virus

Question

Bonjour,


Mon ordinateur fait que de ramer! j'ai fait plusieurs analyse antivirus mais rien.. puis je me suis rendu compte que je me faisait pomper toute la mémoire par "svchost" je me suis donc renseigné mais il est toujours la...

comment faire ???

j'ai fait un rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:45:01, on 16/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\update.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Lucas Orsini\Mes documents\Téléchargements\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=1607
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL (file missing)
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\SearchSettings.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [AmlAssistDirect] C:\Program Files\Aml Pages\AmlAssistDirect.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1214440339-1303643608-839522115-1008\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Margaux Orsini')
O4 - HKUS\S-1-5-21-1214440339-1303643608-839522115-1008\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (User 'Margaux Orsini')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-1214440339-1303643608-839522115-1008 Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'Margaux Orsini')
O4 - S-1-5-21-1214440339-1303643608-839522115-1008 User Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'Margaux Orsini')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: winesm32.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?a64640a6788b444c8f55fa5cc263189d
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?a64640a6788b444c8f55fa5cc263189d
O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

Destrio5 · Answer

Bonjour,


1/

--> Démarre Spybot, clique sur Mode, coche Mode avancé.
--> A gauche, clique sur Outils, puis sur Résident.
--> Décoche la case devant Résident "TeaTimer" :
http://sd-1.archive-host.com/membres/up/3288717712384394/TeaTimer.jpg
--> Quitte Spybot.


2/

&#9679; Télécharge Ad-Remover (de C_XX) sur ton Bureau.
&#9679; Déconnecte-toi d'Internet et ferme toutes applications en cours. 
&#9679; Double-clique sur le programme AD-R situé sur ton Bureau.
&#9679; Clique sur Nettoyer puis valide.
&#9679; Poste le rapport généré (C:\Ad-Report-CLEAN.log).

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

lucul78 · Answer

bonjour,

il ne veut pas m'installer AD-R car soit disant il n'ait compatible que avec vista, windows 7, ou XP
alors que je suis sur XP 2003

Destrio5 · Answer

---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.

A la fin de l'analyse, un message s'affiche :

L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.

lucul78 · Answer

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

19/03/2010 08:29:52
mbam-log-2010-03-19 (08-29-52).txt

Type de recherche: Examen rapide
Eléments examinés: 151780
Temps écoulé: 5 hour(s), 17 minute(s), 34 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\drivers\eqgfiisr.sys (Rootkit.Agent) -> Delete on reboot.

Destrio5 · Answer

--> Télécharge OTL (de OldTimer) sur ton Bureau.
--> Double-clique sur OTL pour le lancer.
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)
--> Une fenêtre apparaît. Dans la section Output en haut de cette fenêtre, coche Minimal Output.
--> Coche également les cases à côté de LOP Check et Purity Check.
--> Enfin, clique sur le bouton Run Scan. Le scan ne prendra pas beaucoup de temps.
--> Une fois l'analyse terminée, deux fenêtres vont s'ouvrir dans le Bloc-notes : OTL.txt et Extras.txt. Ils se trouvent au même endroit que OTL (donc par défaut sur le Bureau).

Pour me transmettre les rapports :
--> Clique sur ce lien : http://www.cijoint.fr/
--> Clique sur Parcourir... et cherche le fichier du rapport que tu souhaites me transmettre.
--> Clique sur Ouvrir.
--> Clique sur Cliquez ici pour déposer le fichier.
--> Un lien de cette forme, hxxp://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt, est ajouté dans la page.
--> Copie-colle ce lien dans ta réponse.

lucul78 · Answer

http://www.cijoint.fr/cjlink.php?file=cj201003/cijPWp4enp.txt

merci

Destrio5 · Answer

Et le rapport OTL ?

lucul78 · Answer

http://www.cijoint.fr/cjlink.php?file=cj201003/cijsUO2a8v.txt

Destrio5 · Answer

--> Retente la manip' avec Ad-Remover.

lucul78 · Answer

.
======= RAPPORT D'AD-REMOVER 2.0.0.0,B | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 19/03/10 à 18:30
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 15:18:25 le 21/03/2010 | Mode normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\ADR.exe
SE: Microsoft® Windows XP(TM)  Service Pack 3 - X86
Nom du PC: MAISON-BIBLIO | Utilisateur actuel: Lucas Orsini (Administrateur)
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
C:\Documents and Settings\Lucas Orsini\Application Data\Search Settings
C:\Documents and Settings\Margaux Orsini\Application Data\Search Settings
C:\Program Files\Application Updater
C:\Program Files\Mozilla Firefox\extensions\searchsettings@spigot.com
C:\Program Files\Search Settings

