Bagle/Wintems m'a tué

Hello,

Voici le rapport combofix

ComboFix 08-03-25.4 - Claude 2008-03-26 13:04:04.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1264 [GMT 1:00]
Endroit: C:\Users\Claude\Desktop\Combo-Fix.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\drivers\down
C:\Windows\system32\drivers\down\605580.exe
C:\Windows\system32\drivers\down\607140.exe
C:\Windows\system32\drivers\down\608247.exe
C:\Windows\system32\drivers\down\608513.exe
C:\Windows\system32\drivers\down\608684.exe
C:\Windows\system32\drivers\down\610447.exe
C:\Windows\system32\drivers\down\612023.exe
C:\Windows\system32\drivers\down\616406.exe
C:\Windows\system32\drivers\down\617139.exe
C:\Windows\system32\drivers\down\620571.exe
C:\Windows\system32\drivers\down\620681.exe
C:\Windows\system32\drivers\down\622365.exe
C:\Windows\system32\drivers\down\624160.exe
C:\Windows\system32\drivers\down\630259.exe
C:\Windows\system32\drivers\down\644580.exe
C:\Windows\system32\drivers\down\651304.exe
C:\Windows\system32\drivers\down\654221.exe
C:\Windows\system32\drivers\down\655921.exe
C:\Windows\system32\drivers\down\660492.exe
C:\Windows\system32\drivers\down\662427.exe
C:\Windows\system32\drivers\down\664579.exe
C:\Windows\system32\drivers\down\665313.exe
C:\Windows\system32\drivers\down\666841.exe
C:\Windows\system32\drivers\down\668277.exe
C:\Windows\system32\drivers\down\671100.exe
C:\Windows\system32\drivers\down\674064.exe
C:\Windows\system32\drivers\down\675453.exe
C:\Windows\system32\drivers\down\676903.exe
C:\Windows\system32\drivers\down\677247.exe
C:\Windows\system32\drivers\down\682535.exe
C:\Windows\system32\drivers\down\684376.exe
C:\Windows\system32\drivers\down\687075.exe
C:\Windows\system32\drivers\down\688604.exe
C:\Windows\system32\drivers\down\692894.exe
C:\Windows\system32\drivers\down\696591.exe
C:\Windows\system32\drivers\down\697605.exe
C:\Windows\system32\drivers\down\697964.exe
C:\Windows\system32\drivers\down\698354.exe
C:\Windows\system32\drivers\down\705124.exe
C:\Windows\system32\drivers\down\712955.exe
C:\Windows\system32\drivers\down\716574.exe
C:\Windows\system32\drivers\down\718010.exe
C:\Windows\system32\drivers\down\727042.exe
C:\Windows\system32\drivers\down\730318.exe
C:\Windows\system32\drivers\down\733345.exe
C:\Windows\system32\drivers\down\735201.exe
C:\Windows\system32\drivers\down\736059.exe
C:\Windows\system32\drivers\down\737213.exe
C:\Windows\system32\drivers\down\737978.exe
C:\Windows\system32\drivers\down\741737.exe
C:\Windows\system32\drivers\down\743500.exe
C:\Windows\system32\drivers\down\774669.exe
C:\Windows\system32\drivers\down\780925.exe
C:\Windows\system32\drivers\down\816088.exe
C:\Windows\system32\drivers\down\817039.exe
C:\Windows\system32\drivers\down\833716.exe
C:\Windows\system32\drivers\down\835385.exe
C:\Windows\system32\drivers\down\838786.exe
C:\Windows\system32\drivers\down\842327.exe
C:\Windows\system32\drivers\down\870828.exe
C:\Windows\system32\drivers\down\876928.exe
C:\Windows\system32\drivers\down\879892.exe
C:\Windows\system32\drivers\down\883043.exe
C:\Windows\system32\drivers\down\886896.exe
C:\Windows\system32\drivers\down\888160.exe
C:\Windows\system32\drivers\down\896802.exe
C:\Windows\system32\drivers\down\906412.exe
C:\Windows\system32\drivers\down\908175.exe
C:\Windows\system32\drivers\down\909283.exe
C:\Windows\system32\drivers\down\914197.exe
C:\Windows\system32\drivers\down\948673.exe
C:\Windows\system32\drivers\down\956894.exe
C:\Windows\system32\drivers\hldrrr.exe
C:\Windows\system32\drivers\srosa.sys
C:\Windows\system32\mdelk.exe
C:\Windows\system32\wintems.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SROSA

