RE- Help pour gomeo svp

Salut,

Tu es infecté par Batimal normalement : https://forum.malekal.com/viewtopic.php?t=28779&start=

Scanne ces fichiers sur www.virustotal.com :
C:\Windows\explorer.exe
C:\Windows\system32\winlogon.exe
et c:\Windows\system32\wininit.exe si existant.

file les liens ici.

Burn, burn, yes ya gonna burn
Burn, burn, yes ya gonna burn
Burn, burn, yes ya gonna burn
Burn, burn, yes ya gonna burn

It goes a-1, 2, 3

voici le rapport zhp diag
http://www.cijoint.fr/cjlink.php?file=cj201010/cije2jqEn6.txt

Zhp Diag sert à rien...
Merci de faire ce qui est demandé.

voilà ce que tu as demandé,

http://www.virustotal.com/file-scan/report.html?id=135dd05678c8997b45982d77298dbdd98061c9d4fe43d77866846012eb061a04-1287612692

http://www.virustotal.com/file-scan/report.html?id=0530b49018b59d4dcd3ecbc19e95b81438208af34bc876bd07129a79896b4d7e-1287611214

http://www.virustotal.com/file-scan/report.html?id=9a02771da9c226552a1766c2dd0295eca8b5b80aae13076ffce6a806fa5c21b8-1287611714

Tu as encore des redirections Gomeo ?

bonjour, oui je suis toujours redirigée sur gomeo

Désactive les logiciels de protection (Antivirus, Antispywares) puis :

Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix, accepte la licence d'utilisation et laisse toi guider.

Eventuellement, installe la console de récupération comme cela est conseillé

Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
Si le rapport ne passe pas, envoie le sur ce site : http://www.cijoint.fr/
et donne le lien ici :)

Tu as le tutorial sur ce lien pour t'aider : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

PS : si Combofix ne se lance pas, renomme le fichier Combofix et retente.

Si pas mieux, tente en mode sans échec sans prise en charge du réseau : Redémarre en mode sans échec, pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.

voici le rapport
http://www.cijoint.fr/cjlink.php?file=cj201010/cijR9PyOyX.txt

Envoie ces deux fichiers sur http://upload.malekal.com :
c:\windows\system32\compstui32.exe
c:\windows\system32\COLORCNV32.exe

~~

DESACTIVE LA PROTECTION ANTIVIR DURANT LA PROCEDURE

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

folder::
c:\programdata\69570425
file::
c:\windows\system32\fdWNet32.dll
c:\windows\system32\devenum32.dll
c:\windows\system32\bitsigd32.dll
c:\windows\system32\compstui32.exe
c:\windows\system32\COLORCNV32.exe
c:\windows\system32\rbleluqcxb.tmp
registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0DB20761-F95D-6C6C-D40C-056CB7057E16}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-
"AppInit_DLLs"=""

Enregistre ce fichier sous le nom CFScript

[*]Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe

[*]Combofix se lance, laisse toi guider..

