VIRUS SUR XP - Page 5

si c'est un pc de marque il y a une procédure de reinstallation d'usine intégrée ou la possibilité de créer un cd de restauration

c'est quoi le pc?

Bonsoir,
cela me parait tout de meme bizarre car il met le meme temps pour afficher le bureau avec les memes bruits de disque, et le pc travaaille toujours tout seul.
Et ce fakealert.origin trouve par drweb, plus de trace?
En fait ce pc a tous le symtomes de ce trojan et pour cette raison, j'en ai reduit l'usage (pas de compte, de numero, etc...) je ne suis pas tres rassure. Je me sers d'un autre pc mais meme avec wifi ca ne me plait pas de trop question adresse.

Bonjour,
C'est un pc monte, je pense, il n'y a pas de marque

remets un rapport combofix alors

je dirais que cette fois-ci kombofix a ete plus long

ComboFix 11-12-06.02 - Patrice 2011-12-08 10:06:51.1.1 - FAT32x86
Uruchomiony z: c:\documents and settings\Patrice.PATRICE\Moje dokumenty\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Usuni?to )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\CSC\d6
.
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Us?ugi )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_RKHIT
.
.
((((((((((((((((((((((((( Pliki utworzone od 2011-11-08 do 2011-12-08 )))))))))))))))))))))))))))))))
.
.
2011-12-07 14:45 . 2011-12-07 14:45 -------- d-----w- C:\Kill'em
2011-12-06 13:41 . 2011-12-06 13:41 -------- d-----w- C:\FOUND.000
2011-12-06 11:47 . 2011-12-06 11:47 -------- d-----w- c:\documents and settings\Patrice.PATRICE\DoctorWeb
2011-12-05 17:33 . 2011-12-05 17:33 -------- d-----w- C:\ZHP
2011-12-05 17:33 . 2011-12-05 17:33 -------- d-----w- c:\program files\ZHPDiag
2011-12-05 12:03 . 2011-12-07 14:41 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2011-12-03 18:43 . 2011-10-03 04:06 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-12-02 12:03 . 2011-12-02 12:03 -------- d-----w- C:\BackUpcanneds
2011-12-02 09:37 . 2011-11-28 17:54 111320 ----a-w- c:\windows\system32\drivers\aswFW.sys
2011-12-02 09:37 . 2011-11-28 17:53 195416 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2011-12-02 09:37 . 2011-11-28 17:26 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys
2011-12-01 18:32 . 2011-11-28 17:53 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-12-01 18:32 . 2011-11-28 17:53 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-12-01 18:32 . 2011-11-28 17:52 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-12-01 18:32 . 2011-11-28 17:52 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-12-01 18:32 . 2011-11-28 17:52 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-12-01 18:32 . 2011-11-28 17:52 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-12-01 18:32 . 2011-11-28 17:51 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-12-01 18:32 . 2011-11-28 17:48 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-12-01 18:32 . 2011-11-28 18:01 41184 ----a-w- c:\windows\avastSS.scr
2011-12-01 18:32 . 2011-11-28 18:01 199816 ----a-w- c:\windows\system32\aswBoot.exe
2011-12-01 18:32 . 2011-12-01 18:32 -------- d-----w- c:\program files\AVAST Software
2011-12-01 18:32 . 2011-12-01 18:32 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\AVAST Software
2011-12-01 17:44 . 2011-12-01 17:44 114937 ----a-w- c:\windows\cscmondump.bin
2011-12-01 16:01 . 2011-12-01 16:01 -------- d-----w- c:\program files\BillP Studios
2011-12-01 16:00 . 1998-02-06 22:39 304128 ----a-w- c:\windows\unin040c.exe
2011-12-01 12:53 . 2011-12-01 12:53 -------- d-----w- c:\documents and settings\Patrice.PATRICE\Dane aplikacji\InfraRecorder
2011-11-29 13:12 . 2011-11-29 13:13 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\CPA_VA
2011-11-28 19:17 . 2011-11-28 19:17 -------- d-----w- c:\documents and settings\Patrice.PATRICE\Ustawienia lokalne\Dane aplikacji\Adobe
2011-11-28 13:35 . 2004-08-03 23:44 83456 ----a-w- c:\windows\system32\olepro32.dll
2011-11-28 13:35 . 2004-08-03 23:44 83456 ----a-w- c:\windows\system32\dllcache\olepro32.dll
2011-11-28 13:27 . 2005-08-26 00:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2011-11-28 11:06 . 2011-11-28 11:06 -------- d-----w- c:\program files\RegCleaner
2011-11-28 07:53 . 2011-11-28 07:53 -------- d-----w- c:\documents and settings\Patrice.PATRICE\Dane aplikacji\Colasoft Packet Builder
2011-11-28 07:35 . 2011-11-28 07:35 -------- d-----w- c:\program files\Common Files\Colasoft Shared
2011-11-28 07:35 . 2011-11-28 07:35 -------- d-----w- c:\documents and settings\Patrice.PATRICE\Dane aplikacji\Colasoft MAC Scanner
2011-11-28 07:35 . 2011-11-28 07:35 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Colasoft Capsa 7 - Enterprise Edition Demo
2011-11-27 15:55 . 2011-11-27 15:55 -------- d-----w- c:\program files\Unlocker
2011-11-27 06:05 . 2011-08-31 16:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-25 20:01 . 2011-11-25 20:03 160 ----a-w- c:\windows\crpf.bin