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier cr‚‚ dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-26 11:21 --------- d-----w C:\Program Files\Trend Micro
2008-03-25 21:46 262,144 ----a-w C:\ntuser.dat
2008-03-25 21:34 --------- d-----w C:\Program Files\Panda Security
2008-03-25 21:26 --------- d-----w C:\Program Files\eMule
2008-03-25 21:05 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-25 20:25 --------- d-----w C:\Program Files\Windows Installer Clean Up
2008-03-25 20:25 --------- d-----w C:\Program Files\MSECACHE
2008-03-25 18:57 --------- d-----w C:\Program Files\Alwil Software
2008-03-24 19:15 --------- d-----w C:\Program Files\PopCap Games
2008-03-19 14:32 691,545 ----a-w C:\Windows\unins000.exe
2008-03-15 14:01 --------- d-----w C:\Program Files\City of Heroes
2008-03-12 10:11 --------- d-----w C:\Program Files\Windows Live
2008-03-12 10:10 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-12 10:09 --------- d-----w C:\PROGRA~2\WLInstaller
2008-03-12 10:04 --------- d-----w C:\Program Files\Windows Mail
2008-03-10 15:01 --------- d-----w C:\Program Files\DivX
2008-03-02 12:58 --------- d-----w C:\Program Files\ScanSoft
2008-02-15 16:03 --------- d-----w C:\Program Files\Microsoft Digital Image 2006
2008-02-15 16:00 --------- d-----w C:\Program Files\Common Files\Nikon
2008-02-13 16:54 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-13 16:53 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-02-13 16:53 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-02-13 16:53 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-02-13 16:53 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-02-13 16:53 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-02-13 16:53 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-02-13 16:52 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-13 16:52 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-13 16:52 17,464 ----a-w C:\Windows\system32\drivers\intelide.sys
2008-02-13 16:52 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-13 16:52 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-13 16:51 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-13 16:51 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-13 16:51 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-13 16:51 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-13 16:51 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-13 16:51 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-13 16:49 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-12 20:59 --------- d-----w C:\Program Files\Java
2008-02-12 14:06 --------- d-----w C:\Program Files\Common Files\Java
2008-02-04 20:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-04 20:24 --------- d-----w C:\Program Files\Ejay
2008-01-26 23:18 --------- d-----w C:\Users\Claude\AppData\Roaming\SEGA
2008-01-26 19:12 --------- d-----w C:\Program Files\Microsoft Games
2007-08-29 22:02 174 --sha-w C:\Program Files\desktop.ini
2007-09-11 17:18 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-09-11 17:18 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-09-11 17:18 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2007-09-15 16:43 22 --sha-w C:\Windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 11:57 1232896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-04-19 17:11 151552]
"RtHDVCpl"="RtHDVCpl.exe" [2004-07-23 10:09 696320 C:\Windows\System32\RtHDVCpl.exe]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 22:11 49152]
"OsdMaestro"="C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 11:59 118784]
"CnxDslTaskBar"="C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe" [2002-07-24 11:48 397312]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-01-13 02:48 275800]
"VX3000"="C:\Windows\vVX3000.exe" [2006-12-06 00:38 707360]
"WinSys2"="C:\Windows\system32\startup.exe" [2006-06-01 06:21 53248]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-04 17:14 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-04 17:14 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-04 17:14 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
c:\hp\support\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
C:\HP\KBD\KbdStub.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LMDVox]
C:\Program Files\Micro Application\Votre PC prend la parole\LMDVox.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2964656226-4141248455-1627299051-1001]
"EnableNotificationsRef"=dword:00000002

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{B52BE322-948B-4826-BAF0-BA9BEF1FD0B5}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{C41C4089-AEA6-48A1-BEDD-C68AEE866855}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{9B696E0A-7B44-492D-88C1-29167B420C69}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{E5E1B489-C6FF-480A-9E5E-669DC42BC003}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{D37426E5-1B94-4CAA-B1D6-B682F31A92F2}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{0809D151-157A-4A21-9859-EE18E94D3EC3}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{1321A7CC-328E-4B07-97CE-6E2A13E988E9}"= TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{A80B45DC-E5DC-47B8-AC3F-63525429F477}"= TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"{3BFA46BA-E2B4-47DF-A5BC-892AD9AF8CEA}"= UDP:C:\Program Files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{43EBFE2B-3612-4419-9148-C5C15E9D4A95}"= TCP:C:\Program Files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{DC1F35A2-6341-4AC0-AF8F-A5525D85626E}"= UDP:C:\Program Files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{9B58A2BB-C3D8-48B8-9FD3-7EB81C56164A}"= TCP:C:\Program Files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{DCD979F6-FE7A-4787-A415-A97EEF2B00A1}"= UDP:C:\Program Files\eMule\emule.exe:eMule
"{3C7BBBF3-C854-405D-9C7C-771CCBD675BF}"= TCP:C:\Program Files\eMule\emule.exe:eMule
"TCP Query User{76CC34D8-CFF5-4251-BABB-30FEC0FD03D8}C:\\program files\\unreal tournament 3\\binaries\\ut3.exe"= UDP:C:\program files\unreal tournament 3\binaries\ut3.exe:UT3
"UDP Query User{CB96087E-E95F-493F-9E21-85BBA62BE0F1}C:\\program files\\unreal tournament 3\\binaries\\ut3.exe"= TCP:C:\program files\unreal tournament 3\binaries\ut3.exe:UT3
"{FB70F3CC-649B-4489-995C-AF90DC48BF89}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R2 DQLWinService;DQLWinService;"C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe" [2006-09-03 09:32]
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2007-01-04 23:13]
R2 UxTuneUp;TuneUp Extension de thème;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
R3 CnxEtP;Conexant AccessRunner USB ADSL WAN Adapter Filter Driver;C:\Windows\system32\DRIVERS\CnxEtP.sys [2002-07-23 17:20]
R3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;C:\Windows\system32\DRIVERS\CnxEtU.sys [2002-07-23 17:20]
R3 CnxTgN;Conexant AccessRunner USB ADSL WAN Adapter Driver;C:\Windows\system32\DRIVERS\CnxTgN.sys [2002-07-24 11:40]
S2 IntelDHSvcConf;Intel DH Service;"C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe" [2006-05-10 08:13]
S2 NMSAccessU;NMSAccessU;C:\Users\Claude\AppData\Local\Temp\{73D2267F-DB19-4E42-96E9-F3C9F8091118}\NMSAccessU.exe []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fced7d58-9e58-11dc-947f-9f14fcf7d3c5}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 13:08:53
Windows 6.0.6000 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\conime.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-26 13:10:37 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-26 12:10:34
.
2008-03-14 09:02:27 --- E O F ---

et le rapport Elibagla

Wed Mar 26 13:30:13 2008
EliBagle v11.18 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\620681.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\838786.EXE.VIR --> Eliminado Bagle

Nº Total de Directorios: 12937
Nº Total de Ficheros: 86683
Nº de Ficheros Analizados: 13226
Nº de Ficheros Infectados: 2
Nº de Ficheros Limpiados: 2

Et enfin le rapport Bitdefender

BitDefender Online Scanner - Rapport virus en temps réel

Généré à: Wed, Mar 26, 2008 - 13:57:38

--------------------------------------------------------------------------------

Info d'analyse

Fichiers scannés
181124

Infectés Fichiers
1

Virus Détectés

DeepScan:Generic.Malware.SPVPkWkg.92497710
1

Et le rapport Secuser:

4 virus trouvés (dont 3 mis en quarantaine)
3 Bagle et 1 Deepscan
Supprimés

Que faire à présent ?

merci ^^

tu n'as pas le rapport bitdefender pour voir les fichiers inféctés?

________

remets ton antivirus et regarde si cela remarche

puis

colle un rapport hijackthis

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."

ni mon antivirus ni mon pare-feu ne fonctionnent (désactivés et réactivation impossible)

par contre merci bien grace à toi j'ai réussi le hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:37:05, on 26/03/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\Eden\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX3000] C:\Windows\vVX3000.exe
O4 - HKLM\..\Run: [WinSys2] C:\Windows\system32\startup.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O13 - Gopher Prefix:
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/VistaMSNPUpldfr-fr.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0A2FDDFC-EA90-4B6C-9550-A171556A98E7}: NameServer = 213.36.80.1 213.36.80.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Users\Claude\AppData\Local\Temp\{73D2267F-DB19-4E42-96E9-F3C9F8091118}\NMSAccessU.exe (file missing)
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

essaye d'installer antivir et scan avec et colle un rapport

https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)

Merci jlpjlp!! ^^

je vais terminer mon 3ème bitdefender histoire d'^tre sur et sinon je suivrai tes judicieux conseils
et je tenterai antivir ^^

très aimable en tous cas merci

colle moi le rapport avec le nom des fichiers infectés surtout!!!

rebonjour jlpjlp

Antivir en mode sans échec:

AntiVir PersonalEdition Classic
Report file date: 2008-03-26 15:52

Scanning for 1167232 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows Vista
Windows version: (plain) [6.0.6000]
Username: Claude
Computer name: PC-DE-CLAUDE

Version information:
BUILD.DAT : 270 15603 Bytes 2007-09-19 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 2007-08-23 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 2007-08-16 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 2007-08-14 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 2007-08-21 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 2007-07-18 14:27:15
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 2008-03-07 14:41:30
ANTIVIR2.VDF : 7.0.3.62 337408 Bytes 2008-03-21 14:41:30
ANTIVIR3.VDF : 7.0.3.78 87552 Bytes 2008-03-26 14:41:30
AVEWIN32.DLL : 7.6.0.75 3334656 Bytes 2008-03-26 14:41:30
AVWINLL.DLL : 1.0.0.7 14376 Bytes 2007-02-26 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 2007-07-18 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 2007-04-16 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 2008-03-26 14:41:30
AVREG.DLL : 7.0.1.6 30760 Bytes 2007-07-18 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 2007-08-28 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 2007-07-18 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 2007-03-08 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 2007-08-07 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 2007-08-21 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 2007-07-23 09:37:21

Configuration settings for the scan:
Jobname..........................: Manual Selection
Configuration file...............: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: I:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: 2008-03-26 15:52

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
17 processes with 17 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!
Boot sector 'F:\'
[NOTE] In the drive 'F:\' no data medium is inserted!
Boot sector 'G:\'
[NOTE] In the drive 'G:\' no data medium is inserted!
Boot sector 'H:\'
[NOTE] In the drive 'H:\' no data medium is inserted!
Boot sector 'I:\'
[NOTE] In the drive 'I:\' no data medium is inserted!