[*]Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
[*]Une fois le scan achevé, un rapport va s'afficher: poste son contenu sur http://www.cijoint.fr/ et donne le lien ici dans un nouveau message.

~~~

Mets à jour Malwarebyte, fais un scan complet avec et poste le rapport ici.
tuto : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

bonsoir, voici le rapport de combofix
http://www.cijoint.fr/cjlink.php?file=cj201010/cijiXncrG1.txt
et le rapport de malvarebytes

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4806

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975

22/10/2010 00:54:08
mbam-log-2010-10-22 (00-54-08).txt

Type d'examen: Examen complet (C:\|)
Elément(s) analysé(s): 267944
Temps écoulé: 1 heure(s), 32 minute(s), 44 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\ProgramData\69570425 (Rogue.Multiple) -> No action taken.

Fichier(s) infecté(s):
C:\WINDOWS\winsxs\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.0.6002.18005_lt-lt_bf12ba06fdc0c65b_msimsg.dll.mui_72e8994f (Trojan.Dropper) -> No action taken.
C:\WINDOWS\System32\GnuHashes.ini (Trojan.Tracur) -> No action taken.

merci

Ca n'a pas marché pour Combofix.

Tu peux retenter stp ?
Mets bien dans le fichier texte ce qui est en italique.

alors je ne sais pas si c'est ca mais voici le rapport avec combix

ComboFix 10-10-21.07 - Noelle 22/10/2010 15:52:22.3.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.2046.1222 [GMT 2:00]
Lancé depuis: c:\users\Noelle\Desktop\noelle.exe
Commutateurs utilisés :: c:\users\Noelle\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\programdata\unrar.exe
c:\windows\lsass.exe
c:\windows\system32\arp.exe

----- BITS: Il y a peut-être des sites infectés -----

hxxp://wlxindex
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-09-22 au 2010-10-22 ))))))))))))))))))))))))))))))))))))
.

2010-10-22 14:06 . 2010-10-22 14:06 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-22 13:15 . 2010-10-07 23:21 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C5EE8361-4191-4EC8-8E59-7C46D51FA679}\mpengine.dll
2010-10-21 13:49 . 2010-10-21 13:49 372736 ----a-w- c:\windows\system32\AUDIOKSE32.dll
2010-10-20 19:28 . 2010-10-22 13:40 -------- d-----w- c:\programdata\69570425
2010-10-19 22:14 . 2010-10-20 20:57 -------- d-----w- c:\program files\ZHPDiag
2010-10-19 14:47 . 2010-10-19 14:47 250880 ----a-w- c:\windows\system32\fdWNet32.dll
2010-10-19 14:45 . 2010-10-19 14:45 365056 ----a-w- c:\windows\system32\devenum32.dll
2010-10-19 14:09 . 2010-10-19 14:09 359936 ----a-w- c:\windows\system32\bitsigd32.dll
2010-10-19 14:08 . 2010-10-19 14:08 1338880 ----a-w- c:\windows\system32\compstui32.exe
2010-10-19 14:08 . 2010-10-19 14:08 1338880 ----a-w- c:\windows\system32\COLORCNV32.exe
2010-10-16 16:26 . 2010-10-16 16:27 -------- d-----w- c:\program files\Common Files\Adobe
2010-10-14 20:45 . 2010-10-14 20:48 -------- d-----w- c:\users\Noelle\AppData\Roaming\Windows Live Writer
2010-10-14 20:45 . 2010-10-14 20:45 -------- d-----w- c:\users\Noelle\AppData\Local\Windows Live Writer
2010-10-12 22:25 . 2010-06-28 17:00 1316864 ----a-w- c:\windows\system32\ole32.dll
2010-10-12 22:25 . 2010-06-28 14:54 339968 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2010-10-12 22:25 . 2010-05-04 19:13 231424 ----a-w- c:\windows\system32\msshsq.dll
2010-10-12 22:25 . 2010-08-31 15:46 954752 ----a-w- c:\windows\system32\mfc40.dll
