ANTIVIRUS2009

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1226
Windows 5.1.2600 Service Pack 3

03/10/2008 14:52:44
mbam-log-2008-10-03 (14-52-30).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 93475
Temps écoulé: 56 minute(s), 39 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 13
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 21

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\tuvsPHAR.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\pmnlmLcA.dll (Trojan.Vundo) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{257759d5-4d66-44b3-8c2e-83147a019687} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{257759d5-4d66-44b3-8c2e-83147a019687} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d3ccfaf7-df03-4e73-95ec-e5e139cc2bf2} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnlmlca (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{d3ccfaf7-df03-4e73-95ec-e5e139cc2bf2} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{831cbac3-8283-4653-9d81-feb9f3f6e47c} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{86a44ef9-78fc-4e18-a564-b18f806f7f56} (Trojan.MultiDefender) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7c4bcd17-bdba-4078-9d8c-8ca8b7eabe77} (Rogue.Multiple) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instbndlkeyldr (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\50a31aea (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{d3ccfaf7-df03-4e73-95ec-e5e139cc2bf2} (Trojan.Vundo) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Security Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\tuvsphar -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\tuvsphar -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> No action taken.

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\Adsl Software Limited (Rogue.MalWarrior) -> No action taken.

Fichier(s) infecté(s):
C:\WINDOWS\system32\tuvsPHAR.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\RAHPsvut.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\RAHPsvut.ini2 (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\pmnlmLcA.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\nwbyemqp.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\pqmeybwn.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\ywfsdceu.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\uecdsfwy.ini (Trojan.Vundo.H) -> No action taken.
C:\System Volume Information\_restore{C3A11C0B-24D2-4422-ACA6-F6D5FAD7DA5F}\RP21\A0002724.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{C3A11C0B-24D2-4422-ACA6-F6D5FAD7DA5F}\RP21\A0002725.exe (Trojan.FakeAlert) -> No action taken.
C:\System Volume Information\_restore{C3A11C0B-24D2-4422-ACA6-F6D5FAD7DA5F}\RP22\A0003789.exe (Trojan.FakeAlert) -> No action taken.
C:\System Volume Information\_restore{C3A11C0B-24D2-4422-ACA6-F6D5FAD7DA5F}\RP22\A0003790.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{C3A11C0B-24D2-4422-ACA6-F6D5FAD7DA5F}\RP22\A0003791.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{C3A11C0B-24D2-4422-ACA6-F6D5FAD7DA5F}\RP23\A0003934.dll (Trojan.BHO) -> No action taken.
C:\System Volume Information\_restore{C3A11C0B-24D2-4422-ACA6-F6D5FAD7DA5F}\RP34\A0007073.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{C3A11C0B-24D2-4422-ACA6-F6D5FAD7DA5F}\RP35\A0008088.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{C3A11C0B-24D2-4422-ACA6-F6D5FAD7DA5F}\RP36\A0010117.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{C3A11C0B-24D2-4422-ACA6-F6D5FAD7DA5F}\RP37\A0010174.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\iifeDtUL.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> No action taken.
C:\WINDOWS\cookies.ini (Malware.Trace) -> No action taken.

deja fait,et apres???

ComboFix 08-10-02.04 - Administrateur 2008-10-03 15:44:07.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.647 [GMT 2:00]
Lancé depuis: D:\ComboFix.exe
* Un nouveau point de restauration a été créé

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\Tasks\ucvduvnu.job
C:\WINDOWS\Temp\tmp3.tmp

----- BITS: Possible infected sites -----

hxxp://77.74.48.101
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MCHINJDRV

((((((((((((((((((((((((( Files Created from 2008-09-03 to 2008-10-03 )))))))))))))))))))))))))))))))
.

