Problème lié à Malware Defender 2009

Question

Bonjour, Bonne année à tous.

Voila, depuis le 1er Janvier, je suis infecté par le rogue : Malware Defender 2009
La seule chose que j'ai été capable de faire est d'empêcher les 2 processus système de ce rogue de se lancer au démarrage grâce à Ccleaner.
Mais depuis, mon PC a de plus en plus de freeze, presque 1 fois sur 2, c'est apparu y'a moins d'une semaine.
Etant donné que Malware Defender m'empêche de lancer tout logiciel de scan de malware ou tout antivirus, je penses avoir choppé un autre virus.

Voici mon rapport HIJACKTHIS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:08 VALR, on 17/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\VistaDrive\VistaDrive.exe
D:\Program Files\Winamp\winampa.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\WINDOWS\system32\LVCOMSX.EXE
D:\Program Files\Logitech\Video\LogiTray.exe
D:\Program Files\RocketDock\RocketDock.exe
D:\Program Files\Windows Sidebar\sidebar.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\DAEMON Tools Lite\daemon.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\Logitech\SetPoint\SetPoint.exe
D:\Program Files\Logitech\Video\FxSvr2.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
D:\Program Files\Skype\Plugin Manager\skypePM.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Windows Sidebar\sidebar.exe
D:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe
D:\WINDOWS\system32
otepad.exe
D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = © Windows XP Ultimate Edition VALR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [VistaDrive] D:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] D:\WINDOWS\System32\DeltaIITray.exe
O4 - HKLM\..\Run: [DeltaIITaskbarApp] D:\WINDOWS\system32\DeltaIITray.exe
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LVCOMSX] D:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] D:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] D:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [RocketDock] "D:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [VisualTaskTip] \Program Files\VisualTaskTips\VisualTaskTips.exe
O4 - HKCU\..\Run: [Sidebar] D:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "D:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [RocketDock] "D:\Program Files\RocketDock\RocketDock.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [VisualTaskTip] \Program Files\VisualTaskTips\VisualTaskTips.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [RocketDock] "D:\Program Files\RocketDock\RocketDock.exe" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [RocketDock] "D:\Program Files\RocketDock\RocketDock.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [RocketDock] "D:\Program Files\RocketDock\RocketDock.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - D:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe

Utilisateur anonyme · Answer

Bonjour

1)Télécharge Rkill sur le bureau ; à partir d’un de ces liens
http://download.bleepingcomputer.com/grinler/rkill.pif
https://download.bleepingcomputer.com/grinler/rkill.scr
https://download.bleepingcomputer.com/grinler/rkill.com
https://download.bleepingcomputer.com/grinler/rkill.exe

Double clic pour le lancer.
Une fenêtre (très rapide) indiquera que tout s'est bien déroulé.
Pour Vista ou Seven, faire un clic droit sur le fichier rkill téléchargé puis choisir "Exécuter en tant qu'Administrateur" pour lancer l'outil. 

2)Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Ou ici : https://forospyware.com 
>Renomme le pour l’enregistrer sur ton bureau en  asdehi (tout simplement pour que l’infection ne le contre pas)
-> Double clique combofix.exe. 
-> Tape sur la touche 1 (Yes) pour démarrer le scan. 
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt 

 Avant d'utiliser ComboFix :  

->  Déconnecte toi d'Internet et referme les fenêtres de tous les programmes en cours.  

->  Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. 

Une fois fait, sur ton bureau double-clic sur Combofix.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

- Attention Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programme. Risque de figer l'ordinateur 

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message. 

/!\  Ne touche à rien tant que le scan n'est pas terminé.  /!\ : risque de figer l'ordinateur (plantage complet) 


::Si combofix détecte quelque chose et de demande a redémarrer tu acceptes


@+

Stephy · Answer

Merci beaucoup pour ta réponse et ta rapidité

Comme je l'ai dis plus haut, mes antivirus et firewall ne fonctionne plus, je n'ai donc pas eu besoin de les desactiver. Sinon je me suis bien deconnecté d'internet et executer combofix, voici ce qu'il en est:

"Administrateur" - 2010-01-17 14:30:08 Service Pack 3
ComboFix 07-05.27.BV - Running from: "D:\Documents and Settings\Administrateur\Bureau\"

((((((((((((((((((((((((((((((( Files Created from 2009-12-17 to 2010-01-17 ))))))))))))))))))))))))))))))))))

2010-01-17 14:29 49,152 --a------ D:\WINDOWS\nircmd.exe
2010-01-17 14:06 <REP> d-------- D:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2010-01-17 13:57 <REP> d-------- D:\FindyKill
2009-12-25 14:52 <REP> d-------- D:\Program Files\Ad-Remover
2009-12-25 14:07 38,224 --a------ D:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-12-25 14:07 19,160 --a------ D:\WINDOWS\system32\drivers\mbam.sys
2009-12-25 14:07 <REP> d-------- D:\Program Files\Malwarebytes' Anti-Malware
2009-12-25 14:07 <REP> d-------- D:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-12-25 13:59 <REP> d-------- D:\Program Files\Avira
2009-12-25 13:59 <REP> d-------- D:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
2009-12-25 13:39 934 --a------ D:\WINDOWS\system32\krl32mainweq.dll
2009-12-25 13:37 202 --a------ D:\WINDOWS\system32\srcr.dat
2009-12-20 12:49 59,392 --a------ D:\WINDOWS\system32\vfwwdm32.dll
2009-12-20 12:46 90,112 --a------ D:\WINDOWS\system32\LQCUI2.dll
2009-12-20 12:46 89,088 --a------ D:\WINDOWS\system32\atl71.dll
2009-12-20 12:46 856,064 --a------ D:\WINDOWS\system32\Ltwvc12n.dll
2009-12-20 12:46 78,336 --a------ D:\WINDOWS\system32\lffax12n.dll
2009-12-20 12:46 65,536 --a------ D:\WINDOWS\system32\MFC71DEU.DLL
2009-12-20 12:46 61,440 --a------ D:\WINDOWS\system32\MFC71ITA.DLL
2009-12-20 12:46 61,440 --a------ D:\WINDOWS\system32\MFC71ESP.DLL
2009-12-20 12:46 57,344 --a------ D:\WINDOWS\system32\MFC71ENU.DLL
2009-12-20 12:46 53,248 -ra------ D:\WINDOWS\system32\InstMed.exe
2009-12-20 12:46 499,712 --a------ D:\WINDOWS\system32\msvcp71.dll
2009-12-20 12:46 49,152 --a------ D:\WINDOWS\system32\MFC71KOR.DLL
2009-12-20 12:46 49,152 --a------ D:\WINDOWS\system32\MFC71JPN.DLL
2009-12-20 12:46 466,944 --a------ D:\WINDOWS\system32\QCUI2.dll
2009-12-20 12:46 462,848 --a------ D:\WINDOWS\system32\LCamCpl.dll
2009-12-20 12:46 45,056 --a------ D:\WINDOWS\system32\MFC71CHT.DLL
2009-12-20 12:46 406,016 --a------ D:\WINDOWS\system32\ltkrn12n.dll
2009-12-20 12:46 40,960 --a------ D:\WINDOWS\system32\MFC71CHS.DLL
2009-12-20 12:46 372,736 --a------ D:\WINDOWS\system32\LVUI2RC.dll
2009-12-20 12:46 348,160 --a------ D:\WINDOWS\system\msvcr71.dll
2009-12-20 12:46 328,704 --a------ D:\WINDOWS\system32\LFCMP12n.DLL
2009-12-20 12:46 326,656 --a------ D:\WINDOWS\system32\drivers\Camdrl.sys
2009-12-20 12:46 30,720 --a------ D:\WINDOWS\system32\lfbmp12n.dll
2009-12-20 12:46 259,072 --a------ D:\WINDOWS\system32\LTDIS12n.dll
2009-12-20 12:46 22,016 --a------ D:\WINDOWS\system32\drivers\LVUSBSta.sys
2009-12-20 12:46 215,552 --a------ D:\WINDOWS\system32\Lvkrn12n.dll
2009-12-20 12:46 207,872 --a------ D:\WINDOWS\system32\ltefx12n.dll
2009-12-20 12:46 204,800 --a------ D:\WINDOWS\system32\LVUI2.dll
2009-12-20 12:46 204,800 --a------ D:\WINDOWS\system32\LVCodec2.dll
2009-12-20 12:46 2,180,096 --a------ D:\WINDOWS\system32\drivers\lvsvf2.sys
2009-12-20 12:46 164,864 --a------ D:\WINDOWS\system32\ltimg12n.dll
2009-12-20 12:46 141,312 --a------ D:\WINDOWS\system32\lftif12n.dll
2009-12-20 12:46 139,264 --a------ D:\WINDOWS\system\CamExL20.dll
2009-12-20 12:46 131,072 --a------ D:\WINDOWS\system32\ltfil12n.DLL
2009-12-20 12:46 106,496 --a------ D:\WINDOWS\system32\lvcoinst.dll
2009-12-20 12:46 1,047,552 --a------ D:\WINDOWS\system32\MFC71u.dll
2009-12-20 12:46 <REP> d-------- D:\Program Files\Fichiers communs\Logitech
2009-12-20 12:18 60,032 --a------ D:\WINDOWS\system32\drivers\USBAUDIO.sys
2009-12-19 15:03 56 --ah----- D:\WINDOWS\system32\ezsidmv.dat
2009-12-19 15:03 <REP> d-------- D:\DOCUME~1\ADMINI~1\APPLIC~1\skypePM
2009-12-19 14:58 <REP> dr------- D:\Program Files\Skype
2009-12-19 14:58 <REP> d-------- D:\Program Files\Fichiers communs\Skype
2009-12-19 14:58 <REP> d-------- D:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2009-12-19 14:58 <REP> d-------- D:\DOCUME~1\ADMINI~1\APPLIC~1\Skype

