Virus system security et sur bureau

belette88 -

Bonjour,
excusez moi de vous derangé mais j'ai 2 virus qui ne veulent pas partir g avira antivir .
le 1er virus est system security qui est detecté par mon antivirus mais pas possible de le suprimé et le 2eme c'est une page d'internet sur mon bureau qui est impossible de trouver et accedé a mes fond d'ecrans pour le changé.
merci par avance de votre reponse

Configuration: Windows XP
Firefox 3.0.5

Afficher la suite

32 réponses

Résumé de la discussion

Deux virus détectés sur Windows XP par Avira Antivir perturbent le système, dont System Security et une page d'accueil qui s'affiche sur le bureau et empêche le changement de fond. Des méthodes de nettoyage techniques sont suggérées, incluant des outils comme ComboFix et SmitFraudFix, ainsi que des procédures de suppression de fichiers et d'analyse des éléments suspects. En cas de persistance, des vérifications supplémentaires et une restauration des paramètres malveillants peuvent être nécessaires, puis des sauvegardes et une éventuelle réinstallation du système pour prévenir la réapparition des menaces et sécuriser le réseau.

Réponse 1 / 32
eZula Contributeur
Essaye ceci peut être http://www.libellules.ch/reparer_internet_explorer.php

0

Réagir
1. belette88
  
  voila ca a marché tout est ok
  je vous remercie pour toute ces manip
  bonne soirée
  comment je met le statut resolu?
  
  0
  
  Réagir
Réponse 2 / 32
eZula Contributeur
Où estimes-tu en être après cette montagne de manipulations, et par rapport aux problèmes de départ ?

0

Réagir
1. belette88
  
  pour le problemen de depart c nikel et meme plus que j'esperé, merci! plu de bloquage a cause des virus par contre internet exporeur n'affiche toujour rien quan je click sur cheker pour les mise a jour. mauvaise configuration?
  
  0
  
  Réagir
Réponse 3 / 32
eZula Contributeur
tape about:config dans la barre d'adresse de FF, valide et cherche les valeurs suivantes (Filtre) et modifie-les comme je t'indique de manière totalement arbitraire

browser.search.defaulturl -> https://www.google.com/webhp?lr=&ie=UTF-8&oe=UTF-8&gws_rd=ssl
browser.search.selectedEngine -> Google
keyword.URL -> https://www.google.com/webhp?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&gws_rd=ssl

Ensuite, ferme Firefox. Supprime le fichier
c:\program files\Mozilla Firefox\components\nsdcads.dll s'il existe encore. Vas dans le répertoire caché c:\documents and settings\laurent anais\Application Data\Mozilla\Firefox\Profiles\suite.User0
mets le fichier user.js à la corbeille, et ne la vide pas.

Redémarre l'ordinateur. Relance combofix normalement et poste le rapport.

0

Réagir
1. belette88
  
  ComboFix 09-01-19.05 - laurent anais 2009-01-20 19:04:46.4 - NTFSx86
  Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1023.537 [GMT 1:00]
  Lancé depuis: c:\documents and settings\laurent anais\Bureau\ComboFix.exe
  AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
  .
  
  ((((((((((((((((((((((((((((( Fichiers créés du 2008-12-20 au 2009-01-20 ))))))))))))))))))))))))))))))))))))
  .
  
