Trojan virtumonde

Salut,

- Télécharge HijackThis V 2.02 (HijackThis Installer) :
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

- Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

- Clique sur Install ensuite sur I Accept

- Clique sur Do a scan system and save log file

- Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.

Télécharge et installe HijackThis .
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

Choisir « Download Hijackthis Installer

Vas dans le répertoire d'installation d'Hijackthis.

C:\Program Files\Trend Micro\HijackThis\

Renomme Hijackthis.exe en monHJK.exe ( click droit --> renommer )
Double clique après sur cet executable et choisis l'option Do a system scan and save a logfile.
Tu postes alors le rapport Hijackthis.

A+

salut

lance ceci ensuite stp :

-Télécharge et installe MalwareByte's Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

- Mets le à jour

---

- Redémarre en mode sans échec :

Au redémarrage de ton PC tapote sur la touche F8 ou F5 sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur

---

- Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
- Sélectionne Exécuter un examen complet si ce n'est pas déjà fait
- clique sur Rechercher

- Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

- Ne supprime rien tant que je ne te le dis pas.

- Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître enregistre-le.

- Si MalwareByte's a détecté des infections, clique sur Afficher les résultats et enregistre le rapport

- Ne ferme pas MalwareBytes's et poste ensuite le rapport.

Tutoriel pour MalwareByte's ici :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/­

poste le rapport please

bises

merci de vos réponses mais ça fonctionne pas car un message d'erreur me dit " les paramètres de sécurité ne vous permettent pas de télécharger ce fichier"...
et je ne sais pas aller plus loin...

Et en utilisant Firefox ?

bien vu Destrio!!

aussi quelles protections etc as tu?

a renommer hijack serait pas de trop , c po cher ^^

en tout cas déjà merci de vos réponses rapides!!!!

j'ai avast comme anti-virus
j'ai fait plusieurs scan avec spyboot qui detecte le trojan mais qui ne sais pas le supprimer ni le mettre en quarantaine...

je ne saais rien charger comme programme.....grrrr

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1226
Windows 5.1.2600 Service Pack 3

3/10/2008 0:35:16
mbam-log-2008-10-03 (00-35-16).txt

Type de recherche: Examen rapide
Eléments examinés: 53859
Temps écoulé: 4 minute(s), 37 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 20
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 13

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{858fde05-345a-4182-b40a-fc23a3a56924} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ljjbtrro (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{858fde05-345a-4182-b40a-fc23a3a56924} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1601d447-7424-4866-8dcc-acf98a2a41e1} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ceb9c60d-f0ad-4b73-a3ab-4fc822e38d66} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ceb9c60d-f0ad-4b73-a3ab-4fc822e38d66} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c3c0ec2c-2c1c-495c-9ad0-1f0ef833d7b5} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8d71eeb8-a1a7-4733-8fa2-1cac015c967d} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{410d416d-6bcc-4ddf-8501-937d68850cb5} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\Sidebar.DLL (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rightonadz (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\HID_Layer (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm13081c66 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\103b2ffa (Trojan.Vundo) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\ljJBtrro.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smlcajmq.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qmjaclms.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jelnabrs.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pheqpnqy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\myss_sb_uninstall.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zsywvw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\info.cmd (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rightonadz-uninst.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dulkqapn.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM13081c66.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM13081c66.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

---> Relance MBAM, va dans Quarantaine et supprime tout

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

grrr il veut toujours pas charger le .exe

re

ben dite vos actions via msn ! on rate ici mais bon

C'est simple, je lui transfère les logiciels.

je sais mais les rapports serait sympa , enfin le tout , bref voilà

biz

Tu ne vois pas le rapport de MBAM ?

ComboFix 08-10-02.04 - Hayon 2008-10-03 0:49:03.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.594 [GMT 2:00]
Lancé depuis: C:\DOCUME~1\Hayon\LOCALS~1\Temp\Rar$EX00.234\ComboFix.exe
* Un nouveau point de restauration a été créé

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Hayon\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\gcnctvjl.dll
C:\WINDOWS\system32\xgpawc.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MCHINJDRV

((((((((((((((((((((((((( Files Created from 2008-09-02 to 2008-10-02 )))))))))))))))))))))))))))))))
.

2008-10-03 00:29 . 2008-10-03 00:29 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-03 00:29 . 2008-10-03 00:29 <REP> d-------- C:\Documents and Settings\Hayon\Application Data\Malwarebytes
2008-10-03 00:29 . 2008-10-03 00:29 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-03 00:29 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-03 00:29 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-28 09:56 . 2008-10-01 14:09 969,329 ---hs---- C:\WINDOWS\system32\nausktbe.ini
2008-09-27 08:36 . 2008-09-27 09:58 963,657 ---hs---- C:\WINDOWS\system32\rjxwlakg.ini
2008-09-27 08:04 . 2008-09-27 08:04 <REP> d-------- C:\Program Files\CCleaner
2008-09-27 08:01 . 2008-09-27 08:01 <REP> d-------- C:\Documents and Settings\Hayon\Application Data\Uniblue
2008-09-26 19:18 . 2008-09-26 19:18 961,218 ---hs---- C:\WINDOWS\system32\rscaqgjc.ini
2008-09-26 19:15 . 2008-09-26 19:15 961,218 ---hs---- C:\WINDOWS\system32\ggjohgwl.ini
2008-09-26 19:14 . 2008-10-01 14:32 380,955 --ahs---- C:\WINDOWS\system32\hgNoYcdd.ini2
2008-09-26 19:14 . 2008-10-01 14:34 380,955 --ahs---- C:\WINDOWS\system32\hgNoYcdd.ini
2008-09-24 17:40 . 2008-09-24 17:40 <REP> d-------- C:\Program Files\TouchStoneSoftware

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-28 08:54 --------- d-----w C:\Program Files\Java
2008-09-28 08:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-24 08:09 --------- d-----w C:\Program Files\IncrediMail
2008-09-05 13:14 --------- d-----w C:\Program Files\ALO Power Audio Converter
2008-09-05 12:58 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-01 09:02 --------- d-----w C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-03-13 09:57 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlay1EXL600]
@="{BF9B13E4-FE9B-4121-853F-866F4E9E2830}"
[HKEY_CLASSES_ROOT\CLSID\{BF9B13E4-FE9B-4121-853F-866F4E9E2830}]
2007-11-13 04:08 599552 --a------ C:\WINDOWS\system32\FPAP-EXL600\FileptcIconOverlay.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-16 68856]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 73840]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 443968]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]
"ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2008-09-24 1279216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 217088]
"Ulead Memory Card Detector"="C:\Program Files\Ulead Systems\Ulead Photo Explorer 7.0\Monitor.exe" [2002-09-11 40960]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-20 7581696]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 73840]
"FixCamera"="C:\WINDOWS\FixCamera.exe" [2007-07-11 20480]
"tsnp2std"="C:\WINDOWS\tsnp2std.exe" [2007-05-10 270336]
"snp2std"="C:\WINDOWS\vsnp2std.exe" [2007-05-10 344064]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 267048]
"MbWzdFPAP-EXL600"="C:\WINDOWS\system32\FPAP-EXL600\PdtGuide.exe" [2007-12-05 1030656]
"nwiz"="nwiz.exe" [2006-07-20 C:\WINDOWS\system32\nwiz.exe]
"VTTimer"="VTTimer.exe" [2005-03-07 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-03-11 C:\WINDOWS\system32\VTTrayp.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 443968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=xgpawc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
-ra------ 2005-08-12 10:38 1056768 C:\Program Files\VIA\RAID\raid_tool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Program Files\\MSN Gaming Zone\\Windows\\hrtzzm.exe"=
"C:\\Program Files\\BitTornado\\btdownloadgui.exe"=
"C:\\Program Files\\utorrent\\utorrent.exe"=
"C:\\Program Files\\aMSN\\bin\\wish.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImLc.exe"=
"C:\\Program Files\\Inventel\\Gateway\\WLANCFG.EXE"=
"C:\\Program Files\\STOIK Imaging\\STOIK Video Converter 2\\VideoPak2.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6346:TCP"= 6346:TCP:shareaza
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 NwSapAgent;Agent SAP;C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2007-06-11 12178688]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1053b9a2-e31e-11dc-a849-000b6ba1920d}]
\Shell\AutoRun\command - E:\AUTORUN.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7705fd50-21a3-11dd-a871-0015f26f3bf6}]
\Shell\AutoRun\command - E:\PdtStart.exe
.
- - - - ORPHANS REMOVED - - - -

BHO-{0149A27F-9CE0-4F2B-B27B-FD1F9006B24b} - (no file)
BHO-{229C2691-23C6-4E7F-8019-744E2ACC85C2} - (no file)
BHO-{2D2EA5E0-777A-4A29-96C7-A8BFF1151AFD} - (no file)
BHO-{60722218-271C-495E-95D0-97B3707E911E} - C:\WINDOWS\system32\ddcYoNgh.dll
BHO-{66991EC8-C020-4B38-BE26-A4D05DC2E648} - (no file)
BHO-{6D838A13-F52D-41AE-9E86-19880B1DFB15} - (no file)
BHO-{858FDE05-345A-4182-B40A-FC23A3A56924} - (no file)
BHO-{CC1F2575-45E7-4B04-BC81-13EF11D2625E} - (no file)
BHO-{e51acd8e-d314-4178-87fd-c7e0e1d30828} - C:\WINDOWS\system32\yikazw.dll
WebBrowser-{196C3A46-4758-433D-A600-802C804AF39C} - (no file)
HKCU-Run-MOBKIT - C:\PROGRA~1\Mobistar\Shell.exe
HKCU-Run-Shareaza - C:\Program Files\Shareaza\Shareaza.exe
HKCU-Run-RegistryBooster 2 d’Uniblue - C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
ShellExecuteHooks-{858FDE05-345A-4182-B40A-FC23A3A56924} - (no file)
Notify-ljJBtrro - (no file)

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
R0 -: HKCU-Main,Start Page = hxxp://mystart.incredimail.com/french/
R0 -: HKCU-Main,Default_Search_URL = hxxp://www.google.com/ie
R0 -: HKLM-Main,Start Page = hxxp://www.01net.com/telecharger/
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s

O16 -: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} - hxxp://www.new2.foto.com/ImageUploader5.cab
C:\WINDOWS\Downloaded Program Files\ImageUploader5.inf
C:\WINDOWS\system32\unicows.dll
C:\WINDOWS\Downloaded Program Files\ImageUploader5.ocx
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-03 00:53:15
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\UTSCSI.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Completion time: 2008-10-03 0:58:11 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-02 22:58:07

Avant-CF: 92.731.736.064 octets libres
Post-Run: 92,653,002,752 octets libres

197 --- E O F --- 2008-09-11 01:02:17

ben si , d'ou je l'ai demandé de la faire cette analyse ^^ 1 ti truc rooooooooo

bizz

/!\ Seul winnieloursonne2 peut suivre cette procédure /!\

1/

---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :

KillAll::

File::
C:\WINDOWS\system32\nausktbe.ini
C:\WINDOWS\system32\rjxwlakg.ini
C:\WINDOWS\system32\rscaqgjc.ini
C:\WINDOWS\system32\ggjohgwl.ini
C:\WINDOWS\system32\hgNoYcdd.ini2
C:\WINDOWS\system32\hgNoYcdd.ini
C:\Program Files\Fichiers communs\FDEUnInstaller.exe
C:\WINDOWS\system32\xgpawc.dll

Folder::
C:\WINDOWS\system32\FPAP-EXL600
C:\Program Files\Macrogaming\SweetIM

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlay1EXL600]
[-HKEY_CLASSES_ROOT\CLSID\{BF9B13E4-FE9B-4121-853F-866F4E9E2830}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SweetIM"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"=-
"SunJavaUpdateSched"=-
"SweetIM"=-
"MbWzdFPAP-EXL600"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1053b9a2-e31e-11dc-a849-000b6ba1920d}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7705fd50-21a3-11dd-a871-0015f26f3bf6}]

---> Colle la sélection dans le bloc-notes

---> Enregistre ce fichier sur le bureau (Impératif)

---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes

2/

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

ComboFix 08-10-02.04 - Hayon 2008-10-03 1:26:42.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.619 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Hayon\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\Hayon\Bureau\cfscript.txt
* Un nouveau point de restauration a été créé

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\Program Files\Fichiers communs\FDEUnInstaller.exe
C:\WINDOWS\system32\ggjohgwl.ini
C:\WINDOWS\system32\hgNoYcdd.ini
C:\WINDOWS\system32\hgNoYcdd.ini2
C:\WINDOWS\system32\nausktbe.ini
C:\WINDOWS\system32\rjxwlakg.ini
C:\WINDOWS\system32\rscaqgjc.ini
C:\WINDOWS\system32\xgpawc.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Fichiers communs\FDEUnInstaller.exe
C:\Program Files\Macrogaming\SweetIM
C:\Program Files\Macrogaming\SweetIM\conf\adapter.xml
C:\Program Files\Macrogaming\SweetIM\conf\autoupdate.xml
C:\Program Files\Macrogaming\SweetIM\conf\logger.xml
C:\Program Files\Macrogaming\SweetIM\conf\messages.xml
C:\Program Files\Macrogaming\SweetIM\conf\sweetim.xml
C:\Program Files\Macrogaming\SweetIM\conf\sweetimapp.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\bbosard@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\bbosard@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\chipie_001@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\chipie_001@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\main_user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\philou.90@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\philou.90@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\pirlouitct@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\pirlouitct@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\winnieloursonne2@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\winnieloursonne2@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001088D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020069.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002006E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020071.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020077.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020110.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002011A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002011B.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020146.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020148.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040021.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004005A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00400B3.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0050001.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\cache_indx.dat