(!) -- Fichiers temporaires supprimés.
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Search Settings
HKLM\Software\Application Updater
HKLM\Software\Classes\CLSID\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}
HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Classes\dc_ads.ads
HKLM\Software\Classes\dc_ads.ads.1
HKLM\Software\Classes\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288}
HKLM\Software\Classes\Rotator.Gizmo3
HKLM\Software\Classes\Rotator.Gizmo3.1
HKLM\Software\Classes\SearchSettings.BHO
HKLM\Software\Classes\SearchSettings.BHO.1
HKLM\Software\Classes\sidepanel.logic
HKLM\Software\Classes\sidepanel.logic.1
HKLM\Software\Classes\sidepanel.panel
HKLM\Software\Classes\sidepanel.panel.1
HKLM\Software\Classes\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}
HKLM\Software\Freeze.com
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Search Settings
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{0579B4B6-0293-4D73-B02D-5EBB0BA0F0A2}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|SearchSettings
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Application Updater\ApplicationUpdater.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.dtd
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\FF\components\SearchSettingsFF.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\FF\install.rdf
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\SearchSettings.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\SearchSettings.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\SearchSettingsRes409.dll
.
============== SCAN ADDITIONNEL ==============
.
* Mozilla FireFox Version 3.5.8 (fr) *
.
C:\Documents and Settings\Lucas Orsini\..\3qo41ilq.default\prefs.js - browser.download.lastDir: C:\Documents and Settings\Lucas Orsini\Bureau
C:\Documents and Settings\Lucas Orsini\..\3qo41ilq.default\prefs.js - browser.search.defaultenginename: Yahoo
C:\Documents and Settings\Lucas Orsini\..\3qo41ilq.default\prefs.js - browser.search.selectedEngine: Yahoo
C:\Documents and Settings\Lucas Orsini\..\3qo41ilq.default\prefs.js - browser.startup.homepage: hxxp://www.google.fr/
C:\Documents and Settings\Lucas Orsini\..\3qo41ilq.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.1.8
C:\Documents and Settings\Lucas Orsini\..\3qo41ilq.default\prefs.js - keyword.URL: hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
C:\Documents and Settings\Chloé ORSINI\..\67iqlga7.default\prefs.js - browser.search.defaultenginename: Google
C:\Documents and Settings\Chloé ORSINI\..\67iqlga7.default\prefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
C:\Documents and Settings\Chloé ORSINI\..\67iqlga7.default\prefs.js - browser.search.selectedEngine: Google
C:\Documents and Settings\Chloé ORSINI\..\67iqlga7.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.0.10
C:\Documents and Settings\Margaux Orsini\..\ku6hb77j.default\prefs.js - browser.download.lastDir: C:\Documents and Settings\Margaux Orsini\Mes documents\Mes images
C:\Documents and Settings\Margaux Orsini\..\ku6hb77j.default\prefs.js - browser.search.defaultenginename: Yahoo
C:\Documents and Settings\Margaux Orsini\..\ku6hb77j.default\prefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
C:\Documents and Settings\Margaux Orsini\..\ku6hb77j.default\prefs.js - browser.search.selectedEngine: Yahoo
C:\Documents and Settings\Margaux Orsini\..\ku6hb77j.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.1.8
C:\Documents and Settings\Margaux Orsini\..\ku6hb77j.default\prefs.js - keyword.URL: hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
.
.
* Internet Explorer Version 7.0.5730.13 *
.
[HKCU\Software\Microsoft\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 1
Use Search Asst: no
.
[HKLM\Software\Microsoft\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: %SystemRoot%\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
.
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
.
============== SUSPECT(S) ==============
.
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Age.Of.Mythology+The.Titan+Serial+NO-CD.FR.rar.1.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Age.Of.Mythology+The.Titan+Serial+NO-CD.FR.rar.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Armed Assault Crack + Czech or Ger to English Patch.rar.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Atomix.Virtual.DJ.Pro.v5c.Cracked.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Battlefield 2 + Crack and Keygen.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Evolution_Patch_2.0_for_PES2008.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Fruity Loops Studio 7 Full + Crack.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\GRAND_THEFT_AUTO_4_CLONEDVD_READNFO-ePEN15 + PROPER CRACK.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\GTA_IV_Crack_by_razor1911_-_100%_working.zip.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Medal of Honor Airborne - Patch FR.rar.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Medal of honor airborne crack.exe.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Medal of Honor AIRBORNE Crack.rar.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Medal of Honor Airborne-HATRED Crack+Keygen.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\MotoGP.08-RELOADED-CRACK-ONLY.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Patch + Voix en Fr Rugby 08.zip.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Patch Fr Rugby 08.zip.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\PES 2008 - ProEvoluti Superpatch 2.0.rar.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Pro Evolution Soccer 2009 Cracked DVD9 by Carlinhos_Lopes - MSJP.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Pro evolution soccer 2009 [PC-DVD][Multi5][Crack+Serial][matrixmersion].torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Rfactor Crack v1.255 (Reloaded).zip.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\RUGBY.08.-.Patch.FRENCH.TXT.[spk2007].zip.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\[NewTorrents.info] Battlefield.2.Keygen-ViTALiTY.torrent
C:\Documents and Settings\Lucas Orsini\Bureau\Pes 2010\Crack\pes2010.exe
C:\Documents and Settings\Lucas Orsini\Favoris\Serials & keys - unlocks the world.url
C:\Documents and Settings\Lucas Orsini\Mes documents\LimeWire\Incomplete\T-219986-crack moto gp 08 crack-serial-keygen.zip
.
========================================
.
C:\DOCUME~1\LUCASO~1\LOCALS~1\Temp: 4 Fichier(s), 128 Dossier(s)
C:\WINDOWS\temp: 2 Fichier(s), 38 Dossier(s)
Temporary Internet Files: 2 Fichier(s), 14 Dossier(s)
.
C:\Ad-Remover\Quarantine: 16 Fichier(s)
C:\Ad-Remover\Backup: 13 Fichier(s)
.
C:\Ad-Report-CLEAN[1].txt - 9671 Octet(s)
.
Fin à: 15:35:07, 21/03/2010
.
============== E.O.F - CLEAN[1] ==============