2010-10-12 22:23 . 2010-08-31 13:27 2038272 ----a-w- c:\windows\system32\win32k.sys
2010-10-12 22:23 . 2010-08-31 15:44 531968 ----a-w- c:\windows\system32\comctl32.dll
2010-10-12 22:19 . 2010-10-12 22:19 -------- d-----w- c:\users\Noelle\AppData\Roaming\Malwarebytes
2010-10-12 22:18 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-12 22:18 . 2010-10-12 22:18 -------- d-----w- c:\programdata\Malwarebytes
2010-10-12 22:18 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-12 22:18 . 2010-10-12 22:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-12 21:05 . 2010-10-12 21:33 -------- d-----w- C:\noelle
2010-10-12 14:41 . 1999-01-20 03:01 210032 ----a-w- c:\windows\system32\DBCLIENT.DLL
2010-10-12 14:41 . 1999-11-12 03:11 183808 ----a-w- c:\windows\system32\BDEADMIN.CPL
2010-10-12 14:41 . 2010-10-12 14:41 -------- d-----w- c:\program files\Common Files\Borland Shared
2010-10-12 13:42 . 2010-10-12 13:42 0 ---ha-w- c:\windows\system32\rbleluqcxb.tmp
2010-10-11 20:58 . 2010-10-19 20:42 -------- d-----w- c:\program files\LimeWire
2010-10-04 23:31 . 2010-10-05 00:00 -------- d-----w- C:\divx
2010-10-04 23:29 . 2010-10-04 23:29 -------- d-----w- c:\users\Noelle\AppData\Roaming\DivX
2010-10-02 13:14 . 2010-10-02 13:14 53248 ----a-r- c:\users\Noelle\AppData\Roaming\Microsoft\Installer\{4B607D6F-112B-4D96-93D5-DFE17CE982AE}\ARPPRODUCTICON.exe
2010-10-02 13:12 . 2009-10-19 19:49 1164728 ----a-w- c:\windows\system32\NMSDVDXU.dll
2010-10-02 13:12 . 2009-05-22 11:26 630784 ----a-w- c:\windows\system32\vsflex8u.ocx
2010-10-02 13:12 . 2009-05-22 11:26 419240 ----a-w- c:\windows\system32\Vsflex7L.ocx
2010-10-02 13:12 . 2009-05-22 11:26 244416 ----a-w- c:\windows\system32\Msflxgrd.ocx
2010-10-02 13:12 . 2010-10-02 13:12 -------- d--h--w- c:\users\Noelle\AppData\Roaming\{D94BA408-F110-488B-A65E-3AE7945F79E6}
2010-10-02 12:43 . 2010-10-02 12:43 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-10-02 12:42 . 2010-10-02 12:42 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-10-02 12:42 . 2010-10-02 12:43 -------- d-----w- c:\program files\DivX
2010-09-29 14:14 . 2010-09-29 14:14 -------- d-----w- c:\programdata\Norton
2010-09-29 14:10 . 2010-06-22 13:30 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-29 14:09 . 2010-08-26 04:23 13312 ----a-w- c:\program files\Internet Explorer\iecompat.dll
2010-09-28 21:20 . 2010-09-28 21:30 -------- d-----w- c:\users\Noelle\Aquarelle
2010-09-28 14:39 . 2010-10-02 12:16 -------- d-----w- C:\KU990i
2010-09-28 14:38 . 2006-05-04 06:33 53248 ----a-w- c:\windows\system32\CommonDL.dll
2010-09-28 14:37 . 2010-10-02 11:56 -------- d-----w- c:\programdata\LGMOBILEAX
2010-09-28 14:21 . 2010-09-28 14:21 -------- d-----w- c:\users\Noelle\AppData\Roaming\Roxio
2010-09-27 22:17 . 2010-05-12 14:09 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-09-27 22:17 . 2010-09-27 22:17 -------- d-----w- c:\program files\ffdshow
2010-09-23 16:08 . 2010-09-23 16:08 -------- d-----w- c:\windows\fr
2010-09-23 16:07 . 2010-08-09 03:26 39264 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2010-09-23 16:04 . 2010-09-23 16:04 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-09-23 15:55 . 2009-09-04 15:44 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2010-09-23 15:55 . 2009-09-04 15:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2010-09-23 15:55 . 2009-09-04 15:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2010-09-23 15:54 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2010-09-23 15:54 . 2010-09-23 15:54 466704 ----a-w- c:\program files\Common Files\Windows Live\.cache\9990d9c01cb5b3705\InstallManager_WLE_WLE.exe
2010-09-23 15:53 . 2010-09-23 15:53 14688 ----a-w- c:\program files\Common Files\Windows Live\.cache\862441601cb5b3704\MeshBetaRemover.exe
2010-09-23 15:53 . 2010-09-23 15:53 525656 ----a-w- c:\program files\Common Files\Windows Live\.cache\830c33c01cb5b3703\DXSETUP.exe
2010-09-23 15:53 . 2010-09-23 15:53 1691480 ----a-w- c:\program files\Common Files\Windows Live\.cache\830c33c01cb5b3703\dsetup32.dll
2010-09-23 15:53 . 2010-09-23 15:53 94040 ----a-w- c:\program files\Common Files\Windows Live\.cache\830c33c01cb5b3703\DSETUP.dll
2010-09-23 15:53 . 2009-08-04 08:02 754688 ----a-w- c:\windows\system32\webservices.dll
2010-09-23 15:53 . 2010-09-23 15:53 525656 ----a-w- c:\program files\Common Files\Windows Live\.cache\7c1425001cb5b3702\DXSETUP.exe
2010-09-23 15:53 . 2010-09-23 15:53 94040 ----a-w- c:\program files\Common Files\Windows Live\.cache\7c1425001cb5b3702\DSETUP.dll
2010-09-23 15:53 . 2010-09-23 15:53 1691480 ----a-w- c:\program files\Common Files\Windows Live\.cache\7c1425001cb5b3702\dsetup32.dll
2010-09-23 15:53 . 2010-10-14 20:44 -------- d-----w- c:\users\Noelle\AppData\Local\Windows Live
2010-09-22 16:10 . 2010-09-22 16:10 103864 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 09:41 . 2010-09-01 15:28 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-09-11 14:06 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2010-09-11 14:06 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2010-09-06 14:22 . 2010-09-06 14:23 29480 ----a-w- c:\windows\system32\msxml3a.dll
2010-09-06 12:14 . 2010-09-06 12:14 445008 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2010-09-06 12:14 . 2010-09-06 12:14 38480 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2010-09-06 12:14 . 2010-09-06 12:14 2560 ----a-w- c:\windows\system32\drivers\fr-FR\wdf01000.sys.mui
2010-09-02 15:18 . 2010-09-02 15:18 377344 ----a-w- c:\windows\system32\winhttp.dll
2010-09-02 15:16 . 2010-09-02 15:16 40960 ----a-w- c:\windows\system32\drivers\fr-FR\http.sys.mui
2010-09-02 13:46 . 2010-09-02 13:46 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-09-02 13:46 . 2010-09-02 13:46 23552 ----a-w- c:\windows\system32\lpk.dll
2010-09-02 13:46 . 2010-09-02 13:46 10240 ----a-w- c:\windows\system32\dciman32.dll
2010-09-02 13:44 . 2010-09-02 13:44 61440 ----a-w- c:\windows\system32\winipsec.dll
2010-09-02 13:44 . 2010-09-02 13:44 272896 ----a-w- c:\windows\system32\polstore.dll
2010-09-02 13:41 . 2010-09-02 13:41 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2010-09-02 13:41 . 2010-09-02 13:41 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2010-09-02 13:41 . 2010-09-02 13:41 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2010-09-02 13:41 . 2010-09-02 13:41 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2010-09-02 13:41 . 2010-09-02 13:41 105984 ----a-w- c:\windows\system32\netiohlp.dll
2010-09-02 13:41 . 2010-09-02 13:41 10240 ----a-w- c:\windows\system32\finger.exe
2010-09-02 13:41 . 2010-09-02 13:41 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2010-09-02 13:39 . 2010-09-02 13:39 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2010-09-02 13:39 . 2010-09-02 13:39 68096 ----a-w- c:\windows\system32\wlanhlp.dll