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2010-01-17 12:11:13 -------- d-----w D:\DOCUME~1\ADMINI~1\APPLIC~1\Azureus
2010-01-16 22:32:02 -------- d-----w D:\DOCUME~1\ADMINI~1\APPLIC~1\Winamp
2010-01-15 11:30:09 -------- d-----w D:\DOCUME~1\ADMINI~1\APPLIC~1\vlc
2009-12-20 11:46:09 -------- d--h--w D:\Program Files\InstallShield Installation Information
2009-12-20 11:46:09 -------- d-----w D:\Program Files\Logitech
2009-12-18 12:24:54 -------- d-----w D:\Program Files\Vuze
2009-12-14 20:25:27 -------- d-----w D:\DOCUME~1\ADMINI~1\APPLIC~1\dvdcss
2009-12-01 16:50:46 -------- d-----w D:\Program Files\Alky for Applications
2009-11-19 21:16:15 -------- d-----w D:\DOCUME~1\ADMINI~1\APPLIC~1\Apple Computer
2009-11-18 18:44:56 -------- d-----w D:\DOCUME~1\ADMINI~1\APPLIC~1\Bioshock
2009-11-15 17:10:13 664 ----a-w D:\WINDOWS\system32\d3d9caps.dat
2009-11-06 15:33:24 107,888 ----a-w D:\WINDOWS\system32\CmdLineExt.dll
2009-10-25 11:35:21 79,052 ----a-w D:\WINDOWS\system32\perfc00C.dat
2009-10-25 11:35:21 498,034 ----a-w D:\WINDOWS\system32\perfh00C.dat

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}=D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 11:07]
{53707962-6F74-2D53-2644-206D7942484F}=D:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 15:31]
{DBC80044-A445-435b-BC74-9C25C1C588A9}=D:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-09-13 01:39]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}=D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-09-13 01:39]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="D:\Program Files\Winamp\winampa.exe" [2009-07-01 17:37]
"SunJavaUpdateSched"="D:\Program Files\Java\jre6\bin\jusched.exe" [2009-09-13 01:39]
"StartCCC"="D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-13 20:24]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" []
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2009-09-05 00:54]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2009-09-08 20:09]
"Adobe Reader Speed Launcher"="D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 16:10]
"LogitechVideoRepair"="D:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24]
"LogitechVideoTray"="D:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14]
"avgnt"="D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 13:08]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="D:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 12:58]
"VisualTaskTip"="\Program Files\VisualTaskTips\VisualTaskTips.exe" []
"Sidebar"="D:\Program Files\Windows Sidebar\sidebar.exe" [2008-05-02 15:07]
"ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2008-05-08 13:13]
"DAEMON Tools Lite"="D:\Program Files\DAEMON Tools Lite\daemon.exe" [2009-04-23 14:51]
"Skype"="D:\Program Files\Skype\Phone\Skype.exe" [2009-10-09 13:11]
"LogitechSoftwareUpdate"="D:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44]
"SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 15:31]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_2"=regsvr32 /s /n /i:U shell32
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"RocketDock"="D:\Program Files\RocketDock\RocketDock.exe"
"VisualTaskTip"=\Program Files\VisualTaskTips\VisualTaskTips.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"=1 (0x1)
"NoLowDiskSpaceChecks"=1 (0x1)
"NoStartBanner"=01000000
"MemCheckBoxInRunDlg"=1 (0x1)
"NoSMBalloonTip"=1 (0x1)
"NoDesktopCleanupWizard"=1 (0x1)
"NoWelcomeScreen"=1 (0x1)
"NoTrayItemsDisplay"=0 (0x0)
"NoStrCmpLogical"=0 (0x0)
"NoInstrumentation"=0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"=1 (0x1)
"NoLowDiskSpaceChecks"=1 (0x1)
"NoStartBanner"=01000000
"MemCheckBoxInRunDlg"=1 (0x1)
"NoSMBalloonTip"=1 (0x1)
"NoDesktopCleanupWizard"=1 (0x1)
"NoWelcomeScreen"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
%SystemRoot%\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
d:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService WebClient LmHosts RemoteRegistry upnphost SSDPSRV
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
napagent
hkmsvc

********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-17 14:30:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

disk error: D:\WINDOWS\

please note that you need administrator rights to perform deep scan

********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\JavaQuickStarterService]
"ImagePath"="\"D:\Program Files\Java\jre6\bin\jqs.exe\" -service -config \"D:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf\""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\H8SRTd.sys]
"imagepath"="\systemroot\system32\drivers\H8SRTxnscdpqjpa.sys"

Completion time: 2010-01-17 14:30:49
D:\ComboFix2.txt ... 2010-01-17 14:29

--- E O F ---

Encore merci pour le temps que tu prends

Stephy · Answer

Coucou, je n'ai qu'une seule session, et c'est celle que j'utilise actuellement.
Ou alors, tu es sur le point de m'apprendre quelque chose que je ne savais pas.
Lorsque j'ai installé windows j'ai indiqué que je serais le seul utilisateur, je n'ai donc pas de differente session.

Merci à toi.

Stephy · Answer

Re Guillaume

J'ai effectué toutes tes opérations.
Il faut savoir que les 2 liens de combofix que tu m'as donné ne fonctionne pas, par consequent je l'ai trouvé ailleurs, et l'icone n'est pas similaire à la tête de lion rouge que tu m'as donné sur le gif, c'est une croix rouge chez moi.
Quoiqu'il en soit j'ai fait ce que tu m'as suggeré et voici le rapport.
Encore merci pour ton temps.