Starting to scan the registry.
The registry was scanned ( '16' files ).

Starting the file scan:

Begin scan in 'C:\' <HP>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Program Files\Panda Security\NanoScan\Engine\psnflg.dll
[DETECTION] Is the Trojan horse TR/Agent.bux.1
[INFO] The file was deleted!
C:\Program Files\Panda Security\TotalScan\pskavs.dll
[DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738
[INFO] The file was deleted!
C:\QooBox\Quarantine\catchme2008-03-26_130852.70.rb0
[0] Archive type: ZIP
--> srosa.sys
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
--> wintems.exe
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
--> mdelk.exe
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
--> hldrrr.exe
[DETECTION] Is the Trojan horse TR/Dldr.Bagle.MA
[INFO] The file was deleted!
C:\QooBox\Quarantine\catchme2008-03-26_130852.70.zip
[0] Archive type: ZIP
--> srosa.sys
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\Windows\System32\mdelk.exe.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\Windows\System32\wintems.exe.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\Windows\System32\drivers\hldrrr.exe.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\Windows\System32\drivers\srosa.sys.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\608247.exe.vir
[DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\817039.exe.vir
[DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
[INFO] The file was deleted!
Begin scan in 'D:\' <Recovery>
Begin scan in 'E:\'
Search path E:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'F:\'
Search path F:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'G:\'
Search path G:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'H:\'
Search path H:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'I:\'
Search path I:\ could not be opened!
Le périphérique n'est pas prêt.

End of the scan: 2008-03-26 16:25
Used time: 32:55 min

The scan has been done completely.

13462 Scanning directories
378013 Files were scanned
13 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
10 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
378000 Files not concerned
3582 Archives were scanned
1 Warnings
10 Notes

13 virus supprimés

mon PC a rebooté normalement et mon UC n'est plus monopolisée

Je peux réutiliser le nettoyeur de registre de tune up utilities

Antivir détecté et activé par mon centre de sécurité

par contre: le firewall windows refuse toujours de s'activer

EDIT: Non,il vient de le faire !! ^^

Mon souci serait-il résolu ?

(par prudence je fais un scan système avec Antivir)

Tout a l'air bon mis à part le fait que je ne peux plus désactiver la vérification permanente des droits d'administrateurs sur Vista,et c'est assez ennuyeux...

mais vu que le souci viral est résolu....merci jlpjlp !!

vire ce qui est dans quarantine en allant dans poste de travail puis C puis qoobox

C:\QooBox\Quarantine

______________

scan avec
MalwareByte's Anti-Malware et vire ce qui est trouvé

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

________________

tu veux garder antivir pour te proteger ou tu a acheté un antivirus?

rq:
tu peux si ca persiste reparer vista:
https://www.thesiteoueb.net/faq-astuces/fiche-pratique-521-comment-reparer-les-fichiers-systeme-sous-vista.html

Merci bien mais je suis passé par MS config pour shooter l'UAC ça a l'air de marcher (les messages intempestifs c'est épuisant et ça bloque la création de fichiers .part sur emule)
En outre je ne peux pas utiliser la méthode de ton dernier lien car je n'ai ni CD de restauration ni OS.Ce PC m'a été donné dans l'état.

J'ai décidé de garder Antivir ça a l'air bien

Je vais essayer ton antimalware merci encore je te tiens très vite au courant ^^

pour protéger gratos ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
MalwareByte's Anti-Malware + SPYBOT

+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

Rq : spybot et ad-aware on sorti de nouvelles versions cette année vérifiez que vous avez la dernière version
--------
un pare feu :
celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall

https://forum.pcastuces.com/sujet.asp?f=25&s=35606
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-----------
CCLEANER pour effacer les traces de surf
---------
naviguer avec firefox ou safari ou opera et non internet explorer plus touché par les virus
http://www.mozilla-europe.org/fr/products/firefox/

Merci là je te dois beaucoup j'ai réussi à réinstaller emule sans souci le centre de sécurité est OK et ça a pas l'air de bouger

Ya juste cette histoire d'UAC définitivement désactivé (je ne sais pas si c'est bon) mais en tout cas c'est déjà moins pénible

Comment faire pour m'assurer une bonne fois pour toutes que tout est normal dans mon registre et mes programmes ?