  2009-01-18 22:18 . 2009-01-20 18:49 <REP> d-------- c:\documents and settings\laurent anais\Application Data\SecondLife
  2009-01-18 22:17 . 2009-01-18 22:18 <REP> d-------- c:\program files\SecondLife
  2009-01-17 22:47 . 2009-01-18 00:55 <REP> d-------- c:\program files\EsetOnlineScanner
  2009-01-14 20:10 . 2009-01-14 20:10 88 -r-hs---- c:\windows\system32\77AD716965.sys
  2009-01-14 19:27 . 2009-01-14 19:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Corel
  2009-01-14 19:23 . 2009-01-14 19:25 <REP> d-------- c:\program files\Fichiers communs\Corel
  2009-01-14 19:11 . 2009-01-14 19:11 <REP> d-------- c:\program files\PhotoFiltre
  2009-01-14 19:00 . 2009-01-14 19:00 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Windows Search
  2009-01-14 18:02 . 2009-01-14 18:02 <REP> d-------- c:\windows\system32\GroupPolicy
  2009-01-14 18:02 . 2009-01-14 18:02 <REP> d-------- c:\program files\Windows Desktop Search
  2009-01-14 18:02 . 2009-01-14 18:02 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Windows Desktop Search
  2009-01-14 18:01 . 2008-03-07 18:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
  2009-01-14 18:01 . 2008-03-07 18:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
  2009-01-14 18:01 . 2008-03-07 18:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
  2009-01-13 23:02 . 2003-03-16 00:15 90,112 --a------ c:\windows\unvise32.exe
  2009-01-13 22:52 . 2009-01-13 22:52 <REP> d-------- c:\program files\THQ
  2009-01-13 22:12 . 2009-01-13 22:12 <REP> d-------- c:\program files\Microsoft Silverlight
  2009-01-13 21:21 . 2009-01-13 21:21 <REP> d-------- c:\program files\filehippo.com
  2009-01-13 18:34 . 2009-01-17 16:02 <REP> d----c--- C:\Baphomet
  2009-01-13 18:14 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
  2009-01-13 18:13 . 2009-01-13 18:13 <REP> d-------- c:\program files\Panda Security
  2009-01-12 22:02 . 2009-01-14 18:53 <REP> d-------- c:\program files\Trend Micro
  2009-01-12 21:41 . 2009-01-12 21:41 579,584 --a------ c:\windows\system32\dllcache\user32.dll
  2009-01-12 21:39 . 2009-01-14 19:42 <REP> d-------- c:\windows\ERUNT
  2009-01-12 21:39 . 2009-01-17 12:16 <REP> d----c--- C:\Backups
  2009-01-11 21:34 . 2009-01-11 22:02 <REP> d-------- c:\program files\Spybot - Search & Destroy
  2009-01-11 21:34 . 2009-01-19 20:26 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
  2009-01-11 21:29 . 2009-01-11 21:29 <REP> d-------- c:\program files\Yahoo!
  2009-01-11 21:29 . 2009-01-11 21:29 <REP> d-------- c:\program files\CCleaner
  2009-01-11 21:29 . 2009-01-11 21:29 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Yahoo!
  2009-01-11 21:29 . 2009-01-14 17:55 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
  2009-01-11 21:07 . 2009-01-11 21:07 <REP> d-------- c:\windows\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
  2009-01-11 21:07 . 2009-01-11 21:11 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Deskbar_{80FA45F7-B41F-470c-86A3-A38414374191}
  2009-01-11 20:50 . 2009-01-11 21:01 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
  2009-01-11 20:50 . 2009-01-11 20:50 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
  2009-01-11 20:40 . 2009-01-11 20:40 <REP> d-------- c:\program files\Enigma Software Group
  2009-01-11 16:23 . 2009-01-11 16:23 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
  2009-01-11 14:26 . 2009-01-13 17:18 <REP> d-------- c:\documents and settings\All Users\Application Data\533936372
  2009-01-11 12:13 . 2009-01-11 12:13 268 --ah-c--- C:\sqmdata14.sqm
  2009-01-11 12:13 . 2009-01-11 12:13 244 --ah-c--- C:\sqmnoopt14.sqm
  2009-01-10 11:46 . 2009-01-10 11:46 268 --ah-c--- C:\sqmdata13.sqm
  2009-01-10 11:46 . 2009-01-10 11:46 244 --ah-c--- C:\sqmnoopt13.sqm
  2009-01-07 21:49 . 2009-01-07 21:49 <REP> d----c--- C:\TMOTM
  2009-01-07 21:44 . 2004-04-16 20:24 61,440 --a------ c:\windows\system32\ISUSPM.cpl
  2009-01-01 17:52 . 2009-01-01 17:52 <REP> d----c--- C:\MicroGaming
  2008-12-27 23:09 . 2008-12-27 23:09 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Games
  2008-12-27 23:09 . 2008-12-27 23:09 <REP> d-------- c:\documents and settings\All Users\Application Data\InstallShield
  2008-12-27 23:08 . 2008-12-27 23:08 <REP> d-------- c:\windows\system32\AGEIA
  2008-12-27 23:00 . 2008-12-27 23:00 <REP> d-------- c:\program files\Focus
  2008-12-26 19:03 . 2008-12-26 19:03 244 --ah-c--- C:\sqmnoopt12.sqm
  2008-12-26 19:03 . 2008-12-26 19:03 232 --ah-c--- C:\sqmdata12.sqm
  