Destrio5 · Answer

--> Relance Ad-Remover et choisis Désinstaller.

/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix

lucul78 · Answer

ComboFix 10-03-20.05 - Lucas Orsini 21/03/2010  15:56:17.10.1 - x86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.2047.1366 [GMT 1:00]
Lancé depuis: c:\documents and settings\Lucas Orsini\Mes documents\Téléchargements\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\dumphive.exe
c:\windows\system32\muzapp.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32	mp.reg
c:\windows\system32	mp72.tmp
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

Une copie infectée de c:\windows\system32\qmgr.dll a été trouvée et désinfectée 
Copie restaurée à partir de - c:\windows\ServicePackFiles\i386\qmgr.dll 

.
(((((((((((((((((((((((((((((   Fichiers créés du 2010-02-21 au 2010-03-21  ))))))))))))))))))))))))))))))))))))
.

2010-03-16 21:36 . 2010-03-16 21:36	--------	d-----w-	c:\windows\system32\CatRoot_bak
2010-03-16 21:29 . 2010-03-16 22:50	--------	d-----w-	C:\b8ef2970b67a1baebe
2010-03-16 20:17 . 2010-03-21 14:34	--------	d-----w-	C:\Ad-Remover
2010-03-13 13:39 . 2010-01-07 15:07	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-13 13:39 . 2010-03-13 13:39	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-03-13 13:39 . 2010-01-07 15:07	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-03-13 11:50 . 2010-03-21 15:09	0	----a-w-	c:\windows\system32\drivers\eqgfiisr.sys
2010-03-12 21:07 . 2010-03-12 21:07	--------	d-----w-	c:\documents and settings\Margaux Orsini\Local Settings\Application Data\Adobe
2010-03-12 13:15 . 2008-04-13 19:40	34688	-c--a-w-	c:\windows\system32\dllcache\lbrtfdc.sys
2010-03-12 13:15 . 2008-04-13 19:40	34688	----a-w-	c:\windows\system32\drivers\lbrtfdc.sys
2010-03-12 13:15 . 2008-04-13 19:41	8576	-c--a-w-	c:\windows\system32\dllcache\i2omgmt.sys
2010-03-12 13:15 . 2008-04-13 19:41	8576	----a-w-	c:\windows\system32\drivers\i2omgmt.sys
2010-03-12 13:14 . 2008-04-13 19:40	8192	-c--a-w-	c:\windows\system32\dllcache\changer.sys
2010-03-12 13:14 . 2008-04-13 19:40	8192	----a-w-	c:\windows\system32\drivers\Changer.sys
2010-03-04 17:40 . 2010-02-12 10:03	293376	------w-	c:\windows\system32\browserchoice.exe