utilise ccleaner nettoie avec et repare le registre

utilise pour supprimer tes traces

CCLEANER: (lance un nettoyage et répare 3 fois le registre) sans installer la barre yahoo

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

Tout est clean visiblement tout refonctionne à merveille

Un grand merci monsieur ^^

Si un jour tu as besoin d'aide pour du montage vidéo ou audio fais moi signe

je me ferai un plaisir de te rendre service ^^

ok bonne continuation

et a bientôt si besoin dans les deux sens!

ya pas dproblème ^^

en tous cas super sympa ce site bravo

bonjour

je voulais vous dire merci pr ce magnifique tutoriel qui m a per;is apres de lognues heures de dure labeure de desactiver ce virus. Oui je dis bien desactiver car celui-ci se reactive automatiquement des que j ouvre Internet Explorer. Je m'explique:

J ai suivi la plupart des conseils ici a savoir
1-combofix
2-elibagle
3-Avira Antivir

En passant j ai Avira Antivir en ce moment en meme temps que Bitdefender internet security 2008 (mon antivirus a la base qui n y vois que du feu avec ce baggle et qui a ete desactiver pendant l infection) et heuresuement car c est grace a avira que le virus a ete supprimer par la suite .

Le probleme c est que maintenant que mon systeme est redevenu normal (plus de wintems.exe et mon antivirus operationnel) voila que des que je lance internet explorer celui ci BUG et j ai la fameuse petite fenetre du CRACK a appliquer qui revien et qui n est en fait que l activation du virus... et rebelotte antivirus qui desactive et je dois tout refaire a zero...

Pourant jai fais une analyse complete avec tous les logicielles et ceux ci ne detectent plus rien apres ce qu'ils surppriment a l origine...

Help svp j ai pas envi de formatter apres tout ce temps et si pres du but...

Je poste les rapports a toute fin utile

ELIBAGLE

Sat Apr 26 18:27:31 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Sat Apr 26 18:30:20 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.31
a "virus@satinfo.es". Gracias.
D:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Eliminado Bagle
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Apr 26 18:30:27 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Nº Total de Directorios: 3443
Nº Total de Ficheros: 32888
Nº de Ficheros Analizados: 8709
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sat Apr 26 18:49:41 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

Sat Apr 26 18:49:44 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 296
Nº Total de Ficheros: 4867
Nº de Ficheros Analizados: 434
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sat Apr 26 20:47:30 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

Sat Apr 26 20:47:37 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad H:\

Nº Total de Directorios: 0
Nº Total de Ficheros: 4
Nº de Ficheros Analizados: 3
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sat Apr 26 20:59:50 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
D:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.31
a "virus@satinfo.es". Gracias.
D:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Renombrado a .VIR
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

Sat Apr 26 21:00:03 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Sat Apr 26 21:00:24 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Apr 26 21:00:26 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Sat Apr 26 21:01:10 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Apr 26 21:01:18 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Sat Apr 26 21:24:05 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
D:\WINDOWS\SYSTEM32\Drivers\HLDRRR.EXE.VIR --> Eliminado

Sat Apr 26 21:24:09 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Nº Total de Directorios: 3456
Nº Total de Ficheros: 32766
Nº de Ficheros Analizados: 8721
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sat Apr 26 21:32:07 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 297
Nº Total de Ficheros: 4868
Nº de Ficheros Analizados: 435
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sun Apr 27 10:21:53 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

Sun Apr 27 10:21:55 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Nº Total de Directorios: 3451
Nº Total de Ficheros: 33202
Nº de Ficheros Analizados: 8727
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sun Apr 27 10:32:07 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

Sun Apr 27 10:32:14 2008
EliBagle v11.31 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Nº Total de Directorios: 240
Nº Total de Ficheros: 977
Nº de Ficheros Analizados: 12
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0
Exploración Detenida por el Usuario.

COMBOFIX

ComboFix 08-04-24.1 - HichamoS 2008-04-26 21:03:48.2 - NTFSx86
Endroit: D:\Documents and Settings\HichamoS\Bureau\killbag.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\WINDOWS\system32\drivers\downld
D:\WINDOWS\system32\drivers\downld\3341421.exe
D:\WINDOWS\system32\drivers\mdelk.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SROSA

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-26 to 2008-04-26 ))))))))))))))))))))))))))))))))))))
.

2008-04-26 21:16 . 2008-04-26 21:16 <REP> d-------- D:\WINDOWS\system32\drivers\downld
2008-04-26 20:58 . 2004-02-16 01:01 638,976 --a------ D:\WINDOWS\system32\drivers\HLDRRR.EXE.VIR
2008-04-26 19:25 . 2008-04-26 19:25 <REP> d-------- D:\Documents and Settings\HichamoS\Application Data\Malwarebytes
2008-04-26 19:24 . 2008-04-26 19:24 <REP> d-------- D:\Program Files\Malwarebytes' Anti-Malware
2008-04-26 19:24 . 2008-04-26 19:24 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-26 18:38 . 2008-04-26 18:38 <REP> d-------- D:\Program Files\Nero
2008-04-26 18:04 . 2008-04-26 18:04 <REP> d-------- D:\Program Files\Avira
2008-04-26 18:04 . 2008-04-26 18:04 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Avira
2008-04-26 17:41 . 2008-04-26 17:41 <REP> d-------- D:\Documents and Settings\Invité
2008-04-26 17:41 . <REP> D:\Documents and Settings\InvitÚ\Local Settings
2008-04-26 17:41 . <REP> D:\Documents and Settings\InvitÚ\Local Settings
2008-04-26 17:25 . 2008-04-26 17:25 1,024 --ah----- D:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-04-26 16:40 . 2008-04-26 17:42 <REP> d-------- D:\The.Bank.Job[2008]DvDrip[Eng]-aXXo
2008-04-26 16:04 . 2008-04-26 19:09 <REP> d-------- D:\!KillBox
2008-04-26 15:20 . 2008-04-26 15:20 <REP> d-------- D:\Program Files\ESET
2008-04-26 15:02 . 2008-04-26 15:02 <REP> d-------- D:\Program Files\Executive Software
2008-04-26 08:31 . 2008-04-26 08:31 <REP> d-------- D:\Documents and Settings\Invit‚
2008-04-26 08:02 . 2008-04-26 08:05 <REP> d-------- D:\Rym backup disc2
2008-04-25 19:07 . 2008-04-25 19:07 <REP> d-------- D:\Program Files\Wallpaper
2008-04-25 19:07 . 2008-04-25 19:10 <REP> d-------- D:\Documents and Settings\HichamoS\Application Data\Wallpaper
2008-04-21 21:34 . 2008-04-21 21:34 132 --a------ D:\WINDOWS\winamp.ini
2008-04-13 14:05 . 2008-04-13 20:37 <REP> d-------- D:\Program Files\TotalHTMLConverter
2008-04-13 13:50 . 2008-04-13 13:50 <REP> d-------- D:\Program Files\TotalDocConverter
2008-04-13 13:50 . 2008-04-13 14:05 <REP> d-------- D:\Documents and Settings\HichamoS\Application Data\Softplicity
2008-04-13 13:20 . 1998-05-19 14:33 396,800 --a------ D:\WINDOWS\system32\msfrt40.dll
2008-04-13 13:20 . 1997-11-05 11:28 215,204 --a------ D:\WINDOWS\system32\saxbasic.hlp
2008-04-13 13:20 . 1997-11-05 11:26 87,552 --a------ D:\WINDOWS\system32\sbpro_42.ocx
2008-04-13 13:18 . 2008-04-16 07:53 <REP> d-------- D:\Program Files\SPSS
2008-04-13 13:17 . 1997-04-13 13:23 302,592 --a------ D:\WINDOWS\unin040c.exe
2008-04-11 20:43 . 2008-04-11 20:43 1,025 --a------ D:\WINDOWS\system32\sysprs7.dll
2008-04-11 17:52 . 2008-04-26 14:53 <REP> d-------- D:\Program Files\FlashGet
2008-04-11 17:02 . 2008-04-11 17:02 1,024 --a------ D:\WINDOWS\system32\clauth2.dll
2008-04-11 17:02 . 2008-04-11 17:02 1,024 --a------ D:\WINDOWS\system32\clauth1.dll
2008-04-11 17:02 . 2008-04-11 20:50 14 --a------ D:\WINDOWS\system32\ssprs.tgz
2008-04-11 17:02 . 2008-04-11 17:02 0 --a------ D:\WINDOWS\system32\nsprs.tgz
2008-04-11 16:57 . 2008-04-12 14:29 <REP> d-------- D:\Program Files\SPSSEval
2008-04-10 08:20 . 2008-04-10 08:20 154 --a------ D:\WINDOWS\adidsl.ini
2008-04-10 08:20 . 2008-04-10 08:20 21 --a------ D:\WINDOWS\Fast800.ini
2008-04-10 08:19 . 2008-04-10 08:19 <REP> d-------- D:\Program Files\SAGEM
2008-04-08 08:12 . 2008-04-08 08:16 <REP> d-------- D:\Program Files\EsetOnlineScanner
2008-04-06 08:02 . 2008-04-06 08:02 <REP> d-------- D:\Program Files\RivaTuner v2.06
2008-04-05 23:21 . 2008-04-05 23:21 <REP> d-------- D:\Program Files\fraps
2008-04-05 23:21 . 2008-04-26 14:46 <REP> d-a------ D:\Documents and Settings\All Users\Application Data\TEMP
2008-04-05 22:23 . 2008-04-05 22:23 <REP> d-------- D:\Program Files\Futuremark
2008-04-05 16:27 . 2008-04-05 16:29 <REP> d-------- D:\Program Files\ATITool
2008-04-05 02:26 . 2008-04-05 02:26 <REP> d-------- D:\WINDOWS\system32\Futuremark
2008-04-03 22:02 . 2008-04-03 22:02 <REP> d-------- D:\Program Files\SystemRequirementsLab
2008-03-28 20:12 . 2008-03-28 20:12 0 --a------ D:\law.sp
2008-03-28 19:30 . 2008-03-28 19:30 1,025 --a------ D:\WINDOWS\system32\sysprs7.tgz
2008-03-28 19:30 . 2008-04-11 20:50 219 --a------ D:\WINDOWS\system32\lsprst7.tgz
2008-03-28 19:30 . 2008-03-28 19:53 16 ---h----- D:\WINDOWS\system32\servdat.slm