2008-10-03 13:46 . 2008-10-03 13:46 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-03 13:46 . 2008-10-03 13:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-03 13:46 . 2008-10-03 13:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2008-10-03 13:46 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-03 13:46 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-02 14:39 . 2008-10-02 14:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-10-02 02:00 . 2008-10-02 02:00 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Search Settings
2008-10-01 20:40 . 2008-10-01 20:47 964,081 ---hs---- C:\WINDOWS\system32\tkesweyg.ini
2008-10-01 10:57 . 2008-10-01 10:58 957,951 ---hs---- C:\WINDOWS\system32\omvrxyvw.ini
2008-09-30 14:52 . 2008-09-30 14:52 <REP> d-------- C:\Program Files\Trend Micro
2008-09-30 02:49 . 2008-09-30 02:51 <REP> d-------- C:\Program Files\AdsGone
2008-09-30 02:49 . 2004-03-09 00:00 260,880 --a------ C:\WINDOWS\system32\MSFLXGRD.OCX
2008-09-30 02:49 . 2004-03-09 00:00 152,848 --a------ C:\WINDOWS\system32\COMDLG32.OCX
2008-09-30 02:49 . 2004-03-09 00:00 124,688 --a------ C:\WINDOWS\system32\MSWINSCK.OCX
2008-09-30 02:49 . 2008-10-03 15:47 59 --a------ C:\WINDOWS\WinNetOptimize98ag.cfg
2008-09-29 14:22 . 2008-09-30 14:23 956,383 ---hs---- C:\WINDOWS\system32\ahbdpirr.ini
2008-09-28 14:19 . 2008-09-28 14:19 952,775 ---hs---- C:\WINDOWS\system32\tjyotejc.ini
2008-09-26 15:14 . 2008-09-26 15:14 <REP> d-------- C:\Program Files\Lavasoft
2008-09-26 15:14 . 2008-09-26 15:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-26 14:52 . 2008-09-26 14:52 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Search Settings
2008-09-26 14:51 . 2008-09-26 14:51 <REP> d-------- C:\Program Files\Search Settings
2008-09-26 14:43 . 2008-09-26 14:43 <REP> d-------- C:\WINDOWS\system32\custom matrices
2008-09-26 14:43 . 2008-09-26 14:43 <REP> d-------- C:\WINDOWS\system32\C2MP
2008-09-26 14:01 . 2008-09-26 14:01 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\PC Tools
2008-09-26 13:59 . 2008-09-26 13:59 207 --a------ C:\WINDOWS\wininit.ini
2008-09-26 13:33 . 2008-09-26 14:13 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-26 13:33 . 2008-09-26 16:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-26 11:25 . 2008-09-27 17:48 <REP> d-------- C:\Program Files\Spyware Doctor
2008-09-26 02:11 . 2008-09-26 13:47 890,273 ---hs---- C:\WINDOWS\system32\gfvhijsh.ini
2008-09-25 18:04 . 2008-09-26 02:10 886,734 ---hs---- C:\WINDOWS\system32\daxjiebb.ini
2008-09-25 18:03 . 2008-09-26 14:00 401,389 --ahs---- C:\WINDOWS\system32\NmSDeMoq.ini2
2008-09-25 18:03 . 2008-09-26 14:01 401,389 --ahs---- C:\WINDOWS\system32\NmSDeMoq.ini
2008-09-22 02:00 . 2008-09-22 02:00 <REP> dr-h----- C:\Documents and Settings\Administrateur\Application Data\SecuROM
2008-09-22 02:00 . 2008-09-22 02:00 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-09-18 17:49 . 2008-09-18 17:51 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\TigerPlayer
2008-09-18 17:48 . 2008-09-22 18:17 <REP> d-------- C:\Program Files\MpcStar
2008-09-18 17:48 . 2008-09-18 17:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-11 11:49 . 2008-09-25 12:14 <REP> d-------- C:\Program Files\BitComet
2008-09-11 11:49 . 2008-10-01 15:21 <REP> d-------- C:\Downloads
2008-09-05 19:59 . 2008-09-05 19:59 <REP> d-------- C:\Program Files\Kaspersky Lab
2008-09-05 19:59 . 2008-10-03 15:48 15,674,656 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-05 19:59 . 2008-10-03 15:47 214,560 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-09-05 19:59 . 2008-10-03 15:46 212,000 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-05 19:59 . 2008-09-05 20:39 96,976 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-09-05 19:59 . 2008-09-05 20:39 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-09-05 19:59 . 2008-10-03 15:46 22,160 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-03 12:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-09-27 16:40 --------- d-----w C:\Program Files\Google
2008-09-27 16:18 --------- d-----w C:\Program Files\Internet Download Manager
2008-09-27 16:15 --------- d-----w C:\Program Files\Yahoo!
2008-09-27 15:51 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Skype
2008-09-27 15:48 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-27 15:14 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\skypePM
2008-09-22 15:45 --------- d-----w C:\Program Files\Download Direct
2008-09-05 18:40 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-08-31 23:39 --------- d-----w C:\Program Files\MSN Messenger
2008-08-31 11:04 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-21 12:43 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Publish Providers
2008-08-21 12:41 --------- d-----w C:\Program Files\Sony
2008-08-21 12:36 --------- d-----w C:\Program Files\Sonic Foundry
2008-08-21 12:35 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Sony
2008-08-21 12:26 --------- d-----w C:\Program Files\Sony Setup
2008-08-21 12:24 --------- d-----w C:\Program Files\Sonic Foundry Setup
2008-08-20 16:58 --------- d-----w C:\Program Files\QuickTime
2008-08-20 16:55 --------- d-----w C:\Program Files\Winamp
2008-08-20 16:50 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-08-03 12:08 --------- d-----w C:\Documents and Settings\LocalService\Application Data\CyberLink
2008-08-03 11:55 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\CyberLink
2008-08-03 11:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-03 11:46 --------- d-----w C:\Program Files\CyberLink
2008-08-03 10:31 --------- d-----w C:\Program Files\DevGuru
2008-07-07 18:21 230,432 ----a-w C:\PA7311.DAT
2008-05-14 07:17 0 ----a-w C:\Program Files\uninstall.dat
2008-03-28 13:38 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-02-29 09:03 17,784,447 ----a-w C:\Program Files\DivX[1].Pro.v6.8.0.30.zip
.