C:\Program Files\Macrogaming\SweetIM\default.xml
C:\Program Files\Macrogaming\SweetIM\mgAdaptersProxy.dll
C:\Program Files\Macrogaming\SweetIM\mgArchive.dll
C:\Program Files\Macrogaming\SweetIM\mgcommon.dll
C:\Program Files\Macrogaming\SweetIM\mgcommunication.dll
C:\Program Files\Macrogaming\SweetIM\mgconfig.dll
C:\Program Files\Macrogaming\SweetIM\mgFlashPlayer.dll
C:\Program Files\Macrogaming\SweetIM\mghooking.dll
C:\Program Files\Macrogaming\SweetIM\mgIEPlayer.dll
C:\Program Files\Macrogaming\SweetIM\mglogger.dll
C:\Program Files\Macrogaming\SweetIM\mgMediaPlayer.dll
C:\Program Files\Macrogaming\SweetIM\mgMsnAuto.dll
C:\Program Files\Macrogaming\SweetIM\mgMsnMessengerAdapter.dll
C:\Program Files\Macrogaming\SweetIM\mgSweetIM.dll
C:\Program Files\Macrogaming\SweetIM\mgUpdateSupport.dll
C:\Program Files\Macrogaming\SweetIM\mgxml_wrapper.dll
C:\Program Files\Macrogaming\SweetIM\mgYahooAuto.dll
C:\Program Files\Macrogaming\SweetIM\mgYahooMessengerAdapter.dll
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\WINDOWS\system32\FPAP-EXL600
C:\WINDOWS\system32\FPAP-EXL600\About.exe
C:\WINDOWS\system32\FPAP-EXL600\Backup.exe
C:\WINDOWS\system32\FPAP-EXL600\BioOne.dll
C:\WINDOWS\system32\FPAP-EXL600\CustomRes.dll
C:\WINDOWS\system32\FPAP-EXL600\DevRF.exe
C:\WINDOWS\system32\FPAP-EXL600\FilePtc.exe
C:\WINDOWS\system32\FPAP-EXL600\FileptcExtractIcon.dll
C:\WINDOWS\system32\FPAP-EXL600\FilePtcFind.exe
C:\WINDOWS\system32\FPAP-EXL600\FileptcIconOverlay.dll
C:\WINDOWS\system32\FPAP-EXL600\FilePtcMenuM.dll
C:\WINDOWS\system32\FPAP-EXL600\FirstWzd.exe
C:\WINDOWS\system32\FPAP-EXL600\FP_TUTOR.exe
C:\WINDOWS\system32\FPAP-EXL600\ICONS\fp.ico
C:\WINDOWS\system32\FPAP-EXL600\ICONS\sf.ico
C:\WINDOWS\system32\FPAP-EXL600\ICONS\Thumbs.db
C:\WINDOWS\system32\FPAP-EXL600\LTTS1NDUT176.dll
C:\WINDOWS\system32\FPAP-EXL600\LTTUSB.dll
C:\WINDOWS\system32\FPAP-EXL600\MbWzd.exe
C:\WINDOWS\system32\FPAP-EXL600\PdtGuide.exe
C:\WINDOWS\system32\FPAP-EXL600\PwdBank.exe
C:\WINDOWS\system32\FPAP-EXL600\PwdBankHook.dll
C:\WINDOWS\system32\FPAP-EXL600\qtintf70.dll
C:\WINDOWS\system32\FPAP-EXL600\Restore.exe
C:\WINDOWS\system32\FPAP-EXL600\SysSet.exe
C:\WINDOWS\system32\FPAP-EXL600\UDLL.dll
C:\WINDOWS\system32\FPAP-EXL600\User Manual\JF220_SW_EN.pdf
C:\WINDOWS\system32\FPAP-EXL600\User Manual\JF220_SW_FR.pdf
C:\WINDOWS\system32\FPAP-EXL600\User Manual\JF220_SW_GE.pdf
C:\WINDOWS\system32\FPAP-EXL600\User Manual\JF220_SW_IT.pdf
C:\WINDOWS\system32\FPAP-EXL600\User Manual\JF220_SW_JP.pdf
C:\WINDOWS\system32\FPAP-EXL600\User Manual\JF220_SW_RU.pdf
C:\WINDOWS\system32\FPAP-EXL600\User Manual\JF220_SW_SC.pdf
C:\WINDOWS\system32\FPAP-EXL600\User Manual\JF220_SW_SP.pdf
C:\WINDOWS\system32\FPAP-EXL600\User Manual\JF220_SW_TC.pdf
C:\WINDOWS\system32\ggjohgwl.ini
C:\WINDOWS\system32\hgNoYcdd.ini
C:\WINDOWS\system32\hgNoYcdd.ini2
C:\WINDOWS\system32\nausktbe.ini
C:\WINDOWS\system32\rjxwlakg.ini
C:\WINDOWS\system32\rscaqgjc.ini

.
((((((((((((((((((((((((( Files Created from 2008-09-02 to 2008-10-02 )))))))))))))))))))))))))))))))
.