2011-11-25 20:01 . 2011-11-25 20:01 158 ----a-w- c:\windows\crpf_sdum.bin
2011-11-25 18:52 . 2011-11-25 18:52 -------- d-----w- C:\VritualRoot
2011-11-25 18:42 . 2011-11-25 18:42 -------- d-----w- c:\program files\Common Files\Filseclab
2011-11-25 18:37 . 2011-11-25 18:37 -------- d-----w- c:\windows\system32\wbem\Repository
2011-11-25 12:53 . 2011-11-30 07:51 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2011-11-23 16:01 . 2002-02-18 17:40 6200 ------w- c:\windows\system32\INT13EXT.VXD
2011-11-12 09:37 . 2011-11-12 09:37 -------- d-----w- c:\documents and settings\Patrice.PATRICE\Ustawienia lokalne\Dane aplikacji\Help
.
.
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-21 08:09 . 2008-01-23 16:54 54016 ----a-w- c:\windows\system32\drivers\NVENETFD.sys
2011-09-21 08:09 . 2008-01-23 16:54 199168 ----a-w- c:\windows\system32\fdco1ins.dll
2011-09-21 08:09 . 2008-01-23 16:54 199168 ----a-w- c:\windows\system32\fdco1.dll
2011-09-09 17:23 . 2011-09-18 06:30 2469760 ----a-w- c:\windows\system32\BootMan.exe
.
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domy?lne, prawid?owe wpisy nie s? pokazane
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-05-06 10:29 64592 ----a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0B
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RkHit.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 21:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Stat 'n' Perf]
2011-04-23 13:33 147517 ----a-w- c:\program files\StatnPerf\StatnPerf.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"d:\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"d:\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\WINDOWS\\system32\\HPZipm12.exe"=
"c:\\WINDOWS\\SOUNDMAN.EXE"=
"c:\\Program Files\\NVIDIA Corporation\\NvMixer\\NVMixerTray.exe"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=
"c:\\WINDOWS\\system32\\Ati2evxx.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R1 CSN5PDTS82;CSN5PDTS82 NDIS Protocol Driver;c:\windows\system32\Drivers\CSN5PDTS82.sys [x]
R1 CSN5PDTS82x64;CSN5PDTS82x64 NDIS Protocol Driver;c:\windows\system32\Drivers\CSN5PDTS82x64.sys [x]
R1 CsNdisLWF;CsNdisLWF NDIS Protocol Driver;c:\windows\system32\Drivers\CsNdisLWF.sys [x]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [2011-11-28 127192]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 MBAMService;MBAMService;c:\documents and settings\Patrice\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 13192]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 8456]
R3 GPCIDrv;GPCIDrv;c:\windows\GPCIDrv.sys [2010-08-09 5112]
R3 M1000Srv;M5603C USB2.0 Camera Driver;c:\windows\system32\Drivers\M1000KNT.sys [2005-07-20 274567]
R3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\DRIVERS\s816bus.sys [2007-06-19 81832]
R3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s816mdfl.sys [2007-06-19 13864]
R3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s816mdm.sys [2007-06-19 107304]
R3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s816mgmt.sys [2007-06-19 99112]
R3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\DRIVERS\s816nd5.sys [2007-06-19 21928]
R3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s816obex.sys [2007-06-19 97320]
R3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\DRIVERS\s816unic.sys [2007-06-19 97704]
S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [2011-11-28 12112]
S0 aswNdis2;avast! Firewall Core Firewall Service; [x]
S0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\DRIVERS\tffsport.sys [2004-08-03 149376]
S1 aswFW;avast! TDI Firewall driver; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\Drivers\LBeepKE.sys [2010-03-18 10448]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
.
------- Skan uzupe?niaj?cy -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
.
- - - - USUNI?TO PUSTE WPISY - - - -
.
Notify-TPSvc - TPSvc.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-08 10:17
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
.
skanowanie ukrytych procesów ...
.
skanowanie ukrytych wpisów autostartu ...
.
skanowanie ukrytych plików ...
.
skanowanie pomy?lnie uko?czone
ukryte pliki: 0
.
**************************************************************************
.
--------------------- Pliki DLL ?adowane pod uruchomionymi procesami ---------------------
.
- - - - - - - > 'winlogon.exe'(624)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'explorer.exe'(3828)
c:\windows\system32\msi.dll
.
------------------------ Pozosta?e uruchomione procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
.
**************************************************************************
.
Czas uko?czenia: 2011-12-08 10:23:20 - komputer zosta? uruchomiony ponownie
ComboFix-quarantined-files.txt 2011-12-08 09:23
.
Przed: 3 782 090 752 bajtów wolnych
Po: 3 950 223 360 bajtów wolnych
.
- - End Of File - - 2765FE6783BAFED1B3498CB496909BE6