------- Sigcheck -------

2004-08-04 01:54 660480 58fe94ef42e074f4cad8bf02e70e6478 C:\WINDOWS\ie7\wininet.dll
2008-04-14 04:33 670208 4a6e04ea20f48d750d9bfed8600d516b C:\WINDOWS\ServicePackFiles\i386\wininet.dll
2008-06-23 18:28 826368 ac0bd61dc2c64906fbfe50e005fefa2c C:\WINDOWS\SoftwareDistribution\Download\848074f054596c97d2468deeb41d6ba1\SP2GDR\wininet.dll
2008-06-23 17:40 827904 52589bae67dd9859724287372668690b C:\WINDOWS\SoftwareDistribution\Download\848074f054596c97d2468deeb41d6ba1\SP2QFE\wininet.dll
2008-04-23 06:16 826368 02d6aabd5f5a32c61478b5cdfe50e4a8 C:\WINDOWS\system32\wininet.dll
2008-04-23 06:16 826368 02d6aabd5f5a32c61478b5cdfe50e4a8 C:\WINDOWS\system32\DllCache\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-07-17 2599224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\MpcStar\Codecs\QuickTime\QTSystem\qttask.exe" [2008-09-18 282624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
AdsGone.lnk - C:\Program Files\AdsGone\AdsGone.exe [2008-09-30 4407296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.tscc"= C:\PROGRA~1\MpcStar\Codecs\tscc\tsccvid.dll
"msacm.ac3filter"= ac3filter.acm
"vidc.hfyu"= huffyuv.dll
"msacm.divxa32"= DivXa32.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP]
--a------ 2007-06-28 12:51 218376 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
--a------ 2008-07-17 15:50 2599224 C:\Program Files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-14 04:33 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-09-05 14:21 133104 C:\Documents and Settings\Administrateur\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2007-02-26 11:34 155648 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2007-02-26 11:34 131072 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 2006-04-13 12:09 49152 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
--------- 2005-10-11 19:25 1961984 C:\Program Files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2006-10-22 13:22 7700480 C:\WINDOWS\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2006-10-22 13:22 86016 C:\WINDOWS\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PAC7311_Monitor]
--a------ 2006-11-03 11:01 319488 C:\WINDOWS\PixArt\PAC7311\Monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
--a------ 2007-02-26 11:33 131072 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-18 17:49 282624 C:\Program Files\MpcStar\Codecs\QuickTime\QTSystem\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2005-12-07 23:57 30208 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings]
--a------ 2008-06-12 16:57 991584 C:\Program Files\Search Settings\SearchSettings.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-02-01 18:22 21898024 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
-ra------ 2007-01-29 20:22 638976 C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--------- 2008-07-07 09:42 2156368 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-08-04 01:02 36352 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 19:43 69632 C:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2007-02-26 16:03 16125440 C:\WINDOWS\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
--a------ 2006-05-16 19:04 2879488 C:\WINDOWS\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"sp_rssrv"=2 (0x2)
"RichVideo"=2 (0x2)
"ose"=3 (0x3)
"NVSvc"=2 (0x2)
"MDM"=2 (0x2)
"gusvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"24324:TCP"= 24324:TCP:BitComet 24324 TCP
"24324:UDP"= 24324:UDP:BitComet 24324 UDP