2010-09-02 13:39 . 2010-09-02 13:39 65024 ----a-w- c:\windows\system32\wlanapi.dll
2010-09-02 13:39 . 2010-09-02 13:39 513536 ----a-w- c:\windows\system32\wlansvc.dll
2010-09-02 13:39 . 2010-09-02 13:39 302592 ----a-w- c:\windows\system32\wlansec.dll
2010-09-02 13:39 . 2010-09-02 13:39 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2010-09-02 13:39 . 2010-09-02 13:39 15181 ----a-w- c:\windows\system32\gatherWirelessInfo.vbs
2010-09-02 13:39 . 2010-09-02 13:39 1401856 ----a-w- c:\windows\system32\msxml6.dll
2010-09-02 13:39 . 2010-09-02 13:39 2048 ----a-w- c:\windows\system32\msxml6r.dll
2010-09-02 13:39 . 2010-09-02 13:39 2048 ----a-w- c:\windows\system32\msxml3r.dll
2010-09-02 13:38 . 2010-09-02 13:38 218624 ----a-w- c:\windows\system32\msv1_0.dll
2010-09-02 13:37 . 2010-09-02 13:37 98816 ----a-w- c:\windows\system32\mfps.dll
2010-09-02 13:37 . 2010-09-02 13:37 53248 ----a-w- c:\windows\system32\rrinstaller.exe
2010-09-02 13:37 . 2010-09-02 13:37 2868224 ----a-w- c:\windows\system32\mf.dll
2010-09-02 13:37 . 2010-09-02 13:37 24576 ----a-w- c:\windows\system32\mfpmp.exe
2010-09-02 13:37 . 2010-09-02 13:37 2048 ----a-w- c:\windows\system32\mferror.dll
2010-09-02 13:34 . 2010-09-02 13:34 71680 ----a-w- c:\windows\system32\atl.dll
2010-09-02 13:31 . 2010-09-02 13:31 160256 ----a-w- c:\windows\system32\wkssvc.dll
2010-09-02 13:31 . 2010-09-02 13:31 53248 ----a-w- c:\windows\system32\tsgqec.dll
2010-09-02 13:31 . 2010-09-02 13:31 2066432 ----a-w- c:\windows\system32\mstscax.dll
2010-09-02 13:31 . 2010-09-02 13:31 136192 ----a-w- c:\windows\system32\aaclient.dll
2010-09-02 13:28 . 2010-09-02 13:28 714240 ----a-w- c:\windows\system32\timedate.cpl
2010-09-02 13:25 . 2010-09-02 13:25 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax
2010-09-02 13:23 . 2010-09-02 13:23 623616 ----a-w- c:\windows\system32\localspl.dll
2010-09-02 13:21 . 2010-09-02 13:21 499712 ----a-w- c:\windows\system32\kerberos.dll
2010-09-02 13:21 . 2010-09-02 13:21 175104 ----a-w- c:\windows\system32\wdigest.dll
2010-09-02 13:21 . 2010-09-02 13:21 9728 ----a-w- c:\windows\system32\lsass.exe
2010-09-02 13:21 . 2010-09-02 13:21 72704 ----a-w- c:\windows\system32\secur32.dll
2010-09-02 13:21 . 2010-09-02 13:21 439864 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2010-09-02 13:21 . 2010-09-02 13:21 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2010-09-02 13:18 . 2010-09-02 13:18 1808896 ----a-w- c:\windows\system32\NlsLexicons0046.dll
2010-09-02 13:18 . 2010-09-02 13:18 1793536 ----a-w- c:\windows\system32\NlsLexicons0045.dll
2010-09-02 13:18 . 2010-09-02 13:18 1411072 ----a-w- c:\windows\system32\NlsLexicons0047.dll
2010-09-02 13:18 . 2010-09-02 13:18 1558016 ----a-w- c:\windows\system32\NlsLexicons0049.dll
2010-09-02 13:18 . 2010-09-02 13:18 2136064 ----a-w- c:\windows\system32\NlsLexicons0021.dll
2010-09-02 13:18 . 2010-09-02 13:18 1782272 ----a-w- c:\windows\system32\NlsLexicons0039.dll
2010-09-02 13:18 . 2010-09-02 13:18 1236992 ----a-w- c:\windows\system32\NlsLexicons0020.dll
2010-09-02 13:18 . 2010-09-02 13:18 7964672 ----a-w- c:\windows\system32\NlsLexicons0024.dll
2010-09-02 13:18 . 2010-09-02 13:18 5499904 ----a-w- c:\windows\system32\NlsLexicons0022.dll
2010-09-02 13:18 . 2010-09-02 13:18 6224896 ----a-w- c:\windows\system32\NlsLexicons0027.dll
2010-09-02 13:18 . 2010-09-02 13:18 5791232 ----a-w- c:\windows\system32\NlsLexicons0026.dll
2010-09-02 13:18 . 2010-09-02 13:18 4175872 ----a-w- c:\windows\system32\NlsLexicons0010.dll
2010-09-02 13:18 . 2010-09-02 13:18 4981248 ----a-w- c:\windows\system32\NlsLexicons0013.dll
2010-09-02 13:18 . 2010-09-02 13:18 2466816 ----a-w- c:\windows\system32\NlsLexicons0011.dll
2010-09-02 13:18 . 2010-09-02 13:18 6781440 ----a-w- c:\windows\system32\NlsLexicons0019.dll
2010-09-02 13:18 . 2010-09-02 13:18 3331072 ----a-w- c:\windows\system32\NlsLexicons0018.dll
2010-09-02 13:18 . 2010-09-02 13:18 11722752 ----a-w- c:\windows\system32\NlsLexicons0001.dll
2010-09-02 13:18 . 2010-09-02 13:18 4164096 ----a-w- c:\windows\system32\NlsLexicons0002.dll
2010-09-02 13:18 . 2010-09-02 13:18 1452544 ----a-w- c:\windows\system32\NlsLexicons0003.dll
2010-09-02 13:18 . 2010-09-02 13:18 3419136 ----a-w- c:\windows\system32\NlsLexicons004a.dll
2010-09-02 13:18 . 2010-09-02 13:18 1702912 ----a-w- c:\windows\system32\NlsLexicons004b.dll
2010-09-02 13:18 . 2010-09-02 13:18 4093440 ----a-w- c:\windows\system32\NlsLexicons004c.dll
2010-09-02 13:18 . 2010-09-02 13:18 1972736 ----a-w- c:\windows\system32\NlsLexicons004e.dll
2010-09-02 13:18 . 2010-09-02 13:18 6014976 ----a-w- c:\windows\system32\NlsLexicons001a.dll
2010-09-02 13:18 . 2010-09-02 13:18 4096 ----a-w- c:\windows\system32\NlsLexicons002a.dll
2010-09-02 13:18 . 2010-09-02 13:18 4045824 ----a-w- c:\windows\system32\NlsLexicons003e.dll
2010-09-02 13:18 . 2010-09-02 13:18 6585856 ----a-w- c:\windows\system32\NlsLexicons001b.dll
2010-09-02 13:18 . 2010-09-02 13:18 6346240 ----a-w- c:\windows\system32\NlsLexicons001d.dll
2010-09-02 13:18 . 2010-09-02 13:18 9892864 ----a-w- c:\windows\system32\NlsLexicons000a.dll
2010-09-02 13:18 . 2010-09-02 13:18 6237696 ----a-w- c:\windows\system32\NlsLexicons000c.dll
2010-09-02 13:18 . 2010-09-02 13:18 1722368 ----a-w- c:\windows\system32\NlsLexicons000d.dll
2010-09-02 13:18 . 2010-09-02 13:18 5654528 ----a-w- c:\windows\system32\NlsLexicons000f.dll
2010-09-02 13:18 . 2010-09-02 13:18 4616192 ----a-w- c:\windows\system32\NlsLexicons0414.dll
2010-09-02 13:18 . 2010-09-02 13:17 5090816 ----a-w- c:\windows\system32\NlsLexicons0416.dll
2010-09-02 13:17 . 2010-09-02 13:17 5031936 ----a-w- c:\windows\system32\NlsLexicons0816.dll
2010-09-02 13:17 . 2010-09-02 13:17 7042560 ----a-w- c:\windows\system32\NlsLexicons081a.dll
2010-09-02 13:17 . 2010-09-02 13:17 5071872 ----a-w- c:\windows\system32\NlsModels0011.dll
2010-09-02 13:17 . 2010-09-02 13:17 3104768 ----a-w- c:\windows\system32\NlsData0045.dll
2010-09-02 13:17 . 2010-09-02 13:17 3104768 ----a-w- c:\windows\system32\NlsData0049.dll
2010-09-02 13:17 . 2010-09-02 13:17 3104768 ----a-w- c:\windows\system32\NlsData0047.dll
2010-09-02 13:17 . 2010-09-02 13:17 3104768 ----a-w- c:\windows\system32\NlsData0046.dll
2010-09-02 13:17 . 2010-09-02 13:17 3104768 ----a-w- c:\windows\system32\NlsData0039.dll
2010-09-02 13:17 . 2010-09-02 13:17 3104768 ----a-w- c:\windows\system32\NlsData0020.dll
2010-09-02 13:17 . 2010-09-02 13:17 1801216 ----a-w- c:\windows\system32\NlsData0022.dll
2010-09-02 13:17 . 2010-09-02 13:17 1801216 ----a-w- c:\windows\system32\NlsData0021.dll
2010-09-02 13:17 . 2010-09-02 13:17 1966592 ----a-w- c:\windows\system32\NlsData0027.dll
2010-09-02 13:17 . 2010-09-02 13:17 1965056 ----a-w- c:\windows\system32\NlsData0026.dll
2010-09-02 13:17 . 2010-09-02 13:17 1965056 ----a-w- c:\windows\system32\NlsData0024.dll