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-21 11:40 . 2007-12-15 12:12	--------	d-----w-	c:\documents and settings\All Users\Application Data\Google Updater
2010-03-14 22:56 . 2010-01-03 21:59	--------	d-----w-	c:\program files\Picasa2
2010-03-13 11:06 . 2010-03-13 11:06	16	----a-w-	c:\documents and settings\LocalService\Application Databuwzv.dat
2010-03-12 13:14 . 2010-03-12 13:14	16	----a-w-	c:\windows\system32\config\systemprofile\Application Databuwzv.dat
2010-03-08 18:08 . 2007-11-17 20:02	1229	----a-w-	c:\windows\eReg.dat
2010-02-28 10:37 . 2007-12-22 20:29	--------	d-----w-	c:\program files\uTorrent
2010-02-28 10:09 . 2008-11-16 21:05	--------	d-----w-	c:\documents and settings\Lucas Orsini\Application Data\LimeWire
2010-02-28 10:05 . 2007-12-22 20:29	--------	d-----w-	c:\documents and settings\Lucas Orsini\Application Data\uTorrent
2010-02-24 09:16 . 2009-10-02 18:27	181632	------w-	c:\windows\system32\MpSigStub.exe
2010-02-19 19:52 . 2007-11-24 17:41	--------	d-----w-	c:\documents and settings\Lucas Orsini\Application Data\AdobeUM
2010-01-30 11:48 . 2007-11-17 14:34	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-01-29 21:44 . 2008-07-12 21:34	--------	d-----w-	c:\documents and settings\Lucas Orsini\Application Data\dvdcss
2010-01-22 20:05 . 2007-11-28 16:48	53952	----a-w-	c:\documents and settings\Margaux Orsini\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-22 18:24 . 2010-01-22 18:24	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee
2010-01-22 18:19 . 2010-01-22 07:47	--------	d-----w-	c:\documents and settings\All Users\Application Data\NOS
2010-01-22 07:48 . 2010-01-22 07:48	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-01-05 09:56 . 2004-08-05 12:00	832512	----a-w-	c:\windows\system32\wininet.dll
2010-01-05 09:56 . 2004-08-05 12:00	78336	----a-w-	c:\windows\system32\ieencode.dll
2010-01-05 09:56 . 2004-08-05 12:00	17408	------w-	c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2004-08-05 12:00	353792	----a-w-	c:\windows\system32\drivers\srv.sys
2006-05-03 10:06 . 2009-03-05 16:22	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2009-03-05 16:22	31232	--sh--r-	c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2009-03-05 16:22	216064	--sh--r-	c:\windows\system32
bDX.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"SoundMan"="SOUNDMAN.EXE" [2004-08-30 69632]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-20 149280]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 266497]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-02-20 741376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
"nwiz"="nwiz.exe" [2009-01-15 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
"SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-12-14 132624]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Margaux Orsini\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

c:\documents and settings\Lucas Orsini\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-7-16 626176]
D'marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"=
"c:\Program Files\EA GAMES\MOHDA\moh_Breakthrough.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hposid01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"=
"c:\Program Files\Fichiers communs\InstallShield\engine\6\Intel 32\Ikernel.exe"=
"c:\Program Files\Hewlett-Packard\HP Media Vault\Utilities\HPMVTray.exe"=
"c:\Program Files\Hewlett-Packard\HP Media Vault\Utilities\NASSelector.exe"=
"c:\Program Files\Hewlett-Packard\HP Media Vault\Utilities\NASDriveMapper.exe"=
"c:\Program Files\Hewlett-Packard\HP Media Vault\Utilities\HPEZBkup.exe"=
"c:\Program Files\Hewlett-Packard\HP Media Vault\Utilities\HPMVCheck.exe"=
"c:\Program Files\NewTech Infosystems\NTI Shadow 3\Shadow.exe"=
"c:\Program Files\NewTech Infosystems\NTI DriveBackup! 4\CDDIB32.exe"=
"c:\Program Files\NewTech Infosystems\NTI DriveBackup! 4\DIBExplor.exe"=
"c:\Program Files\EA GAMES\MOHDA\moh_spearhead.exe"=
"c:\Program Files\EA GAMES\MOHDA\fpupdate.exe"=
"c:\Program Files\uTorrent\uTorrent.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\VideoLAN\VLC\vlc.exe"=
"c:\Documents and Settings\Lucas Orsini\Bureau\Earned\System\EiB.exe"=
"c:\Program Files\LimeWire\LimeWire.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\KONAMI\Pro Evolution Soccer 2010\pes2010.exe"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\Documents and Settings\Lucas Orsini\Bureau\Pes 2010\Crack\pes2010.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21002:TCP"= 21002:TCP:*:Disabled:BitComet 21002 TCP
"21002:UDP"= 21002:UDP:*:Disabled:BitComet 21002 UDP

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 19:19 13592]
R3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [16/11/2007 20:15 223232]
R3 PhTVTune;ProVideo WDM TVTuner;c:\windows\system32\drivers\PhTVTune.sys [17/11/2007 20:21 24288]
R3 RDID1046;EDIROL UA-25;c:\windows\system32\drivers\Rdwm1046.sys [19/01/2010 09:59 172561]
S2 Application Updater;Application Updater;"c:\program files\Application Updater\ApplicationUpdater.exe" --> c:\program files\Application Updater\ApplicationUpdater.exe [?]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [12/07/2008 18:08 1527900]
S3 sea3bus;Sony Ericsson Device 0A3 driver (WDM);c:\windows\system32\drivers\sea3bus.sys [26/01/2007 19:05 61600]
S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasUSB.sys [16/01/2008 16:20 18432]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - eqgfiisr
*Deregistered* - project

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{367cbdcf-9476-11dc-b7e4-806d6172696f}]
\Shell\AutoRun\command - I:\autorun.exe
.
Contenu du dossier 'Tâches planifiées'

2010-03-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-15 19:39]

2010-03-20 c:\windows\Tasks\HPpromotions journeysoftware.job
- c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 16:36]

2010-03-21 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mWindow Title = 
uInternet Settings,ProxyOverride = *.local
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Download with &Shareaza - c:\program files\Crux P2P\Plugins\RazaWebHook.dll/3000
IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?a64640a6788b444c8f55fa5cc263189d
IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?a64640a6788b444c8f55fa5cc263189d
IE: Télécharger avec &BitSpirit - c:\program files\BitSpirit\bsurl.htm
FF - ProfilePath - c:\documents and settings\Lucas Orsini\Application Data\Mozilla\Firefox\Profiles\3qo41ilq.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592
pCIDetect13.dll
FF - plugin: c:\program files\Picasa2
pPicasa2.dll
FF - plugin: c:\program files\Picasa2
pPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-ares - c:\program files\Ares\Ares.exe
HKCU-Run-AmlAssistDirect - c:\program files\Aml Pages\AmlAssistDirect.exe
AddRemove-BattlEye - c:\program files\Bohemia Interactive\ArmA\BattlEye\UnInstallBE.exe
AddRemove-XviD_is1 - c:\program files\XviD\unins000.exe
AddRemove-{651DF20A-B6D8-4C7A-BBD8-EBC5FC7CF1C1} - c:\program files\InstallShield Installation Information\{651DF20A-B6D8-4C7A-BBD8-EBC5FC7CF1C1}\setup.exe
AddRemove-{E9EB5689-4F76-4E3C-A675-5ED5F52AB890} - c:\program files\InstallShield Installation Information\{E9EB5689-4F76-4E3C-A675-5ED5F52AB890}\setup.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-21 16:05
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\eqgfiisr]

.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(1256)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32
vsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\Fichiers communs\Teleca Shared\Generic.exe
c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
.
**************************************************************************
.
Heure de fin: 2010-03-21  16:19:43 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-03-21 15:19
ComboFix2.txt  2008-10-16 06:35
ComboFix3.txt  2008-10-14 15:14

Avant-CF: 6 635 175 936 octets libres
Après-CF: 10 887 393 280 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP  dition familiale" /noexecute=optin /fastdetect

- - End Of File - - 592254097BEC41974B139D3159AE5948

Destrio5 · Answer

/!\ Seul lucul78 peut suivre cette procédure. /!\


1/

---> Ouvre le Bloc-notes.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :






KillAll::

Driver::
Application Updater

File::
c:\documents and settings\LocalService\Application Data\rbuwzv.dat     
c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat     
c:\windows\system32\drivers\eqgfiisr.sys     

Folder::
c:\program files\Application Updater

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\eqgfiisr]     






--> Colle la sélection dans le Bloc-notes.

--> Enregistre ce fichier sur le Bureau (Impératif).

--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.


2/

--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

--> Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

--> Une fois le scan achevé, un rapport va s'afficher : poste-le.

--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt

lucul78 · Answer

ComboFix 10-03-20.06 - Lucas Orsini 21/03/2010  20:23:28.11.1 - x86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.2047.1486 [GMT 1:00]
Lancé depuis: c:\documents and settings\Lucas Orsini\Mes documents\Téléchargements\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Lucas Orsini\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\documents and settings\LocalService\Application Databuwzv.dat"
"c:\windows\system32\config\systemprofile\Application Databuwzv.dat"
"c:\windows\system32\drivers\eqgfiisr.sys"
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\Application Databuwzv.dat
c:\windows\system32\config\systemprofile\Application Databuwzv.dat
c:\windows\system32\drivers\eqgfiisr.sys

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_APPLICATION_UPDATER
-------\Service_Application Updater
-------\Legacy_eqgfiisr
-------\Service_eqgfiisr


(((((((((((((((((((((((((((((   Fichiers créés du 2010-02-21 au 2010-03-21  ))))))))))))))))))))))))))))))))))))
.

2010-03-16 21:36 . 2010-03-16 21:36	--------	d-----w-	c:\windows\system32\CatRoot_bak
2010-03-16 21:29 . 2010-03-16 22:50	--------	d-----w-	C:\b8ef2970b67a1baebe
2010-03-16 20:17 . 2010-03-21 14:34	--------	d-----w-	C:\Ad-Remover
2010-03-13 13:39 . 2010-01-07 15:07	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-13 13:39 . 2010-03-13 13:39	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-03-13 13:39 . 2010-01-07 15:07	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-03-12 21:07 . 2010-03-12 21:07	--------	d-----w-	c:\documents and settings\Margaux Orsini\Local Settings\Application Data\Adobe
2010-03-12 13:15 . 2008-04-13 19:40	34688	-c--a-w-	c:\windows\system32\dllcache\lbrtfdc.sys
2010-03-12 13:15 . 2008-04-13 19:40	34688	----a-w-	c:\windows\system32\drivers\lbrtfdc.sys
2010-03-12 13:15 . 2008-04-13 19:41	8576	-c--a-w-	c:\windows\system32\dllcache\i2omgmt.sys
2010-03-12 13:15 . 2008-04-13 19:41	8576	----a-w-	c:\windows\system32\drivers\i2omgmt.sys
2010-03-12 13:14 . 2008-04-13 19:40	8192	-c--a-w-	c:\windows\system32\dllcache\changer.sys
2010-03-12 13:14 . 2008-04-13 19:40	8192	----a-w-	c:\windows\system32\drivers\Changer.sys
2010-03-04 17:40 . 2010-02-12 10:03	293376	------w-	c:\windows\system32\browserchoice.exe

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-21 11:40 . 2007-12-15 12:12	--------	d-----w-	c:\documents and settings\All Users\Application Data\Google Updater
2010-03-14 22:56 . 2010-01-03 21:59	--------	d-----w-	c:\program files\Picasa2
2010-03-08 18:08 . 2007-11-17 20:02	1229	----a-w-	c:\windows\eReg.dat
2010-02-28 10:37 . 2007-12-22 20:29	--------	d-----w-	c:\program files\uTorrent
2010-02-28 10:09 . 2008-11-16 21:05	--------	d-----w-	c:\documents and settings\Lucas Orsini\Application Data\LimeWire
2010-02-28 10:05 . 2007-12-22 20:29	--------	d-----w-	c:\documents and settings\Lucas Orsini\Application Data\uTorrent
2010-02-24 09:16 . 2009-10-02 18:27	181632	------w-	c:\windows\system32\MpSigStub.exe
2010-02-19 19:52 . 2007-11-24 17:41	--------	d-----w-	c:\documents and settings\Lucas Orsini\Application Data\AdobeUM
2010-01-30 11:48 . 2007-11-17 14:34	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-01-29 21:44 . 2008-07-12 21:34	--------	d-----w-	c:\documents and settings\Lucas Orsini\Application Data\dvdcss
2010-01-22 20:05 . 2007-11-28 16:48	53952	----a-w-	c:\documents and settings\Margaux Orsini\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-22 18:24 . 2010-01-22 18:24	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee
2010-01-22 18:19 . 2010-01-22 07:47	--------	d-----w-	c:\documents and settings\All Users\Application Data\NOS
2010-01-22 07:48 . 2010-01-22 07:48	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-01-05 09:56 . 2004-08-05 12:00	832512	------w-	c:\windows\system32\wininet.dll
2010-01-05 09:56 . 2004-08-05 12:00	78336	----a-w-	c:\windows\system32\ieencode.dll
2010-01-05 09:56 . 2004-08-05 12:00	17408	------w-	c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2004-08-05 12:00	353792	----a-w-	c:\windows\system32\drivers\srv.sys
2006-05-03 10:06 . 2009-03-05 16:22	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2009-03-05 16:22	31232	--sh--r-	c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2009-03-05 16:22	216064	--sh--r-	c:\windows\system32
bDX.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"SoundMan"="SOUNDMAN.EXE" [2004-08-30 69632]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-20 149280]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 266497]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-02-20 741376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
"nwiz"="nwiz.exe" [2009-01-15 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
"SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-12-14 132624]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Margaux Orsini\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

c:\documents and settings\Lucas Orsini\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-7-16 626176]
D'marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"=
"c:\Program Files\EA GAMES\MOHDA\moh_Breakthrough.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hposid01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"=
"c:\Program Files\Fichiers communs\InstallShield\engine\6\Intel 32\Ikernel.exe"=
"c:\Program Files\Hewlett-Packard\HP Media Vault\Utilities\HPMVTray.exe"=
"c:\Program Files\Hewlett-Packard\HP Media Vault\Utilities\NASSelector.exe"=
"c:\Program Files\Hewlett-Packard\HP Media Vault\Utilities\NASDriveMapper.exe"=
"c:\Program Files\Hewlett-Packard\HP Media Vault\Utilities\HPEZBkup.exe"=
"c:\Program Files\Hewlett-Packard\HP Media Vault\Utilities\HPMVCheck.exe"=
"c:\Program Files\NewTech Infosystems\NTI Shadow 3\Shadow.exe"=
"c:\Program Files\NewTech Infosystems\NTI DriveBackup! 4\CDDIB32.exe"=
"c:\Program Files\NewTech Infosystems\NTI DriveBackup! 4\DIBExplor.exe"=
"c:\Program Files\EA GAMES\MOHDA\moh_spearhead.exe"=
"c:\Program Files\EA GAMES\MOHDA\fpupdate.exe"=
"c:\Program Files\uTorrent\uTorrent.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\VideoLAN\VLC\vlc.exe"=
"c:\Documents and Settings\Lucas Orsini\Bureau\Earned\System\EiB.exe"=
"c:\Program Files\LimeWire\LimeWire.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\KONAMI\Pro Evolution Soccer 2010\pes2010.exe"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\Documents and Settings\Lucas Orsini\Bureau\Pes 2010\Crack\pes2010.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21002:TCP"= 21002:TCP:*:Disabled:BitComet 21002 TCP
"21002:UDP"= 21002:UDP:*:Disabled:BitComet 21002 UDP

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 19:19 13592]
R3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [16/11/2007 20:15 223232]
R3 PhTVTune;ProVideo WDM TVTuner;c:\windows\system32\drivers\PhTVTune.sys [17/11/2007 20:21 24288]
R3 RDID1046;EDIROL UA-25;c:\windows\system32\drivers\Rdwm1046.sys [19/01/2010 09:59 172561]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [12/07/2008 18:08 1527900]
S3 sea3bus;Sony Ericsson Device 0A3 driver (WDM);c:\windows\system32\drivers\sea3bus.sys [26/01/2007 19:05 61600]
S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasUSB.sys [16/01/2008 16:20 18432]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - project

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'

2010-03-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-15 19:39]

2010-03-21 c:\windows\Tasks\HPpromotions journeysoftware.job
- c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 16:36]

2010-03-21 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mWindow Title = 
uInternet Settings,ProxyOverride = *.local
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Download with &Shareaza - c:\program files\Crux P2P\Plugins\RazaWebHook.dll/3000
IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?a64640a6788b444c8f55fa5cc263189d
IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?a64640a6788b444c8f55fa5cc263189d
IE: Télécharger avec &BitSpirit - c:\program files\BitSpirit\bsurl.htm
FF - ProfilePath - c:\documents and settings\Lucas Orsini\Application Data\Mozilla\Firefox\Profiles\3qo41ilq.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592
pCIDetect13.dll
FF - plugin: c:\program files\Picasa2
pPicasa2.dll
FF - plugin: c:\program files\Picasa2
pPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-21 20:31
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(4040)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32
vsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\Fichiers communs\Teleca Shared\Generic.exe
c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
.
**************************************************************************
.
Heure de fin: 2010-03-21  20:43:56 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-03-21 19:43
ComboFix2.txt  2010-03-21 15:19
ComboFix3.txt  2008-10-16 06:35
ComboFix4.txt  2008-10-14 15:14

Avant-CF: 10 885 017 600 octets libres
Après-CF: 10 846 326 784 octets libres

- - End Of File - - 2C2779A543892ACA334F6417A2E7995E

Destrio5 · Answer

--> Menu Démarrer > Exécuter > Tape ComboFix /uninstall et valide.

--> Refais un scan OTL et poste le rapport OTL.

lucul78 · Answer

http://www.cijoint.fr/cjlink.php?file=cj201003/cijvyLKimc.txt

Destrio5 · Answer

Le PC va bien ?

--> Double-clique sur OTL pour le lancer.
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)
--> Sous l'onglet Custom Scans/Fixes en bas de la fenêtre, copie-colle le texte suivant (entre les deux espaces) :




:OTL
[2009/03/05 17:14:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Lucas Orsini\Application Data\Mozilla\Extensions\{ae2cff10-0d52-4066-8be9-4abcf119fa79}     
O2 - BHO: (Shareaza Web Download Hook) - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll File not found     
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6} - No CLSID value found.     
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) 
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) 
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) 
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) 
[2007/12/05 12:50:19 | 000,000,000 | R--D | M] -- C:\Documents and Settings\All Users\Application Data\reparateurdesysteme  

:commands
[emptytemp]
[reboot]




--> Puis clique sur le bouton Run Fix en haut de la fenêtre.
--> Laisse le programme travailler, redémarre une fois le fix terminé.
--> Poste le rapport qui s'affichera après redémarrage.

lucul78 · Answer

All processes killed
========== OTL ==========
C:\Documents and Settings\Lucas Orsini\Application Data\Mozilla\Extensions\{ae2cff10-0d52-4066-8be9-4abcf119fa79} folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EEDB912-C5FA-486F-8334-57288578C627}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EEDB912-C5FA-486F-8334-57288578C627}\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
C:\Documents and Settings\All Users\Application Dataeparateurdesysteme\Data folder moved successfully.
C:\Documents and Settings\All Users\Application Dataeparateurdesysteme folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Chloé ORSINI
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 157915 bytes
->FireFox cache emptied: 14612608 bytes
->Flash cache emptied: 4247 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: Jean Pierre ORSINI
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: Lucas Orsini
->Temp folder emptied: 455176 bytes
->Temporary Internet Files folder emptied: 43997 bytes
->Java cache emptied: 33428910 bytes
->FireFox cache emptied: 44232295 bytes
->Google Chrome cache emptied: 612860 bytes
->Flash cache emptied: 1968390 bytes
 
User: Margaux Orsini
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 157915 bytes
->Java cache emptied: 941233 bytes
->FireFox cache emptied: 100567305 bytes
->Flash cache emptied: 6819 bytes
 
User: NetworkService
->Temp folder emptied: 6824 bytes
->Temporary Internet Files folder emptied: 49286 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 71040606 bytes
%systemroot%\System32 .tmp files removed: 4340736 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 554543 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 224828 bytes
RecycleBin emptied: 143530 bytes
 
Total Files Cleaned = 261,00 mb
 
 
OTL by OldTimer - Version 3.1.37.3 log created on 03232010_182754

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Destrio5 · Answer

Tu n'as pas d'antivirus ?

--> Mets à jour Java.

--> Mets à jour Adobe Reader.

lucul78 · Answer

SI si j'ai antivir, l'ordinateur fonctionne bien, il y a juste un problème avec un fichier système qui me prend tout mon processeur (99%) donc du cou mon ordi ram beaucoup pour ouvrir une fenêtre

Destrio5 · Answer

Quel est ce fichier ?

lucul78 · Answer

"svchost "

merci

Virus - Page 2

Discussions similaires

Newsletters