Mon site infecté par un trojan.w32

Ton antivirus (F-Secure Anti-Virus) te propose de le laisser faire la désinfection.

Il ne t'a pas proposé de mettre en quarantaine?

Il y a un outil très efficace pour ces "cochonneries"; c'est "Malwarebytes". Tu le trouveras ici:

https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/

OK merci je télécharge et scan et reviens ensuite

Me revoilà, tu avais raison F-secure n'avais pas supprimer le virus.
Malwarebytes en a détecté 2. Donc sur mon poste c'est bon
Mais comment je dois faire pour analyser mon site ?

Alors là, tu me vois bien désolé, mais ma "culture informatique" (celle d'un retraité autodidacte!) ne me permet pas de t'aider d'avantage..............!

J'espère que le relais te sera plus utile!

Bon courage!

Salut,

Lire ceci pour le hack de ton site : https://forums.commentcamarche.net/forum/affich-17637285-rkit-bubnix-s#6

Madness Rox \o/

Merci à TOUS ET pour tout
je lis et relis et travaille et scan et nettoie

j'espère arriver à me débarasser de cette cochonnerie

Il faut absolument que tu commences par nettoyer ton PC que tu utilises pour gérer ton site, il y a de grandes chance qu'il soit infecté (à moins que vous êtes plusieurs à avoir des accès FTP auquel cas c'est un autre PC).

Si tu veux qu'on verif, fais ça :

Désactive les logiciels de protection (Antivirus, Antispywares) puis :

Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix, accepte la licence d'utilisation et laisse toi guider.

Eventuellement, installe la console de récupération comme cela est conseillé

Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Tu as le tutorial sur ce lien pour t'aider : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

PS : si Combofix ne se lance pas, renomme le fichier Combofix et retente.

Si pas mieux, tente en mode sans échec sans prise en charge du réseau : Redémarre en mode sans échec, pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.

Madness Rox \o/

Voilà le résultat avec combofix

ComboFix 10-05-17.05 - manue 19/05/2010 17:45:03.1.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3066.1565 [GMT 2:00]
Lancé depuis: c:\users\manue\Desktop\ComboFix.exe
FW: AntiVirus Firewall 7.03 *enabled* {D4747503-0346-49EB-9262-997542F79BF4}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\prefs.js
c:\users\manue\ComboFix.exe
c:\windows\system32\st326124.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-19 au 2010-05-19 ))))))))))))))))))))))))))))))))))))
.

2010-05-19 11:51 . 2010-05-19 11:52 -------- d-----w- c:\users\manue\log naturailes
2010-05-19 10:54 . 2010-05-19 10:55 -------- d-----w- C:\site verole
2010-05-19 09:20 . 2010-05-19 09:20 -------- d-----w- c:\users\manue\AppData\Roaming\Malwarebytes
2010-05-19 09:20 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-19 09:20 . 2010-05-19 09:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-19 09:20 . 2010-05-19 09:20 -------- d-----w- c:\programdata\Malwarebytes
2010-05-19 09:20 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-19 09:20 . 2010-05-19 09:20 6153352 ----a-w- c:\users\manue\mbam-setup-1.46.exe
2010-05-19 09:09 . 2010-05-19 09:12 -------- d-----w- c:\users\manue\sauvegarde bd naturailes
2010-05-19 08:02 . 2010-05-19 08:02 -------- d-----w- c:\users\manue\McAfeeCHUP_VSP_fr_24M_R2
2010-05-19 08:00 . 2010-05-19 08:02 89705863 ----a-w- c:\users\manue\McAfeeCHUP_VSP_fr_24M_R2.zip
2010-05-19 06:47 . 2010-05-19 06:47 -------- d-----w- c:\users\manue\naturailes
2010-05-17 14:14 . 2010-05-18 13:24 -------- d-----w- c:\users\manue\CETSENS
2010-05-15 13:35 . 2010-05-15 13:35 -------- d-----w- C:\config
2010-05-15 13:06 . 2010-05-15 13:19 -------- d-----w- C:\wordpress
2010-05-15 09:21 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-05-08 09:21 . 2010-05-18 12:15 -------- d-----w- c:\users\manue\BIOMONDE
2010-05-08 09:20 . 2010-05-08 09:20 -------- d-----w- c:\users\manue\Nouveau dossier (1)