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-26 20:55 81,984 ----a-w D:\WINDOWS\system32\bdod.bin
2008-04-26 18:54 --------- d-----w D:\Program Files\Fichiers communs\BitDefender
2008-04-26 18:54 --------- d-----w D:\Documents and Settings\All Users\Application Data\BitDefender
2008-04-26 15:53 --------- d-----w D:\Documents and Settings\HichamoS\Application Data\uTorrent
2008-04-26 09:05 --------- d-----w D:\Program Files\Fichiers communs\Ahead
2008-04-24 07:10 39,248 ----a-w D:\Documents and Settings\HichamoS\Application Data\GDIPFONTCACHEV1.DAT
2008-04-14 19:17 --------- d-----w D:\Documents and Settings\HichamoS\Application Data\Image Zone Express
2008-04-10 22:42 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-04-10 08:20 23 ----a-w D:\WINDOWS\system32\drivers\adidsl.cfg
2008-03-20 08:09 1,845,376 ----a-w D:\WINDOWS\system32\win32k.sys
2008-03-16 18:54 --------- d-----w D:\Documents and Settings\HichamoS\Application Data\ABBYY
2008-03-15 18:52 --------- d-----w D:\Program Files\Lame codec
2008-03-15 18:36 --------- d-----w D:\Program Files\Audacity
2008-03-10 22:47 --------- d-----w D:\Program Files\Digital Video
2008-03-10 22:47 --------- d-----w D:\Documents and Settings\HichamoS\Application Data\InstallShield
2008-03-06 20:09 --------- d-----w D:\Program Files\Free RM to MP3 Converter
2008-03-06 20:03 --------- d-----w D:\Program Files\MSECache
2008-03-06 19:46 --------- d-----w D:\Documents and Settings\HichamoS\Application Data\River Past G3
2008-03-06 19:46 --------- d-----w D:\Documents and Settings\All Users\Application Data\River Past G3
2008-03-06 19:41 161,286 ----a-w D:\WINDOWS\Audio Capture Uninstaller.exe
2008-03-06 19:41 --------- d-----w D:\Program Files\River Past
2008-03-06 19:41 --------- d-----w D:\Program Files\Fichiers communs\River Past
2008-03-03 20:34 --------- d-----w D:\Documents and Settings\HichamoS\Application Data\Skype
2008-03-03 20:22 --------- d-----w D:\Program Files\Google
2008-03-02 14:19 --------- d-----w D:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-03-02 11:56 --------- d-----w D:\Program Files\Fichiers communs\Adobe
2008-03-02 11:56 --------- d-----w D:\Documents and Settings\HichamoS\Application Data\AdobeUM
2008-03-01 12:58 826,368 ----a-w D:\WINDOWS\system32\wininet.dll
2008-02-26 22:37 --------- d-----w D:\Program Files\HP
2008-02-26 21:11 --------- d-----w D:\Documents and Settings\HichamoS\Application Data\Ahead
2008-02-20 06:51 282,624 ----a-w D:\WINDOWS\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w D:\WINDOWS\system32\dnsrslvr.dll
2008-02-11 09:39 253,952 ----a-w D:\WINDOWS\system32\OnlineScannerDLLA.dll
2008-02-11 09:39 237,568 ----a-w D:\WINDOWS\system32\OnlineScannerDLLW.dll
2008-02-08 13:53 110,592 ----a-w D:\WINDOWS\system32\OnlineScannerLang.dll
2008-02-05 08:48 77,824 ----a-w D:\WINDOWS\system32\OnlineScannerUninstaller.exe
.