R2 NwSapAgent;Agent SAP;C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 24344]
R3 PAC7311;Trust Webcam Live;C:\WINDOWS\system32\DRIVERS\PA707UCM.SYS [2007-03-14 449024]
S3 CAM1210;SM0121 USB 2.0 Video Camera;C:\WINDOWS\system32\Drivers\cam1210.sys [2006-07-24 89856]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64ff79cb-9a61-11db-ad35-0019210607ee}]
\Shell\??\command - F:\taipingtianguov1.1.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL taipingtianguov1.1.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6df9c134-c162-11dc-ad5d-0019210607ee}]
\Shell\??\command - F:\taipingtianguov1.1.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL taipingtianguov1.1.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff0519ce-a284-11db-ad58-0019210607ee}]
\Shell\??\command - E:\taipingtianguov1.1.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL taipingtianguov1.1.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

BHO-{49864D0E-6D36-4E13-958A-35EB9D6007E3} - C:\WINDOWS\system32\qoMeDSmN.dll
MSConfigStartUp-50a31aea - C:\WINDOWS\system32\nwbyemqp.dll
MSConfigStartUp-L08FXLRD_20328750 - C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - Études DVD\EDICT.EXE
MSConfigStartUp-L08FXLRD_2829562 - C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - Études DVD\EDICT.EXE
MSConfigStartUp-L08FXLRD_320812 - C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - Études DVD\EDICT.EXE
MSConfigStartUp-SpywareTerminator - C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
MSConfigStartUp-swg - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\lx62ziin.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.atcomet.com/m/
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-03 15:48:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\WgaTray.exe
.
**************************************************************************
.
Completion time: 2008-10-03 15:50:47 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-03 13:50:42

Avant-CF: 23ÿ882ÿ653ÿ696 octets libres
Post-Run: 25,171,197,952 octets libres

261 --- E O F --- 2008-09-10 15:56:36

Salut,

- Télécharge et installe MalwareByte's Anti-Malware :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

- Mets-le à jour

- Redémarre en mode sans échec (Recommandé) :
https://www.malekal.com/demarrer-windows-mode-sans-echec/

- Choisis ta session habituelle

- Fais un scan complet avec MalwareByte's Anti-Malware

- Supprime tout ce que le logiciel trouve, enregistre le rapport

- Redémarre en mode normal et poste le rapport ici

Tutorial :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Fais ce que destrio te dit, c'est exactement ce que je voulait que tu fasse ! c'est un virus (antivirus2009)

Clique sur Supprimer la sélection.

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

/!\ Seul molka peut suivre cette procédure /!\

1/

---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :

KillAll::

File::
C:\WINDOWS\system32\tkesweyg.ini
C:\WINDOWS\system32\omvrxyvw.ini
C:\WINDOWS\system32\ahbdpirr.ini
C:\WINDOWS\system32\tjyotejc.ini
C:\WINDOWS\system32\gfvhijsh.ini
C:\WINDOWS\system32\daxjiebb.ini
C:\WINDOWS\system32\NmSDeMoq.ini2
C:\WINDOWS\system32\NmSDeMoq.ini
C:\Program Files\DivX[1].Pro.v6.8.0.30.zip
F:\taipingtianguov1.1.exe
E:\taipingtianguov1.1.exe
C:\WINDOWS\system32\nwbyemqp.dll
C:\WINDOWS\system32\qoMeDSmN.dll

Folder::
C:\WINDOWS\system32\config\systemprofile\Application Data\Search Settings
C:\Documents and Settings\Administrateur\Application Data\Search Settings
C:\Program Files\Search Settings

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64ff79cb-9a61-11db-ad35-0019210607ee}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6df9c134-c162-11dc-ad5d-0019210607ee}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff0519ce-a284-11db-ad58-0019210607ee}]

---> Colle la sélection dans le bloc-notes

---> Enregistre ce fichier sur le bureau (Impératif)

---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes

2/

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt