Win32.Agent.fbx

Question

Bonjour, comme dit dans le titre,Spybot m'a trouvé ca,comment dois je le supprimer,merci,j'ai lu pas mal de sujet mais apparement chaque cas est particulier.Merci d'avance pour votre aide!!



Configuration: Windows Vista / Internet Explorer 7.0

archet9 · Answer

Bonjour,

Pour voir cela:

Télécharge RSIT (de random/random) sur le bureau :

- Double clique sur RSIT.exe qui est sur le bureau
- Clique sur "Continue" dans la fenêtre
- RSIT téléchargera HijackThis si il n'est pas présent où détecté, alors il faudra accepter la licence
- Poste le contenu de log.txt plus info.txt (réduit ds la barre de taches) à la fin de l'analyse .
- Si le rapport est trop long pour passer sur le forum héberge le sur http://www.cijoint.fr/
et colle le lien généré.
Les rapports sont dans le dossier ici C:\rsit
a+

lululudic · Answer

Ok,je vais essayer tout ca,mais sans avoir commencer j'espere pas me gourrer avec tous ses termes bizaroides,merci en tous cas d'avoir repondu si vite!!Je tiens au courant

lululudic · Answer

http://www.cijoint.fr/cjlink.php?file=cj201005/cijudCiYD7.txt

et

http://www.cijoint.fr/cjlink.php?file=cj201005/cijycEJbVr.txt

archet9 · Answer

Très bien,

1) 
*   Télécharge de AD-Remover sur ton Bureau. (Merci à C_XX)
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe

Miroir: 

https://www.androidworld.fr/

/!\ Ferme toutes applications en cours /!\ 

/!\ Désactive provisoirement et seulement le temps de l'utilisation de AD-Remover, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. 
 
- Double-clique sur l'icône Ad-remover située sur ton Bureau. 
- Sur la page, clique sur le bouton « Nettoyer »
- Confirme lancement du scan
- Laisse travailler l'outil.
- Poste le rapport qui apparaît à la fin. 

(Le rapport est sauvegardé aussi sous C:\Ad-report(Scan/clean).Txt) 

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)


2)
Fais un scan avec cet antispyware : 
Malwarebytes + tutoriel 
 
Tu l'installes; mets le a jour...(onglet mise a jour)
Click maintenant sur l'onglet recherche et coche la case :
 "Executer un examen rapide".
Puis click sur "rechercher". 
Laisses le scanner le pc...
A la fin du scan, clique sur Afficher les résultats 
Si des elements on ete trouvés : 
> click sur supprimer la selection.
si il t'es demandé de redemarrer > click sur "oui".
A la fin un rapport va s'ouvrir; 
sauvegarde le de maniere a le retrouver en vue de le poster sur le forum.
Copies et colles le rapport stp.  

a+

lululudic · Answer

Wouah  !!??

Bon,beinh,C'est parti !

lululudic · Answer

.
======= RAPPORT D'AD-REMOVER 2.0.0.0,D | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 07/05/10 à 16:50
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 18:36:38 le 15/05/2010 | Mode normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\ADR.exe
SE: Microsoft® Windows Vista(TM) HomePremium Service Pack 2 - X86
Nom du PC: PC-DE-LULU (Sony Corporation VGN-AR51E)
Utilisateur actuel: lulu
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
C:\log_lobby.txt
C:\log_lobby_dumper.txt
[b]ERREUR SUPPRESSION !![/b] : C:\Users\lulu\AppData\Local\hbceff.bat
C:\Users\lulu\binternet.exe
C:\Users\lulu\scriptjava.html

(!) -- Fichiers temporaires supprimés.
.
HKCU\Software\Microsoft\Internet Explorer\MenuExt\Recherche avec cherche.us
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{19F2B849-4ADE-4d4b-85F9-C31C643DBDE9}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1F8FF992-7483-4900-9B92-89AB40880FFA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKCU\Software\pacificpoker
HKCU\Software\pokerinstaller
HKCU\Software\WebMediaPlayer
HKLM\Software\Classes\CLSID\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
HKLM\Software\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
HKLM\Software\Classes\CLSID\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKLM\Software\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
HKLM\Software\Classes\urlsearchhook.toolbarurlsearchhook
HKLM\Software\Classes\urlsearchhook.toolbarurlsearchhook.1
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5A63C6AF-C6EA-4668-B22B-8067562488C5}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\hbceff
HKLM\Software\Trymedia Systems
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{91C18ED5-5E1C-4AE5-A148-A861DE8C8E16}
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|FBSSA
.
(Orpheline) BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} (CLSID manquant)
.
============== SCAN ADDITIONNEL ==============
.
.
* Internet Explorer Version 8.0.6001.18904 *
.
[HKCU\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 1
.
[HKLM\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
.
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
.
========================================
.
C:\Ad-Remover\Quarantine: 4 Fichier(s)
C:\Ad-Remover\Backup: 15 Fichier(s)
.
C:\Ad-Report-CLEAN[1].txt - 3751 Octet(s)
.
Fin à: 18:41:04, 15/05/2010
.
============== E.O.F - CLEAN[1] ==============

lululudic · Answer

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4052

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

15/05/2010 18:59:33
mbam-log-2010-05-15 (18-59-33).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 124298
Temps écoulé: 7 minute(s), 44 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

archet9 · Answer

Clique sur ce lien : 
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 
Clique sur navilog1.exe pour le télécharger 
Choisis Enregistrer 

et enregistre-le sur ton bureau. 

Ensuite double clique sur navilog1.exe pour lancer l'installation. 
Une fois l'installation terminée, le fix s'exécutera automatiquement. 
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau). 

Laisse-toi guider. Au menu principal, choisis 1 et valide. 
 

Patiente jusqu'au message : 
*** Analyse Terminée le ..... *** 
Appuie sur une touche comme demandé, le bloc note va s'ouvrir. 
Copie-colle l'intégralité dans une réponse. Referme le bloc note. 
Le rapport est en outre sauvegardé à la racine du disque (C:\fixnavi.txt) 
poste le rapport obtenu 

a+

lululudic · Answer

Fix Navipromo version 4.0.8 commencé le 15/05/2010 21:38:05,40

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:
avilog1

Mise à jour le 09.03.2010 à 18h00 par IL-MAFIOSO

Microsoft® Windows Vista(TM) Édition Familiale Premium  ( v6.0.6002 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU     T7250  @ 2.00GHz )
BIOS : Ver 1.00PARTTBL
USER : lulu ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1296 [VPS 081208-0] 4.8.1296 (Activated)


C:\ (Local Disk) - NTFS - Total:177 Go (Free:92 Go)
D:\ (USB)
E:\ (USB)
F:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
G:\ (CD or DVD)
I:\ (CD or DVD)


Recherche executée en mode normal 


[b]Aucune Infection Navipromo/Egdaccess trouvée/b



*** Scan terminé 15/05/2010 21:38:31,80 ***

archet9 · Answer

Refais mpi un nouveau RSIT stp

a+
........

lululudic · Answer

http://www.cijoint.fr/cjlink.php?file=cj201005/cij9lNDolz.txt

et

http://www.cijoint.fr/cjlink.php?file=cj201005/cijsXgByGg.txt

archet9 · Answer

Pas bon encore:

---> Télécharge ComboFix.exe de sUBs sur ton Bureau : 
http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\ 

---> Double-clique sur Combofix.exe 
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...". 
Accepte en cliquant sur "Oui" 

---> Mets-le en langue française F 
Tape sur la touche 1 (Yes) pour démarrer le scan. 

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\ 

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire. 

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu 

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\ 

Note : Le rapport se trouve également là : C:\ComboFix.txt

a+

lululudic · Answer

ComboFix 10-05-15.01 - lulu 16/05/2010   0:25.1.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.2046.865 [GMT 2:00]
Lancé depuis: c:\users\lulu\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 081208-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1296 [VPS 081208-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((   Fichiers créés du 2010-04-15 au 2010-05-15  ))))))))))))))))))))))))))))))))))))
.

2010-05-15 22:34 . 2010-05-15 22:34	--------	d-----w-	c:\users\lulu\AppData\Local	emp
2010-05-15 22:34 . 2010-05-15 22:34	--------	d-----w-	c:\users\Default\AppData\Local	emp
2010-05-15 19:36 . 2010-05-15 19:38	--------	d---a-w-	C:\Navilog1
2010-05-15 16:36 . 2010-05-15 16:40	--------	d-----w-	C:\Ad-Remover
2010-05-15 15:43 . 2010-05-15 20:53	--------	d-----w-	c:\program files	rend micro
2010-05-15 15:43 . 2010-05-15 20:48	--------	d-----w-	C:sit
2010-05-12 12:59 . 2010-01-29 15:40	738816	----a-w-	c:\windows\system32\inetcomm.dll
2010-05-04 06:51 . 2010-04-12 15:29	411368	----a-w-	c:\windows\system32\deployJava1.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-15 22:20 . 2007-08-17 12:03	12	----a-w-	c:\windows\bthservsdp.dat
2010-05-15 22:16 . 2009-12-02 18:22	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2010-05-15 22:15 . 2009-12-02 18:22	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2010-05-15 16:48 . 2009-12-15 23:25	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-05-12 13:58 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-05-12 13:54 . 2007-08-17 13:33	--------	d-----w-	c:\programdata\Microsoft Help
2010-05-11 09:13 . 2007-11-20 19:20	48872	----a-w-	c:\users\lulu\AppData\Roaming
vModes.dat
2010-05-06 08:36 . 2009-10-03 13:50	221568	------w-	c:\windows\system32\MpSigStub.exe
2010-05-04 06:56 . 2010-05-04 06:54	64	----a-w-	c:\users\lulu\errorlog.tmp
2010-05-04 06:51 . 2007-08-17 13:45	--------	d-----w-	c:\program files\Java
2010-04-29 13:39 . 2009-12-15 23:25	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2009-12-15 23:25	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-04-15 16:51 . 2010-04-15 16:51	--------	d-----w-	c:\program files\MSECache
2010-04-13 06:53 . 2006-11-02 15:48	681712	----a-w-	c:\windows\system32\perfh00C.dat
2010-04-13 06:53 . 2006-11-02 15:48	128882	----a-w-	c:\windows\system32\perfc00C.dat
2010-03-30 20:04 . 2007-08-17 13:45	--------	d-----w-	c:\program files\Common Files\Java
2010-03-05 14:01 . 2010-04-15 12:10	420352	----a-w-	c:\windows\system32\vbscript.dll
2010-02-23 11:10 . 2010-04-15 12:10	212992	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2010-02-23 11:10 . 2010-04-15 12:10	79360	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2010-02-23 11:10 . 2010-04-15 12:10	106496	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2010-02-23 06:39 . 2010-03-31 07:37	916480	----a-w-	c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-03-31 07:37	109056	----a-w-	c:\windows\system32\iesysprep.dll
2010-02-23 06:33 . 2010-03-31 07:37	71680	----a-w-	c:\windows\system32\iesetup.dll
2010-02-23 04:55 . 2010-03-31 07:37	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2010-02-20 23:06 . 2010-03-10 18:18	24064	----a-w-	c:\windows\system32
shhttp.dll
2010-02-20 23:05 . 2010-03-10 18:18	30720	----a-w-	c:\windows\system32\httpapi.dll
2010-02-20 20:53 . 2010-03-10 18:18	411648	----a-w-	c:\windows\system32\drivers\http.sys
2010-02-18 14:07 . 2010-04-15 12:10	904576	----a-w-	c:\windows\system32\drivers	cpip.sys
2010-02-18 14:07 . 2010-04-15 12:10	3600776	----a-w-	c:\windows\system32
tkrnlpa.exe
2010-02-18 14:07 . 2010-04-15 12:10	3548040	----a-w-	c:\windows\system32
toskrnl.exe
2010-02-18 13:30 . 2010-04-15 12:10	200704	----a-w-	c:\windows\system32\iphlpsvc.dll
2010-02-18 11:28 . 2010-04-15 12:10	25088	----a-w-	c:\windows\system32\drivers	unnel.sys
2008-05-10 21:10 . 2008-05-10 21:10	0	--sh--w-	c:\windows\S24B4853C.tmp
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-04-17 196608]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-04-03 98304]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-27 39408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2007-06-26 4489216]
"Skytel"="Skytel.exe" [2007-06-26 1826816]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 835584]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-06-11 317560]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-11-26 30192]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"AppMon Utility"="c:\program files\Sony\AppMonUtil\AppMonUtility.exe" [2007-07-12 534392]
"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]
"NvSvc"="c:\windows\system32
vsvc.dll" [2007-08-01 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-01 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-01 81920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

c:\users\lulu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Audio Filter.lnk - c:\program files\Sony\SonicStage Mastering Studio\Audio Filter\SSMSFilter.exe [2007-9-6 5742136]
OneNote 2007 - Capture d''cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\VESWinlogon]
2007-07-24 17:26	98304	----a-w-	c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):00,18,67,e5,b5,32,ca,01

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-05-03 717296]
R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 135664]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2009-11-26 30192]
R3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
R3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [2007-07-09 415392]
R3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-10 745472]
R3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]
R3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2009-09-08 83312]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [2009-12-08 673136]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-11-24 20560]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-11-24 53328]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2008-09-12 233472]
S2 regi;regi;c:\windows\system32\driversegi.sys [2007-04-17 11032]
S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2007-07-05 292152]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2008-09-12 36512]
S3 R5U870FLx86;R5U870 UVC Lower Filter  ;c:\windows\system32\Drivers\R5U870FLx86.sys [2007-04-20 73472]
S3 R5U870FUx86;R5U870 UVC Upper Filter  ;c:\windows\system32\Drivers\R5U870FUx86.sys [2007-04-20 43904]
S3 ti21sony;ti21sony;c:\windows\system32\drivers	i21sony.sys [2007-06-06 812544]


--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - FSUSBEXDISK

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
.
Contenu du dossier 'Tâches planifiées'

2010-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 08:48]

2010-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 08:48]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://www.cherche.us/Result.php?cx=partner-pub-0420647136319153%3A5n6ugpjrdrh&cof=GIMP%3ACCCCCC%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A10%3BDIV%3A%23FFFFF0%3B&q={searchTerms}
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Convertir les liens sélectionnés en fichier Adobe PDF
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Trusted Zone: chat-land.org
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} - hxxp://download.livetv.ru/livetv.ru/cab/tvants.cab.rar
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-16 00:34
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000003d

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000003d

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000003d

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2010-05-16  00:36:29
ComboFix-quarantined-files.txt  2010-05-15 22:36

Avant-CF: 98 838 085 632 octets libres
Après-CF: 98 778 308 608 octets libres

- - End Of File - - 0BF730773A1BA8D1F7E55E36228A66C5

archet9 · Answer

DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection) 

 Télécharge List_Kill'em et enregistre le sur ton bureau
 
http://sd-1.archive-host.com/...

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation 

une fois terminée , clic sur "terminer" et le programme se lancera seul 

choisis choisis l'option Search 

un icone blanc et noir va s'afficher sur le bureau , il te servira à rappeler le programme si besoin. 

 laisse travailler l'outil 

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué. 

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan 

 Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED" 

a+

lululudic · Answer

Excuse-moi mais comment on desactive l'antivirus et le pare feu?

lululudic · Answer

Je ferai tout ca demain,merci deja pour tout,a demain !!

lululudic · Answer

ComboFix 10-05-15.01 - lulu 16/05/2010  14:34:03.3.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.2046.891 [GMT 2:00]
Lancé depuis: c:\users\lulu\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 081208-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1296 [VPS 081208-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((   Fichiers créés du 2010-04-16 au 2010-05-16  ))))))))))))))))))))))))))))))))))))
.

2010-05-16 12:42 . 2010-05-16 12:42	--------	d-----w-	c:\users\lulu\AppData\Local	emp
2010-05-16 12:42 . 2010-05-16 12:42	--------	d-----w-	c:\users\Public\AppData\Local	emp
2010-05-16 12:42 . 2010-05-16 12:42	--------	d-----w-	c:\users\Default\AppData\Local	emp
2010-05-15 19:36 . 2010-05-15 19:38	--------	d---a-w-	C:\Navilog1
2010-05-15 16:36 . 2010-05-15 16:40	--------	d-----w-	C:\Ad-Remover
2010-05-15 15:43 . 2010-05-15 20:53	--------	d-----w-	c:\program files	rend micro
2010-05-15 15:43 . 2010-05-15 20:48	--------	d-----w-	C:sit
2010-05-12 12:59 . 2010-01-29 15:40	738816	----a-w-	c:\windows\system32\inetcomm.dll
2010-05-04 06:51 . 2010-04-12 15:29	411368	----a-w-	c:\windows\system32\deployJava1.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-16 12:30 . 2007-08-17 12:03	12	----a-w-	c:\windows\bthservsdp.dat
2010-05-15 22:16 . 2009-12-02 18:22	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2010-05-15 22:15 . 2009-12-02 18:22	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2010-05-15 16:48 . 2009-12-15 23:25	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-05-12 13:58 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-05-12 13:54 . 2007-08-17 13:33	--------	d-----w-	c:\programdata\Microsoft Help
2010-05-11 09:13 . 2007-11-20 19:20	48872	----a-w-	c:\users\lulu\AppData\Roaming
vModes.dat
2010-05-06 08:36 . 2009-10-03 13:50	221568	------w-	c:\windows\system32\MpSigStub.exe
2010-05-04 06:56 . 2010-05-04 06:54	64	----a-w-	c:\users\lulu\errorlog.tmp
2010-05-04 06:51 . 2007-08-17 13:45	--------	d-----w-	c:\program files\Java
2010-04-29 13:39 . 2009-12-15 23:25	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2009-12-15 23:25	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-04-15 16:51 . 2010-04-15 16:51	--------	d-----w-	c:\program files\MSECache
2010-04-13 06:53 . 2006-11-02 15:48	681712	----a-w-	c:\windows\system32\perfh00C.dat
2010-04-13 06:53 . 2006-11-02 15:48	128882	----a-w-	c:\windows\system32\perfc00C.dat
2010-03-30 20:04 . 2007-08-17 13:45	--------	d-----w-	c:\program files\Common Files\Java
2010-03-05 14:01 . 2010-04-15 12:10	420352	----a-w-	c:\windows\system32\vbscript.dll
2010-02-23 11:10 . 2010-04-15 12:10	212992	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2010-02-23 11:10 . 2010-04-15 12:10	79360	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2010-02-23 11:10 . 2010-04-15 12:10	106496	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2010-02-23 06:39 . 2010-03-31 07:37	916480	----a-w-	c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-03-31 07:37	109056	----a-w-	c:\windows\system32\iesysprep.dll
2010-02-23 06:33 . 2010-03-31 07:37	71680	----a-w-	c:\windows\system32\iesetup.dll
2010-02-23 04:55 . 2010-03-31 07:37	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2010-02-20 23:06 . 2010-03-10 18:18	24064	----a-w-	c:\windows\system32
shhttp.dll
2010-02-20 23:05 . 2010-03-10 18:18	30720	----a-w-	c:\windows\system32\httpapi.dll
2010-02-20 20:53 . 2010-03-10 18:18	411648	----a-w-	c:\windows\system32\drivers\http.sys
2010-02-18 14:07 . 2010-04-15 12:10	904576	----a-w-	c:\windows\system32\drivers	cpip.sys
2010-02-18 14:07 . 2010-04-15 12:10	3600776	----a-w-	c:\windows\system32
tkrnlpa.exe
2010-02-18 14:07 . 2010-04-15 12:10	3548040	----a-w-	c:\windows\system32
toskrnl.exe
2010-02-18 13:30 . 2010-04-15 12:10	200704	----a-w-	c:\windows\system32\iphlpsvc.dll
2010-02-18 11:28 . 2010-04-15 12:10	25088	----a-w-	c:\windows\system32\drivers	unnel.sys
2008-05-10 21:10 . 2008-05-10 21:10	0	--sh--w-	c:\windows\S24B4853C.tmp
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-04-17 196608]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-04-03 98304]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-27 39408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2007-06-26 4489216]
"Skytel"="Skytel.exe" [2007-06-26 1826816]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 835584]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-06-11 317560]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-11-26 30192]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"AppMon Utility"="c:\program files\Sony\AppMonUtil\AppMonUtility.exe" [2007-07-12 534392]
"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]
"NvSvc"="c:\windows\system32
vsvc.dll" [2007-08-01 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-01 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-01 81920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

c:\users\lulu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Audio Filter.lnk - c:\program files\Sony\SonicStage Mastering Studio\Audio Filter\SSMSFilter.exe [2007-9-6 5742136]
OneNote 2007 - Capture d''cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\VESWinlogon]
2007-07-24 17:26	98304	----a-w-	c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):00,18,67,e5,b5,32,ca,01

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-05-03 717296]
R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 135664]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2009-11-26 30192]
R3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
R3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [2007-07-09 415392]
R3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-10 745472]
R3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]
R3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2009-09-08 83312]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [2009-12-08 673136]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-11-24 20560]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-11-24 53328]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2008-09-12 233472]
S2 regi;regi;c:\windows\system32\driversegi.sys [2007-04-17 11032]
S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2007-07-05 292152]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2008-09-12 36512]
S3 R5U870FLx86;R5U870 UVC Lower Filter  ;c:\windows\system32\Drivers\R5U870FLx86.sys [2007-04-20 73472]
S3 R5U870FUx86;R5U870 UVC Upper Filter  ;c:\windows\system32\Drivers\R5U870FUx86.sys [2007-04-20 43904]
S3 ti21sony;ti21sony;c:\windows\system32\drivers	i21sony.sys [2007-06-06 812544]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
.
Contenu du dossier 'Tâches planifiées'

2010-05-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 08:48]

2010-05-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 08:48]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://www.cherche.us/Result.php?cx=partner-pub-0420647136319153%3A5n6ugpjrdrh&cof=GIMP%3ACCCCCC%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A10%3BDIV%3A%23FFFFF0%3B&q={searchTerms}
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Convertir les liens sélectionnés en fichier Adobe PDF
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Trusted Zone: chat-land.org
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} - hxxp://download.livetv.ru/livetv.ru/cab/tvants.cab.rar
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-16 14:42
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000003d

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000003d

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000003d

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2010-05-16  14:44:54
ComboFix-quarantined-files.txt  2010-05-16 12:44
ComboFix2.txt  2010-05-16 11:47
ComboFix3.txt  2010-05-15 22:36

Avant-CF: 98 725 982 208 octets libres
Après-CF: 98 695 872 512 octets libres

- - End Of File - - E6A6B87FC2F51E66CC9CE70809396F72


Est ce que ce rapport convient?par rapport au pare feu et l'anti virus?

archet9 · Answer

https://forums.commentcamarche.net/forum/affich-17739792-win32-agent-fbx#14

lululudic · Answer

¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.0.0.1 ¤¤¤¤¤¤¤¤¤¤

User : lulu (Administrateurs) 
Update on 09/05/2010 by g3n-h@ckm@n ::::: 09.15
Start at: 15:02:04 | 16/05/2010

Intel(R) Core(TM)2 Duo CPU     T7250  @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium  (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1296 [VPS 081208-0] 4.8.1296 [ Enabled | Updated ]

C:\ -> Disque fixe local | 177,39 Go (91,95 Go free) | NTFS
D:\ -> Disque amovible
E:\ -> Disque amovible
F:\ -> Disque CD-ROM | 692,41 Mo (0 Mo free) [100106_1646] | CDFS
 
Boot: Normal 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running 

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\FsUsbExService.Exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\MsPMSPSv.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Sony\SonicStage Mastering Studio\Audio Filter\SSMSFilter.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run" 
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ehTray.exe	REG_SZ         	C:\Windows\ehome\ehTray.exe
MsnMsgr	REG_SZ         	"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
ISUSPM Startup	REG_SZ         	C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
WMPNSCFG	REG_SZ         	C:\Program Files\Windows Media Player\WMPNSCFG.exe
AutoStartNPSAgent	REG_SZ         	C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
swg	REG_SZ         	"C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
Sidebar	REG_SZ         	C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
Windows Defender	REG_EXPAND_SZ  	%ProgramFiles%\Windows Defender\MSASCui.exe -hide 
RtHDVCpl	REG_SZ         	RtHDVCpl.exe 
Skytel	REG_SZ         	Skytel.exe 
SynTPEnh	REG_SZ         	C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 
ISBMgr.exe	REG_SZ         	"C:\Program Files\Sony\ISB Utility\ISBMgr.exe" 
Google Desktop Search	REG_SZ         	"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup 
IAAnotif	REG_SZ         	C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe 
AppMon Utility	REG_SZ         	"C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe" @@@Start 
SystrayORAHSS	REG_SZ         	"C:\Program Files\OrangeHSS\Systray\SystrayApp.exe" 
avast!	REG_SZ         	C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
ISUSScheduler	REG_SZ         	"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start 
NvSvc	REG_SZ         	RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart 
NvCplDaemon	REG_SZ         	RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup 
NvMediaCenter	REG_SZ         	RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit 
SunJavaUpdateSched	REG_SZ         	"C:\Program Files\Common Files\Java\Java Update\jusched.exe" 
Adobe Reader Speed Launcher	REG_SZ         	"C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
Adobe ARM	REG_SZ         	"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] 
ConsentPromptBehaviorAdmin	REG_DWORD      	2 (0x2) 
ConsentPromptBehaviorUser	REG_DWORD      	1 (0x1) 
EnableInstallerDetection	REG_DWORD      	1 (0x1) 
EnableLUA	REG_DWORD      	1 (0x1) 
EnableSecureUIAPaths	REG_DWORD      	1 (0x1) 
EnableVirtualization	REG_DWORD      	1 (0x1) 
PromptOnSecureDesktop	REG_DWORD      	1 (0x1) 
ValidateAdminCodeSignatures	REG_DWORD      	0 (0x0) 
dontdisplaylastusername	REG_DWORD      	0 (0x0) 
legalnoticecaption	REG_SZ         	 
legalnoticetext	REG_SZ         	 
scforceoption	REG_DWORD      	0 (0x0) 
shutdownwithoutlogon	REG_DWORD      	1 (0x1) 
undockwithoutlogon	REG_DWORD      	1 (0x1) 
FilterAdministratorToken	REG_DWORD      	0 (0x0) 
EnableUIADesktopToggle	REG_DWORD      	0 (0x0) 
DisableRegistryTools	REG_DWORD      	0 (0x0) 

===============

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveTypeAutoRun	REG_DWORD      	145 (0x91) 
NoDrives	REG_DWORD      	0 (0x0) 

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
BindDirectlyToPropertySetStorage	REG_DWORD      	0 (0x0) 
NoDrives	REG_DWORD      	0 (0x0) 

===============
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS	REG_SZ         	C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 
 ReportBootOk	REG_SZ         	1 
 Shell	REG_SZ         	Explorer.exe 
 Userinit	REG_SZ         	C:\Windows\system32\userinit.exe, 
 VmApplet	REG_SZ         	rundll32 shell32,Control_RunDLL "sysdm.cpl" 
 AutoRestartShell	REG_DWORD      	1 (0x1) 
 LegalNoticeCaption	REG_SZ         	 
 LegalNoticeText	REG_SZ         	 
 PowerdownAfterShutdown	REG_SZ         	0 
 ShutdownWithoutLogon	REG_SZ         	0 
 cachedlogonscount	REG_SZ         	10 
 forceunlocklogon	REG_DWORD      	0 (0x0) 
 passwordexpirywarning	REG_DWORD      	14 (0xe) 
 Background	REG_SZ         	0 0 0 
 DebugServerCommand	REG_SZ         	no 
 WinStationsDisabled	REG_SZ         	0 
 DisableCAD	REG_DWORD      	1 (0x1) 
 scremoveoption	REG_SZ         	0 
 ShutdownFlags	REG_DWORD      	39 (0x27) 
 SFCDisable	REG_DWORD      	0 (0x0) 
 System	REG_SZ         	 

===============

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\VESWinlogon]

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972}	REG_SZ         	 

===============

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe	REG_SZ         	C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

===============
ActivX controls
===============

[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{215B8138-A3CF-44C5-803F-8226143CFC0A}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{3860DD98-0549-4D50-AA72-5D17D200EE10}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{4C833081-D026-4FF8-968F-7EAB660D2FBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{80DD2229-B8E4-4C77-B72F-F22972D723EA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8100D56A-5661-482C-BEE8-AFECE305D968}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

==============
BHO :
======

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\..\{CE7B1BC4-1292-48F3-A808-A5904C9A7ED2}: DhcpNameServer=192.168.1.1 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{CE7B1BC4-1292-48F3-A808-A5904C9A7ED2}: DhcpNameServer=192.168.1.1 
HKLM\SYSTEM\CS2\Services\Tcpip\..\{CE7B1BC4-1292-48F3-A808-A5904C9A7ED2}: DhcpNameServer=192.168.1.1 
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 

================
Internet Explorer :
================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr
Local Page	REG_SZ         	C:\Windows\System32\blank.htm
Default_Search_URL	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp
Search Page	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.google.fr/?gws_rd=ssl
Local Page	REG_SZ         	C:\Windows\system32\blank.htm
Search Page	REG_SZ         	http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

========
Services
========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] 

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
Wlansvc : 0x2 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
windefend : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )
wscsvc : 0x2 ( OK = 2 )

========
Safemode
========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!  
 
=========
Atapi.sys
=========

C:\Windows\ERDNT\cache\atapi.sys : 
 MD5 :: [1f05b78ab91c9075565a9d8a4b880bc4]
SHA256 :: [737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd]
 
C:\Windows\System32\drivers\atapi.sys : 
 MD5 :: [1f05b78ab91c9075565a9d8a4b880bc4]
SHA256 :: [737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd]
 
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys : 
 MD5 :: [1f05b78ab91c9075565a9d8a4b880bc4]
SHA256 :: [737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd]
 
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys : 
 MD5 :: [4f4fcb8b6ea06784fb6d475b7ec7300f]
SHA256 :: [6202d85c9a75e3f01f5f94f069c4cd8a2b9295a182301eae5940ec3bc2c1d896]
 
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys : 
 MD5 :: [2d9c903dc76a66813d350a562de40ed9]
SHA256 :: [82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3]
 
C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys : 
 MD5 :: [2d9c903dc76a66813d350a562de40ed9]
SHA256 :: [82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3]
 
C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys : 
 MD5 :: [1f05b78ab91c9075565a9d8a4b880bc4]
SHA256 :: [737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd]
 
Référence :
==========

Win 2000_SP2   : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4   : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b     : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b      : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b  : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b  : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b  : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b  : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b  : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e
 
=======
Drive :
=======

Défragmenteur de disque Windows
Copyright (c) 2006 Microsoft Corp.

Rapport d'analyse pour le volume C: 

    Taille du volume                	= 177 Go
    Espace libre                    	= 91.96 Go
    Étendue d'espace libre la plus grande 	= 41.59 Go
    Pourcentage de fragmentation des fichiers 	= 0 %

    Remarque : sur les volumes NTFS, les fragments de fichiers de plus de 64 Mo ne sont pas inclus dans les statistiques de fragmentation.

    Il n'est pas nécessaire de défragmenter ce volume. 	 

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Program Files\TorrentSpeeder  
Present !! : C:\Windows\System32\_r_a_p_.tmp  
Present !! : C:\Windows\System32\_r_a_p_.tmp  
Present !! : C:\Users\lulu\AppData\Local\etria.bat  
Present !! : C:\Users\lulu\AppData\Local\hbceff.bat  
Present !! : C:\Users\lulu\AppData\Local\d3d9caps.dat  
Present !! : C:\Users\lulu\AppData\Local\fusioncache.dat  
Present !! : C:\Users\lulu\AppData\Local\GDIPFONTCACHEV1.DAT  
 
¤¤¤¤¤¤¤¤¤¤ Keys : 

Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives  
Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives  
Present !! : HKEY_USERS\S-1-5-21-2957999420-2827681497-2377544952-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives  
Present !! : HKCR\Interface\{4897bba6-48d9-468c-8efa-846275d7701b}  

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-16 15:13:17
Windows 6.0.6002 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iastor.sys 
kernel: MBR read successfully
user & kernel MBR OK 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] 
cval	REG_DWORD      	1 (0x1) 
FirewallDisableNotify	REG_DWORD      	0 (0x0) 
AntiVirusDisableNotify	REG_DWORD      	0 (0x0) 
UpdatesDisableNotify	REG_DWORD      	0 (0x0) 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 15:13:18,97

archet9 · Answer

Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau. 
mais cette fois-ci : 

 choisis l'option clean 

ton PC va redemarrer, 

laisse travailler l'outil. 