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-19 13:27 . 2010-02-08 12:45 -------- d-----w- c:\users\manue\AppData\Roaming\FileZilla
2010-05-18 07:42 . 2009-04-28 09:02 104920 ----a-w- c:\users\manue\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-16 13:10 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-05-16 12:56 . 2009-04-24 13:33 -------- d-----w- c:\programdata\Microsoft Help
2010-05-15 14:42 . 2008-01-21 08:40 676256 ----a-w- c:\windows\system32\perfh00C.dat
2010-05-15 14:42 . 2008-01-21 08:40 126540 ----a-w- c:\windows\system32\perfc00C.dat
2010-05-08 12:13 . 2010-05-08 12:13 16 ----a-w- c:\users\manue\AppData\Roaming\qvjsge.dat
2010-05-06 08:36 . 2009-11-22 13:40 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-06 05:51 . 2009-05-01 17:28 6944 ----a-w- c:\users\manue\AppData\Local\d3d9caps.dat
2010-04-23 10:54 . 2009-12-21 15:47 -------- d-----w- c:\programdata\Roxio
2010-03-25 10:03 . 2009-04-24 13:16 -------- d-----w- c:\programdata\McAfee
2010-03-25 08:19 . 2010-03-25 08:04 33920 ----a-w- c:\windows\system32\drivers\fsbts.sys
2010-03-25 08:00 . 2009-04-29 13:53 -------- d-----w- c:\programdata\fssg
2010-03-25 08:00 . 2009-04-29 13:54 -------- d-----w- c:\programdata\F-Secure
2010-03-09 16:25 . 2010-03-31 07:04 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-09 15:42 . 2010-03-31 07:04 834048 ----a-w- c:\windows\system32\wininet.dll
2010-03-04 17:33 . 2010-04-14 06:35 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-02-23 11:10 . 2010-04-14 06:36 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-23 11:10 . 2010-04-14 06:36 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-02-23 11:10 . 2010-04-14 06:36 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-20 23:06 . 2010-03-12 07:51 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-02-20 23:05 . 2010-03-12 07:51 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-02-20 20:53 . 2010-03-12 07:51 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-04-24 13:08 . 2009-04-24 13:08 75 --sh--r- c:\windows\CT4CET.bin
2009-04-24 22:17 . 2009-04-24 22:15 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-26 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"SightSpeed"="c:\program files\Dell Video Chat\DellVideoChat.exe" [2008-12-18 4823928]
"Adobe Acrobat Synchronizer"="c:\program files\Adobe\Acrobat 9.0\Acrobat\AdobeCollabSync.exe" [2008-06-11 542096]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-08-25 200704]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" [2008-06-03 446635]
"Dell DataSafe Online"="c:\program files\Dell DataSafe Online\DataSafeOnline.exe" [2009-11-13 1807600]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2008-07-04 132392]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-01-29 206064]
"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
"F-Secure Manager"="c:\program files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2009-11-18 201128]
"F-Secure TNB"="c:\program files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2009-11-18 1655208]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Fnac"="c:\program files\Fnac\Fnac.exe" [2009-02-26 933984]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-12-22 483420]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"Hiyo"="c:\program files\HiYo\bin\HiYo.exe" [2010-03-14 247152]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

c:\users\manue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-2-27 1316192]
OneNote 2007 - Capture d''cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
e-Carte Bleue La Banque Postale.lnk - c:\program files\e-Carte Bleue La Banque Postale\ecbl-lbp.exe [2009-8-12 278528]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-7-31 1616976]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-1-20 525664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-04-24 13:18 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):62,d2,83,d6,25,6d,ca,01