analyse ce fichier sur virus total http://www.virustotal.com/index.html
c:\windows\CSC\d6

et colle nous le rapport

ensuite

colle un rapport avec GMEr et dis nous si il trouve des infections notées en rouge
https://www.commentcamarche.net/faq/14963-supprimer-les-rootkits#premiere-methode-en-utilisant-gmer

Impossible de trouver CSC
Voici le rapport GMER

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2011-12-08 14:36:43
Windows 5.1.2600 Dodatek Service Pack 2 Harddisk0\DR0 -> \Device\00000079 SAMSUNG_HD160JJ rev.WU100-33
Running: vx2ypsjf.exe; Driver: C:\DOCUME~1\PATRIC~1.PA~\USTAWI~1\Temp\pwldapob.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateKey [0xEC7EEBDA]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateValueKey [0xEC7EEA45]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xEC8437A2]
Code \WINDOWS\system32\ntkrnlpa.exe[PAGEVRFY] [8064B508] pIofCallDriver
Code \WINDOWS\system32\ntkrnlpa.exe[PAGEVRFY] [8064BB9E] pIofCompleteRequest
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)

Device \FileSystem\Fastfat \Fat aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswFW.SYS (avast! Filtering TDI driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswFW.SYS (avast! Filtering TDI driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswFW.SYS (avast! Filtering TDI driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswFW.SYS (avast! Filtering TDI driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

---- EOF - GMER 1.0.15 ----

J'avais oublie
pas de rouge en C

ok

redemarre le pc

puis remets un rapport combofix

voici le rapport :

ComboFix 11-12-06.02 - Patrice 2011-12-08 15:12:28.2.1 - FAT32x86
Uruchomiony z: c:\documents and settings\Patrice.PATRICE\Moje dokumenty\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((( Pliki utworzone od 2011-11-08 do 2011-12-08 )))))))))))))))))))))))))))))))
.
.
2011-12-07 14:45 . 2011-12-07 14:45 -------- d-----w- C:\Kill'em
2011-12-06 13:41 . 2011-12-06 13:41 -------- d-----w- C:\FOUND.000
2011-12-06 11:47 . 2011-12-06 11:47 -------- d-----w- c:\documents and settings\Patrice.PATRICE\DoctorWeb
2011-12-05 17:33 . 2011-12-05 17:33 -------- d-----w- C:\ZHP
2011-12-05 17:33 . 2011-12-05 17:33 -------- d-----w- c:\program files\ZHPDiag
2011-12-05 12:03 . 2011-12-07 14:41 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2011-12-03 18:43 . 2011-10-03 04:06 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-12-02 12:03 . 2011-12-02 12:03 -------- d-----w- C:\BackUpcanneds
2011-12-02 09:37 . 2011-11-28 17:54 111320 ----a-w- c:\windows\system32\drivers\aswFW.sys
2011-12-02 09:37 . 2011-11-28 17:53 195416 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2011-12-02 09:37 . 2011-11-28 17:26 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys
2011-12-01 18:32 . 2011-11-28 17:53 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-12-01 18:32 . 2011-11-28 17:53 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-12-01 18:32 . 2011-11-28 17:52 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-12-01 18:32 . 2011-11-28 17:52 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-12-01 18:32 . 2011-11-28 17:52 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-12-01 18:32 . 2011-11-28 17:52 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-12-01 18:32 . 2011-11-28 17:51 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-12-01 18:32 . 2011-11-28 17:48 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-12-01 18:32 . 2011-11-28 18:01 41184 ----a-w- c:\windows\avastSS.scr
2011-12-01 18:32 . 2011-11-28 18:01 199816 ----a-w- c:\windows\system32\aswBoot.exe
2011-12-01 18:32 . 2011-12-01 18:32 -------- d-----w- c:\program files\AVAST Software
2011-12-01 18:32 . 2011-12-01 18:32 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\AVAST Software
2011-12-01 17:44 . 2011-12-01 17:44 114937 ----a-w- c:\windows\cscmondump.bin
2011-12-01 16:01 . 2011-12-01 16:01 -------- d-----w- c:\program files\BillP Studios
2011-12-01 16:00 . 1998-02-06 22:39 304128 ----a-w- c:\windows\unin040c.exe
2011-12-01 12:53 . 2011-12-01 12:53 -------- d-----w- c:\documents and settings\Patrice.PATRICE\Dane aplikacji\InfraRecorder
2011-11-29 13:12 . 2011-11-29 13:13 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\CPA_VA
2011-11-28 19:17 . 2011-11-28 19:17 -------- d-----w- c:\documents and settings\Patrice.PATRICE\Ustawienia lokalne\Dane aplikacji\Adobe
2011-11-28 13:35 . 2004-08-03 23:44 83456 ----a-w- c:\windows\system32\olepro32.dll
2011-11-28 13:35 . 2004-08-03 23:44 83456 ----a-w- c:\windows\system32\dllcache\olepro32.dll
2011-11-28 13:27 . 2005-08-26 00:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2011-11-28 11:06 . 2011-11-28 11:06 -------- d-----w- c:\program files\RegCleaner
2011-11-28 07:53 . 2011-11-28 07:53 -------- d-----w- c:\documents and settings\Patrice.PATRICE\Dane aplikacji\Colasoft Packet Builder
2011-11-28 07:35 . 2011-11-28 07:35 -------- d-----w- c:\program files\Common Files\Colasoft Shared
2011-11-28 07:35 . 2011-11-28 07:35 -------- d-----w- c:\documents and settings\Patrice.PATRICE\Dane aplikacji\Colasoft MAC Scanner
2011-11-28 07:35 . 2011-11-28 07:35 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Colasoft Capsa 7 - Enterprise Edition Demo
2011-11-27 15:55 . 2011-11-27 15:55 -------- d-----w- c:\program files\Unlocker
2011-11-27 06:05 . 2011-08-31 16:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-25 20:01 . 2011-11-25 20:03 160 ----a-w- c:\windows\crpf.bin
2011-11-25 20:01 . 2011-11-25 20:01 158 ----a-w- c:\windows\crpf_sdum.bin
2011-11-25 18:52 . 2011-11-25 18:52 -------- d-----w- C:\VritualRoot
2011-11-25 18:42 . 2011-11-25 18:42 -------- d-----w- c:\program files\Common Files\Filseclab
2011-11-25 18:37 . 2011-11-25 18:37 -------- d-----w- c:\windows\system32\wbem\Repository
2011-11-25 12:53 . 2011-11-30 07:51 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2011-11-23 16:01 . 2002-02-18 17:40 6200 ------w- c:\windows\system32\INT13EXT.VXD
2011-11-12 09:37 . 2011-11-12 09:37 -------- d-----w- c:\documents and settings\Patrice.PATRICE\Ustawienia lokalne\Dane aplikacji\Help
.
.
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-21 08:09 . 2008-01-23 16:54 54016 ----a-w- c:\windows\system32\drivers\NVENETFD.sys
2011-09-21 08:09 . 2008-01-23 16:54 199168 ----a-w- c:\windows\system32\fdco1ins.dll
2011-09-21 08:09 . 2008-01-23 16:54 199168 ----a-w- c:\windows\system32\fdco1.dll
2011-09-09 17:23 . 2011-09-18 06:30 2469760 ----a-w- c:\windows\system32\BootMan.exe
.
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domy?lne, prawid?owe wpisy nie s? pokazane
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-05-06 10:29 64592 ----a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0B
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RkHit.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 21:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Stat 'n' Perf]
2011-04-23 13:33 147517 ----a-w- c:\program files\StatnPerf\StatnPerf.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"d:\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"d:\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\WINDOWS\\system32\\HPZipm12.exe"=
"c:\\WINDOWS\\SOUNDMAN.EXE"=
"c:\\Program Files\\NVIDIA Corporation\\NvMixer\\NVMixerTray.exe"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=
"c:\\WINDOWS\\system32\\Ati2evxx.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R1 CSN5PDTS82;CSN5PDTS82 NDIS Protocol Driver;c:\windows\system32\Drivers\CSN5PDTS82.sys [x]
R1 CSN5PDTS82x64;CSN5PDTS82x64 NDIS Protocol Driver;c:\windows\system32\Drivers\CSN5PDTS82x64.sys [x]
R1 CsNdisLWF;CsNdisLWF NDIS Protocol Driver;c:\windows\system32\Drivers\CsNdisLWF.sys [x]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [2011-11-28 127192]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 MBAMService;MBAMService;c:\documents and settings\Patrice\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 13192]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 8456]
R3 GPCIDrv;GPCIDrv;c:\windows\GPCIDrv.sys [2010-08-09 5112]
R3 M1000Srv;M5603C USB2.0 Camera Driver;c:\windows\system32\Drivers\M1000KNT.sys [2005-07-20 274567]
R3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\DRIVERS\s816bus.sys [2007-06-19 81832]
R3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s816mdfl.sys [2007-06-19 13864]
R3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s816mdm.sys [2007-06-19 107304]
R3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s816mgmt.sys [2007-06-19 99112]
R3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\DRIVERS\s816nd5.sys [2007-06-19 21928]
R3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s816obex.sys [2007-06-19 97320]
R3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\DRIVERS\s816unic.sys [2007-06-19 97704]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [2011-11-28 12112]
S0 aswNdis2;avast! Firewall Core Firewall Service; [x]
S0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\DRIVERS\tffsport.sys [2004-08-03 149376]
S1 aswFW;avast! TDI Firewall driver; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\Drivers\LBeepKE.sys [2010-03-18 10448]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
.
------- Skan uzupe?niaj?cy -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-08 15:20
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
.
skanowanie ukrytych procesów ...
.
skanowanie ukrytych wpisów autostartu ...
.
skanowanie ukrytych plików ...
.
skanowanie pomy?lnie uko?czone
ukryte pliki: 0
.
**************************************************************************
.
--------------------- Pliki DLL ?adowane pod uruchomionymi procesami ---------------------
.
- - - - - - - > 'winlogon.exe'(684)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'explorer.exe'(2828)
c:\windows\system32\msi.dll
.
Czas uko?czenia: 2011-12-08 15:23:42
ComboFix-quarantined-files.txt 2011-12-08 14:23
ComboFix2.txt 2011-12-08 09:23
.
Przed: 3 769 860 096 bajtów wolnych
Po: 3 759 439 872 bajtów wolnych
.
- - End Of File - - B178C822E5E384BD324A443BB86E355D

ok il ne trouve plus rien

les soucis persistent?

Je pense car toujours tres lent et le pc travaille tout seul (lumiere, bruits disque)

Il est toujours tres long au demarrage et travaille toujours tout seul (lumiere qui clignote et bruits de disque)
Internet : mieux avant

vas dans demarrer puis Executer (ou recherche sous vista/7) et tape msconfig

dans l'onglet démarrer tu peux désactiver certains éléments non utiles

Bonjour,
non la plus rien a faire, les reglages sont effectues depuis longtemps.
Hier j'ai installe un vieux logiciel "bootvis" et ce matin j'ai teste. En fait je viens de remarquer que la duree excessive d'ouverture est due a une connection internet.
Durant ces environ 90 sec supplementaires des petites diodes clignotent indiquant un echange internet.
Comme je commence a utiliser avast, peut-etre est-ce lui qui fonctionne deja avant d'avoir le bureau?

Pour ce qui est du scan realise avec pcsafedoctor et tous les trojans, backdoors, etc..., trouves, en fait il n'y avait rien?
Et ce fakealert.origin disparu aussi?
A se demander si tout cela etait vrai?

pcsafedoctor etait un rogue, un faux logiciel de désinfection! il signale des infections alors qu'il n'y a rien et bloque le pc...

avast effectivement se connecte avant le bureau

tu peux tester en le désactivant du demarrage via msconfig (mais faire au moins 2 démarrage pour être sûr, le premier modifiant ce qui a été décoché dans le menu démarrer)

Super les faux logiciels.
Je ne comprends pas trop, lorsque je desactive avast et l'enleve du demarrage dans msconfig ilest present (coche) au redemarrage dans msconfig mais en bas a droite de l'ecran se trouve desactive.
Donc pour le moment rien ne change + de 2 min pour arriver au bureau.

c est quoi le pc? Quel processeur? Combien de ram? Si tu debranche le pc de ta box la diode pour le net continue a travailler ? c est quoi ta box?