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau , 

 colle le contenu dans ta reponse 


a+

lululudic · Answer

¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.0.0.1 ¤¤¤¤¤¤¤¤¤¤ 
 
User : lulu (Administrateurs) 
Update on 09/05/2010 by g3n-h@ckm@n ::::: 09.15
Start at: 15:25:17 | 16/05/2010

Intel(R) Core(TM)2 Duo CPU     T7250  @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium  (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1296 [VPS 081208-0] 4.8.1296 [ Enabled | Updated ]

C:\ -> Disque fixe local | 177,39 Go (92,35 Go free) | NTFS
D:\ -> Disque amovible
E:\ -> Disque amovible
F:\ -> Disque CD-ROM | 692,41 Mo (0 Mo free) [100106_1646] | CDFS
G:\ -> Disque CD-ROM
I:\ -> Disque CD-ROM
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
 
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\FsUsbExService.Exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\MsPMSPSv.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32unonce.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\conime.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Windows\system32\PresentationSettings.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe
 
¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\Program Files\TorrentSpeeder 
 
Quarantined & Deleted !! : C:\Windows\System32\_r_a_p_.tmp 
Quarantined & Deleted !! : C:\Users\lulu\AppData\Local\etria.bat 
Quarantined & Deleted !! : C:\Users\lulu\AppData\Local\hbceff.bat 
Quarantined & Deleted !! : C:\Users\lulu\AppData\Local\d3d9caps.dat 
Quarantined & Deleted !! : C:\Users\lulu\AppData\Local\fusioncache.dat 
Quarantined & Deleted !! : C:\Users\lulu\AppData\Local\GDIPFONTCACHEV1.DAT 
 
=======
Hosts :
=======

127.0.0.1       localhost   

========
Registry
========

Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives  
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives  
Deleted : HKCR\Interface\{4897bba6-48d9-468c-8efa-846275d7701b}  
=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp
Local Page	REG_SZ         	C:\WINDOWS\system32\blank.htm
Default_Search_URL	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp
Search Page	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.google.com/?gws_rd=ssl
Local Page	REG_SZ         	C:\WINDOWS\system32\blank.htm
Search Page	REG_SZ         	http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] 
cval	REG_DWORD      	1 (0x1) 
FirewallDisableNotify	REG_DWORD      	0 (0x0) 
AntiVirusDisableNotify	REG_DWORD      	0 (0x0) 
UpdatesDisableNotify	REG_DWORD      	0 (0x0) 
FirstRunDisabled	REG_DWORD      	1 (0x1) 
AntiVirusOverride	REG_DWORD      	1 (0x1) 
FirewallOverride	REG_DWORD      	1 (0x1) 
 
========
Services
=========

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Wlansvc : Start = 2   
 SharedAccess : Start = 2   
 windefend : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

============
Disk Cleaned
anti-ver blaster : OK 
Prefetch cleaned 
================
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

archet9 · Answer

Refait Un RSIT stp

lululudic · Answer

http://www.cijoint.fr/cjlink.php?file=cj201005/cijN6EKMoY.txt

archet9 · Answer

Ok

Pour desinstaller les outils utilisés

Télécharge OTCleanIt sur ton Bureau: http://www.geekstogo.com/forum/files/file/403-otc-oldtimers-clean-it/ 

Lance OTCleanIt avec un double-clic (sous Vista, lance-le en cliquant droit sur OTCleanIt.exe et en sélectionnant "exécuter en tant qu'administrateur") 

Appuie sur le bouton "CleanUp!" 

A la question "begin cleanup process?", réponds "YES" 

A la fin de l'opération, si OTCleanIt demande de redémarrer ("Do you want to reboot now?"), ferme ce que tu es en train de faire (internet, documents divers...) et clique sur "YES": 

Au redémarrage, OTCleanIt aura supprimé les outils de désinfection, et se sera même autodétruit!

a+

lululudic · Answer

Cool,merci,archet9,pour le temps passé,bye !!

Win32.Agent.fbx

25 réponses

Votre réponse

Discussions similaires

Newsletters