((((((((((((((((((((((((((((( snapshot@2008-04-26_17.38.52.78 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-26 17:34:31 2,048 --s-a-w D:\WINDOWS\bootstat.dat
+ 2008-04-26 21:16:14 2,048 --s-a-w D:\WINDOWS\bootstat.dat
- 2008-02-16 23:11:54 61,440 ----a-r D:\WINDOWS\Installer\{139412E5-09C2-463A-8B1C-26AEB8655BA7}\helpicon.exe
+ 2008-04-26 18:55:31 61,440 ----a-r D:\WINDOWS\Installer\{139412E5-09C2-463A-8B1C-26AEB8655BA7}\helpicon.exe
- 2008-02-16 23:11:54 32,768 ----a-r D:\WINDOWS\Installer\{139412E5-09C2-463A-8B1C-26AEB8655BA7}\maintenance_icon.exe
+ 2008-04-26 18:55:31 32,768 ----a-r D:\WINDOWS\Installer\{139412E5-09C2-463A-8B1C-26AEB8655BA7}\maintenance_icon.exe
- 2008-02-16 23:11:54 22,486 ----a-r D:\WINDOWS\Installer\{139412E5-09C2-463A-8B1C-26AEB8655BA7}\register_icon.exe
+ 2008-04-26 18:55:31 22,486 ----a-r D:\WINDOWS\Installer\{139412E5-09C2-463A-8B1C-26AEB8655BA7}\register_icon.exe
- 2008-02-16 23:11:54 57,344 ----a-r D:\WINDOWS\Installer\{139412E5-09C2-463A-8B1C-26AEB8655BA7}\texticon.exe
+ 2008-04-26 18:55:31 57,344 ----a-r D:\WINDOWS\Installer\{139412E5-09C2-463A-8B1C-26AEB8655BA7}\texticon.exe
+ 2008-01-21 18:12:56 41,792 ----a-w D:\WINDOWS\system32\drivers\avgntdd.sys
+ 2008-01-21 18:11:28 22,336 ----a-w D:\WINDOWS\system32\drivers\avgntmgr.sys
+ 2008-03-04 13:28:53 79,424 ----a-w D:\WINDOWS\system32\drivers\avipbb.sys
+ 2007-03-01 10:34:22 28,352 ----a-w D:\WINDOWS\system32\drivers\ssmdrv.sys
- 2008-02-16 23:38:16 77,824 ----a-w D:\WINDOWS\system32\xcomm.dll
+ 2007-07-20 15:54:30 77,824 ----a-w D:\WINDOWS\system32\xcomm.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-19 14:09 15360]
"NBJ"="D:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-09-22 16:10 1871872]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="D:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04 139264]
"ASUS SmartDoctor"="D:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe" [2006-10-20 14:51 1093632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-26 21:10 262401]
"BDAgent"="D:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2008-04-26 19:15 360448]
"BitDefender Antiphishing Helper"="D:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [2008-04-26 19:15 61440]
"NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"TkBellExe"="D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-02-17 09:46 180269]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 12:22 86016 D:\WINDOWS\system32\nvmctray.dll]
"NeroFilterCheck"="D:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2004-02-16 01:01 638976]
"NeroCheck"="D:\WINDOWS\system32\\NeroCheck.exe" [2001-07-09 11:50 155648]
"HP Software Update"="D:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"egui"="D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [ ]
"DrvLsnr"="D:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 11:34 69632]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 14:09 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
--------- 2004-09-22 16:10 1871872 D:\Program Files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-10-22 12:22 1622016 D:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2004-02-16 01:01 638976 D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ekrn"=2 (0x2)
"EHttpSrv"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"D:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"D:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"D:\\Program Files\\MSN Messenger\\livecall.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"D:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"D:\\Program Files\\FlashGet\\flashget.exe"=

R2 Pctspk;PCTEL Speaker Phone;D:\WINDOWS\system32\pctspk.exe [2001-08-23 17:47]
R3 Ptserlp;PCTEL Serial Device Driver for PCI;D:\WINDOWS\system32\DRIVERS\ptserlp.sys [2001-08-17 21:28]
S3 Bdfndisf;BitDefender Firewall NDIS Filter Service;D:\WINDOWS\system32\DRIVERS\bdfndisf.sys []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79eca384-ebb1-11dc-aa27-4d6564696130}]
\Shell\AutoRun\command - semo2x.exe
\Shell\explore\Command - semo2x.exe
\Shell\open\Command - semo2x.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94539e51-e155-11dc-aa13-4d6564696130}]
\Shell\AutoRun\command - 0hct8ybw.bat
\Shell\explore\Command - 0hct8ybw.bat
\Shell\open\Command - 0hct8ybw.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bfc25326-0b1c-11dd-aa7e-e4e18fd026ed}]
\Shell\Auto\command - H:\auto.exe
\Shell\AutoRun\command - D:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
\Shell\explore\Command - H:\b.com
\Shell\open\Command - H:\b.com

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-26 21:17:09
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bdfsfltr]
"ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bdfsfltr]
"ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\
.
------------------------ Other Running Processes ------------------------
.
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\ATKKBService.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\system32\wdfmgr.exe
D:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
D:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
D:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
D:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
D:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
D:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
D:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-04-26 21:23:02 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-26 21:22:57
ComboFix2.txt 2008-04-26 17:41:11

Pre-Run: 6,378,450,944 octets libres
Post-Run: 6,368,624,640 octets libres