R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
R3 OA002Afx;Provides a software interface to control audio effects of OA002 camera.;c:\windows\system32\Drivers\OA002Afx.sys [2008-06-23 148056]
R3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
R3 PCD5SRVC{3F6A8B78-EC003E00-05040104};PCD5SRVC{3F6A8B78-EC003E00-05040104} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms [2008-11-04 22904]
R4 F-Secure Filter;F-Secure File System Filter;c:\program files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2009-11-18 41640]
R4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2009-11-18 27048]
S0 fsbts;fsbts;c:\windows\system32\Drivers\fsbts.sys [2010-03-25 33920]
S1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\Orange\AntivirusFirewall\HIPS\drivers\fshs.sys [2009-11-18 69928]
S1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [2009-11-18 37544]
S1 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2009-11-18 72904]
S1 fsvista;F-Secure Vista Support Driver;c:\program files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsvista.sys [2009-11-18 14248]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\aestsrv.exe [2008-12-22 81920]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2010-05-06 113856]
S3 FSORSPClient;F-Secure ORSP Client;c:\program files\Orange\AntivirusFirewall\ORSP Client\fsorsp.exe [2010-05-17 55992]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2008-08-25 54784]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2008-08-25 203264]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-12-22 3662848]
S3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\DRIVERS\OA001Ufd.sys [2009-01-19 133472]
S3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\DRIVERS\OA001Vid.sys [2009-01-19 279488]
S3 OA002Ufd;Creative Camera OA002 Upper Filter Driver;c:\windows\system32\DRIVERS\OA002Ufd.sys [2008-06-23 142432]
S3 OA002Vid;Creative Camera OA002 Function Driver;c:\windows\system32\DRIVERS\OA002Vid.sys [2008-06-23 265568]
S3 RLDesignVirtualAudioCableWdm;Live! Cam Virtual;c:\windows\system32\DRIVERS\livecamv.sys [2007-01-15 31616]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contenu du dossier 'Tâches planifiées'

2010-05-19 c:\windows\Tasks\User_Feed_Synchronization-{C32B123A-7DDC-48AC-8526-522F9945FED1}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
LSP: c:\program files\Orange\AntivirusFirewall\FSPS\program\FSLSP.DLL
Trusted Zone: fnac.com\vod
DPF: {83A4D5A6-E2C1-4EDD-AD48-1A1C50BD06EF} - hxxp://www.girafoto.fr/uploaders/aurigma_6_5_1_0/ImageUploader6.cab
FF - ProfilePath - c:\users\manue\AppData\Roaming\Mozilla\Firefox\Profiles\suh4yo0w.default\
FF - prefs.js: browser.search.selectedEngine - MyStart Rechercher
FF - prefs.js: browser.startup.homepage - hxxp://mystart.hiyo.com/
FF - prefs.js: keyword.URL - hxxp://mystart.hiyo.com/?loc=ff_address&search=
FF - component: c:\program files\Orange\AntivirusFirewall\NRS\litmus-ff@f-secure.com\components\litmus-ff.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programdata\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-AdobeBridge - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-19 17:53
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCD5SRVC{3F6A8B78-EC003E00-05040104}]
"ImagePath"="\??\c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms"
.
Heure de fin: 2010-05-19 17:57:18
ComboFix-quarantined-files.txt 2010-05-19 15:57

Avant-CF: 227 160 702 976 octets libres
Après-CF: 227 732 979 712 octets libres

- - End Of File - - 6CA87E3C689A952E349D8CF0CA77AC3B

OK ça roulotte.

Change le mot de passe FTP pour accéder aux sites.
Puis nettoyage la page.
Faut que tu supprimes le javascript pourri tout en bas de la page :

<script>vs:false};var Iw=''; etc etc etc etc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etcetc etc etc</script>
<!--7a203c78a0558429eefbc4d77153fb49-->

Ce résultat c'est pour mon 1er ordi

j'en ai un autre sur lequel je vais également installer combi et posterai ensuite le résultat

Encore merci pour ton aide Malekal_morte

De quel javascript tu parles, tu vois ça où ??

Voilà j'ai vu le code dans la page index et l'ai supprimé*

J'ai changé les mots de passe FTP

Et j'ai oublié de te parler de mon blog
www.blog.associationnaturailes.fr

Comment ont-ils fait pour infecter la page index, via ftp ??
je l'avais sur mon ordi avant ??

Excuse mais je ne suis pas une pro en sécurité et virus,etc.....