  .
  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2009-01-20 18:03 --------- d-----w c:\documents and settings\laurent anais\Application Data\OpenOffice.org2
  2009-01-18 13:43 3,532 -c--a-w C:\drmHeader.bin
  2009-01-14 19:44 4,184 --sha-w c:\windows\system32\KGyGaAvL.sys
  2009-01-14 19:10 --------- d-----w c:\documents and settings\laurent anais\Application Data\Corel
  2009-01-14 18:23 --------- d-----w c:\program files\Corel
  2009-01-11 15:28 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
  2009-01-11 15:25 --------- d-----w c:\program files\Lavasoft
  2009-01-11 13:23 --------- d--h--w c:\program files\InstallShield Installation Information
  2009-01-09 20:36 --------- d-----w c:\program files\DivX
  2009-01-04 17:54 2,516 --sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
  2009-01-04 17:53 88 --sh--r c:\documents and settings\All Users\Application Data\77AD716965.sys
  2008-12-27 22:08 279,712 ----a-w c:\windows\system32\drivers\atksgt.sys
  2008-12-27 22:08 25,888 ----a-w c:\windows\system32\drivers\lirsgt.sys
  2008-12-13 06:37 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
  2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
  2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
  2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll
  2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll
  2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
  2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll
  2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll
  2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll
  2008-12-03 20:57 --------- d-----w c:\program files\Micro Application
  2008-11-28 17:10 --------- d-----w c:\documents and settings\laurent anais\Application Data\InstallShield
  2008-11-28 17:08 --------- d-----w c:\program files\Eidos
  2008-11-06 16:37 524,288 ----a-w c:\windows\system32\DivXsm.exe
  2008-11-06 16:37 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
  2008-11-06 16:35 200,704 ----a-w c:\windows\system32\ssldivx.dll
  2008-11-06 16:35 1,044,480 ----a-w c:\windows\system32\libdivx.dll
  2008-11-06 16:33 823,296 ----a-w c:\windows\system32\divx_xx0c.dll
  2008-11-06 16:33 823,296 ----a-w c:\windows\system32\divx_xx07.dll
  2008-11-06 16:33 815,104 ----a-w c:\windows\system32\divx_xx0a.dll
  2008-11-06 16:33 802,816 ----a-w c:\windows\system32\divx_xx11.dll
  2008-11-06 16:33 684,032 ----a-w c:\windows\system32\DivX.dll
  2008-11-06 16:33 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
  2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
  2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
  2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
  2008-06-20 17:06 5,632 --sha-w c:\program files\Thumbs.db
  2008-06-16 19:23 2,648,090 ----a-w c:\program files\eMulePlus-1.2d.Installer.exe
  2008-05-16 18:42 6,115,448 ----a-w c:\program files\Firefox Setup 2.0.0.14.exe
  2008-05-15 18:10 35,203 ----a-w c:\program files\elephant.jpg
  2008-02-19 20:18 47,360 ----a-w c:\documents and settings\laurent anais\Application Data\pcouffin.sys
  2007-08-15 21:39 56 --sh--r c:\windows\system32\656971AD77.sys
  2008-08-30 15:34 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008083020080831\index.dat
  .
  
  ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
  "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
  "SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-10-23 202024]
  "filehippo.com"="c:\program files\filehippo.com\UpdateChecker.exe" [2008-12-31 146432]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "LaunchApp"="Alaunch" [X]
  "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
  "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-12 45056]
  "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
  "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
  "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
  "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
  "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
  "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-04-28 401408]
  "AspireService"="c:\program files\Acer\Acer eMode Management\AspireService.exe" [2006-06-09 110592]
  "MediaSync"="c:\program files\Acer\Acer eConsole\MediaSync.exe" [2006-05-04 425984]
  "PCMService"="c:\program files\Acer TV-FM\PCMService.exe" [2006-03-29 143360]
  "ImageItEncrypt"="c:\windows\system32\ImageItEncrypt.exe" [2005-12-30 40960]
  "EPSON Stylus Photo R240 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE" [2005-04-25 98304]
  "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-07 77824]
  "ORAHSSSessionManager"="c:\program files\Orange HSS\SessionManager\SessionManager.exe" [2007-07-24 102400]
  "NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
  "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
  "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497]
  "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
  "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-07-18 185896]
  "SystrayORAHSS"="c:\program files\Orange HSS\Systray\SystrayApp.exe" [2007-07-24 94208]
  "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-04-17 196608]
  "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
  "Corel Photo Downloader"="c:\program files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-28 531272]
  "SiSPower"="SiSPower.dll" [2005-07-13 c:\windows\system32\SiSPower.dll]
  "AGRSMMSG"="AGRSMMSG.exe" [2004-04-13 c:\windows\AGRSMMSG.exe]
  "SoundMan"="SOUNDMAN.EXE" [2005-08-16 c:\windows\SOUNDMAN.EXE]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
  
  c:\documents and settings\laurent anais\Menu D‚marrer\Programmes\D‚marrage\
  OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]
  
  c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
  Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
  Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
  Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
  
  [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
  "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
  "msacm.dvacm"= c:\progra~1\FICHIE~1\ULEADS~1\vio\dvacm.acm
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "c:\\Program Files\\Acer TV-FM\\PowerCinema.exe"=
  "c:\\Program Files\\Acer TV-FM\\PCMService.exe"=
  "c:\\Program Files\\Messenger\\msmsgs.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "c:\\Program Files\\eMule\\eMule.exe"=
  "c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=
  "c:\\WINDOWS\\system32\\dpvsetup.exe"=
  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  "c:\\Program Files\\Fichiers communs\\Nero\\Nero Web\\SetupX.exe"=
  "c:\\Program Files\\Orange HSS\\Connectivity\\ConnectivityManager.exe"=
  
  R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-13 28544]
  S3 CAM1210;SM0121 USB 2.0 Video Camera;c:\windows\system32\drivers\cam1210.sys [2006-07-24 89856]
  S3 DMSKSSRh;DMSKSSRh;\??\c:\docume~1\LAUREN~1\LOCALS~1\Temp\DMSKSSRh.sys --> c:\docume~1\LAUREN~1\LOCALS~1\Temp\DMSKSSRh.sys [?]
  .
  Contenu du dossier 'Tâches planifiées'
  
  2009-01-17 c:\windows\Tasks\Update Checker.job
  - c:\progra~1\FILEHI~1.COM\UPDATE~1.EXE [2008-12-31 12:22]
  