"Administrateur" - 2010-01-17 15:15:13 Service Pack 3
ComboFix 07-05.27.BV - Running from: "D:\Documents and Settings\Administrateur\"
Command switches used :: ""D:\Documents and Settings\Administrateur\Bureau\cfscript.txt""

((((((((((((((((((((((((((((((( Files Created from 2009-12-17 to 2010-01-17 ))))))))))))))))))))))))))))))))))

2010-01-17 14:29 49,152 --a------ D:\WINDOWS\nircmd.exe
2010-01-17 14:06 <REP> d-------- D:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2010-01-17 13:57 <REP> d-------- D:\FindyKill
2009-12-25 14:52 <REP> d-------- D:\Program Files\Ad-Remover
2009-12-25 14:07 38,224 --a------ D:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-12-25 14:07 19,160 --a------ D:\WINDOWS\system32\drivers\mbam.sys
2009-12-25 14:07 <REP> d-------- D:\Program Files\Malwarebytes' Anti-Malware
2009-12-25 14:07 <REP> d-------- D:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-12-25 13:59 <REP> d-------- D:\Program Files\Avira
2009-12-25 13:59 <REP> d-------- D:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
2009-12-25 13:39 934 --a------ D:\WINDOWS\system32\krl32mainweq.dll
2009-12-25 13:37 202 --a------ D:\WINDOWS\system32\srcr.dat
2009-12-20 12:49 59,392 --a------ D:\WINDOWS\system32\vfwwdm32.dll
2009-12-20 12:46 90,112 --a------ D:\WINDOWS\system32\LQCUI2.dll
2009-12-20 12:46 89,088 --a------ D:\WINDOWS\system32\atl71.dll
2009-12-20 12:46 856,064 --a------ D:\WINDOWS\system32\Ltwvc12n.dll
2009-12-20 12:46 78,336 --a------ D:\WINDOWS\system32\lffax12n.dll
2009-12-20 12:46 65,536 --a------ D:\WINDOWS\system32\MFC71DEU.DLL
2009-12-20 12:46 61,440 --a------ D:\WINDOWS\system32\MFC71ITA.DLL
2009-12-20 12:46 61,440 --a------ D:\WINDOWS\system32\MFC71ESP.DLL
2009-12-20 12:46 57,344 --a------ D:\WINDOWS\system32\MFC71ENU.DLL
2009-12-20 12:46 53,248 -ra------ D:\WINDOWS\system32\InstMed.exe
2009-12-20 12:46 499,712 --a------ D:\WINDOWS\system32\msvcp71.dll
2009-12-20 12:46 49,152 --a------ D:\WINDOWS\system32\MFC71KOR.DLL
2009-12-20 12:46 49,152 --a------ D:\WINDOWS\system32\MFC71JPN.DLL
2009-12-20 12:46 466,944 --a------ D:\WINDOWS\system32\QCUI2.dll
2009-12-20 12:46 462,848 --a------ D:\WINDOWS\system32\LCamCpl.dll
2009-12-20 12:46 45,056 --a------ D:\WINDOWS\system32\MFC71CHT.DLL
2009-12-20 12:46 406,016 --a------ D:\WINDOWS\system32\ltkrn12n.dll
2009-12-20 12:46 40,960 --a------ D:\WINDOWS\system32\MFC71CHS.DLL
2009-12-20 12:46 372,736 --a------ D:\WINDOWS\system32\LVUI2RC.dll
2009-12-20 12:46 348,160 --a------ D:\WINDOWS\system\msvcr71.dll
2009-12-20 12:46 328,704 --a------ D:\WINDOWS\system32\LFCMP12n.DLL
2009-12-20 12:46 326,656 --a------ D:\WINDOWS\system32\drivers\Camdrl.sys
2009-12-20 12:46 30,720 --a------ D:\WINDOWS\system32\lfbmp12n.dll
2009-12-20 12:46 259,072 --a------ D:\WINDOWS\system32\LTDIS12n.dll
2009-12-20 12:46 22,016 --a------ D:\WINDOWS\system32\drivers\LVUSBSta.sys
2009-12-20 12:46 215,552 --a------ D:\WINDOWS\system32\Lvkrn12n.dll
2009-12-20 12:46 207,872 --a------ D:\WINDOWS\system32\ltefx12n.dll
2009-12-20 12:46 204,800 --a------ D:\WINDOWS\system32\LVUI2.dll
2009-12-20 12:46 204,800 --a------ D:\WINDOWS\system32\LVCodec2.dll
2009-12-20 12:46 2,180,096 --a------ D:\WINDOWS\system32\drivers\lvsvf2.sys
2009-12-20 12:46 164,864 --a------ D:\WINDOWS\system32\ltimg12n.dll
2009-12-20 12:46 141,312 --a------ D:\WINDOWS\system32\lftif12n.dll
2009-12-20 12:46 139,264 --a------ D:\WINDOWS\system\CamExL20.dll
2009-12-20 12:46 131,072 --a------ D:\WINDOWS\system32\ltfil12n.DLL
2009-12-20 12:46 106,496 --a------ D:\WINDOWS\system32\lvcoinst.dll
2009-12-20 12:46 1,047,552 --a------ D:\WINDOWS\system32\MFC71u.dll
2009-12-20 12:46 <REP> d-------- D:\Program Files\Fichiers communs\Logitech
2009-12-20 12:18 60,032 --a------ D:\WINDOWS\system32\drivers\USBAUDIO.sys
2009-12-19 15:03 56 --ah----- D:\WINDOWS\system32\ezsidmv.dat
2009-12-19 15:03 <REP> d-------- D:\DOCUME~1\ADMINI~1\APPLIC~1\skypePM
2009-12-19 14:58 <REP> dr------- D:\Program Files\Skype
2009-12-19 14:58 <REP> d-------- D:\Program Files\Fichiers communs\Skype
2009-12-19 14:58 <REP> d-------- D:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2009-12-19 14:58 <REP> d-------- D:\DOCUME~1\ADMINI~1\APPLIC~1\Skype

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2010-01-17 12:11:13 -------- d-----w D:\DOCUME~1\ADMINI~1\APPLIC~1\Azureus
2010-01-16 22:32:02 -------- d-----w D:\DOCUME~1\ADMINI~1\APPLIC~1\Winamp
2010-01-15 11:30:09 -------- d-----w D:\DOCUME~1\ADMINI~1\APPLIC~1\vlc
2009-12-20 11:46:09 -------- d--h--w D:\Program Files\InstallShield Installation Information
2009-12-20 11:46:09 -------- d-----w D:\Program Files\Logitech
2009-12-18 12:24:54 -------- d-----w D:\Program Files\Vuze
2009-12-14 20:25:27 -------- d-----w D:\DOCUME~1\ADMINI~1\APPLIC~1\dvdcss
2009-12-01 16:50:46 -------- d-----w D:\Program Files\Alky for Applications
2009-11-19 21:16:15 -------- d-----w D:\DOCUME~1\ADMINI~1\APPLIC~1\Apple Computer
2009-11-18 18:44:56 -------- d-----w D:\DOCUME~1\ADMINI~1\APPLIC~1\Bioshock
2009-11-15 17:10:13 664 ----a-w D:\WINDOWS\system32\d3d9caps.dat
2009-11-06 15:33:24 107,888 ----a-w D:\WINDOWS\system32\CmdLineExt.dll
2009-10-25 11:35:21 79,052 ----a-w D:\WINDOWS\system32\perfc00C.dat
2009-10-25 11:35:21 498,034 ----a-w D:\WINDOWS\system32\perfh00C.dat

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}=D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 11:07]
{53707962-6F74-2D53-2644-206D7942484F}=D:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 15:31]
{DBC80044-A445-435b-BC74-9C25C1C588A9}=D:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-09-13 01:39]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}=D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-09-13 01:39]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="D:\Program Files\Winamp\winampa.exe" [2009-07-01 17:37]
"SunJavaUpdateSched"="D:\Program Files\Java\jre6\bin\jusched.exe" [2009-09-13 01:39]
"StartCCC"="D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-13 20:24]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" []
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2009-09-05 00:54]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2009-09-08 20:09]
"Adobe Reader Speed Launcher"="D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 16:10]
"LogitechVideoRepair"="D:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24]
"LogitechVideoTray"="D:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14]
"avgnt"="D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 13:08]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="D:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 12:58]
"VisualTaskTip"="\Program Files\VisualTaskTips\VisualTaskTips.exe" []
"Sidebar"="D:\Program Files\Windows Sidebar\sidebar.exe" [2008-05-02 15:07]
"ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2008-05-08 13:13]
"DAEMON Tools Lite"="D:\Program Files\DAEMON Tools Lite\daemon.exe" [2009-04-23 14:51]
"Skype"="D:\Program Files\Skype\Phone\Skype.exe" [2009-10-09 13:11]
"LogitechSoftwareUpdate"="D:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44]
"SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 15:31]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_2"=regsvr32 /s /n /i:U shell32
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"RocketDock"="D:\Program Files\RocketDock\RocketDock.exe"
"VisualTaskTip"=\Program Files\VisualTaskTips\VisualTaskTips.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"=1 (0x1)
"NoLowDiskSpaceChecks"=1 (0x1)
"NoStartBanner"=01000000
"MemCheckBoxInRunDlg"=1 (0x1)
"NoSMBalloonTip"=1 (0x1)
"NoDesktopCleanupWizard"=1 (0x1)
"NoWelcomeScreen"=1 (0x1)
"NoTrayItemsDisplay"=0 (0x0)
"NoStrCmpLogical"=0 (0x0)
"NoInstrumentation"=0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"=1 (0x1)
"NoLowDiskSpaceChecks"=1 (0x1)
"NoStartBanner"=01000000
"MemCheckBoxInRunDlg"=1 (0x1)
"NoSMBalloonTip"=1 (0x1)
"NoDesktopCleanupWizard"=1 (0x1)
"NoWelcomeScreen"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
%SystemRoot%\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
d:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService WebClient LmHosts RemoteRegistry upnphost SSDPSRV
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
napagent
hkmsvc

********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-17 15:15:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

disk error: D:\WINDOWS\

please note that you need administrator rights to perform deep scan

********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\JavaQuickStarterService]
"ImagePath"="\"D:\Program Files\Java\jre6\bin\jqs.exe\" -service -config \"D:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf\""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\H8SRTd.sys]
"imagepath"="\systemroot\system32\drivers\H8SRTxnscdpqjpa.sys"

Completion time: 2010-01-17 15:15:55
D:\ComboFix2.txt ... 2010-01-17 14:30
D:\ComboFix3.txt ... 2010-01-17 14:29

--- E O F ---

Stephy · Answer

Je ne veux surtout pas être de mauvaise fois, au contraire j'aimerais que mon PC fonctionne à nouveau normalement.
Cependant, les 4liens RKILL ne fonctionne pas, mais je l'avais téléchargé auparavant, il y a 2 semaines, j'ai donc utilisé celui ci.
Les liens pour Combofix ne fonctionne pas chez moi, je tombe sur un forum sur l'un et sur l'autre, ca me dis simplement que le lien est mort ou qu'il n'existe pas.

C'est peut être encore un coup de mes infections, je n'en sais rien, mais je te dis ce qu'il se passe chez moi en tout cas :/

Stephy · Answer

Voici le rapport Combofix,
Je m'excuse je l'ai lancé à partir de mes documents, et sans le renommé, j'espère que mon étourderie ne freinera pas ton diagnostic. Voici le rapport.

ComboFix 10-01-16.03 - Administrateur 17/01/2010  15:59:31.1.4 - x86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.2039.1663 [GMT 1:00]
Lancé depuis: d:\documents and settings\Administrateur\Mes documents\ComboFix.exe

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
d:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
D:\LOG.TXT
d:\windows\system32\drivers\H8SRTxnscdpqjpa.sys
d:\windows\system32\H8SRTfvmhfuyurq.dat
d:\windows\system32\h8srtkrl32mainweq.dll
d:\windows\system32\H8SRTtdkslovymo.dll
d:\windows\system32\H8SRTxmsnaxwhpm.dll
d:\windows\system32\H8SRTypdmybxrjs.dll
d:\windows\system32\krl32mainweq.dll
d:\windows\system32\msconfig.exe
d:\windows\system32\srcr.dat

----- BITS: Il y a peut-être des sites infectés -----

hxxp://download.xbox.com:80
.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_H8SRTd.sys
-------\Legacy_H8SRTd.sys


(((((((((((((((((((((((((((((   Fichiers créés du 2009-12-17 au 2010-01-17  ))))))))))))))))))))))))))))))))))))
.

2010-01-17 13:29 . 2005-11-08 23:26	38400	----a-w-	d:\windows\system32\moveex.exe
2010-01-17 13:06 . 2010-01-17 15:02	--------	d-----w-	d:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-17 13:06 . 2010-01-17 13:06	--------	d-----w-	d:\program files\Spybot - Search & Destroy
2010-01-17 12:57 . 2010-01-17 12:58	--------	d-----w-	D:\FindyKill
2009-12-25 13:52 . 2009-12-25 14:10	--------	d-----w-	d:\program files\Ad-Remover
2009-12-25 13:07 . 2009-12-03 15:14	38224	----a-w-	d:\windows\system32\drivers\mbamswissarmy.sys
2009-12-25 13:07 . 2009-12-25 13:07	--------	d-----w-	d:\program files\Malwarebytes' Anti-Malware
2009-12-25 13:07 . 2009-12-25 13:07	--------	d-----w-	d:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-25 13:07 . 2009-12-03 15:13	19160	----a-w-	d:\windows\system32\drivers\mbam.sys
2009-12-25 12:59 . 2009-03-30 09:32	96104	----a-w-	d:\windows\system32\drivers\avipbb.sys
2009-12-25 12:59 . 2009-02-13 11:28	22360	----a-w-	d:\windows\system32\drivers\avgntmgr.sys
2009-12-25 12:59 . 2009-02-13 11:17	45416	----a-w-	d:\windows\system32\drivers\avgntdd.sys
2009-12-25 12:59 . 2009-12-25 12:59	--------	d-----w-	d:\program files\Avira
2009-12-25 12:59 . 2009-12-25 12:59	--------	d-----w-	d:\documents and settings\All Users\Application Data\Avira
2009-12-20 12:13 . 2009-12-20 12:13	--------	d-----w-	d:\documents and settings\Administrateur\Local Settings\Application Data\Logitech-LS
2009-12-20 11:49 . 2008-04-13 16:33	59392	----a-w-	d:\windows\system32\vfwwdm32.dll
2009-12-20 11:18 . 2008-04-13 08:45	60032	-c--a-w-	d:\windows\system32\dllcache\usbaudio.sys
2009-12-20 11:18 . 2008-04-13 08:45	60032	----a-w-	d:\windows\system32\drivers\USBAUDIO.sys
2009-12-19 14:03 . 2010-01-17 11:53	--------	d-----w-	d:\documents and settings\Administrateur\Application Data\skypePM
2009-12-19 14:03 . 2009-12-19 14:03	56	---ha-w-	d:\windows\system32\ezsidmv.dat
2009-12-19 13:58 . 2010-01-17 13:21	--------	d-----w-	d:\documents and settings\Administrateur\Application Data\Skype
2009-12-19 13:58 . 2009-12-19 13:58	--------	d-----w-	d:\program files\Fichiers communs\Skype
2009-12-19 13:58 . 2009-12-19 13:58	--------	d-----r-	d:\program files\Skype
2009-12-19 13:58 . 2009-12-19 13:58	--------	d-----w-	d:\documents and settings\All Users\Application Data\Skype

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-17 12:11 . 2009-09-13 00:40	--------	d-----w-	d:\documents and settings\Administrateur\Application Data\Azureus
2010-01-16 22:32 . 2009-09-13 00:04	--------	d-----w-	d:\documents and settings\Administrateur\Application Data\Winamp
2010-01-15 11:30 . 2009-09-14 08:47	--------	d-----w-	d:\documents and settings\Administrateur\Application Data\vlc
2009-12-25 05:41 . 2009-10-11 00:46	600056	----a-w-	d:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-12-20 11:46 . 2009-12-20 11:46	--------	d-----w-	d:\program files\Fichiers communs\Logitech
2009-12-20 11:46 . 2009-09-19 18:03	--------	d-----w-	d:\program files\Logitech
2009-12-20 11:46 . 2009-09-12 02:53	--------	d--h--w-	d:\program files\InstallShield Installation Information
2009-12-18 12:24 . 2009-09-13 00:40	--------	d-----w-	d:\program files\Vuze
2009-12-14 20:25 . 2009-09-14 08:47	--------	d-----w-	d:\documents and settings\Administrateur\Application Data\dvdcss
2009-12-01 16:50 . 2009-09-12 02:39	--------	d-----w-	d:\program files\Alky for Applications
2009-11-19 21:16 . 2009-09-22 05:27	--------	d-----w-	d:\documents and settings\Administrateur\Application Data\Apple Computer
2009-11-18 18:44 . 2009-09-16 16:50	--------	d-----w-	d:\documents and settings\Administrateur\Application Data\Bioshock
2009-11-15 17:10 . 2009-11-15 17:10	664	----a-w-	d:\windows\system32\d3d9caps.dat
2009-11-06 15:33 . 2009-09-16 15:26	107888	----a-w-	d:\windows\system32\CmdLineExt.dll
2009-10-25 11:35 . 2008-04-14 16:00	79052	----a-w-	d:\windows\system32\perfc00C.dat
2009-10-25 11:35 . 2008-04-14 16:00	498034	----a-w-	d:\windows\system32\perfh00C.dat
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	d:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	d:\program files\mozilla firefox\plugins\ssldivx.dll
.

------- Sigcheck -------

[-] 2008-05-08 . AE0D48AF37F5A48156D4A6BAE07C9121 . 568320 . . [5.1.2600.5512] . . d:\windows\system32\winlogon.exe

[-] 2008-05-08 . D449DF66B6335B443508A58B1E8DB996 . 647680 . . [5.82] . . d:\windows\system32\comctl32.dll

[-] 2008-05-08 . 3C3BC824F70B00CB9507E8F3FD0D0A46 . 2516480 . . [5.1.2600.5512] . . d:\windows\system32
toskrnl.exe

[-] 2008-05-08 . DB3AB42404D66860A4C4E9ED8530D0FD . 724480 . . [5.1.2600.5512] . . d:\windows\system32\user32.dll

[-] 2007-10-29 . D84567752FB42D8DC55CFB85FE0EDECE . 1916416 . . [6.00.2900.2894] . . d:\windows\explorer.exe


[-] 2008-05-15 . A5780186A76EABA3E656E63B41862997 . 1571840 . . [5.1.2600.5512] . . d:\windows\system32\sfcfiles.dll

[-] 2008-05-08 . 58DB2EE838D5B7BAD0F7F10A6C920390 . 40960 . . [5.1.2600.5512] . . d:\windows\system32\ctfmon.exe

[-] 2008-05-15 . A37C1B89E3446B9E3CBB4FE260FE52B9 . 2395136 . . [5.1.2600.5512] . . d:\windows\system32
tkrnlpa.exe

d:\windows\System32\wscntfy.exe ... manque !!
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="d:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Sidebar"="d:\program files\Windows Sidebar\sidebar.exe" [2008-05-02 1276416]
"DAEMON Tools Lite"="d:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"Skype"="d:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"LogitechSoftwareUpdate"="d:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"SpybotSD TeaTimer"="d:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="d:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2009-09-13 149280]
"StartCCC"="d:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-13 98304]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"QuickTime Task"="d:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2009-09-08 305440]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"LogitechVideoRepair"="d:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="d:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="d:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2008-03-01 124928]

d:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech SetPoint.lnk - d:\program files\Logitech\SetPoint\SetPoint.exe [2009-9-19 813584]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LBTWlgn]
2009-07-20 10:28	72208	----a-w-	d:\program files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"DisablePagingExecutive"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"d:\Program Files\Skype\Phone\Skype.exe"=
"d:\Program Files\Skype\Plugin Manager\skypePM.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\program files\Avira\AntiVir Desktop\sched.exe [25/12/2009 13:59 VALR 108289]
R2 LBeepKE;LBeepKE;d:\windows\system32\drivers\LBeepKE.sys [19/09/2009 19:04 VALR 10384]
R3 DELTAII;Service for M-Audio Delta Driver (WDM);d:\windows\system32\drivers\deltaII.sys [12/09/2009 20:09 VALR 302728]
S3 NTIOLib_1_0_0;NTIOLib_1_0_0;d:\program files\MSI\ControlCenter\NTIOLib.sys [12/09/2009 04:09 VALR 7680]
S4 sptd;sptd;d:\windows\system32\drivers\sptd.sys [16/09/2009 16:11 VALR 721904]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
2008-03-01 12:58	124928	----a-w-	d:\windows\system32\advpack.dll
.
.
------- Examen supplémentaire -------
.
mStart Page = about:blank
uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s
FF - ProfilePath - d:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\mpu21qpu.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - component: d:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-VisualTaskTip - \Program Files\VisualTaskTips\VisualTaskTips.exe
HKU-Default-Run-VisualTaskTip - \Program Files\VisualTaskTips\VisualTaskTips.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-17 16:02
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-484763869-796845957-1801674531-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:bd,69,31,75,36,b8,14,da,c1,b2,89,8e,a7,0e,65,e1,de,47,51,15,6c,17,fb,
   db,12,70,b6,d7,4b,82,84,c5,9b,9b,e3,bc,42,c1,e7,87,07,a0,a7,ff,03,c9,e3,8f,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_USERS\S-1-5-21-484763869-796845957-1801674531-500\Software\SecuROM\License information*]
"datasecu"=hex:01,d4,7e,97,ed,ad,1b,ac,73,09,ab,ce,39,db,84,bf,f6,45,6d,52,b3,
   85,05,0b,15,db,2d,a8,8c,30,2e,66,04,0d,16,f4,79,bb,6c,b2,d4,e4,98,10,60,67,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(464)
d:\windows\system32\SETUPAPI.dll
d:\windows\system32\Ati2evxx.dll
d:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll
d:\program files\fichiers communs\logishrd\bluetooth\LBTServ.dll
d:\windows\system32\COMRes.dll
d:\windows\system32\cscui.dll

- - - - - - - > 'lsass.exe'(520)
d:\windows\system32\setupapi.dll
d:\windows\system32\scecli.dll
.
------------------------ Autres processus actifs ------------------------
.
d:\windows\system32\Ati2evxx.exe
d:\windows\system32\Ati2evxx.exe
d:\program files\Avira\AntiVir Desktop\avguard.exe
d:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\windows\system32\LVComsX.exe
d:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
d:\program files\Logitech\Video\FxSvr2.exe
d:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
d:\program files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
d:\program files\iPod\bin\iPodService.exe
d:\program files\Skype\Plugin Manager\skypePM.exe
d:\program files\Avira\AntiVir Desktop\GUARDGUI.EXE
.
**************************************************************************
.
Heure de fin: 2010-01-17  16:03:50 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-01-17 15:03
ComboFix2.txt  2010-01-17 14:15

Avant-CF: 9 499 639 808 octets libres
Après-CF: 9 477 423 104 octets libres

- - End Of File - - A7A3E8B5FA63E3DBE287527857256FCF

Stephy · Answer

MERCIIII C'est genial, mon antivirus fonctionne à nouveau ainsi que spybot.
C'est vraiment cool.