2008-10-03 00:29 . 2008-10-03 00:29 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-03 00:29 . 2008-10-03 00:29 <REP> d-------- C:\Documents and Settings\Hayon\Application Data\Malwarebytes
2008-10-03 00:29 . 2008-10-03 00:29 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-03 00:29 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-03 00:29 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-27 08:04 . 2008-09-27 08:04 <REP> d-------- C:\Program Files\CCleaner
2008-09-27 08:01 . 2008-09-27 08:01 <REP> d-------- C:\Documents and Settings\Hayon\Application Data\Uniblue
2008-09-24 17:40 . 2008-09-24 17:40 <REP> d-------- C:\Program Files\TouchStoneSoftware

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-02 23:27 --------- d-----w C:\Program Files\Macrogaming
2008-09-28 08:54 --------- d-----w C:\Program Files\Java
2008-09-28 08:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-24 08:09 --------- d-----w C:\Program Files\IncrediMail
2008-09-05 13:14 --------- d-----w C:\Program Files\ALO Power Audio Converter
2008-09-05 12:58 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-01 09:02 --------- d-----w C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
.

((((((((((((((((((((((((((((( snapshot@2008-10-03_ 0.57.49.34 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-02 23:29:32 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_7bc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-16 68856]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 443968]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]
"ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2008-09-24 1279216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 217088]
"Ulead Memory Card Detector"="C:\Program Files\Ulead Systems\Ulead Photo Explorer 7.0\Monitor.exe" [2002-09-11 40960]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-20 7581696]
"FixCamera"="C:\WINDOWS\FixCamera.exe" [2007-07-11 20480]
"tsnp2std"="C:\WINDOWS\tsnp2std.exe" [2007-05-10 270336]
"snp2std"="C:\WINDOWS\vsnp2std.exe" [2007-05-10 344064]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 267048]
"nwiz"="nwiz.exe" [2006-07-20 C:\WINDOWS\system32\nwiz.exe]
"VTTimer"="VTTimer.exe" [2005-03-07 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-03-11 C:\WINDOWS\system32\VTTrayp.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 443968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljJBtrro]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
-ra------ 2005-08-12 10:38 1056768 C:\Program Files\VIA\RAID\raid_tool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Program Files\\MSN Gaming Zone\\Windows\\hrtzzm.exe"=
"C:\\Program Files\\BitTornado\\btdownloadgui.exe"=
"C:\\Program Files\\utorrent\\utorrent.exe"=
"C:\\Program Files\\aMSN\\bin\\wish.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImLc.exe"=
"C:\\Program Files\\Inventel\\Gateway\\WLANCFG.EXE"=
"C:\\Program Files\\STOIK Imaging\\STOIK Video Converter 2\\VideoPak2.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6346:TCP"= 6346:TCP:shareaza
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 NwSapAgent;Agent SAP;C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2007-06-11 12178688]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
.
- - - - ORPHANS REMOVED - - - -

BHO-{0149A27F-9CE0-4F2B-B27B-FD1F9006B24b} - (no file)
BHO-{229C2691-23C6-4E7F-8019-744E2ACC85C2} - (no file)
BHO-{2D2EA5E0-777A-4A29-96C7-A8BFF1151AFD} - (no file)
BHO-{60722218-271C-495E-95D0-97B3707E911E} - (no file)
BHO-{66991EC8-C020-4B38-BE26-A4D05DC2E648} - (no file)
BHO-{6D838A13-F52D-41AE-9E86-19880B1DFB15} - (no file)
BHO-{858FDE05-345A-4182-B40A-FC23A3A56924} - (no file)
BHO-{CC1F2575-45E7-4B04-BC81-13EF11D2625E} - (no file)
BHO-{e51acd8e-d314-4178-87fd-c7e0e1d30828} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-03 01:30:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\UTSCSI.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\Setup\avast.setup
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Completion time: 2008-10-03 1:34:51 - machine was rebooted [Hayon]
ComboFix-quarantined-files.txt 2008-10-02 23:34:47
ComboFix2.txt 2008-10-02 22:58:12

Avant-CF: 92,574,654,464 octets libres
Post-Run: 92,551,049,216 octets libres

262 --- E O F --- 2008-09-11 01:02:17

youpie plus de message d'erreur!