Log hijackthis suite à trojan

.
======= LOGFILE OF AD-REMOVER 1.1.4.6_J | ONLY XP/VISTA/7 =======
.
Updated by C_XX on 05.02.2010 at 17:34
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Launch at: 13:39:36, 09/02/2010 | Normal Boot | Option: CLEAN
Executed from: C:\Ad-Remover\
Operating system: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Computer Name: ACER-CAB9EEA47C | Current user: Amandine Andr‚
.
============== NEUTRALIZED ELEMENT(S) ==============
.

C:\DOCUME~1\AMANDI~1\APPLIC~1\Microsoft\Internet Explorer\Quick Launch\Pacific Poker.lnk 

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3712
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 6.0.2900.5512

09/02/2010 14:33:37
mbam-log-2010-02-09 (14-33-37).txt

Type de recherche: Examen rapide
Eléments examinés: 120548
Temps écoulé: 4 minute(s), 25 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Amandine André\Application Data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Application Data\fvgqad.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\fvgqad.dat (Malware.Trace) -> Quarantined and deleted successfully.

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\ deleted successfully.
C:\Program Files\Search Settings\kb125\SearchSettings.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{FE063DB9-4EC0-403e-8DD8-394C54984B2C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows\CurrentVersion\Run not found.
C:\Program Files\Search Settings\SearchSettings.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\\none deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\breadthes deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c4f2cbc-f32d-4a03-9812-86f39379811b}\ not found.
========== FILES ==========
C:\Program Files\Search Settings\kb125\res folder moved successfully.
C:\Program Files\Search Settings\kb125\temp folder moved successfully.
C:\Program Files\Search Settings\kb125 folder moved successfully.
C:\Program Files\Search Settings folder moved successfully.
File\Folder C:\Program Files\AskTBar not found.
File\Folder C:\Program Files\Video ActiveX Object not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: All Users
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 558804 bytes
 
User: LocalService
->Temp folder emptied: 65716 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: Amandine André
->Temp folder emptied: 44729 bytes
->Temporary Internet Files folder emptied: 1624739 bytes
->FireFox cache emptied: 41169535 bytes
->Google Chrome cache emptied: 5929193 bytes
 
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 4037876 bytes
->FireFox cache emptied: 54987507 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19593 bytes
%systemroot%\System32 .tmp files removed: 3433472 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 599262 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23924302 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 16409960 bytes
 
Total Files Cleaned = 146,00 mb
 
 
OTL by OldTimer - Version 3.1.28.0 log created on 02092010_154851

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

ComboFix 10-02-08.09 - Administrateur 09/02/2010  18:31:38.1.1 - FAT32x86 MINIMAL
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.502.369 [GMT 1:00]
Lancé depuis: c:\documents and settings\Administrateur\Mes documents\Téléchargements\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100209-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\WinPCap
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\windows\system32\COMCTL32.OCA
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_NPF


(((((((((((((((((((((((((((((   Fichiers créés du 2010-01-09 au 2010-02-09  ))))))))))))))))))))))))))))))))))))
.

2010-02-09 14:48 . 2010-02-09 14:48	--------	d-----w-	C:\_OTL
2010-02-09 13:26 . 2010-02-09 13:26	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Malwarebytes
2010-02-09 13:26 . 2010-01-07 15:07	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-09 13:26 . 2010-02-09 13:26	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-02-09 13:26 . 2010-02-09 13:26	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-09 13:26 . 2010-01-07 15:07	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-02-09 12:33 . 2010-02-09 12:33	--------	d-----w-	C:\Ad-Remover
2010-02-09 11:52 . 2010-02-09 11:52	--------	d-----w-	c:\program files\Trend Micro
2010-02-09 11:49 . 2010-02-09 11:49	--------	d-----w-	c:\documents and settings\Administrateur\Local Settings\Application Data\Mozilla
2010-02-08 13:47 . 2010-02-08 13:47	--------	d-----w-	c:\windows\BDOSCAN8
2010-02-08 12:54 . 2010-02-08 12:54	--------	d-----w-	c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2010-02-08 12:54 . 2010-02-08 12:54	--------	d-----w-	c:\program files\File Scanner Library (Spybot - Search & Destroy)
2010-02-08 12:54 . 2010-02-08 12:54	--------	d-----w-	c:\program files\TeaTimer (Spybot - Search & Destroy)
2010-02-08 12:54 . 2010-02-08 12:54	--------	d-----w-	c:\program files\SDHelper (Spybot - Search & Destroy)
2010-01-22 19:55 . 2010-01-22 19:55	--------	d-----w-	C:\FOUND.000
2010-01-14 09:36 . 2009-11-21 15:58	471552	------w-	c:\windows\system32\dllcache\aclayers.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-22 05:09 . 2004-08-05 04:00	671232	----a-w-	c:\windows\system32\wininet.dll
2009-12-22 05:08 . 2004-08-05 04:00	81920	----a-w-	c:\windows\system32\ieencode.dll
2009-12-17 14:49 . 2009-12-17 14:49	--------	d-----w-	c:\program files\ESET
2009-12-17 12:11 . 2009-12-17 12:11	116	----a-w-	c:\windows\system32\fjhdyfhsn.bat
2009-12-17 11:51 . 2009-12-17 11:51	--------	d-----w-	c:\program files\CCleaner
2009-12-15 08:26 . 2009-12-13 21:13	20	----a-w-	c:\windows\system32\config\systemprofile\Application Data\fvgqad.dat
2009-11-24 23:54 . 2008-10-05 16:38	1280480	----a-w-	c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2008-10-05 16:39	93424	----a-w-	c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:51 . 2008-10-05 16:39	94160	----a-w-	c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2008-10-05 16:39	114768	----a-w-	c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2008-10-05 16:39	20560	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2008-10-05 16:39	48560	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2008-10-05 16:39	23120	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2008-10-05 16:39	27408	----a-w-	c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2008-10-05 16:39	97480	----a-w-	c:\windows\system32\AvastSS.scr
2009-11-21 15:58 . 2004-08-05 04:00	471552	----a-w-	c:\windows\AppPatch\AcLayers.dll
2009-02-24 20:34 . 2009-02-24 20:34	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 20:34 . 2009-02-24 20:34	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"epm-dm"="c:\acer\Empowering Technology\ePower\epm-dm.exe" [2005-11-25 212992]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-11-07 185632]
"RTHDCPL"="RTHDCPL.EXE" [2009-09-11 18717696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Amandine André^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.1.lnk]
path=c:\documents and settings\Amandine André\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.1.lnk
backup=c:\windows\pss\OpenOffice.org 2.1.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Amandine André^Menu Démarrer^Programmes^Démarrage^Outil de détection de support de Cyber-shot Viewer.lnk]
path=c:\documents and settings\Amandine André\Menu Démarrer\Programmes\Démarrage\Outil de détection de support de Cyber-shot Viewer.lnk
backup=c:\windows\pss\Outil de détection de support de Cyber-shot Viewer.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-05-11 02:06	40048	----a-w-	c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
2009-11-24 23:51	81000	----a-w-	c:\progra~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 15:44	3883856	----a-w-	c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Prolific_OneButton]
2006-04-03 14:38	32768	----a-r-	c:\program files\Prolific\One Button\OneBtn.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Acer\\Acer Arcade\\PCMService.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [05/10/2008 17:39 114768]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [05/10/2008 17:39 20560]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [04/07/2009 19:32 233472]
S2 SBKUPNT;SBKUPNT;c:\windows\system32\drivers\SBKUPNT.SYS [14/11/2009 11:45 14976]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [04/10/2009 15:29 1684736]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [04/07/2009 19:32 36608]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - ilbccly
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://global.acer.com
DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab
DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\3b8gkhvf.default\
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\TurnTool\Viewer\nptnt.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-RunOnce-NeroHomeFirstStart - c:\program files\Fichiers communs\Nero\Lib\NMFirstStart.exe
HKLM-Run-SearchSettings - c:\program files\Search Settings\SearchSettings.exe
HKLM-Run-EoEngine - (no file)
HKLM-Run-NPSStartup - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-09 18:42
Windows 5.1.2600 Service Pack 3 FAT NTAPI

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
"ImagePath"="\"c:\program files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe\"\00|\00\00\00\00\00\00\00\00\00\00\00\002\00\00\00\00\00S\02pè\13\00pè\13\00\18î‘|ÐÑ\\02H™
[\02m\05’|æ\1b€|\00\00\15\00\00\00\00\00ö\1b"


[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ilbccly]

.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(744)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(560)
c:\windows\system32\eappprxy.dll
.
Heure de fin: 2010-02-09  18:44:26 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-02-09 17:44

Avant-CF: 8 755 363 840 octets libres
Après-CF: 8 620 539 904 octets libres

- - End Of File - - 8075B044B03A5C6861938B05E97886B2

ComboFix 10-02-08.09 - Administrateur 09/02/2010  19:21:50.2.1 - FAT32x86 NETWORK
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.502.325 [GMT 1:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Administrateur\Bureau\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100209-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\windows\system32\config\systemprofile\Application Data\fvgqad.dat"
"c:\windows\System32\drivers\ilbccly.sys"
"c:\windows\system32\fjhdyfhsn.bat"
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\config\systemprofile\Application Data\fvgqad.dat
c:\windows\System32\drivers\ilbccly.sys
c:\windows\system32\fjhdyfhsn.bat

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ilbccly
-------\Service_ilbccly


(((((((((((((((((((((((((((((   Fichiers créés du 2010-01-09 au 2010-02-09  ))))))))))))))))))))))))))))))))))))
.

2010-02-09 14:48 . 2010-02-09 14:48	--------	d-----w-	C:\_OTL
2010-02-09 13:26 . 2010-02-09 13:26	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Malwarebytes
2010-02-09 13:26 . 2010-01-07 15:07	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-09 13:26 . 2010-02-09 13:26	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-02-09 13:26 . 2010-02-09 13:26	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-09 13:26 . 2010-01-07 15:07	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-02-09 12:33 . 2010-02-09 12:33	--------	d-----w-	C:\Ad-Remover
2010-02-09 11:52 . 2010-02-09 11:52	--------	d-----w-	c:\program files\Trend Micro
2010-02-09 11:49 . 2010-02-09 11:49	--------	d-----w-	c:\documents and settings\Administrateur\Local Settings\Application Data\Mozilla
2010-02-08 13:47 . 2010-02-08 13:47	--------	d-----w-	c:\windows\BDOSCAN8
2010-02-08 12:54 . 2010-02-08 12:54	--------	d-----w-	c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2010-02-08 12:54 . 2010-02-08 12:54	--------	d-----w-	c:\program files\File Scanner Library (Spybot - Search & Destroy)
2010-02-08 12:54 . 2010-02-08 12:54	--------	d-----w-	c:\program files\TeaTimer (Spybot - Search & Destroy)
2010-02-08 12:54 . 2010-02-08 12:54	--------	d-----w-	c:\program files\SDHelper (Spybot - Search & Destroy)
2010-01-22 19:55 . 2010-01-22 19:55	--------	d-----w-	C:\FOUND.000
2010-01-14 09:36 . 2009-11-21 15:58	471552	------w-	c:\windows\system32\dllcache\aclayers.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-22 05:09 . 2004-08-05 04:00	671232	------w-	c:\windows\system32\wininet.dll
2009-12-22 05:08 . 2004-08-05 04:00	81920	----a-w-	c:\windows\system32\ieencode.dll
2009-12-17 14:49 . 2009-12-17 14:49	--------	d-----w-	c:\program files\ESET
2009-12-17 11:51 . 2009-12-17 11:51	--------	d-----w-	c:\program files\CCleaner
2009-11-24 23:54 . 2008-10-05 16:38	1280480	----a-w-	c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2008-10-05 16:39	93424	----a-w-	c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:51 . 2008-10-05 16:39	94160	----a-w-	c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2008-10-05 16:39	114768	----a-w-	c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2008-10-05 16:39	20560	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2008-10-05 16:39	48560	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2008-10-05 16:39	23120	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2008-10-05 16:39	27408	----a-w-	c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2008-10-05 16:39	97480	----a-w-	c:\windows\system32\AvastSS.scr
2009-11-21 15:58 . 2004-08-05 04:00	471552	----a-w-	c:\windows\AppPatch\AcLayers.dll
2009-02-24 20:34 . 2009-02-24 20:34	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 20:34 . 2009-02-24 20:34	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"epm-dm"="c:\acer\Empowering Technology\ePower\epm-dm.exe" [2005-11-25 212992]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-11-07 185632]
"RTHDCPL"="RTHDCPL.EXE" [2009-09-11 18717696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Amandine André^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.1.lnk]
path=c:\documents and settings\Amandine André\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.1.lnk
backup=c:\windows\pss\OpenOffice.org 2.1.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Amandine André^Menu Démarrer^Programmes^Démarrage^Outil de détection de support de Cyber-shot Viewer.lnk]
path=c:\documents and settings\Amandine André\Menu Démarrer\Programmes\Démarrage\Outil de détection de support de Cyber-shot Viewer.lnk
backup=c:\windows\pss\Outil de détection de support de Cyber-shot Viewer.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-05-11 02:06	40048	----a-w-	c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
2009-11-24 23:51	81000	----a-w-	c:\progra~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 15:44	3883856	----a-w-	c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Prolific_OneButton]
2006-04-03 14:38	32768	----a-r-	c:\program files\Prolific\One Button\OneBtn.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Acer\\Acer Arcade\\PCMService.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [05/10/2008 17:39 114768]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [05/10/2008 17:39 20560]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [04/07/2009 19:32 233472]
S2 SBKUPNT;SBKUPNT;c:\windows\system32\drivers\SBKUPNT.SYS [14/11/2009 11:45 14976]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [04/10/2009 15:29 1684736]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [04/07/2009 19:32 36608]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://global.acer.com
DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab
DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\3b8gkhvf.default\
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\TurnTool\Viewer\nptnt.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-09 19:26
Windows 5.1.2600 Service Pack 3 FAT NTAPI

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
"ImagePath"="\"c:\program files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe\"\00|\00\00\00\00\00\00\00\00\00\00\00\002\00\00\00\00\00S\02pè\13\00pè\13\00\18î‘|ÐÑ\\02H™
[\02m\05’|æ\1b€|\00\00\15\00\00\00\00\00ö\1b"

.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(728)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2010-02-09  19:28:47 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-02-09 18:28
ComboFix2.txt  2010-02-09 17:44

Avant-CF: 8 600 272 896 octets libres
Après-CF: 8 548 892 672 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

- - End Of File - - 46309B7D957D1020844B3E9C78416F77