Voici le rapport Findykill, j'ai branché 1 ipod et 1 clef usb.
Encore une fois merci !! N'hesite pas à m'expliquer si tu le veux bien ce qu'il s'est passé, je m'y connais un petit peu en ordi et j'aimerais ne plus refaire l'erreur.



############################## | FindyKill V5.024 |

# User : Administrateur () # PCALR
# Update on 09/01/2010 by El Desaparecido
# Start at: 16:29:31 VALR | 17/01/2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Core(TM) i5 CPU         750  @ 2.67GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Disabled

# C:\ # Disque fixe local # 445,24 Go (350,1 Go free) # NTFS
# D:\ # Disque fixe local # 20,51 Go (8,82 Go free) # NTFS
# E:\ # Disque CD-ROM # 0 Mo (0 Mo free) [Audio CD] # CDFS
# F:\ # Disque amovible # 3,77 Go (1,12 Go free) [KINGSTON] # FAT32
# I:\ # Disque amovible # 7,41 Go (421,16 Mo free) [IPOD (STEPH] # FAT32

############################## | Processus actifs |

D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir Desktop\sched.exe
D:\Program Files\Avira\AntiVir Desktop\avguard.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Winamp\winampa.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Logitech\Video\LogiTray.exe
D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
D:\Program Files\RocketDock\RocketDock.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\WINDOWS\system32\LVComsX.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\Program Files\Logitech\SetPoint\SetPoint.exe
D:\Program Files\Logitech\Video\FxSvr2.exe
D:\WINDOWS\System32\alg.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Skype\Plugin Manager\skypePM.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Windows NT\Accessoires\WORDPAD.EXE
D:\WINDOWS\system32\wbem\wmiprvse.exe

################## | D: |


################## | D:\WINDOWS |


################## | D:\WINDOWS\Prefetch |


################## | D:\WINDOWS\system32 |


################## | D:\WINDOWS\system32\drivers |


################## | D:\Documents and Settings\Administrateur\Application Data |


################## | Temporary Internet Files |


################## | Registre |


################## | Etat |

# Affichage des fichiers cachés : OK
 
# Mode sans echec : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 ) 
# Ip6Fw -> Start = 3 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 


################## | Cracks > Keygens > Serials |

"C:\Azureus download\BioshockCrack\Bioshock.exe"  
16/09/2009 16:47 VALR |Size 16302080 |Crc32 dbbc998e |Md5 a5fb8b5849326d81e263f79fe6f60bab  
 
"C:\Kit jeu Complet\Batman Arkham Asylum\Crack\BmLauncher.exe"  
09/08/2009 20:48 VALR |Size 8574216 |Crc32 002fd969 |Md5 332ab88845d68cb37cbd1475c7b792e8  
 
"C:\Kit jeu Complet\Batman Arkham Asylum\Crack\BmStartApp.exe"  
03/09/2009 20:59 VALR |Size 364544 |Crc32 a2b5f014 |Md5 cd0f21abd310e79d068f5e159b926313  
 
"C:\Kit jeu Complet\BIOSHOCK\BioshockCrack\Bioshock.exe"  
16/09/2009 16:47 VALR |Size 16302080 |Crc32 dbbc998e |Md5 a5fb8b5849326d81e263f79fe6f60bab  
 
"I:\Crack\BmLauncher.exe"  
09/08/2009 21:48 VALR |Size 8574216 |Crc32 002fd969 |Md5 332ab88845d68cb37cbd1475c7b792e8  
 
"I:\Crack\BmStartApp.exe"  
03/09/2009 21:59 VALR |Size 364544 |Crc32 a2b5f014 |Md5 cd0f21abd310e79d068f5e159b926313  
 

################## | ! Fin du rapport # FindyKill V5.024 ! |

Stephy · Answer

Re, Voici le AD-Report:



.
======= RAPPORT D'AD-REMOVER 1.1.4.6_H | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 16.01.2010 à 22:13
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 16:42:37, 17/01/2010 | Mode Normal | Option: SCAN
Exécuté de: D:\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Nom du PC: PCALR | Utilisateur actuel: Administrateur
.
============== ÉLÉMENT(S) TROUVÉ(S) ==============
.

.
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.7 [fr] *
.
 Nom du profil: mpu21qpu.default (Administrateur)
.
(ADMINI~1, prefs.js) Browser.download.lastDir, D:\Documents and Settings\Administrateur\Mes documents\TÃ©lÃ©chargements
(ADMINI~1, prefs.js) Browser.search.selectedEngine, DAEMON Search
(ADMINI~1, prefs.js) Extensions.enabledItems, {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.6.2,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,jqs@sun.com:1.0,{B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.7
. 
. 
.
* Internet Explorer Version 7.0.5730.13 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Do404Search: 01000000
Local Page: D:\WINDOWS\system32\blank.htm
Show_ToolBar: yes
Enable Browser Extensions: yes
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Delete_Temp_Files_On_Exit: yes
Local Page: %SystemRoot%\system32\blank.htm
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: about:blank
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
D:\Documents and Settings\Administrateur\Application Data\Azureus	orrents\Alawar-Games-World-Of-Goo-Precracked-DuTY [mininova].torrent
D:\Documents and Settings\Administrateur\Application Data\Azureus	orrents\Bioshock Crack [mininova].torrent
D:\Documents and Settings\Administrateur\Mes documents\T‚l‚chargements\Bioshock_Version_11_Patch_Worldwide_Retail.zip
D:\Documents and Settings\Administrateur\Mes documents\T‚l‚chargements\grand_theft_auto_iv_patch_1_multi-langues_270646(2).zip
D:\Documents and Settings\Administrateur\Mes documents\T‚l‚chargements\grand_theft_auto_iv_patch_1_multi-langues_270646.zip
D:\Documents and Settings\Administrateur\Mes documents\T‚l‚chargements\grand_theft_auto_iv_patch_v1.0.2.0_multi-langues_274194.exe
D:\Documents and Settings\Administrateur\Mes documents\T‚l‚chargements\grand_theft_auto_iv_patch_v1.0.4.0_multi-langues_291476.exe
.
===================================
.
3598 Octet(s) - D:\Ad-Report-CLEAN[1].log 
3038 Octet(s) - D:\Ad-Report-SCAN[1].log 
.
3 Fichier(s) - D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp 
2 Fichier(s) - D:\WINDOWS\Temp 
129 Fichier(s) - D:\WINDOWS\Prefetch 
.
3 Fichier(s) - D:\Ad-Remover\BACKUP
0 Fichier(s) - D:\Ad-Remover\QUARANTINE
.
Fin à: 16:43:42 | 17/01/2010 - SCAN[1]
.
============== E.O.F ==============
.

Stephy · Answer

Voici le premier Rapport de Ad-remover, je lance malware byte's et je te dis ca.


.
======= RAPPORT D'AD-REMOVER 1.1.4.6_H | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 16.01.2010 à 22:13
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 17:00:55, 17/01/2010 | Mode Normal | Option: CLEAN
Exécuté de: D:\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Nom du PC: PCALR | Utilisateur actuel: Administrateur
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.


(!) -- Fichiers temporaires supprimés.
 
