:19 -------- d-----w- c:\program files\MyLanViewer
2010-01-10 22:41 . 2010-01-10 22:41 -------- d-----w- c:\program files\Panasonic
2010-01-10 22:41 . 2006-02-27 11:45 36864 ----a-w- c:\windows\system32\SDDEVMGR.dll
2010-01-10 21:34 . 2010-01-10 21:34 -------- d-----w- c:\program files\Hotmail Popper
2010-01-10 21:34 . 2004-03-19 16:58 356352 ----a-w- c:\windows\bkuninst.exe
2010-01-10 21:31 . 2010-01-10 21:31 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Esteem Technology
2010-01-10 21:30 . 2010-01-10 21:30 -------- d-----w- c:\program files\Break Reminder 3
2010-01-08 20:46 . 2010-01-08 20:46 -------- d-----w- c:\program files\ElcomSoft
2010-01-08 20:32 . 2010-01-08 20:32 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Avira
2010-01-08 20:30 . 2010-01-08 20:30 -------- d-----w- c:\program files\SuperScan
2010-01-08 20:08 . 2010-01-14 22:57 -------- d-----w- c:\program files\Power Email Harvester
2010-01-02 10:45 . 2010-01-02 10:45 -------- d-----w- C:\found.001
2009-12-28 17:04 . 2001-08-23 17:04 12288 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-12-27 14:36 . 2009-12-27 14:36 52263 ----a-w- c:\windows\BricoPackUninst.cmd
2009-12-27 14:32 . 2009-12-27 14:36 6120 ----a-w- c:\windows\BricoPackFoldersDelete.cmd
2009-12-27 14:32 . 2009-12-27 14:32 -------- d-----w- c:\windows\BricoPacks
2009-12-27 14:16 . 2009-12-27 14:16 -------- d-----w- c:\windows\system32\VIRepair
2009-12-27 13:50 . 2009-12-27 13:58 -------- d-----w- c:\documents and settings\Administrateur\Application Data\ViStart
2009-12-27 13:50 . 2009-12-27 14:12 -------- d-----w- c:\documents and settings\Administrateur\Application Data\ViSplore
2009-12-27 13:50 . 2009-12-27 13:50 -------- d-----w- c:\documents and settings\Administrateur\Application Data\ViGlance
2009-12-27 13:45 . 2009-09-09 21:19 146412 ----a-w- c:\windows\system32\vilaunch.exe
2009-12-27 13:38 . 2009-12-27 14:18 -------- d-----w- c:\windows\system32\VITrans
2009-12-27 13:38 . 2009-12-27 13:49 -------- d-----w- C:\VTPFiles
2009-12-27 13:38 . 2006-12-03 17:15 111104 ----a-w- c:\windows\system32\Uharc.exe
2009-12-27 13:38 . 2006-12-03 17:15 19968 ----a-w- c:\windows\system32\reico.exe
2009-12-27 13:38 . 2006-12-03 17:15 69632 ----a-w- c:\windows\system32\moveex.exe
2009-12-27 13:38 . 2006-12-03 17:14 8636 ----a-w- c:\windows\system32\modifype.exe
2009-12-27 13:38 . 2004-11-27 19:00 94208 ----a-w- c:\windows\system32\pskill.exe
2009-12-27 13:36 . 2009-03-23 17:39 20480 ----a-w- c:\windows\system32\scrnrdr.exe
2009-12-27 10:42 . 2009-12-27 10:42 -------- d-----w- c:\program files\ICQ6Toolbar
2009-12-27 10:41 . 2009-12-27 10:42 -------- d-----w- c:\documents and settings\All Users\Application Data\ICQ
2009-12-27 10:40 . 2009-12-27 11:46 -------- d-----w- c:\documents and settings\Administrateur\Application Data\ICQ
2009-12-27 10:37 . 2010-01-11 16:53 -------- d-----w- c:\program files\ICQ6.5
2009-12-27 00:35 . 2009-12-27 00:35 -------- d-----w- c:\documents and settings\Administrateur\Application Data\vlc
2009-12-26 23:03 . 2009-12-26 23:03 -------- d-----w- c:\program files\VideoLAN
2009-12-26 19:21 . 2009-12-26 19:28 -------- d-----w- c:\documents and settings\Administrateur\Application Data\TeamViewer
2009-12-26 19:20 . 2009-12-26 19:20 -------- d-----w- c:\program files\TeamViewer
2009-12-26 19:19 . 2009-12-26 19:19 -------- d-----w- c:\documents and settings\Administrateur\temp
2009-12-26 19:03 . 2009-12-26 19:04 198064 ----a-w- c:\documents and settings\Administrateur\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-12-26 19:01 . 2010-01-12 21:09 -------- d-----w- c:\program files\Internet Download Manager
2009-12-26 18:43 . 2009-12-27 10:33 -------- d-----w- c:\documents and settings\Administrateur\Application Data\IDM
2009-12-25 21:39 . 2009-12-25 21:41 -------- d-----w- c:\program files\EasyPHP 3.0
2009-12-25 21:05 . 2009-12-25 21:05 -------- d--h--w- c:\windows\system32\GroupPolicy
2009-12-25 18:51 . 2004-08-17 20:52 219648 -c--a-w- c:\windows\system32\dllcache\uxtheme.dll
2009-12-25 16:09 . 2009-12-25 16:09 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Passware
2009-12-25 15:52 . 2009-12-25 15:55 -------- d-----w- c:\program files\Unlocker
2009-12-25 15:23 . 2009-12-25 15:23 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Thinstall
2009-12-25 15:23 . 2009-12-25 15:23 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Thinstall
2009-12-25 14:01 . 2009-12-25 15:01 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-24 23:08 . 2009-12-24 23:08 -------- d-----w- c:\program files\UxTheme Multipatcher Fr
2009-12-24 22:43 . 2009-12-24 22:43 -------- d-----w- c:\program files\HDDGURU LLF Tool
2009-12-24 16:33 . 2009-12-24 16:36 -------- d-----w- c:\program files\ophcrack
2009-12-24 13:07 . 2009-12-27 13:52 46048 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-24 13:06 . 2009-12-24 13:07 -------- d-----w- c:\documents and settings\Administrateur\Application Data\BACS.exe
2009-12-23 23:35 . 2007-10-30 12:42 74240 ----a-w- c:\windows\system32\DWRCST.EXE
2009-12-23 23:23 . 2009-12-23 23:23 -------- d-----w- c:\documents and settings\Administrateur\Application Data\DWMRCMSI
2009-12-23 23:14 . 2009-12-23 23:26 -------- d-----w- c:\documents and settings\Administrateur\Application Data\DameWare Development
2009-12-23 15:26 . 2009-12-23 15:26 -------- d-----w- c:\program files\PhotoInstrument
2009-12-23 13:08 . 2001-08-17 22:02 9600 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-12-23 12:17 . 2009-12-23 12:17 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Ahead

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-15 13:00 . 2009-12-03 13:02 -------- d-----w- c:\documents and settings\Administrateur\Application Data\uTorrent
2010-01-15 13:00 . 2009-12-02 18:50 -------- d-----w- c:\documents and settings\Administrateur\Application Data\DMCache
2010-01-14 22:57 . 2001-08-28 14:00 69792 ----a-w- c:\windows\system32\perfc00C.dat
2010-01-14 22:57 . 2001-08-28 14:00 455782 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-14 17:28 . 2010-01-14 16:40 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-13 17:55 . 2010-01-13 17:55 686 ----a-w- c:\program files\RegSearch.txt
2010-01-12 19:27 . 2009-12-02 17:46 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-11 14:10 . 2010-01-11 14:10 -------- d-----w- c:\program files\LogMeIn Rescue
2010-01-10 11:40 . 2009-12-14 17:31 -------- d-----w- c:\program files\Universal Share Downloader
2010-01-03 14:01 . 2009-12-02 18:18 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Skype
2010-01-03 12:40 . 2009-12-02 18:22 -------- d-----w- c:\documents and settings\Administrateur\Application Data\skypePM
2009-12-29 13:47 . 2009-12-03 13:02 -------- d-----w- c:\program files\uTorrent
2009-12-20 15:41 . 2009-12-13 20:49 -------- d-----w- c:\program files\Driver Genius
2009-12-20 14:36 . 2009-12-06 16:58 -------- d-----w- c:\documents and settings\Administrateur\Application Data\DAEMON Tools Pro
2009-12-20 13:51 . 2009-12-13 16:34 -------- d-----w- c:\program files\CCleaner
2009-12-19 20:10 . 2009-12-02 18:15 -------- d-----w- c:\program files\Winamp
2009-12-19 18:04 . 2004-08-04 00:54 428032 ----a-w- c:\windows\system32\cmd.exe
2009-12-19 17:59 . 2009-12-11 02:08 1212080 ----a-w- c:\documents and settings\Administrateur\Application Data\GameRanger\GameRanger\GameRanger.exe
2009-12-19 17:40 . 2009-12-14 14:27 308224 ----a-w- c:\windows\IsUn040c.exe
2009-12-19 16:17 . 2009-12-02 17:40 118272 ----a-w- c:\windows\system32\calc.exe
2009-12-19 16:17 . 2009-12-02 17:40 444928 ----a-w- c:\windows\system32\mspaint.exe
2009-12-19 16:17 . 2009-12-02 17:40 411648 ----a-w- c:\windows\system32\mstsc.exe
2009-12-19 16:17 . 2001-08-28 14:00 152576 ----a-w- c:\windows\system32\sndvol32.exe
2009-12-19 16:17 . 2009-12-02 17:40 182272 ----a-w- c:\windows\system32\sndrec32.exe
2009-12-19 16:16 . 2004-08-04 00:55 1230848 ----a-w- c:\windows\system32\ntbackup.exe
2009-12-19 16:16 . 2009-12-02 17:40 80896 ----a-w- c:\windows\system32\charmap.exe
2009-12-19 16:13 . 2009-12-02 17:40 128000 ----a-w- c:\windows\system32\mshearts.exe
2009-12-19 16:13 . 2009-12-02 17:40 119808 ----a-w- c:\windows\system32\WINmine.exe
2009-12-19 16:13 . 2009-12-02 17:40 55808 ----a-w- c:\windows\system32\freecell.exe
2009-12-19 16:08 . 2009-12-02 17:40 57344 ----a-w- c:\windows\system32\sol.exe
2009-12-19 16:08 . 2009-12-02 17:40 539136 ----a-w- c:\windows\system32\spider.exe
2009-12-19 16:03 . 2004-08-04 00:55 32768 ----a-w- c:\windows\system32\odbcad32.exe
2009-12-15 16:39 . 2009-12-05 12:40 -------- d-----w- c:\program files\EA GAMES
2009-12-15 12:21 . 2009-12-15 12:21 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2009-12-14 20:28 . 2009-12-02 17:46 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-12-14 14:31 . 2009-12-13 23:30 -------- d-----w- c:\program files\InterVideo
2009-12-14 14:31 . 2009-12-13 23:51 -------- d-----w- c:\program files\ChrisTV Lite
2009-12-14 14:31 . 2009-12-10 23:23 -------- d-----w- c:\program files\BitSpirit
2009-12-13 23:36 . 2009-12-13 23:32 -------- d-----w- c:\documents and settings\All Users\Application Data\InterVideo
2009-12-13 23:30 . 2009-12-13 23:30 -------- d-----w- c:\program files\Fichiers communs\InterVideo
2009-12-13 21:50 . 2009-12-13 21:50 -------- d-----w- c:\program files\Intel
2009-12-13 21:48 . 2009-12-02 17:46 -------- d-----w- c:\program files\CyberLink
2009-12-13 19:59 . 2009-12-13 19:58 -------- d-----w- c:\program files\ma-config.com
2009-12-13 19:58 . 2009-12-13 19:58 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2009-12-11 21:28 . 2009-12-03 17:52 -------- d-----w- c:\program files\Dofus
2009-12-10 23:24 . 2009-12-10 23:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\BitSpirit