2010-09-02 13:17 . 2010-09-02 13:17 4495360 ----a-w- c:\windows\system32\NlsData0010.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0DB20761-F95D-6C6C-D40C-056CB7057E16}]
2010-10-19 14:47 250880 ----a-w- c:\windows\System32\fdWNet32.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-08-10 4217720]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2009-10-26 1458176]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-09 4390912]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-05-27 1721640]
"B2C_AGENT"="c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe" [2010-09-27 391096]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\fdWNet32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Lancement rapide d'Adobe Reader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-01 06:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 03:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2010-05-27 20:31 1721640 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Devices remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-07-31 49504]
S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2010-04-23 483688]
S2 SysMain32;Superfetch ;c:\windows\system32\COLORCNV32.exe [2010-10-19 1338880]
S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtport.sys [2009-09-29 12160]
S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys [2009-09-29 10496]
S3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmodem.sys [2009-09-29 12928]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-04-23 550760]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-04-23 195944]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-04-23 21864]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-04-23 19304]
S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-23 209768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/portail
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=73&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: {{0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\Windows Live\Companion\companioncore.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-RTHDBPL - c:\windows\lsass.exe
HKLM-Run-RTHDBPL - c:\windows\lsass.exe
HKU-Default-Run-RTHDBPL - c:\windows\lsass.exe
MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
MSConfigStartUp-IS CfgWiz - c:\program files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe

.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000003d

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2010-10-22 16:09:49
ComboFix-quarantined-files.txt 2010-10-22 14:09
ComboFix2.txt 2010-10-21 21:14
ComboFix3.txt 2010-10-21 14:31

Avant-CF: 192 149 315 584 octets libres
Après-CF: 192 190 099 456 octets libres

- - End Of File - - 67BDF310EB0629A69ABDDD39CFBDD5B1

* Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau.
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)

* Lance OTL
o sous Personnalisation, copie_colle le contenu du cadre ci dessous et clic Correction, un rapport apparraitra suite à l'operation que tu conserveras sur clé usb par exemple afin d'en coller le resultat:

:files
c:\programdata\69570425
c:\windows\system32\fdWNet32.dll
c:\windows\system32\devenum32.dll
c:\windows\system32\bitsigd32.dll
c:\windows\system32\compstui32.exe
c:\windows\system32\COLORCNV32.exe
:reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-
"AppInit_DLLs"=""

* redemarre le pc sous windows et poste le rapport ici