.
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.7 [fr] *
.
 Nom du profil: mpu21qpu.default (Administrateur)
.
(ADMINI~1, prefs.js) Browser.download.lastDir, D:\Documents and Settings\Administrateur\Mes documents\TÃ©lÃ©chargements
(ADMINI~1, prefs.js) Browser.search.selectedEngine, DAEMON Search
(ADMINI~1, prefs.js) Extensions.enabledItems, {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.6.2,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,jqs@sun.com:1.0,{B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.7
. 
. 
.
* Internet Explorer Version 7.0.5730.13 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Do404Search: 01000000
Local Page: D:\WINDOWS\system32\blank.htm
Show_ToolBar: yes
Enable Browser Extensions: yes
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: %SystemRoot%\system32\blank.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
D:\Documents and Settings\Administrateur\Application Data\Azureus	orrents\Alawar-Games-World-Of-Goo-Precracked-DuTY [mininova].torrent
D:\Documents and Settings\Administrateur\Application Data\Azureus	orrents\Bioshock Crack [mininova].torrent
D:\Documents and Settings\Administrateur\Mes documents\T‚l‚chargements\Bioshock_Version_11_Patch_Worldwide_Retail.zip
D:\Documents and Settings\Administrateur\Mes documents\T‚l‚chargements\grand_theft_auto_iv_patch_1_multi-langues_270646(2).zip
D:\Documents and Settings\Administrateur\Mes documents\T‚l‚chargements\grand_theft_auto_iv_patch_1_multi-langues_270646.zip
D:\Documents and Settings\Administrateur\Mes documents\T‚l‚chargements\grand_theft_auto_iv_patch_v1.0.2.0_multi-langues_274194.exe
D:\Documents and Settings\Administrateur\Mes documents\T‚l‚chargements\grand_theft_auto_iv_patch_v1.0.4.0_multi-langues_291476.exe
.
===================================
.
3598 Octet(s) - D:\Ad-Report-CLEAN[1].log 
3215 Octet(s) - D:\Ad-Report-CLEAN[2].log 
3375 Octet(s) - D:\Ad-Report-SCAN[1].log 
.
2 Fichier(s) - D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp 
2 Fichier(s) - D:\WINDOWS\Temp 
1 Fichier(s) - D:\WINDOWS\Prefetch 
.
20 Fichier(s) - D:\Ad-Remover\BACKUP
0 Fichier(s) - D:\Ad-Remover\QUARANTINE
.
Fin à: 17:01:46 | 17/01/2010 - CLEAN[2]
.
============== E.O.F ==============
.

Stephy · Answer

Re,

Voici le rapport de MBAM.


Malwarebytes' Anti-Malware 1.42
Version de la base de données: 3289
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

17/01/2010 17:16:32 VALR
mbam-log-2010-01-17 (17-16-32).txt

Type de recherche: Examen complet (C:\|D:\|I:\|)
Eléments examinés: 143097
Temps écoulé: 7 minute(s), 52 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
D:\Documents and Settings\Administrateur\Bureau\SmitfraudFix.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
D:\QooBox\Quarantine\D\WINDOWS\system32\drivers\H8SRTxnscdpqjpa.sys.vir (Malware.Packer) -> Quarantined and deleted successfully.

Stephy · Answer

Re

J'ai supprimé les fichiers en quarantaine, Firefox refonctionne normalement.
Tout les liens fonctionnent.

Merci beaucoup pour ton aide. Je suis tout ouïe pour la suite :)

Stephy · Answer

Re, Bonsoir Guillaume,

Désolé pour le temps de réponse, j'ai du sortir.

voici le rapport RSIT

Le rapport info.txt:

info.txt logfile of random's system information tool 1.06 2010-01-17 19:00:30

======Uninstall list======

-->MsiExec /X{6833245E-DD86-479A-882A-8360D62C8194}
Adobe Flash Player 10 Plugin-->D:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->D:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Ad-Remover By C_XX-->"D:\Ad-Remover\Un-ADR.exe"
Alky for Applications (Windows XP)-->MsiExec.exe /X{BB05D173-9681-4812-A7FA-BD4042A3DA00}
Apple Application Support-->MsiExec.exe /I{0C34B801-6AEC-4667-B053-03A67E2D0415}
Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ATI - Utilitaire de désinstallation du logiciel-->D:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI AVIVO Codecs-->MsiExec.exe /I{2AEB1EAF-9E1C-4361-8562-5AC7AE6AC177}
ATI Catalyst Control Center-->RunDll32 D:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0 
ATI Display Driver-->rundll32 D:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI HYDRAVISION-->RunDll32 D:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}\setup.exe" 
ATI Parental Control & Encoder-->MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B99309BDC7}
ATI Problem Report Wizard-->MsiExec.exe /X{5DA6F06A-B389-407B-BF8C-1548767914D8}
Avira AntiVir Personal - Free Antivirus-->D:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Batman: Arkham Asylum-->"D:\Program Files\InstallShield Installation Information\{4E79A60F-15D2-4BEC-91AD-E41EC42E61B0}\setup.exe" -runfromtemp -l0x040c -removeonly
BioShock-->D:\Program Files\InstallShield Installation Information\{E280923D-C5D9-4728-8C79-AC9A0DC75875}\setup.exe -runfromtemp -l0x040c -removeonly
Catalyst Control Center - Branding-->MsiExec.exe /I{CF929EEB-CE39-4F06-B1BF-F51FC617A2B2}
CCleaner-->"D:\Program Files\CCleaner\uninst.exe"
CDDRV_Installer-->MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A}
ControlCenter-->"D:\Program Files\MSI\ControlCenter\unins000.exe"
Correctif pour Windows XP (KB938759)-->"D:\WINDOWS\$NtUninstallKB938759$\spuninst\spuninst.exe"
Delta-->D:\Program Files\InstallShield Installation Information\{A4810699-E859-43A6-8F40-1743873E72AB}\setup.exe -runfromtemp -l0x0009 -removeonly
DivX Web Player-->D:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
erLT-->MsiExec.exe /I{A498D9EB-927B-459B-85D6-DD6EF8C2C564}
Fraps-->"D:\Fraps\uninstall.exe"
Gadget Documents récents Microsoft Office 2007-->MsiExec.exe /X{90120000-008A-040C-0000-0000000FF1CE}
Grand Theft Auto IV-->"D:\Program Files\InstallShield Installation Information\{579BA58C-F33D-4970-9953-B94B43768AC3}\setup.exe" -runfromtemp -l0x040c -removeonly
HijackThis 2.0.2-->"D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->D:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
iTunes-->MsiExec.exe /I{EC2A8F27-4FBF-4E41-B27B-FE822511B761}
Java(TM) 6 Update 16-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216016FF}
KhalInstallWrapper-->MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}
Logiciel d'archivage WinRAR-->D:\Program Files\WinRAR\uninstall.exe
Logiciel QuickCam de Logitech-->RunDll32 D:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{C43048A9-742C-4DAD-90D2-E3B53C9DB825}\setup.exe" -l0x40c 
Logitech SetPoint-->"D:\Program Files\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe" -runfromtemp -l0x040c -removeonly
Malwarebytes' Anti-Malware-->"D:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->D:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}
Microsoft Games for Windows - LIVE-->MsiExec.exe /X{F112F66E-25CA-42DD-983C-6118EB38F606}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"D:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"D:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.5.7)-->D:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 6.0 Parser (KB925673)-->MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
NVIDIA PhysX-->MsiExec.exe /X{6833245E-DD86-479A-882A-8360D62C8194}
Prism Video Converter-->D:\Program Files\NCH Software\Prism\uninst.exe
Programme de gestion Camera de Logitech®-->"D:\Program Files\Fichiers communs\Logitech\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
Reason 4.0-->"C:\Reason\Reason\Uninstall Reason\unins000.exe"
RocketDock 1.3.5-->"D:\Program Files\RocketDock\unins000.exe"
Rockstar Games Social Club-->"D:\Program Files\InstallShield Installation Information\{08B3869E-D282-424C-9AFC-870E04A4BA14}\setup.exe" -runfromtemp -l0x040c -removeonly
Skype web features-->MsiExec.exe /I{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}
Skype™ 4.1-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Spybot - Search & Destroy-->"D:\Program Files\Spybot - Search & Destroy\unins000.exe"
TmNationsForever-->"C:\Jeux\TmNationsForever\unins000.exe"
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VLC media player 1.0.1-->D:\Program Files\VideoLAN\VLC\uninstall.exe
Volet Windows-->RUNDLL32 advpack.dll,LaunchINFSection Sidebar.inf,UnInstall
Vuze-->D:\Program Files\Vuze\uninstall.exe
Winamp-->"D:\Program Files\Winamp\UninstWA.exe"
Windows Internet Explorer 8-->"D:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"D:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"D:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}

======Hosts File======

127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com

Securitycenter WMI appears to be broken

======System event log======

Computer Name: PCALR
Event Code: 7009
Message: Délai (30000 millisecondes) d'attente pour une connexion du service Avira AntiVir Planificateur.