2009-12-10 15:48 . 2009-12-10 15:48 -------- d-----w- c:\documents and settings\Administrateur\Application Data\AdobeUM
2009-12-10 15:48 . 2009-12-10 15:47 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-12-10 13:52 . 2009-12-10 13:52 -------- d-----w- c:\program files\IObit
2009-12-09 13:48 . 2009-12-02 20:45 -------- d-----w- c:\documents and settings\Administrateur\Application Data\GameRanger
2009-12-08 21:26 . 2009-12-08 21:26 155312 ----a-w- c:\documents and settings\Administrateur\Application Data\GameRanger\GameRanger\Data\GameRanger.dll
2009-12-08 21:26 . 2009-12-08 21:26 48816 ----a-w- c:\documents and settings\Administrateur\Application Data\GameRanger\GameRanger\Data\GameRangerLaunch.dll
2009-12-08 11:07 . 2009-12-08 11:07 -------- d-----w- c:\program files\Microsoft.NET
2009-12-06 17:16 . 2009-12-02 18:15 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Winamp
2009-12-06 16:59 . 2009-12-06 16:59 722416 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-06 13:27 . 2009-12-06 13:27 -------- d-----w- c:\program files\Common Files
2009-12-06 13:07 . 2009-12-06 13:07 -------- d-----w- c:\program files\SystemRequirementsLab
2009-12-06 13:07 . 2009-12-06 13:07 -------- d-----w- c:\documents and settings\Administrateur\Application Data\SystemRequirementsLab
2009-12-06 13:07 . 2009-12-06 13:07 138240 ----a-w- c:\documents and settings\Administrateur\Application Data\SystemRequirementsLab\SRLProxy_srl_4_1_14_0_d.dll
2009-12-06 13:07 . 2009-12-06 13:07 138240 ----a-w- c:\documents and settings\Administrateur\Application Data\SystemRequirementsLab\SRLProxy_srl_4_1_14_0_c.dll
2009-12-06 13:07 . 2009-12-06 13:07 138240 ----a-w- c:\documents and settings\Administrateur\Application Data\SystemRequirementsLab\SRLProxy_srl_4_1_14_0_b.dll
2009-12-06 13:07 . 2009-12-06 13:07 138240 ----a-w- c:\documents and settings\Administrateur\Application Data\SystemRequirementsLab\SRLProxy_srl_4_1_14_0_a.dll
2009-12-06 00:49 . 2009-12-06 00:48 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Media Player Classic
2009-12-06 00:27 . 2009-12-06 00:27 -------- d-----w- c:\program files\DDD Pool_at
2009-12-06 00:24 . 2009-12-06 00:24 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-12-03 20:52 . 2009-12-02 17:44 86331 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-02 20:13 . 2009-12-02 20:13 -------- d-----w- c:\program files\Microsoft Games
2009-12-02 19:49 . 2009-12-02 19:49 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-02 19:48 . 2009-12-02 19:48 -------- d-----w- c:\program files\Java
2009-12-02 19:46 . 2009-12-02 19:46 152576 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-02 19:45 . 2009-12-02 19:45 79488 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-02 19:05 . 2009-12-02 19:05 -------- d-----w- c:\program files\Windows Live
2009-12-02 18:28 . 2009-12-02 18:28 -------- d-----w- c:\program files\Alwil Software
2009-12-02 18:22 . 2009-12-02 18:22 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-12-02 18:18 . 2009-12-02 18:18 -------- d-----r- c:\program files\Skype
2009-12-02 18:18 . 2009-12-02 18:18 -------- d-----w- c:\program files\Fichiers communs\Skype
2009-12-02 18:18 . 2009-12-02 18:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-12-02 18:09 . 2009-12-02 18:09 0 ----a-w- c:\windows\nsreg.dat
2009-12-02 17:58 . 2009-12-02 17:58 -------- d-----w- c:\program files\Analog Devices
2009-12-02 17:57 . 2009-12-02 17:56 -------- d-----w- c:\program files\Broadcom
2009-12-02 17:47 . 2009-12-02 17:47 -------- d-----w- c:\program files\Ahead
2009-12-02 17:47 . 2009-12-02 17:47 -------- d-----w- c:\program files\Fichiers communs\Ahead
2009-12-02 17:46 . 2009-12-02 17:46 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2009-12-02 17:43 . 2009-12-02 17:43 -------- d-----w- c:\program files\Services en ligne
2009-12-02 17:41 . 2009-12-02 17:41 21892 ----a-w- c:\windows\system32\emptyregdb.dat
2009-11-30 19:37 . 2009-11-30 19:37 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-11-21 16:42 . 2004-08-04 00:54 470528 ----a-w- c:\windows\AppPatch\aclayers.dll
2007-06-03 18:35 . 2010-01-13 17:53 2560 ----a-w- c:\program files\History.txt
2007-06-03 18:31 . 2010-01-13 17:53 916 ----a-w- c:\program files\Options.txt
.