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-07 08:22 . 2007-11-01 09:41 -------- d-----w- c:\documents and settings\MANUE\Application Data\FileZilla
2010-03-28 13:50 . 2010-03-26 09:35 33920 ----a-w- c:\windows\system32\drivers\fsbts.sys
2010-03-26 12:22 . 2008-06-16 15:23 -------- d-----w- c:\documents and settings\MANUE\Application Data\F-Secure
2010-03-26 09:33 . 2008-06-14 13:52 -------- d-----w- c:\documents and settings\All Users\Application Data\fssg
2010-03-26 09:33 . 2008-06-14 13:54 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure
2010-03-17 16:08 . 2010-01-11 12:43 623488 ----a-w- c:\documents and settings\MANUE\Application Data\HiYo\Data\hiyo_install.exe
2010-03-10 06:16 . 2006-11-07 09:19 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:17 . 2006-11-07 09:19 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 12:31 . 2006-11-07 09:19 454016 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2006-06-15 18:33 . 2009-08-19 08:58 233472 ----a-w- c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-25 16:43 . 2009-08-19 08:58 204895 ----a-w- c:\program files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 12:41 . 2009-08-19 08:58 77824 ----a-w- c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-06-19 11:10 . 2009-08-19 08:58 426081 ----a-w- c:\program files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 10:19 . 2009-08-19 08:57 458752 ----a-w- c:\program files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 16:35 . 2009-08-19 08:58 139264 ----a-w- c:\program files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 09:10 . 2009-08-19 08:57 204800 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 09:42 . 2009-08-19 08:57 106496 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 09:22 . 2009-08-19 08:57 212992 ----a-w- c:\program files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 09:21 . 2009-08-19 08:57 167936 ----a-w- c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll
2009-08-19 08:58 . 2009-08-19 08:58 75 --sh--r- c:\windows\CT4CET.bin
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-04 15:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"fsc-reminder.exe"="c:\windows\reminder\fsc-reminder.exe" [2005-01-19 28672]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-01-27 251264]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-14 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe" [2009-07-31 468408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 16264192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"nwiz"="nwiz.exe" [2006-07-20 1519616]
"Muscbrigade"="c:\musicbrigade\Musicbrigade.exe" [2005-12-22 40960]
"SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"F-Secure Manager"="c:\program files\Securitoo\Av_Fw\Common\FSM32.EXE" [2009-11-18 201128]
"F-Secure TNB"="c:\program files\Securitoo\Av_Fw\FSGUI\TNBUtil.exe" [2009-11-18 1655208]
"News Service"="c:\program files\Securitoo\Av_Fw\FSGUI\ispnews.exe" [2004-05-06 372736]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"vspdfprsrv.exe"="c:\program files\Visagesoft\eXPert PDF Creator\vspdfprsrv.exe" [2005-10-31 704512]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-20 149280]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" [2008-06-03 446635]
"ORAHSSSessionManager"="c:\program files\OrangeHSS\SessionManager\SessionManager.exe" [2009-03-03 107248]
"Hiyo"="c:\program files\HiYo\bin\HiYo.exe" [2010-01-11 230768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2007-8-17 110592]
D'marrage rapide de HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
e-Carte Bleue La Banque Postale.lnk - c:\program files\e-Carte Bleue La Banque Postale\ecbl-lbp.exe [2009-8-11 278528]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
NkvMon.exe.lnk - c:\program files\Nikon\NkView6\NkvMon.exe [2006-12-30 241664]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [26/03/2010 11:35 33920]
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [28/12/2006 12:04 81864]
R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\Securitoo\Av_Fw\HIPS\drivers\fshs.sys [26/03/2010 11:34 69928]
R2 PMJ151NM;Panasonic DVC Web Camera;c:\windows\system32\drivers\PMJ151NM.sys [29/12/2006 16:20 14848]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\Securitoo\Av_Fw\Anti-Virus\minifilter\fsgk.sys [07/06/2007 08:32 113856]
R3 FSORSPClient;F-Secure ORSP Client;c:\program files\Securitoo\Av_Fw\ORSP Client\fsorsp.exe [26/03/2010 11:34 55992]
R3 RLDesignVirtualAudioCableWdm;Live! Cam Virtual;c:\windows\system32\drivers\livecamv.sys [19/08/2009 11:13 31616]
R3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [07/11/2006 11:23 215040]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [03/02/2010 11:36 135664]
S3 MTDVC;Panasonic DVC USB-SERIAL Driver for NT Technology;c:\windows\system32\drivers\mtdv2ku1.sys [29/12/2006 16:19 12590]
S3 MTDVC_ENUM;Panasonic DVC COM Driver for NT Technology;c:\windows\system32\drivers\mtdv2ks1.sys [29/12/2006 16:19 11569]
S3 OA002Afx;Provides a software interface to control audio effects of OA002 camera.;c:\windows\system32\drivers\OA002Afx.sys [19/08/2009 11:08 148056]
S3 OA002Ufd;Creative Camera OA002 Upper Filter Driver;c:\windows\system32\drivers\OA002Ufd.sys [19/08/2009 11:08 144672]
S3 OA002Vid;Creative Camera OA002 Function Driver;c:\windows\system32\drivers\OA002Vid.sys [19/08/2009 11:08 268672]
S4 Atse60npsscs;Atse60npsscs; [x]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\Securitoo\Av_Fw\Anti-Virus\win2k\fsfilter.sys [28/12/2006 12:03 41640]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\Securitoo\Av_Fw\Anti-Virus\win2k\fsrec.sys [28/12/2006 12:03 27048]
.
Contenu du dossier 'Tâches planifiées'