Record Number: 5
Source Name: Service Control Manager
Time Written: 20100115115826.000000+060
Event Type: erreur
User: 

Computer Name: PCALR
Event Code: 4201
Message: Le système a détecté que la carte réseau \DEVICE\TCPIP_{69C8BDB5-A0F5-4F26-A6DC-5E4068F7DC8F} était connectée au réseau,
et a lancé une opération normale sur la carte réseau.

Record Number: 4
Source Name: Tcpip
Time Written: 20100115115737.000000+060
Event Type: Informations
User: 

Computer Name: PCALR
Event Code: 17
Message: AVGNTFLT successfully loaded

Record Number: 3
Source Name: avgntflt
Time Written: 20100115115737.000000+060
Event Type: Informations
User: 

Computer Name: PCALR
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 2
Source Name: EventLog
Time Written: 20100115115707.000000+060
Event Type: Informations
User: 

Computer Name: PCALR
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Multiprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20100115115707.000000+060
Event Type: Informations
User: 

=====Application event log=====

Computer Name: PCALR
Event Code: 105
Message: The service was started.

Record Number: 5
Source Name: ATI Smart
Time Written: 20100108164339.000000+060
Event Type: Informations
User: 

Computer Name: PCALR
Event Code: 2004
Message: Impossible d'ouvrir le Service serveur. Les données de performance du
serveur ne seront pas renvoyées. Le code d'erreur renvoyé est la donnée DWORD 0.

Record Number: 4
Source Name: PerfNet
Time Written: 20100108164238.000000+060
Event Type: erreur
User: 

Computer Name: PCALR
Event Code: 2004
Message: Impossible d'ouvrir le Service serveur. Les données de performance du
serveur ne seront pas renvoyées. Le code d'erreur renvoyé est la donnée DWORD 0.

Record Number: 3
Source Name: PerfNet
Time Written: 20100108164020.000000+060
Event Type: erreur
User: 

Computer Name: PCALR
Event Code: 105
Message: The service was started.

Record Number: 2
Source Name: ATI Smart
Time Written: 20100108164018.000000+060
Event Type: Informations
User: 

Computer Name: PCALR
Event Code: 2004
Message: Impossible d'ouvrir le Service serveur. Les données de performance du
serveur ne seront pas renvoyées. Le code d'erreur renvoyé est la donnée DWORD 0.

Record Number: 1
Source Name: PerfNet
Time Written: 20100810173919.000000+120
Event Type: erreur
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;D:\Program Files\Alky for Applications\Libraries;D:\Program Files\ATI Technologies\ATI.ACE\Core-Static;D:\Program Files\QuickTime\QTSystem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 30 Stepping 5, GenuineIntel
"PROCESSOR_REVISION"=1e05
"NUMBER_OF_PROCESSORS"=4
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;D:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=D:\Program Files\Java\jre6\lib\ext\QTJava.zip
"RGSCLauncher"=C:\Jeux\GTA IV\Rockstar Games Social Club
"RGSC"=C:\Jeux\GTA IV\Rockstar Games Social Club\1_0_0_0

-----------------EOF-----------------

Stephy · Answer

Maintenant le fichier log.txt:


Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2010-01-17 19:00:19
Microsoft Windows XP Professionnel Service Pack 3
System drive D: has 9 GB (42%) free of 21 GB
Total RAM: 2039 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:00 VALR, on 17/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir Desktop\sched.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Winamp\winampa.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Logitech\Video\LogiTray.exe
D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
D:\Program Files\RocketDock\RocketDock.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\Program Files\Windows Sidebar\sidebar.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Avira\AntiVir Desktop\avguard.exe
D:\WINDOWS\system32\LVComsX.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Logitech\Video\FxSvr2.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\CCleaner\CCleaner.exe
d:\program files\avira\antivir desktop\avcenter.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\RSIT.exe
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\Administrateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.windows.fr/ie8/bienvenue
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] D:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] D:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [RocketDock] "D:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Sidebar] D:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "D:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [RocketDock] "D:\Program Files\RocketDock\RocketDock.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [RocketDock] "D:\Program Files\RocketDock\RocketDock.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - D:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - D:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe

Stephy · Answer

Coucou, Merci d'être encore là

voici le rapport de OTM

PS: Je vais aller manger je ne pourrais repondre de suite, à plus tard.


All processes killed
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
D:\Log.txt moved successfully.
D:\Documents and Settings\All Users\Application Data\sysReserve.ini moved successfully.
D:\WINDOWS\system32\moveex.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 17203022 bytes
->Temporary Internet Files folder emptied: 98438 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 89871566 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2351795 bytes
%systemroot%\System32 .tmp files removed: 2693120 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 255 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 67 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 107,00 mb
 
 
OTM by OldTimer - Version 3.1.6.0 log created on 01172010_204543

Files moved on Reboot...
File D:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\mpu21qpu.default\OfflineCache\index.sqlite not found!

Registry entries deleted on Reboot...

Stephy · Answer

Merci encore Guillaume pour m'avoir autant éclairé et aidé,

Pour le moment je suis en entreprise et j'ai pas trop le temps de faire les scans et les mises à jours, je fais tout ca Jeudi ou Vendredi. 

Bonne semaine à toi

Stephy · Answer

Coup de motivation !!!

Voici le rapport Javara



JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Tue Jan 19 19:52:23 2010

Found and removed: D:\Documents and Settings\Administrateur\Application Data\Sun\Java\jre1.6.0_16

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

------------------------------------

Finished reporting.



JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Tue Jan 19 19:52:59 2010

------------------------------------

Finished reporting.

Stephy · Answer

Voici le rapport de TCLEANER




[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

D:\Combofix.txt: trouvé !
D:\Qoobox: trouvé !
D:\_OTM: trouvé !
D:\FindyKill: trouvé !
D:\Rsit: trouvé !
D:\Ad-remover: trouvé !
D:\Documents and Settings\Administrateur\Mes documents\ComboFix.exe: trouvé !
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\OTM.exe: trouvé !
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\ComboFix.exe: trouvé !
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\HijackThis.exe: trouvé !
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\Ad-R.exe: trouvé !
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\hijackthis.log: trouvé !
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\Rsit.exe: trouvé !
D:\Program Files\Ad-remover: trouvé !
D:\QooBox\Quarantine\catchme.log: trouvé !
D:\WINDOWS\mbr.exe: trouvé !

---------------------------------
--> Suppression: 

D:\Documents and Settings\Administrateur\Mes documents\ComboFix.exe: ERREUR DE SUPPRESSION !!
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\OTM.exe: supprimé !
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\ComboFix.exe: supprimé !
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\HijackThis.exe: supprimé !
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\Ad-R.exe: supprimé !
D:\Combofix.txt: supprimé !
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\hijackthis.log: supprimé !
D:\Documents and Settings\Administrateur\Mes documents\Téléchargements\Rsit.exe: supprimé !
D:\QooBox\Quarantine\catchme.log: supprimé !
D:\WINDOWS\mbr.exe: supprimé !
D:\Qoobox: supprimé !
D:\_OTM: supprimé !
D:\FindyKill: supprimé !
D:\Rsit: supprimé !
D:\Ad-remover: supprimé !
D:\Program Files\Ad-remover: supprimé !

Stephy · Answer

Et voici le rapport de mon ANtivirus, j'attend tes instructions.

Bonne soirée !

Problème lié à Malware Defender 2009

18 réponses

Votre réponse

Discussions similaires

Newsletters