------- Sigcheck -------

[-] 2008-04-14 . C4153F037157C7BE7C54FD88887F027D . 3066880 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\mshtml.dll
[-] 2004-08-04 . 5FBFB9097AD849CEDA0B34F8407ADCEE . 3444224 . . [6.00.2900.2180] . . c:\windows\system32\mshtml.dll

[-] 2008-04-14 . 4A6E04EA20F48D750D9BFED8600D516B . 670208 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\wininet.dll
[-] 2004-08-04 . F6AD4C0F992B3B51C044AD74D9E2E854 . 694784 . . [6.00.2900.2180] . . c:\windows\system32\wininet.dll

[-] 2008-04-14 . F2317622D29F9FF0F88AEECD5F60F0DD . 1037824 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\explorer.exe
[-] 2004-08-04 . 9F3B76C8CF787449A47F05ABAB4E13E6 . 978432 . . [6.00.2900.2180] . . c:\windows\explorer.exe

[-] 2008-04-14 . 02DA31AB433A6C1110A736C85701DECA . 13824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\wscntfy.exe

[-] 2008-04-14 . E17C85D5B5CF477638433B851A98499E . 1571840 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\sfcfiles.dll
[-] 2004-10-31 16:59 . AB3D62010AF342203FFA60C2D94DBC68 . 8704 . . [1] . . c:\windows\system32\sfcfiles.dll