  2009-01-20 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
  - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
  .
  .
  ------- Examen supplémentaire -------
  .
  mWindow Title =
  IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
  IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
  IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?8bebaba9299846cd8b3462399d909966
  IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?8bebaba9299846cd8b3462399d909966
  TCP: {6560E730-C9E6-4205-8C89-8699C603188E} = 192.168.1.1
  DPF: {D5D30A68-E230-49D9-B4D5-BF7532692945} - hxxps://clients.cdiscount.com/ediag/activex/CDiscount.cab
  FF - ProfilePath - c:\documents and settings\laurent anais\Application Data\Mozilla\Firefox\Profiles\suite.User0\
  FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
  FF - prefs.js: browser.search.selectedEngine - google
  FF - prefs.js: browser.startup.homepage - hxxp://www.w-w-w-dot-com.com/start.php
  FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
  FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
  .
  
  **************************************************************************
  
  catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2009-01-20 19:07:47
  Windows 5.1.2600 Service Pack 3 NTFS
  
  Recherche de processus cachés ...
  
  Recherche d'éléments en démarrage automatique cachés ...
  
  Recherche de fichiers cachés ...
  
  Scan terminé avec succès
  Fichiers cachés: 0
  
  **************************************************************************
  .
  --------------------- CLES DE REGISTRE BLOQUEES ---------------------
  
  [HKEY_USERS\S-1-5-21-430353115-455240563-1979012898-1006\Software\Microsoft\SystemCertificates\AddressBook*]
  @Allowed: (Read) (RestrictedCode)
  @Allowed: (Read) (RestrictedCode)
  .
  --------------------- DLLs chargées dans les processus actifs ---------------------
  
  - - - - - - - > 'winlogon.exe'(708)
  c:\windows\system32\Ati2evxx.dll
  .
  Heure de fin: 2009-01-20 19:09:46
  ComboFix-quarantined-files.txt 2009-01-20 18:09:42
  ComboFix2.txt 2009-01-20 17:08:57
  ComboFix3.txt 2009-01-17 19:58:56
  ComboFix4.txt 2009-01-15 18:29:49
  
  Avant-CF: 30 203 265 024 octets libres
  Après-CF: 30,192,623,616 octets libres
  
  226 --- E O F --- 2008-12-18 22:08:36
  
  0
  
  Réagir
Réponse 4 / 32
eZula Contributeur
Bien. Est-ce que tu peux supprimer combofix, le retélécharger et poster le rapport, stp http://download.bleepingcomputer.com/sUBs/ComboFix.exe

0

Réagir
1. belette88
  
  ComboFix 09-01-19.05 - laurent anais 2009-01-20 18:03:52.3 - NTFSx86
  Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1023.423 [GMT 1:00]
  Lancé depuis: c:\documents and settings\laurent anais\Bureau\ComboFix.exe
  AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
  * Un nouveau point de restauration a été créé
  .
  
  ((((((((((((((((((((((((((((( Fichiers créés du 2008-12-20 au 2009-01-20 ))))))))))))))))))))))))))))))))))))
  .
  
