Sujet Précédent Sujet Suivant

Rootkit

Fermé
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010 - 8 mai 2010 à 19:10
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010 - 9 mai 2010 à 13:39
bonjour, j'ai un problème de virus rootkit situé

C:windows/system/32/drivers/mskssrv.sys

en plus je n'ai plus de son. je ne sais pas si celà est lié. merci pour votre aide


A voir également:

21 réponses

  • 1
  • 2
Réponse 1 / 21
Utilisateur anonyme
Modifié par archet9 le 8/05/2010 à 19:19
Bonjour,

Télécharges FindyKill de Chiquitine29 sur ton bureau :

http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe

Mirroir :

http://findykill.changelog.fr/Setup.exe




! Déconnectes toi et ferme toutes applications en cours !

* Double clique sur "FindyKill.exe" pour lancer l'installation et laisse les paramètres d'instalation par défaut .

* Branches tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

* Double-clique sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .

* Au menu principal choisis l'option " F " pour français et tapes sur [entrée] .

* Au second menu Choisis l'option " 1 " (recherche) et tapes sur [entrée]

Laisses travailler l'outil et ne touche à rien ...

--> Postes le rapport qui apparait à la fin , sur le forum ...

( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
0
Réponse 2 / 21
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010
8 mai 2010 à 20:03
############################## | FindyKill V5.041 |

# User : benben (Administrateurs) # DUSHMOLL-978A5D
# Update on 29/04/2010 by El Desaparecido
# Start at: 20:00:42 | 08/05/2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# AMD Athlon(tm) Processor LE-1640
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1368 [VPS 100508-0] 4.8.1368 [ Enabled | Updated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 232,88 Go (88,55 Go free) # NTFS
# D:\ # Disque CD-ROM # 469,28 Mo (0 Mo free) [GIGABYTE] # CDFS
# G:\ # Disque amovible

################## | Eléments infectieux |

D:\autorun.inf

################## | Registre |


################## | Etat |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | ! Fin du rapport # FindyKill V5.041 ! |
0
Réponse 3 / 21
Utilisateur anonyme
8 mai 2010 à 20:23
Dsl...Mauvaise pioche !

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt
a+
0
Réponse 4 / 21
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010
8 mai 2010 à 20:48
ComboFix 10-05-07.07 - benben 08/05/2010 20:34:27.1.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1982.1431 [GMT 2:00]
Lancé depuis: c:\documents and settings\benben\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100508-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\benben\LOCALS~1\Temp\svchost.exe
c:\documents and settings\benben\Application Data\inst.exe
c:\documents and settings\benben\Recent\Thumbs.db
c:\program files\Search Settings
c:\program files\Search Settings\kb127\SearchSettings.dll
c:\program files\Search Settings\kb127\SearchSettingsRes409.dll
c:\program files\Search Settings\SearchSettings.exe
C:\Thumbs.db
c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-08 au 2010-05-08 ))))))))))))))))))))))))))))))))))))
.

2010-05-08 17:24 . 2010-05-08 18:00 -------- d-----w- C:\FyK
2010-05-08 16:43 . 2010-05-08 16:43 -------- d-----w- c:\program files\ma-config.com
2010-05-08 16:43 . 2010-05-08 16:43 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2010-05-08 16:07 . 2007-05-09 07:40 15872 ----a-r- c:\windows\system32\RtkCoInst.dll
2010-05-08 16:07 . 2007-05-03 02:01 180224 ----a-r- c:\windows\system32\SRSTSHD.dll
2010-05-08 16:07 . 2007-04-16 08:09 167936 ----a-r- c:\windows\system32\SRSHP360.dll
2010-05-08 16:07 . 2007-04-12 23:08 135168 ----a-r- c:\windows\system32\SRSWOW.dll
2010-05-08 16:07 . 2007-03-23 06:34 266240 ----a-r- c:\windows\system32\RtkApoApi.dll
2010-05-08 16:07 . 2007-05-08 12:13 532480 ----a-r- c:\windows\system32\RtkPgExt.dll
2010-05-08 16:07 . 2006-12-13 01:30 339968 ----a-r- c:\windows\system32\SRSTSXT.dll
2010-05-08 16:07 . 2007-05-02 05:02 1911808 ----a-r- c:\windows\system32\RtkAPO.dll
2010-05-08 16:07 . 2007-05-10 08:10 4468736 ----a-r- c:\windows\RtHDVCpl.exe
2010-05-08 16:07 . 2007-05-10 09:25 1775712 ----a-r- c:\windows\system32\drivers\RTKVHDA.sys
2010-05-08 16:07 . 2010-05-08 16:07 -------- d-----w- c:\windows\LastGood
2010-05-05 18:26 . 2008-04-13 18:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-05-05 18:26 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-05-05 18:24 . 2008-04-13 18:41 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-05-05 18:24 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-05-05 18:23 . 2008-04-13 18:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-04-29 19:18 . 2010-04-29 19:18 1190400 ----a-w- c:\documents and settings\benben\Application Data\Dealio\dinstallhelper.3E9FB0BF059147B1BECBD3E9B553787D.dll
2010-04-28 18:11 . 2010-04-29 17:08 -------- d-----w- c:\documents and settings\benben\Application Data\FileZilla
2010-04-28 18:10 . 2010-04-28 18:10 -------- d-----w- c:\program files\WalterShop.com
2010-04-25 07:15 . 2010-04-25 07:15 -------- d-----w- c:\program files\TuneUpMedia
2010-04-25 07:15 . 2010-04-25 07:15 -------- d-----w- c:\documents and settings\benben\Application Data\TuneUpMedia
2010-04-25 07:15 . 2010-04-25 07:15 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUpMedia
2010-04-24 16:11 . 2010-04-24 16:11 -------- d-----w- c:\program files\uTorrent
2010-04-24 16:11 . 2010-05-08 16:04 -------- d-----w- c:\documents and settings\benben\Application Data\uTorrent
2010-04-24 15:59 . 2010-04-24 16:04 -------- d-----w- c:\documents and settings\benben\Application Data\gtk-2.0
2010-04-24 15:55 . 2010-04-24 16:07 -------- d-----w- c:\documents and settings\benben\Application Data\deluge
2010-04-24 15:55 . 2010-04-24 16:05 -------- d-----w- c:\program files\GTK2-Runtime
2010-04-24 15:53 . 2010-04-24 16:05 -------- d-----w- c:\program files\Deluge
2010-04-19 11:34 . 2008-06-10 12:00 26112 ----a-w- c:\documents and settings\benben\Application Data\Mozilla\Firefox\Profiles\zyz9rq1h.default\extensions\deezermsn@akryus.net\msnwial2.exe
2010-04-18 16:52 . 2010-04-18 16:52 -------- d-----w- c:\program files\UnifiedToolbar
2010-04-17 15:00 . 2010-04-17 15:00 -------- d-----w- c:\program files\Freeplayer

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-08 18:38 . 2007-10-12 01:00 859648 ----a-w- c:\windows\system32\drivers\lvusbsta.sys
2010-05-08 16:00 . 2010-03-26 18:32 -------- d-----w- c:\documents and settings\benben\Application Data\vlc
2010-05-08 15:59 . 2008-08-14 17:07 15600 ----a-w- c:\windows\gdrv.sys
2010-05-05 18:26 . 2008-08-25 17:20 859648 ----a-w- c:\windows\system32\drivers\nabtsfec.sys
2010-05-05 18:26 . 2008-08-25 17:20 859648 ----a-w- c:\windows\system32\drivers\mstee.sys
2010-05-05 18:26 . 2008-08-14 17:18 859648 ----a-w- c:\windows\system32\drivers\mspqm.sys
2010-05-05 18:26 . 2008-08-14 17:18 859648 ----a-w- c:\windows\system32\drivers\mspclock.sys
2010-05-05 18:26 . 2004-08-19 15:52 859648 ----a-w- c:\windows\system32\drivers\Modem.sys
2010-05-05 18:25 . 2010-05-05 18:26 859648 ----a-w- c:\windows\system32\drivers\OLD9E.tmp
2010-05-05 18:22 . 2010-05-05 18:22 16 ----a-w- c:\documents and settings\benben\Application Data\qvjsge.dat
2010-05-05 05:58 . 2009-12-14 20:01 -------- d-----w- c:\documents and settings\benben\Application Data\Azureus
2010-04-30 17:48 . 2009-01-01 08:54 -------- d-----w- c:\documents and settings\benben\Application Data\dvdcss
2010-04-29 19:18 . 2009-04-21 21:01 -------- d-----w- c:\program files\Bonjour
2010-04-29 19:14 . 2009-04-21 20:59 -------- d-----w- c:\program files\Apple Software Update
2010-04-29 19:13 . 2009-04-21 20:58 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-04-25 07:23 . 2009-12-14 20:01 -------- d-----w- c:\program files\Vuze
2010-04-25 07:15 . 2009-11-07 19:01 -------- d-----w- c:\program files\iTunes
2010-04-24 14:47 . 2010-01-15 14:57 1 ----a-w- c:\documents and settings\benben\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-19 18:08 . 2009-05-16 20:53 -------- d-----w- c:\documents and settings\benben\Application Data\agi
2010-04-18 16:53 . 2009-05-16 20:52 -------- d-----w- c:\program files\AGI
2010-04-18 16:53 . 2009-05-16 20:53 -------- d-----w- c:\program files\Kiwee Toolbar
2010-04-18 16:52 . 2009-05-16 20:53 -------- d-----w- c:\documents and settings\All Users\Application Data\agi
2010-04-14 19:32 . 2008-08-15 14:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-12 11:21 . 2006-03-02 12:00 94868 ----a-w- c:\windows\system32\perfc00C.dat
2010-04-12 11:21 . 2006-03-02 12:00 514928 ----a-w- c:\windows\system32\perfh00C.dat
2010-04-09 06:50 . 2008-09-01 20:32 -------- d-----w- c:\program files\Fichiers communs\Adobe
2010-04-04 17:23 . 2008-09-13 18:57 -------- d-----w- c:\program files\Fichiers communs\Java
2010-04-04 17:22 . 2010-04-04 17:22 503808 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-347efc12-n\msvcp71.dll
2010-04-04 17:22 . 2010-04-04 17:22 499712 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-347efc12-n\jmc.dll
2010-04-04 17:22 . 2010-04-04 17:22 348160 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-347efc12-n\msvcr71.dll
2010-04-04 17:22 . 2010-04-04 17:22 61440 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-74c83d55-n\decora-sse.dll
2010-04-04 17:22 . 2010-04-04 17:22 12800 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-74c83d55-n\decora-d3d.dll
2010-04-04 17:22 . 2008-09-13 18:58 -------- d-----w- c:\program files\Java
2010-03-28 16:06 . 2010-01-20 16:18 -------- d-----w- c:\program files\NirSoft
2010-03-23 17:24 . 2008-08-27 07:26 -------- d-----w- c:\program files\PhotoFiltre
2010-03-15 19:17 . 2009-09-01 19:18 -------- d-----w- c:\program files\Free Video Converter
2010-03-09 11:10 . 2006-03-02 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-03-09 02:28 . 2009-04-14 18:33 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-26 05:42 . 2006-03-02 12:00 671232 ----a-w- c:\windows\system32\wininet.dll
2010-02-26 05:42 . 2006-03-02 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-24 13:11 . 2006-03-02 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 12:07 . 2006-03-02 12:00 2192000 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:07 . 2004-08-19 16:04 2068864 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 10:03 . 2010-03-12 07:56 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 04:34 . 2006-03-02 12:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 17:06 . 2010-02-11 17:06 86016 ----a-w- c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\Zylom\DressShopHop\fr-FR\ZylomHost.exe
2010-02-11 17:06 . 2010-02-11 17:06 49152 ----a-w- c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\Zylom\DressShopHop\fr-FR\ZylomAdapter.dll
2010-02-11 17:06 . 2010-02-11 17:06 2060288 ----a-w- c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\Zylom\DressShopHop\fr-FR\DressShopHop.exe
2010-02-11 12:02 . 2006-03-02 12:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0BC6E3FA-78EF-4886-842C-5A1258C4455A}"= "mscoree.dll" [2008-07-25 282112]

[HKEY_CLASSES_ROOT\clsid\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
[HKEY_CLASSES_ROOT\agihelper.AGUtils]
[HKEY_CLASSES_ROOT\TypeLib\{647B16D8-AD7B-4983-82D7-82A270FC9E6D}]
[HKEY_CLASSES_ROOT\agcutils.AGSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
2008-07-25 09:16 282112 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1c99b848-84cb-4ce4-8cd8-ed5719484d9f}"= "mscoree.dll" [2008-07-25 282112]
"{9ec204df-0e48-4c32-816e-2e928a4fd9c2}"= "mscoree.dll" [2008-07-25 282112]

[HKEY_CLASSES_ROOT\clsid\{1c99b848-84cb-4ce4-8cd8-ed5719484d9f}]
[HKEY_CLASSES_ROOT\UnifiedToolbar.UnifiedToolbar]

[HKEY_CLASSES_ROOT\clsid\{9ec204df-0e48-4c32-816e-2e928a4fd9c2}]
[HKEY_CLASSES_ROOT\IEToolbar.Toolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"MediaDicoAnglais"="c:\program files\Micro Application\MediaDICO Anglais\MediaDICOAnglais.exe" [2001-04-26 221184]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-04-24 321328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 16342528]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-08-05 647520]
"KiweeHook"="c:\program files\Kiwee Toolbar\3.2\kwtbaim.exe" [2009-11-25 56544]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Freeplayer\\vlc\\vlc.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Deluge\\Deluge-Python\\deluge.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [14/08/2008 22:29 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [14/08/2008 22:29 20560]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [01/05/2010 13:58 271728]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - DRIVERHARDWAREV2
*NewlyCreated* - MACONFSERVICE

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.durable.com/recherche
uDefault_Search_URL = hxxp://www.durable.com/recherche
uSearchMigratedDefaultURL = hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q={searchTerms}
mStart Page = hxxp://www.durable.com/recherche
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.durable.com/recherche
uSearchURL,(Default) = hxxp://www.durable.com/recherche
IE: Compare Prices with &Dealio - c:\documents and settings\benben\Application Data\Dealio\kb127\res\DealioSearch.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\documents and settings\benben\Application Data\Mozilla\Firefox\Profiles\zyz9rq1h.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://imp.free.fr/
FF - prefs.js: keyword.URL - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\documents and settings\benben\Application Data\Mozilla\Firefox\Profiles\zyz9rq1h.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-WinUsr - c:\program files\Winsudate\gibusr.exe
HKLM-Run-SearchSettings - c:\program files\Search Settings\SearchSettings.exe
AddRemove-qtxbeh - c:\documents and settings\benben\local settings\application data\qtxbeh.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-08 20:37
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LVUSBSta]
"ImagePath"="system32\drivers\LVUSBSta.sys"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(656)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2010-05-08 20:39:29
ComboFix-quarantined-files.txt 2010-05-08 18:39

Avant-CF: 94 984 818 688 octets libres
Après-CF: 96 088 756 224 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 64FE3768E989E26E7DE2F382475EDB39
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 21
Utilisateur anonyme
8 mai 2010 à 21:06
Re

|==>/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour cet ordinateur/!\<==|
|===========>il est fort déconseillé de le transposer sur un autre ordinateur !<==========|
-----------------------------------------------------------------------------------------------

Toujours avec toutes les protections désactivées, fais ceci :

* Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
* Copie/colle dans le bloc-notes ce qui est entre les lignes ci dessous (sans les lignes) :

----------------------------------------------------------


KillAll::

Driver::
LVUSBSta
Registry::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LVUSBSta]
"ImagePath"="system32\drivers\LVUSBSta.sys"
Rootkit ::
c:\windows\system32\drivers\lvusbsta.sys





-----------------------------------------------------------------

* Enregistre ce fichier sur ton Bureau (et pas ailleurs !) Sous le nom CFScript.txt
* Quitte le Bloc Notes

* Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) comme sur ce lien :
http://img517.imageshack.us/img517/8662/cfscript10uc2.gif

* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt


@+
0
Réponse 6 / 21
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010
8 mai 2010 à 21:46
as tu recu le rapport rien ne s'affiche
0
Réponse 7 / 21
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010
8 mai 2010 à 21:47
ComboFix 10-05-07.07 - benben 08/05/2010 21:15:35.2.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1982.1414 [GMT 2:00]
Lancé depuis: c:\documents and settings\benben\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\benben\Bureau\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100508-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_LVUSBSta


((((((((((((((((((((((((((((( Fichiers créés du 2010-04-08 au 2010-05-08 ))))))))))))))))))))))))))))))))))))
.

2010-05-08 17:24 . 2010-05-08 18:00 -------- d-----w- C:\FyK
2010-05-08 16:43 . 2010-05-08 16:43 -------- d-----w- c:\program files\ma-config.com
2010-05-08 16:43 . 2010-05-08 16:43 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2010-05-08 16:07 . 2007-05-09 07:40 15872 ----a-r- c:\windows\system32\RtkCoInst.dll
2010-05-08 16:07 . 2007-05-03 02:01 180224 ----a-r- c:\windows\system32\SRSTSHD.dll
2010-05-08 16:07 . 2007-04-16 08:09 167936 ----a-r- c:\windows\system32\SRSHP360.dll
2010-05-08 16:07 . 2007-04-12 23:08 135168 ----a-r- c:\windows\system32\SRSWOW.dll
2010-05-08 16:07 . 2007-03-23 06:34 266240 ----a-r- c:\windows\system32\RtkApoApi.dll
2010-05-08 16:07 . 2007-05-08 12:13 532480 ----a-r- c:\windows\system32\RtkPgExt.dll
2010-05-08 16:07 . 2006-12-13 01:30 339968 ----a-r- c:\windows\system32\SRSTSXT.dll
2010-05-08 16:07 . 2007-05-02 05:02 1911808 ----a-r- c:\windows\system32\RtkAPO.dll
2010-05-08 16:07 . 2007-05-10 08:10 4468736 ----a-r- c:\windows\RtHDVCpl.exe
2010-05-08 16:07 . 2007-05-10 09:25 1775712 ----a-r- c:\windows\system32\drivers\RTKVHDA.sys
2010-05-05 18:26 . 2008-04-13 18:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-05-05 18:26 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-05-05 18:24 . 2008-04-13 18:41 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-05-05 18:24 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-05-05 18:23 . 2008-04-13 18:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-04-29 19:18 . 2010-04-29 19:18 1190400 ----a-w- c:\documents and settings\benben\Application Data\Dealio\dinstallhelper.3E9FB0BF059147B1BECBD3E9B553787D.dll
2010-04-28 18:11 . 2010-04-29 17:08 -------- d-----w- c:\documents and settings\benben\Application Data\FileZilla
2010-04-28 18:10 . 2010-04-28 18:10 -------- d-----w- c:\program files\WalterShop.com
2010-04-25 07:15 . 2010-04-25 07:15 -------- d-----w- c:\program files\TuneUpMedia
2010-04-25 07:15 . 2010-04-25 07:15 -------- d-----w- c:\documents and settings\benben\Application Data\TuneUpMedia
2010-04-25 07:15 . 2010-04-25 07:15 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUpMedia
2010-04-24 16:11 . 2010-04-24 16:11 -------- d-----w- c:\program files\uTorrent
2010-04-24 16:11 . 2010-05-08 19:20 -------- d-----w- c:\documents and settings\benben\Application Data\uTorrent
2010-04-24 15:59 . 2010-04-24 16:04 -------- d-----w- c:\documents and settings\benben\Application Data\gtk-2.0
2010-04-24 15:55 . 2010-04-24 16:07 -------- d-----w- c:\documents and settings\benben\Application Data\deluge
2010-04-24 15:55 . 2010-04-24 16:05 -------- d-----w- c:\program files\GTK2-Runtime
2010-04-24 15:53 . 2010-04-24 16:05 -------- d-----w- c:\program files\Deluge
2010-04-19 11:34 . 2008-06-10 12:00 26112 ----a-w- c:\documents and settings\benben\Application Data\Mozilla\Firefox\Profiles\zyz9rq1h.default\extensions\deezermsn@akryus.net\msnwial2.exe
2010-04-18 16:52 . 2010-04-18 16:52 -------- d-----w- c:\program files\UnifiedToolbar
2010-04-17 15:00 . 2010-04-17 15:00 -------- d-----w- c:\program files\Freeplayer

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-08 19:23 . 2007-10-12 01:00 859648 ----a-w- c:\windows\system32\drivers\lvusbsta.sys
2010-05-08 16:00 . 2010-03-26 18:32 -------- d-----w- c:\documents and settings\benben\Application Data\vlc
2010-05-08 15:59 . 2008-08-14 17:07 15600 ----a-w- c:\windows\gdrv.sys
2010-05-05 18:26 . 2008-08-25 17:20 859648 ----a-w- c:\windows\system32\drivers\nabtsfec.sys
2010-05-05 18:26 . 2008-08-25 17:20 859648 ----a-w- c:\windows\system32\drivers\mstee.sys
2010-05-05 18:26 . 2008-08-14 17:18 859648 ----a-w- c:\windows\system32\drivers\mspqm.sys
2010-05-05 18:26 . 2008-08-14 17:18 859648 ----a-w- c:\windows\system32\drivers\mspclock.sys
2010-05-05 18:26 . 2004-08-19 15:52 859648 ----a-w- c:\windows\system32\drivers\Modem.sys
2010-05-05 18:25 . 2010-05-05 18:26 859648 ----a-w- c:\windows\system32\drivers\OLD9E.tmp
2010-05-05 18:22 . 2010-05-05 18:22 16 ----a-w- c:\documents and settings\benben\Application Data\qvjsge.dat
2010-05-05 05:58 . 2009-12-14 20:01 -------- d-----w- c:\documents and settings\benben\Application Data\Azureus
2010-04-30 17:48 . 2009-01-01 08:54 -------- d-----w- c:\documents and settings\benben\Application Data\dvdcss
2010-04-29 19:18 . 2009-04-21 21:01 -------- d-----w- c:\program files\Bonjour
2010-04-29 19:14 . 2009-04-21 20:59 -------- d-----w- c:\program files\Apple Software Update
2010-04-29 19:13 . 2009-04-21 20:58 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-04-25 07:23 . 2009-12-14 20:01 -------- d-----w- c:\program files\Vuze
2010-04-25 07:15 . 2009-11-07 19:01 -------- d-----w- c:\program files\iTunes
2010-04-24 14:47 . 2010-01-15 14:57 1 ----a-w- c:\documents and settings\benben\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-19 18:08 . 2009-05-16 20:53 -------- d-----w- c:\documents and settings\benben\Application Data\agi
2010-04-18 16:53 . 2009-05-16 20:52 -------- d-----w- c:\program files\AGI
2010-04-18 16:53 . 2009-05-16 20:53 -------- d-----w- c:\program files\Kiwee Toolbar
2010-04-18 16:52 . 2009-05-16 20:53 -------- d-----w- c:\documents and settings\All Users\Application Data\agi
2010-04-14 19:32 . 2008-08-15 14:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-12 11:21 . 2006-03-02 12:00 94868 ----a-w- c:\windows\system32\perfc00C.dat
2010-04-12 11:21 . 2006-03-02 12:00 514928 ----a-w- c:\windows\system32\perfh00C.dat
2010-04-09 06:50 . 2008-09-01 20:32 -------- d-----w- c:\program files\Fichiers communs\Adobe
2010-04-04 17:23 . 2008-09-13 18:57 -------- d-----w- c:\program files\Fichiers communs\Java
2010-04-04 17:22 . 2010-04-04 17:22 503808 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-347efc12-n\msvcp71.dll
2010-04-04 17:22 . 2010-04-04 17:22 499712 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-347efc12-n\jmc.dll
2010-04-04 17:22 . 2010-04-04 17:22 348160 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-347efc12-n\msvcr71.dll
2010-04-04 17:22 . 2010-04-04 17:22 61440 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-74c83d55-n\decora-sse.dll
2010-04-04 17:22 . 2010-04-04 17:22 12800 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-74c83d55-n\decora-d3d.dll
2010-04-04 17:22 . 2008-09-13 18:58 -------- d-----w- c:\program files\Java
2010-03-28 16:06 . 2010-01-20 16:18 -------- d-----w- c:\program files\NirSoft
2010-03-23 17:24 . 2008-08-27 07:26 -------- d-----w- c:\program files\PhotoFiltre
2010-03-15 19:17 . 2009-09-01 19:18 -------- d-----w- c:\program files\Free Video Converter
2010-03-09 11:10 . 2006-03-02 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-03-09 02:28 . 2009-04-14 18:33 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-26 05:42 . 2006-03-02 12:00 671232 ----a-w- c:\windows\system32\wininet.dll
2010-02-26 05:42 . 2006-03-02 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-24 13:11 . 2006-03-02 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 12:07 . 2006-03-02 12:00 2192000 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:07 . 2004-08-19 16:04 2068864 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 10:03 . 2010-03-12 07:56 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 04:34 . 2006-03-02 12:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 17:06 . 2010-02-11 17:06 86016 ----a-w- c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\Zylom\DressShopHop\fr-FR\ZylomHost.exe
2010-02-11 17:06 . 2010-02-11 17:06 49152 ----a-w- c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\Zylom\DressShopHop\fr-FR\ZylomAdapter.dll
2010-02-11 17:06 . 2010-02-11 17:06 2060288 ----a-w- c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\Zylom\DressShopHop\fr-FR\DressShopHop.exe
2010-02-11 12:02 . 2006-03-02 12:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0BC6E3FA-78EF-4886-842C-5A1258C4455A}"= "mscoree.dll" [2008-07-25 282112]

[HKEY_CLASSES_ROOT\clsid\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
[HKEY_CLASSES_ROOT\agihelper.AGUtils]
[HKEY_CLASSES_ROOT\TypeLib\{647B16D8-AD7B-4983-82D7-82A270FC9E6D}]
[HKEY_CLASSES_ROOT\agcutils.AGSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
2008-07-25 09:16 282112 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1c99b848-84cb-4ce4-8cd8-ed5719484d9f}"= "mscoree.dll" [2008-07-25 282112]
"{9ec204df-0e48-4c32-816e-2e928a4fd9c2}"= "mscoree.dll" [2008-07-25 282112]

[HKEY_CLASSES_ROOT\clsid\{1c99b848-84cb-4ce4-8cd8-ed5719484d9f}]
[HKEY_CLASSES_ROOT\UnifiedToolbar.UnifiedToolbar]

[HKEY_CLASSES_ROOT\clsid\{9ec204df-0e48-4c32-816e-2e928a4fd9c2}]
[HKEY_CLASSES_ROOT\IEToolbar.Toolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"MediaDicoAnglais"="c:\program files\Micro Application\MediaDICO Anglais\MediaDICOAnglais.exe" [2001-04-26 221184]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-04-24 321328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 16342528]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-08-05 647520]
"KiweeHook"="c:\program files\Kiwee Toolbar\3.2\kwtbaim.exe" [2009-11-25 56544]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Freeplayer\\vlc\\vlc.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Deluge\\Deluge-Python\\deluge.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [14/08/2008 22:29 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [14/08/2008 22:29 20560]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [01/05/2010 13:58 271728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.durable.com/recherche
uDefault_Search_URL = hxxp://www.durable.com/recherche
uSearchMigratedDefaultURL = hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q={searchTerms}
mStart Page = hxxp://www.durable.com/recherche
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.durable.com/recherche
uSearchURL,(Default) = hxxp://www.durable.com/recherche
IE: Compare Prices with &Dealio - c:\documents and settings\benben\Application Data\Dealio\kb127\res\DealioSearch.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\documents and settings\benben\Application Data\Mozilla\Firefox\Profiles\zyz9rq1h.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://imp.free.fr/
FF - prefs.js: keyword.URL - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\documents and settings\benben\Application Data\Mozilla\Firefox\Profiles\zyz9rq1h.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-08 21:19
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LVUSBSta]
"ImagePath"="system32\drivers\LVUSBSta.sys"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(656)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2532)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\windows\RTHDCPL.EXE
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\Fichiers communs\Nero\Lib\NMIndexingService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2010-05-08 21:25:48 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-05-08 19:25
ComboFix2.txt 2010-05-08 18:39

Avant-CF: 96 104 943 616 octets libres
Après-CF: 95 964 442 624 octets libres

- - End Of File - - E99B7E06DF59E47D0A0A42BD7112C77D
0
Réponse 8 / 21
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010
8 mai 2010 à 21:50
j'ai eu un message d'avast lors du redémarage me signifiant qu'un rootkit avait été trouvé mais je n''ai plus la fin du lieu quand j'ai posté le rapport la première fois ca n'a pas marché et je n'avais pas noté tout le message d'avast...
0
Réponse 9 / 21
Utilisateur anonyme
8 mai 2010 à 22:49
Fais un scan avec cet antispyware :
Malwarebytes + tutoriel

Tu l'installes; mets le a jour...(onglet mise a jour)
Click maintenant sur l'onglet recherche et coche la case :
"Executer un examen rapide".
Puis click sur "rechercher".
Laisses le scanner le pc...
A la fin du scan, clique sur Afficher les résultats
Si des elements on ete trouvés :
> click sur supprimer la selection.
si il t'es demandé de redemarrer > click sur "oui".
A la fin un rapport va s'ouvrir;
sauvegarde le de maniere a le retrouver en vue de le poster sur le forum.
Copies et colles le rapport stp.

a+


0
Réponse 10 / 21
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010
8 mai 2010 à 23:23
mbmam m'a signifié qu'il ne pouvait pas tout supprimé





Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4079

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

08/05/2010 23:11:38
mbam-log-2010-05-08 (23-11-38).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 120787
Temps écoulé: 5 minute(s), 12 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\drivers\lvusbsta.sys (Rootkit.Agent) -> Delete on reboot.
0
Réponse 11 / 21
Utilisateur anonyme
8 mai 2010 à 23:39
C:\WINDOWS\system32\drivers\lvusbsta.sys (Rootkit.Agent) -> Delete on reboot.
==> J'espère...

Relance COMBOFIX stp

a+
0
Réponse 12 / 21
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010
8 mai 2010 à 23:54
ComboFix 10-05-07.07 - benben 08/05/2010 23:42:05.3.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1982.1483 [GMT 2:00]
Lancé depuis: c:\documents and settings\benben\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100508-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((( Fichiers créés du 2010-04-08 au 2010-05-08 ))))))))))))))))))))))))))))))))))))
.

2010-05-08 17:24 . 2010-05-08 18:00 -------- d-----w- C:\FyK
2010-05-08 16:43 . 2010-05-08 16:43 -------- d-----w- c:\program files\ma-config.com
2010-05-08 16:43 . 2010-05-08 16:43 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2010-05-08 16:07 . 2007-05-09 07:40 15872 ----a-r- c:\windows\system32\RtkCoInst.dll
2010-05-08 16:07 . 2007-05-03 02:01 180224 ----a-r- c:\windows\system32\SRSTSHD.dll
2010-05-08 16:07 . 2007-04-16 08:09 167936 ----a-r- c:\windows\system32\SRSHP360.dll
2010-05-08 16:07 . 2007-04-12 23:08 135168 ----a-r- c:\windows\system32\SRSWOW.dll
2010-05-08 16:07 . 2007-03-23 06:34 266240 ----a-r- c:\windows\system32\RtkApoApi.dll
2010-05-08 16:07 . 2007-05-08 12:13 532480 ----a-r- c:\windows\system32\RtkPgExt.dll
2010-05-08 16:07 . 2006-12-13 01:30 339968 ----a-r- c:\windows\system32\SRSTSXT.dll
2010-05-08 16:07 . 2007-05-02 05:02 1911808 ----a-r- c:\windows\system32\RtkAPO.dll
2010-05-08 16:07 . 2007-05-10 08:10 4468736 ----a-r- c:\windows\RtHDVCpl.exe
2010-05-08 16:07 . 2007-05-10 09:25 1775712 ----a-r- c:\windows\system32\drivers\RTKVHDA.sys
2010-05-05 18:26 . 2008-04-13 18:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-05-05 18:26 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-05-05 18:24 . 2008-04-13 18:41 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-05-05 18:24 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-05-05 18:23 . 2008-04-13 18:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-04-29 19:18 . 2010-04-29 19:18 1190400 ----a-w- c:\documents and settings\benben\Application Data\Dealio\dinstallhelper.3E9FB0BF059147B1BECBD3E9B553787D.dll
2010-04-28 18:11 . 2010-04-29 17:08 -------- d-----w- c:\documents and settings\benben\Application Data\FileZilla
2010-04-28 18:10 . 2010-04-28 18:10 -------- d-----w- c:\program files\WalterShop.com
2010-04-25 07:15 . 2010-04-25 07:15 -------- d-----w- c:\program files\TuneUpMedia
2010-04-25 07:15 . 2010-04-25 07:15 -------- d-----w- c:\documents and settings\benben\Application Data\TuneUpMedia
2010-04-25 07:15 . 2010-04-25 07:15 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUpMedia
2010-04-24 16:11 . 2010-04-24 16:11 -------- d-----w- c:\program files\uTorrent
2010-04-24 16:11 . 2010-05-08 21:19 -------- d-----w- c:\documents and settings\benben\Application Data\uTorrent
2010-04-24 15:59 . 2010-04-24 16:04 -------- d-----w- c:\documents and settings\benben\Application Data\gtk-2.0
2010-04-24 15:55 . 2010-04-24 16:07 -------- d-----w- c:\documents and settings\benben\Application Data\deluge
2010-04-24 15:55 . 2010-04-24 16:05 -------- d-----w- c:\program files\GTK2-Runtime
2010-04-24 15:53 . 2010-04-24 16:05 -------- d-----w- c:\program files\Deluge
2010-04-19 11:34 . 2008-06-10 12:00 26112 ----a-w- c:\documents and settings\benben\Application Data\Mozilla\Firefox\Profiles\zyz9rq1h.default\extensions\deezermsn@akryus.net\msnwial2.exe
2010-04-18 16:52 . 2010-04-18 16:52 -------- d-----w- c:\program files\UnifiedToolbar
2010-04-17 15:00 . 2010-04-17 15:00 -------- d-----w- c:\program files\Freeplayer

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-08 21:37 . 2008-08-14 17:17 -------- d-----w- c:\program files\Realtek
2010-05-08 21:04 . 2009-11-26 10:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-08 16:00 . 2010-03-26 18:32 -------- d-----w- c:\documents and settings\benben\Application Data\vlc
2010-05-08 15:59 . 2008-08-14 17:07 15600 ----a-w- c:\windows\gdrv.sys
2010-05-05 18:26 . 2008-08-25 17:20 859648 ----a-w- c:\windows\system32\drivers\nabtsfec.sys
2010-05-05 18:26 . 2008-08-25 17:20 859648 ----a-w- c:\windows\system32\drivers\mstee.sys
2010-05-05 18:26 . 2008-08-14 17:18 859648 ----a-w- c:\windows\system32\drivers\mspqm.sys
2010-05-05 18:22 . 2010-05-05 18:22 16 ----a-w- c:\documents and settings\benben\Application Data\qvjsge.dat
2010-05-05 05:58 . 2009-12-14 20:01 -------- d-----w- c:\documents and settings\benben\Application Data\Azureus
2010-04-30 17:48 . 2009-01-01 08:54 -------- d-----w- c:\documents and settings\benben\Application Data\dvdcss
2010-04-29 19:18 . 2009-04-21 21:01 -------- d-----w- c:\program files\Bonjour
2010-04-29 19:14 . 2009-04-21 20:59 -------- d-----w- c:\program files\Apple Software Update
2010-04-29 19:13 . 2009-04-21 20:58 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-04-29 13:39 . 2009-11-26 10:04 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2009-11-26 10:04 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-25 07:23 . 2009-12-14 20:01 -------- d-----w- c:\program files\Vuze
2010-04-25 07:15 . 2009-11-07 19:01 -------- d-----w- c:\program files\iTunes
2010-04-24 14:47 . 2010-01-15 14:57 1 ----a-w- c:\documents and settings\benben\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-19 18:08 . 2009-05-16 20:53 -------- d-----w- c:\documents and settings\benben\Application Data\agi
2010-04-18 16:53 . 2009-05-16 20:52 -------- d-----w- c:\program files\AGI
2010-04-18 16:53 . 2009-05-16 20:53 -------- d-----w- c:\program files\Kiwee Toolbar
2010-04-18 16:52 . 2009-05-16 20:53 -------- d-----w- c:\documents and settings\All Users\Application Data\agi
2010-04-14 19:32 . 2008-08-15 14:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-12 11:21 . 2006-03-02 12:00 94868 ----a-w- c:\windows\system32\perfc00C.dat
2010-04-12 11:21 . 2006-03-02 12:00 514928 ----a-w- c:\windows\system32\perfh00C.dat
2010-04-09 06:50 . 2008-09-01 20:32 -------- d-----w- c:\program files\Fichiers communs\Adobe
2010-04-04 17:23 . 2008-09-13 18:57 -------- d-----w- c:\program files\Fichiers communs\Java
2010-04-04 17:22 . 2010-04-04 17:22 503808 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-347efc12-n\msvcp71.dll
2010-04-04 17:22 . 2010-04-04 17:22 499712 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-347efc12-n\jmc.dll
2010-04-04 17:22 . 2010-04-04 17:22 348160 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-347efc12-n\msvcr71.dll
2010-04-04 17:22 . 2010-04-04 17:22 61440 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-74c83d55-n\decora-sse.dll
2010-04-04 17:22 . 2010-04-04 17:22 12800 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-74c83d55-n\decora-d3d.dll
2010-04-04 17:22 . 2008-09-13 18:58 -------- d-----w- c:\program files\Java
2010-03-28 16:06 . 2010-01-20 16:18 -------- d-----w- c:\program files\NirSoft
2010-03-23 17:24 . 2008-08-27 07:26 -------- d-----w- c:\program files\PhotoFiltre
2010-03-15 19:17 . 2009-09-01 19:18 -------- d-----w- c:\program files\Free Video Converter
2010-03-09 11:10 . 2006-03-02 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-03-09 02:28 . 2009-04-14 18:33 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-26 05:42 . 2006-03-02 12:00 671232 ----a-w- c:\windows\system32\wininet.dll
2010-02-26 05:42 . 2006-03-02 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-24 13:11 . 2006-03-02 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 12:07 . 2006-03-02 12:00 2192000 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:07 . 2004-08-19 16:04 2068864 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 10:03 . 2010-03-12 07:56 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 04:34 . 2006-03-02 12:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 17:06 . 2010-02-11 17:06 86016 ----a-w- c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\Zylom\DressShopHop\fr-FR\ZylomHost.exe
2010-02-11 17:06 . 2010-02-11 17:06 49152 ----a-w- c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\Zylom\DressShopHop\fr-FR\ZylomAdapter.dll
2010-02-11 17:06 . 2010-02-11 17:06 2060288 ----a-w- c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\Zylom\DressShopHop\fr-FR\DressShopHop.exe
2010-02-11 12:02 . 2006-03-02 12:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-05-08_18.37.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-08 21:17 . 2010-05-08 21:17 16384 c:\windows\Temp\Perflib_Perfdata_5e4.dat
+ 2010-05-08 21:17 . 2010-05-08 21:17 16384 c:\windows\Temp\Perflib_Perfdata_200.dat
+ 2004-08-19 15:52 . 2008-04-14 01:53 30336 c:\windows\system32\drivers\modem.sys
+ 2004-08-19 15:52 . 2008-04-14 01:53 30336 c:\windows\system32\dllcache\modem.sys
+ 2008-08-14 17:18 . 2008-04-13 18:39 5376 c:\windows\system32\drivers\mspclock.sys
+ 2008-08-14 17:18 . 2008-04-13 18:39 5376 c:\windows\system32\dllcache\mspclock.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0BC6E3FA-78EF-4886-842C-5A1258C4455A}"= "mscoree.dll" [2008-07-25 282112]

[HKEY_CLASSES_ROOT\clsid\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
[HKEY_CLASSES_ROOT\agihelper.AGUtils]
[HKEY_CLASSES_ROOT\TypeLib\{647B16D8-AD7B-4983-82D7-82A270FC9E6D}]
[HKEY_CLASSES_ROOT\agcutils.AGSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
2008-07-25 09:16 282112 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1c99b848-84cb-4ce4-8cd8-ed5719484d9f}"= "mscoree.dll" [2008-07-25 282112]
"{9ec204df-0e48-4c32-816e-2e928a4fd9c2}"= "mscoree.dll" [2008-07-25 282112]

[HKEY_CLASSES_ROOT\clsid\{1c99b848-84cb-4ce4-8cd8-ed5719484d9f}]
[HKEY_CLASSES_ROOT\UnifiedToolbar.UnifiedToolbar]

[HKEY_CLASSES_ROOT\clsid\{9ec204df-0e48-4c32-816e-2e928a4fd9c2}]
[HKEY_CLASSES_ROOT\IEToolbar.Toolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"MediaDicoAnglais"="c:\program files\Micro Application\MediaDICO Anglais\MediaDICOAnglais.exe" [2001-04-26 221184]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-04-24 321328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 16342528]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-08-05 647520]
"KiweeHook"="c:\program files\Kiwee Toolbar\3.2\kwtbaim.exe" [2009-11-25 56544]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Freeplayer\\vlc\\vlc.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Deluge\\Deluge-Python\\deluge.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [14/08/2008 22:29 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [14/08/2008 22:29 20560]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [01/05/2010 13:58 271728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.durable.com/recherche
uDefault_Search_URL = hxxp://www.durable.com/recherche
uSearchMigratedDefaultURL = hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q={searchTerms}
mStart Page = hxxp://www.durable.com/recherche
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.durable.com/recherche
uSearchURL,(Default) = hxxp://www.durable.com/recherche
IE: Compare Prices with &Dealio - c:\documents and settings\benben\Application Data\Dealio\kb127\res\DealioSearch.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\documents and settings\benben\Application Data\Mozilla\Firefox\Profiles\zyz9rq1h.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://imp.free.fr/
FF - prefs.js: keyword.URL - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\documents and settings\benben\Application Data\Mozilla\Firefox\Profiles\zyz9rq1h.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-08 23:48
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(644)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(212)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2010-05-08 23:50:00
ComboFix-quarantined-files.txt 2010-05-08 21:49
ComboFix2.txt 2010-05-08 19:25
ComboFix3.txt 2010-05-08 18:39

Avant-CF: 96 399 831 040 octets libres
Après-CF: 96 365 203 456 octets libres

- - End Of File - - E8A0A1DD71F8B46EB4051C10532731B5
0
Réponse 13 / 21
Utilisateur anonyme
9 mai 2010 à 00:15
Comment se comporte le pc stp++a+
0
Réponse 14 / 21
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010
9 mai 2010 à 00:17
normal sauf que je n'ai plus de son et tout a l'heure avast a détecté des rotkit dans OLD9E et Modem.sys et mspclock
0
Réponse 15 / 21
Utilisateur anonyme
9 mai 2010 à 00:43
|==>/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour cet ordinateur/!\<==|
|===========>il est fort déconseillé de le transposer sur un autre ordinateur !<==========|
-----------------------------------------------------------------------------------------------

Toujours avec toutes les protections désactivées, fais ceci :

* Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
* Copie/colle dans le bloc-notes ce qui est entre les lignes ci dessous (sans les lignes) :

----------------------------------------------------------


KillAll::



File::
c:\program files\kiwee toolbar\3.2\kwtbaim.exe




-----------------------------------------------------------------

* Enregistre ce fichier sur ton Bureau (et pas ailleurs !) Sous le nom CFScript.txt
* Quitte le Bloc Notes

* Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) comme sur ce lien :
http://img517.imageshack.us/img517/8662/cfscript10uc2.gif

* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt

0
Réponse 16 / 21
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010
9 mai 2010 à 01:08
ComboFix 10-05-07.07 - benben 09/05/2010 0:49.4.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1982.1384 [GMT 2:00]
Lancé depuis: c:\documents and settings\benben\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\benben\Bureau\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100508-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\program files\kiwee toolbar\3.2\kwtbaim.exe"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\kiwee toolbar\3.2\kwtbaim.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-08 au 2010-05-08 ))))))))))))))))))))))))))))))))))))
.

2010-05-08 17:24 . 2010-05-08 18:00 -------- d-----w- C:\FyK
2010-05-08 16:43 . 2010-05-08 16:43 -------- d-----w- c:\program files\ma-config.com
2010-05-08 16:43 . 2010-05-08 16:43 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2010-05-08 16:07 . 2007-05-09 07:40 15872 ----a-r- c:\windows\system32\RtkCoInst.dll
2010-05-08 16:07 . 2007-05-03 02:01 180224 ----a-r- c:\windows\system32\SRSTSHD.dll
2010-05-08 16:07 . 2007-04-16 08:09 167936 ----a-r- c:\windows\system32\SRSHP360.dll
2010-05-08 16:07 . 2007-04-12 23:08 135168 ----a-r- c:\windows\system32\SRSWOW.dll
2010-05-08 16:07 . 2007-03-23 06:34 266240 ----a-r- c:\windows\system32\RtkApoApi.dll
2010-05-08 16:07 . 2007-05-08 12:13 532480 ----a-r- c:\windows\system32\RtkPgExt.dll
2010-05-08 16:07 . 2006-12-13 01:30 339968 ----a-r- c:\windows\system32\SRSTSXT.dll
2010-05-08 16:07 . 2007-05-02 05:02 1911808 ----a-r- c:\windows\system32\RtkAPO.dll
2010-05-08 16:07 . 2007-05-10 08:10 4468736 ----a-r- c:\windows\RtHDVCpl.exe
2010-05-08 16:07 . 2007-05-10 09:25 1775712 ----a-r- c:\windows\system32\drivers\RTKVHDA.sys
2010-05-05 18:26 . 2008-04-13 18:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-05-05 18:26 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-05-05 18:24 . 2008-04-13 18:41 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-05-05 18:24 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-05-05 18:23 . 2008-04-13 18:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-04-28 18:11 . 2010-04-29 17:08 -------- d-----w- c:\documents and settings\benben\Application Data\FileZilla
2010-04-28 18:10 . 2010-04-28 18:10 -------- d-----w- c:\program files\WalterShop.com
2010-04-25 07:15 . 2010-04-25 07:15 -------- d-----w- c:\program files\TuneUpMedia
2010-04-25 07:15 . 2010-04-25 07:15 -------- d-----w- c:\documents and settings\benben\Application Data\TuneUpMedia
2010-04-25 07:15 . 2010-04-25 07:15 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUpMedia
2010-04-24 16:11 . 2010-04-24 16:11 -------- d-----w- c:\program files\uTorrent
2010-04-24 16:11 . 2010-05-08 22:54 -------- d-----w- c:\documents and settings\benben\Application Data\uTorrent
2010-04-24 15:59 . 2010-04-24 16:04 -------- d-----w- c:\documents and settings\benben\Application Data\gtk-2.0
2010-04-24 15:55 . 2010-04-24 16:07 -------- d-----w- c:\documents and settings\benben\Application Data\deluge
2010-04-24 15:55 . 2010-04-24 16:05 -------- d-----w- c:\program files\GTK2-Runtime
2010-04-24 15:53 . 2010-04-24 16:05 -------- d-----w- c:\program files\Deluge
2010-04-18 16:52 . 2010-04-18 16:52 -------- d-----w- c:\program files\UnifiedToolbar
2010-04-17 15:00 . 2010-04-17 15:00 -------- d-----w- c:\program files\Freeplayer

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-08 21:37 . 2008-08-14 17:17 -------- d-----w- c:\program files\Realtek
2010-05-08 21:04 . 2009-11-26 10:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-08 16:00 . 2010-03-26 18:32 -------- d-----w- c:\documents and settings\benben\Application Data\vlc
2010-05-08 15:59 . 2008-08-14 17:07 15600 ----a-w- c:\windows\gdrv.sys
2010-05-05 18:26 . 2008-08-25 17:20 859648 ----a-w- c:\windows\system32\drivers\nabtsfec.sys
2010-05-05 18:26 . 2008-08-25 17:20 859648 ----a-w- c:\windows\system32\drivers\mstee.sys
2010-05-05 18:26 . 2008-08-14 17:18 859648 ----a-w- c:\windows\system32\drivers\mspqm.sys
2010-05-05 18:22 . 2010-05-05 18:22 16 ----a-w- c:\documents and settings\benben\Application Data\qvjsge.dat
2010-05-05 05:58 . 2009-12-14 20:01 -------- d-----w- c:\documents and settings\benben\Application Data\Azureus
2010-04-30 17:48 . 2009-01-01 08:54 -------- d-----w- c:\documents and settings\benben\Application Data\dvdcss
2010-04-29 19:18 . 2010-04-29 19:18 1190400 ----a-w- c:\documents and settings\benben\Application Data\Dealio\dinstallhelper.3E9FB0BF059147B1BECBD3E9B553787D.dll
2010-04-29 19:18 . 2009-04-21 21:01 -------- d-----w- c:\program files\Bonjour
2010-04-29 19:14 . 2009-04-21 20:59 -------- d-----w- c:\program files\Apple Software Update
2010-04-29 19:13 . 2009-04-21 20:58 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-04-29 13:39 . 2009-11-26 10:04 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2009-11-26 10:04 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-25 07:23 . 2009-12-14 20:01 -------- d-----w- c:\program files\Vuze
2010-04-25 07:15 . 2009-11-07 19:01 -------- d-----w- c:\program files\iTunes
2010-04-24 14:47 . 2010-01-15 14:57 1 ----a-w- c:\documents and settings\benben\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-19 18:08 . 2009-05-16 20:53 -------- d-----w- c:\documents and settings\benben\Application Data\agi
2010-04-18 16:53 . 2009-05-16 20:52 -------- d-----w- c:\program files\AGI
2010-04-18 16:53 . 2009-05-16 20:53 -------- d-----w- c:\program files\Kiwee Toolbar
2010-04-18 16:52 . 2009-05-16 20:53 -------- d-----w- c:\documents and settings\All Users\Application Data\agi
2010-04-14 19:32 . 2008-08-15 14:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-12 11:21 . 2006-03-02 12:00 94868 ----a-w- c:\windows\system32\perfc00C.dat
2010-04-12 11:21 . 2006-03-02 12:00 514928 ----a-w- c:\windows\system32\perfh00C.dat
2010-04-09 06:50 . 2008-09-01 20:32 -------- d-----w- c:\program files\Fichiers communs\Adobe
2010-04-04 17:23 . 2008-09-13 18:57 -------- d-----w- c:\program files\Fichiers communs\Java
2010-04-04 17:22 . 2010-04-04 17:22 503808 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-347efc12-n\msvcp71.dll
2010-04-04 17:22 . 2010-04-04 17:22 499712 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-347efc12-n\jmc.dll
2010-04-04 17:22 . 2010-04-04 17:22 348160 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-347efc12-n\msvcr71.dll
2010-04-04 17:22 . 2010-04-04 17:22 61440 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-74c83d55-n\decora-sse.dll
2010-04-04 17:22 . 2010-04-04 17:22 12800 ----a-w- c:\documents and settings\benben\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-74c83d55-n\decora-d3d.dll
2010-04-04 17:22 . 2008-09-13 18:58 -------- d-----w- c:\program files\Java
2010-03-28 16:06 . 2010-01-20 16:18 -------- d-----w- c:\program files\NirSoft
2010-03-23 17:24 . 2008-08-27 07:26 -------- d-----w- c:\program files\PhotoFiltre
2010-03-15 19:17 . 2009-09-01 19:18 -------- d-----w- c:\program files\Free Video Converter
2010-03-09 11:10 . 2006-03-02 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-03-09 02:28 . 2009-04-14 18:33 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-26 05:42 . 2006-03-02 12:00 671232 ----a-w- c:\windows\system32\wininet.dll
2010-02-26 05:42 . 2006-03-02 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-24 13:11 . 2006-03-02 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 12:07 . 2006-03-02 12:00 2192000 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:07 . 2004-08-19 16:04 2068864 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 10:03 . 2010-03-12 07:56 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 04:34 . 2006-03-02 12:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 17:06 . 2010-02-11 17:06 86016 ----a-w- c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\Zylom\DressShopHop\fr-FR\ZylomHost.exe
2010-02-11 17:06 . 2010-02-11 17:06 49152 ----a-w- c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\Zylom\DressShopHop\fr-FR\ZylomAdapter.dll
2010-02-11 17:06 . 2010-02-11 17:06 2060288 ----a-w- c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\Zylom\DressShopHop\fr-FR\DressShopHop.exe
2010-02-11 12:02 . 2006-03-02 12:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0BC6E3FA-78EF-4886-842C-5A1258C4455A}"= "mscoree.dll" [2008-07-25 282112]

[HKEY_CLASSES_ROOT\clsid\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
[HKEY_CLASSES_ROOT\agihelper.AGUtils]
[HKEY_CLASSES_ROOT\TypeLib\{647B16D8-AD7B-4983-82D7-82A270FC9E6D}]
[HKEY_CLASSES_ROOT\agcutils.AGSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
2008-07-25 09:16 282112 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1c99b848-84cb-4ce4-8cd8-ed5719484d9f}"= "mscoree.dll" [2008-07-25 282112]
"{9ec204df-0e48-4c32-816e-2e928a4fd9c2}"= "mscoree.dll" [2008-07-25 282112]

[HKEY_CLASSES_ROOT\clsid\{1c99b848-84cb-4ce4-8cd8-ed5719484d9f}]
[HKEY_CLASSES_ROOT\UnifiedToolbar.UnifiedToolbar]

[HKEY_CLASSES_ROOT\clsid\{9ec204df-0e48-4c32-816e-2e928a4fd9c2}]
[HKEY_CLASSES_ROOT\IEToolbar.Toolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"MediaDicoAnglais"="c:\program files\Micro Application\MediaDICO Anglais\MediaDICOAnglais.exe" [2001-04-26 221184]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-04-24 321328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 16342528]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-08-05 647520]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\benben\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Freeplayer\\vlc\\vlc.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Deluge\\Deluge-Python\\deluge.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [14/08/2008 22:29 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [14/08/2008 22:29 20560]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [01/05/2010 13:58 271728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.durable.com/recherche
uDefault_Search_URL = hxxp://www.durable.com/recherche
uSearchMigratedDefaultURL = hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q={searchTerms}
mStart Page = hxxp://www.durable.com/recherche
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.durable.com/recherche
uSearchURL,(Default) = hxxp://www.durable.com/recherche
IE: Compare Prices with &Dealio - c:\documents and settings\benben\Application Data\Dealio\kb127\res\DealioSearch.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\documents and settings\benben\Application Data\Mozilla\Firefox\Profiles\zyz9rq1h.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://imp.free.fr/
FF - prefs.js: keyword.URL - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\documents and settings\benben\Application Data\Mozilla\Firefox\Profiles\zyz9rq1h.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-KiweeHook - c:\program files\Kiwee Toolbar\3.2\kwtbaim.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-09 00:53
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(652)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4000)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\Fichiers communs\Nero\Lib\NMIndexingService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Heure de fin: 2010-05-09 01:00:49 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-05-08 23:00
ComboFix2.txt 2010-05-08 21:50
ComboFix3.txt 2010-05-08 19:25
ComboFix4.txt 2010-05-08 18:39

Avant-CF: 96 376 262 656 octets libres
Après-CF: 96 334 766 080 octets libres

- - End Of File - - 5CC6A7A10758708FF95F344A5AAA312E
0
Réponse 17 / 21
Utilisateur anonyme
9 mai 2010 à 08:31
DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

Télécharge List_Kill'em et enregistre le sur ton bureau

http://sd-1.archive-host.com/...

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis choisis l'option Search

un icone blanc et noir va s'afficher sur le bureau , il te servira à rappeler le programme si besoin.

laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

0
Réponse 18 / 21
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010
9 mai 2010 à 11:25
merci pour ton aide voici le rapport

¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.0.0.1 ¤¤¤¤¤¤¤¤¤¤

User : benben (Administrateurs)
Update on 09/05/2010 by g3n-h@ckm@n ::::: 09.15
Start at: 11:08:54 | 09/05/2010

AMD Athlon(tm) Processor LE-1640
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 6.0.2900.5512
Windows Firewall Status : Disabled
AV : avast! antivirus 4.8.1368 [VPS 100508-1] 4.8.1368 [ (!) Disabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 232,88 Go (89,84 Go free) | NTFS
D:\ -> Disque CD-ROM | 469,28 Mo (0 Mo free) [GIGABYTE] | CDFS
G:\ -> Disque amovible

Boot: Normal
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
MediaDicoAnglais REG_SZ C:\Program Files\Micro Application\MediaDICO Anglais\MediaDICOAnglais.exe Lancement
uTorrent REG_SZ "C:\Program Files\uTorrent\uTorrent.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
StartCCC REG_SZ C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
RTHDCPL REG_SZ RTHDCPL.EXE
avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
NeroFilterCheck REG_SZ C:\WINDOWS\system32\NeroCheck.exe
NBKeyScan REG_SZ "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
fssui REG_SZ "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
SunJavaUpdateSched REG_SZ "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
QuickTime Task REG_SZ "C:\Program Files\QuickTime\QTTask.exe" -atboottime
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Adobe ARM REG_SZ "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
DisableRegistryTools REG_DWORD 0 (0x0)

===============

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
NoDrives REG_DWORD 0 (0x0)

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDrives REG_DWORD 0 (0x0)

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ DUSHMOLL-978A5D
DefaultUserName REG_SZ benben
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ benben
AltDefaultDomainName REG_SZ DUSHMOLL-978A5D
ChangePasswordUseKerberos REG_DWORD 1 (0x1)

===============

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
C:\Program Files\Shareaza\Shareaza.exe REG_SZ C:\Program Files\Shareaza\Shareaza.exe:*:Enabled:Shareaza Ultimate File Sharing
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE REG_SZ C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
C:\WINDOWS\system32\dpvsetup.exe REG_SZ C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test
C:\Program Files\Freeplayer\vlc\vlc.exe REG_SZ C:\Program Files\Freeplayer\vlc\vlc.exe:*:Enabled:VLC media player
C:\Program Files\VideoLAN\VLC\vlc.exe REG_SZ C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player
C:\Program Files\Vuze\Azureus.exe REG_SZ C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus / Vuze
C:\Program Files\Deluge\Deluge-Python\deluge.exe REG_SZ C:\Program Files\Deluge\Deluge-Python\deluge.exe:*:Enabled:deluge
C:\Program Files\uTorrent\uTorrent.exe REG_SZ C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
C:\Program Files\ma-config.com\maconfservice.exe REG_SZ C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare

===============
ActivX controls
===============

[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\CabBuilder]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5C051655-FCD5-4969-9182-770EA5AA5565}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D6F45B3-9043-443D-A792-115447494D24}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6414512B-B978-451D-A0D8-FCFDF33E833C}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{BD8667B7-38D8-4C77-B580-18C3E146372C}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}]

===============
[SilentIEStubProcessing REG_SZ Y]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0fde1f56-0d59-4fd7-9624-e3df6b419d0f}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{166B1BCA-3F9C-11CF-8075-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5056b317-8d4c-43ee-8543-b9d1e234b8f4}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8b15971b-5355-4c82-8c07-7e181ea07608}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{94de52c8-2d59-4f1b-883e-79663d2d9a8c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

==============
BHO :
======

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6A87B991-A31F-4130-AE72-6D0C294BF082}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\..\{8C68F83F-4009-41DF-9D02-F093F4EBADF3}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\..\{8C68F83F-4009-41DF-9D02-F093F4EBADF3}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS2\Services\Tcpip\..\{8C68F83F-4009-41DF-9D02-F093F4EBADF3}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\..\{8C68F83F-4009-41DF-9D02-F093F4EBADF3}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241

================
Internet Explorer :
================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.durable.com/recherche
Local Page REG_EXPAND_SZ %SystemRoot%\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.durable.com/recherche
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

========
Services
========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

========
Safemode
========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!

=========
Atapi.sys
=========

C:\WINDOWS\$NtServicePackUninstall$\atapi.sys :
MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]

C:\WINDOWS\ERDNT\cache\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

C:\WINDOWS\ServicePackFiles\i386\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

C:\WINDOWS\system32\drivers\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

=======
Drive :
=======

Défragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
233 Go total, 89,85 Go libre (38%), 14% fragmenté (fragmentation du fichier 29%)

Vous devriez défragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Documents and Settings\All Users\Application Data\AGI
Present !! : C:\Documents and Settings\LocalService\Application Data\agi
Present !! : C:\Program Files\AGI
Present !! : C:\Program Files\Dealio
Present !! : C:\Program Files\Kiwee Toolbar
Present !! : C:\Program Files\Live-Player
Present !! : C:\Program Files\WindowsUpdate
Present !! : C:\WINDOWS\002624_.tmp
Present !! : C:\WINDOWS\SET25.tmp
Present !! : C:\WINDOWS\SET3.tmp
Present !! : C:\WINDOWS\SET4.tmp
Present !! : C:\WINDOWS\SET8.tmp
Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : C:\WINDOWS\System32\setb3.tmp
Present !! : C:\Documents and Settings\benben\Application Data\qvjsge.dat
Present !! : C:\Documents and Settings\benben\Application Data\pcouffin.inf
Present !! : C:\Documents and Settings\benben\Application Data\pcouffin.log
Present !! : C:\Documents and Settings\benben\Application Data\qvjsge.dat
Present !! : C:\Documents and Settings\benben\Application Data\Dealio
Present !! : C:\Documents and Settings\benben\Application Data\Live-Player
Present !! : C:\Documents and Settings\benben\Application Data\Search Settings
Present !! : C:\Documents and Settings\benben\Local Settings\Application Data\Kiwee Toolbar

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar : {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}
Present !! : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks : {0BC6E3FA-78EF-4886-842C-5A1258C4455A}
Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Present !! : HKEY_USERS\S-1-5-21-1715567821-1326574676-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Present !! : HKEY_USERS\S-1-5-21-1715567821-1326574676-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Present !! : "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0BC6E3FA-78EF-4886-842C-5A1258C4455A}"
Present !! : "HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}"
Present !! : "HKLM\Software\Microsoft\Internet Explorer\Extensions\{E908B145-C847-4e85-B315-07E2E70DECF8}"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A87B991-A31F-4130-AE72-6D0C294BF082}"
Present !! : "HKLM\Software\Search Settings"
Present !! : HKCR\CLSID\{6A87B991-A31F-4130-AE72-6D0C294BF082}
Present !! : HKCR\CLSID\{6E15D3C4-C6FC-4F02-B130-77CC5B1F09DB}
Present !! : HKCR\CLSID\{E03BAFDC-EB9D-4C35-A7A2-AB6C62FF0A68}
Present !! : HKCR\CLSID\{E6375F37-E4D1-4F51-B651-4658C27AC5BF}
Present !! : HKCR\interface\{5663B370-F3C3-40D1-9C46-0E800AA4D0E8}
Present !! : HKCR\KiweeIEToolbar.KiweeToolbar
Present !! : HKCR\KiweeIEToolbar.KiweeToolbar.1
Present !! : HKCR\KiweeIEToolbar.ToolbarInfo
Present !! : HKCR\KiweeIEToolbar.ToolbarInfo.1
Present !! : HKCR\Typelib\{259EEB17-79AA-44DF-8410-8E55F82A902A}
Present !! : HKCR\Typelib\{C7403C30-3644-43D8-A82F-4BD84B9682D9}
Present !! : HKCU\Software\AGI
Present !! : HKLM\Software\Classes\CLSID\{6A87B991-A31F-4130-AE72-6D0C294BF082}
Present !! : HKLM\Software\Classes\CLSID\{6E15D3C4-C6FC-4F02-B130-77CC5B1F09DB}
Present !! : HKLM\Software\Classes\CLSID\{E03BAFDC-EB9D-4C35-A7A2-AB6C62FF0A68}
Present !! : HKLM\Software\Classes\CLSID\{E6375F37-E4D1-4F51-B651-4658C27AC5BF}
Present !! : HKLM\Software\Classes\Interface\{5663B370-F3C3-40D1-9C46-0E800AA4D0E8}
Present !! : HKLM\Software\Classes\KiweeIEToolbar.KiweeToolbar
Present !! : HKLM\Software\Classes\KiweeIEToolbar.KiweeToolbar.1
Present !! : HKLM\Software\Classes\KiweeIEToolbar.ToolbarInfo
Present !! : HKLM\Software\Classes\KiweeIEToolbar.ToolbarInfo.1
Present !! : HKLM\Software\Classes\Typelib\{259EEB17-79AA-44DF-8410-8E55F82A902A}
Present !! : HKLM\Software\Classes\Typelib\{C7403C30-3644-43D8-A82F-4BD84B9682D9}
Present !! : HKLM\Software\Dealio
Present !! : HKU\.DEFAULT\Software\AGI

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-09 11:13:36
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 1 (0x1)
FirewallOverride REG_DWORD 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 11:13:37,09
0
Réponse 19 / 21
Utilisateur anonyme
9 mai 2010 à 12:05
Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
mais cette fois-ci :

choisis l'option clean

ton PC va redemarrer,

laisse travailler l'outil.

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

a+
0
Réponse 20 / 21
loran12 Messages postés 14 Date d'inscription samedi 8 mai 2010 Statut Membre Dernière intervention 9 mai 2010
9 mai 2010 à 12:26
voici le rapport



¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.0.0.1 ¤¤¤¤¤¤¤¤¤¤

User : benben (Administrateurs)
Update on 09/05/2010 by g3n-h@ckm@n ::::: 09.15
Start at: 12:10:36 | 09/05/2010

AMD Athlon(tm) Processor LE-1640
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 6.0.2900.5512
Windows Firewall Status : Disabled
AV : avast! antivirus 4.8.1368 [VPS 100508-1] 4.8.1368 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 232,88 Go (89,85 Go free) | NTFS
D:\ -> Disque CD-ROM | 469,28 Mo (0 Mo free) [GIGABYTE] | CDFS
G:\ -> Disque amovible


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\AGI
Quarantined & Deleted !! : C:\Documents and Settings\LocalService\Application Data\agi
Quarantined & Deleted !! : C:\Program Files\AGI
Quarantined & Deleted !! : C:\Program Files\Dealio
Quarantined & Deleted !! : C:\Program Files\Kiwee Toolbar
Quarantined & Deleted !! : C:\Program Files\Live-Player
Quarantined & Deleted !! : C:\Program Files\WindowsUpdate
Quarantined & Deleted !! : C:\WINDOWS\002624_.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET25.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET3.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET4.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET8.tmp

Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\System32\setb3.tmp
Quarantined & Deleted !! : C:\Documents and Settings\benben\Application Data\qvjsge.dat
Quarantined & Deleted !! : C:\Documents and Settings\benben\Application Data\pcouffin.inf
Quarantined & Deleted !! : C:\Documents and Settings\benben\Application Data\pcouffin.log
Quarantined & Deleted !! : C:\Documents and Settings\benben\Application Data\Dealio
Quarantined & Deleted !! : C:\Documents and Settings\benben\Application Data\Live-Player
Quarantined & Deleted !! : C:\Documents and Settings\benben\Application Data\Search Settings
Quarantined & Deleted !! : C:\Documents and Settings\benben\Local Settings\Application Data\Kiwee Toolbar

=======
Hosts :
=======

127.0.0.1 localhost

========
Registry
========

Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar : {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}
Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks : {0BC6E3FA-78EF-4886-842C-5A1258C4455A}
Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Deleted : "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0BC6E3FA-78EF-4886-842C-5A1258C4455A}"
Deleted : "HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}"
Deleted : "HKLM\Software\Microsoft\Internet Explorer\Extensions\{E908B145-C847-4e85-B315-07E2E70DECF8}"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A87B991-A31F-4130-AE72-6D0C294BF082}"
Deleted : "HKLM\Software\Search Settings"
Deleted : HKCR\CLSID\{6A87B991-A31F-4130-AE72-6D0C294BF082}
Deleted : HKCR\CLSID\{6E15D3C4-C6FC-4F02-B130-77CC5B1F09DB}
Deleted : HKCR\CLSID\{E03BAFDC-EB9D-4C35-A7A2-AB6C62FF0A68}
Deleted : HKCR\CLSID\{E6375F37-E4D1-4F51-B651-4658C27AC5BF}
Deleted : HKCR\interface\{5663B370-F3C3-40D1-9C46-0E800AA4D0E8}
Deleted : HKCR\KiweeIEToolbar.KiweeToolbar
Deleted : HKCR\KiweeIEToolbar.KiweeToolbar.1
Deleted : HKCR\KiweeIEToolbar.ToolbarInfo
Deleted : HKCR\KiweeIEToolbar.ToolbarInfo.1
Deleted : HKCR\Typelib\{259EEB17-79AA-44DF-8410-8E55F82A902A}
Deleted : HKCR\Typelib\{C7403C30-3644-43D8-A82F-4BD84B9682D9}
Deleted : HKCU\Software\AGI
Deleted : HKLM\Software\Dealio
Deleted : HKU\.DEFAULT\Software\AGI
=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/?gws_rd=ssl
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 1 (0x1)
FirewallOverride REG_DWORD 1 (0x1)

========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
================



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
0

Discussions similaires

Rootkit détecté par AVG mais ne fait rien?
Hakayami -
hellodu95 -

11 réponses
help rootkit
celine746 -
celine746 -

21 réponses
Avast détecte un rootkit
Marie12345 -
Marie12345 -

2 réponses
win32 Rootkit
Mary -
plopus -

8 réponses
hacker defender 100 rootkit
andros -
andros -

22 réponses