2010-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 09:36]

2010-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 09:36]

2010-05-19 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-02-04 15:50]

2010-05-19 c:\windows\Tasks\User_Feed_Synchronization-{62E11F81-6509-44D6-9098-3AC747397BBC}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.fr/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
LSP: c:\program files\Securitoo\Av_Fw\FSPS\program\FSLSP.DLL
Trusted Zone: labanquepostale.fr\www.particuliers
Trusted Zone: mappy.com
Trusted Zone: orange.fr
Trusted Zone: videoposte.com\ws
Trusted Zone: videoposte.com\www
Trusted Zone: voila.fr\rw.search.ke
Trusted Zone: weborama.fr\orange
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - hxxp://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
FF - ProfilePath - c:\documents and settings\MANUE\Application Data\Mozilla\Firefox\Profiles\j81c3jdv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - MyStart Rechercher
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://mystart.hiyo.com/?loc=ff_address&search=
FF - component: c:\documents and settings\MANUE\Application Data\Mozilla\Firefox\Profiles\j81c3jdv.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\program files\Securitoo\Av_Fw\NRS\litmus-ff@f-secure.com\components\litmus-ff.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRLCT4Player.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\program files\TurnTool\Viewer\nptnt.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-Magentic - c:\progra~1\Magentic\bin\Magentic.exe
HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
HKCU-Run-CanalPlayer - c:\program files\Lecteur CANALPLAY\CanalPlayer.exe
HKCU-Run-Uniblue RegistryBooster 2009 - c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe

**************************************************************************
Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\OMSCAN]
"ImagePath"="\Sys"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PMJ151LA]
"ImagePath"="%SystemRoot%\PMJ151LA.BIN"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\*-€|ÿÿÿÿ;*€|ù*9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
"C040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(916)
c:\program files\securitoo\av_fw\hips\fshook32.dll
c:\program files\Securitoo\Av_Fw\FWES\Program\fsdc32.dll

- - - - - - - > 'lsass.exe'(972)
c:\program files\Securitoo\Av_Fw\FSPS\program\FSLSP.DLL
c:\program files\securitoo\av_fw\hips\fshook32.dll
c:\program files\Securitoo\Av_Fw\FWES\Program\fsdc32.dll

- - - - - - - > 'csrss.exe'(892)
c:\program files\Securitoo\Av_Fw\FWES\Program\fsdc32.dll
.
Heure de fin: 2010-05-19 19:06:40
ComboFix-quarantined-files.txt 2010-05-19 17:06

Avant-CF: 186 910 478 336 octets libres
Après-CF: 187 149 766 656 octets libres

- - End Of File - - C2F79F23D287451ECC966B2F0A89BA1C

Je pense c'est OK.
Attendons demain voir si le code malicieux ne revient pas :)

Merci Malekal-morte

Je jeterai un oeil demain matin vite fait, je pars pour la journée.

Sinon à vendredi

Bonne soirée