[-] 2008-04-14 . E598D81197E2E0EC42A0C55772BB00E8 . 59904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\regsvc.dll

c:\windows\System32\wscntfy.exe ... manque !!
c:\windows\System32\regsvc.dll ... manque !!
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-12-19 289584]
"USB Threat Defender"="d:\djinn\utdefender.exe" [2009-07-01 1215488]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-12-26 3118512]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-09-16 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2009-10-26 15872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="c:\windows\system32\sti_ci.dll" [2004-08-04 138240]

c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
TransBar.lnk - c:\windows\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-6-1 65536]
UberIcon.lnk - c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-5-21 180224]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\RACServerLogon]
2007-09-11 10:03 57344 ----a-w- c:\windows\system32\RACServerLogon2.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\Administrateur\\Application Data\\GameRanger\\GameRanger\\GameRanger.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Sierra\\SWAT 4\\Content\\System\\Swat4.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\PCNetSoftware\\RAC Server\\RACs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5745:TCP"= 5745:TCP:fmzjf
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"6129:TCP"= 6129:TCP:DameWare Mini Remote Control Service

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [06/12/2009 16:59 722416]
R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [19/12/2009 20:39 194817]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [19/12/2009 20:39 108289]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [19/12/2009 20:39 434945]
R2 RACDriver;RAC driver;c:\program files\PCNetSoftware\RAC Server\RACDriver.sys [13/01/2010 18:21 8208]
S2 bdtclznj;Security Network;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 hmwqlfjq;System Security;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 mrkjyhavd;Installer Universal;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S3 FlyPCI;FlyPCI;c:\windows\system32\drivers\FlyPCI.sys [13/12/2009 21:31 4134]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [11/12/2009 15:43 238960]
S3 VMHybrid;VMHybrid service;c:\windows\system32\DRIVERS\VMHybrid.sys --> c:\windows\system32\DRIVERS\VMHybrid.sys [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
mrkjyhavd
bdtclznj
hmwqlfjq
qpbhwg
xlzjfsgx
.
.
------- Examen supplémentaire -------
.
IE: &NeoTrace It! - c:\progra~1\NEOTRA~1\NTXcontext.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\76n0mnyw.default\
FF - component: c:\documents and settings\Administrateur\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\76n0mnyw.default\extensions\playbox@toolbar\components\toolbarhomewmp.dll
FF - plugin: c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\76n0mnyw.default\extensions\TechnicianConsole@logmeinrescue.com\platform\WINNT\plugins\npRescue.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Explorer_Run-Generic Host Process - c:\windows\system32\scvhost.exe
MSConfigStartUp-Run - c:\windows\system32\scvhost.exe
ActiveSetup-{15FB8F0F-A66C-D1D0-3AF5-6C7D694A67A2} - c:\program files\Bifrost\server.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-15 12:56
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x813581F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf956cfc3
\Driver\ACPI -> ACPI.sys @ 0xf93c5cb8
\Driver\atapi -> 0x813581f8
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
ParseProcedure -> ntoskrnl.exe @ 0x8056f07e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
ParseProcedure -> ntoskrnl.exe @ 0x8056f07e
NDIS: Broadcom NetXtreme Gigabit Ethernet for hp -> SendCompleteHandler -> NDIS.sys @ 0xf9264ba0
PacketIndicateHandler -> NDIS.sys @ 0xf9253a0b
SendHandler -> NDIS.sys @ 0xf9267b31
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):e1,d5,7b,e1,e2,0c,ee,3b,96,e4,fd,85,5d,aa,5c,c2,e7,96,bb,6d,c9,
33,de,b4,52,a3,dd,0d,a8,95,0a,aa,f8,96,db,4f,84,59,85,09,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{df34106b-868d-46da-a605-948c31a16a21}]
@Denied: (Full) (Everyone)
"Model"=dword:00000166
"Therad"=dword:00000018
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\windows\system32\RACServerLogon2.dll

- - - - - - - > 'lsass.exe'(792)
c:\program files\Avira\AntiVir Desktop\avsda.dll

- - - - - - - > 'explorer.exe'(3980)
c:\program files\Unlocker\UnlockerHook.dll
c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll
c:\windows\system32\ntshrui.dll
c:\program files\Internet Download Manager\idmmkb.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\PCNetSoftware\RAC Server\RACs.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Heure de fin: 2010-01-15 13:06:55 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-01-15 13:06

Avant-CF: 5 163 474 944 octets libres
Après-CF: 5 136 273 408 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

- - End Of File - - 135DA0647E4B30F1C265CA5397E1BC1E

Re,

Refait nous un RSIT s'il te plait...

@+