  2009-01-18 22:18 . 2009-01-18 22:21 <REP> d-------- c:\documents and settings\laurent anais\Application Data\SecondLife
  2009-01-18 22:17 . 2009-01-18 22:18 <REP> d-------- c:\program files\SecondLife
  2009-01-17 22:47 . 2009-01-18 00:55 <REP> d-------- c:\program files\EsetOnlineScanner
  2009-01-14 20:10 . 2009-01-14 20:10 88 -r-hs---- c:\windows\system32\77AD716965.sys
  2009-01-14 19:27 . 2009-01-14 19:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Corel
  2009-01-14 19:23 . 2009-01-14 19:25 <REP> d-------- c:\program files\Fichiers communs\Corel
  2009-01-14 19:11 . 2009-01-14 19:11 <REP> d-------- c:\program files\PhotoFiltre
  2009-01-14 19:00 . 2009-01-14 19:00 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Windows Search
  2009-01-14 18:02 . 2009-01-14 18:02 <REP> d-------- c:\windows\system32\GroupPolicy
  2009-01-14 18:02 . 2009-01-14 18:02 <REP> d-------- c:\program files\Windows Desktop Search
  2009-01-14 18:02 . 2009-01-14 18:02 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Windows Desktop Search
  2009-01-14 18:01 . 2008-03-07 18:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
  2009-01-14 18:01 . 2008-03-07 18:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
  2009-01-14 18:01 . 2008-03-07 18:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
  2009-01-13 23:02 . 2003-03-16 00:15 90,112 --a------ c:\windows\unvise32.exe
  2009-01-13 22:52 . 2009-01-13 22:52 <REP> d-------- c:\program files\THQ
  2009-01-13 22:12 . 2009-01-13 22:12 <REP> d-------- c:\program files\Microsoft Silverlight
  2009-01-13 21:21 . 2009-01-13 21:21 <REP> d-------- c:\program files\filehippo.com
  2009-01-13 18:34 . 2009-01-17 16:02 <REP> d----c--- C:\Baphomet
  2009-01-13 18:14 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
  2009-01-13 18:13 . 2009-01-13 18:13 <REP> d-------- c:\program files\Panda Security
  2009-01-12 22:02 . 2009-01-14 18:53 <REP> d-------- c:\program files\Trend Micro
  2009-01-12 21:41 . 2009-01-12 21:41 579,584 --a------ c:\windows\system32\dllcache\user32.dll
  2009-01-12 21:39 . 2009-01-14 19:42 <REP> d-------- c:\windows\ERUNT
  2009-01-12 21:39 . 2009-01-17 12:16 <REP> d----c--- C:\Backups
  2009-01-11 21:34 . 2009-01-11 22:02 <REP> d-------- c:\program files\Spybot - Search & Destroy
  2009-01-11 21:34 . 2009-01-19 20:26 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
  2009-01-11 21:29 . 2009-01-11 21:29 <REP> d-------- c:\program files\Yahoo!
  2009-01-11 21:29 . 2009-01-11 21:29 <REP> d-------- c:\program files\CCleaner
  2009-01-11 21:29 . 2009-01-11 21:29 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Yahoo!
  2009-01-11 21:29 . 2009-01-14 17:55 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
  2009-01-11 21:07 . 2009-01-11 21:07 <REP> d-------- c:\windows\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
  2009-01-11 21:07 . 2009-01-11 21:11 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Deskbar_{80FA45F7-B41F-470c-86A3-A38414374191}
  2009-01-11 20:50 . 2009-01-11 21:01 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
  2009-01-11 20:50 . 2009-01-11 20:50 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
  2009-01-11 20:40 . 2009-01-11 20:40 <REP> d-------- c:\program files\Enigma Software Group
  2009-01-11 16:23 . 2009-01-11 16:23 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
  2009-01-11 14:26 . 2009-01-13 17:18 <REP> d-------- c:\documents and settings\All Users\Application Data\533936372
  2009-01-11 12:13 . 2009-01-11 12:13 268 --ah-c--- C:\sqmdata14.sqm
  2009-01-11 12:13 . 2009-01-11 12:13 244 --ah-c--- C:\sqmnoopt14.sqm
  2009-01-10 11:46 . 2009-01-10 11:46 268 --ah-c--- C:\sqmdata13.sqm
  2009-01-10 11:46 . 2009-01-10 11:46 244 --ah-c--- C:\sqmnoopt13.sqm
  2009-01-07 21:49 . 2009-01-07 21:49 <REP> d----c--- C:\TMOTM
  2009-01-07 21:44 . 2004-04-16 20:24 61,440 --a------ c:\windows\system32\ISUSPM.cpl
  2009-01-01 17:52 . 2009-01-01 17:52 <REP> d----c--- C:\MicroGaming
  2008-12-27 23:09 . 2008-12-27 23:09 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Games
  2008-12-27 23:09 . 2008-12-27 23:09 <REP> d-------- c:\documents and settings\All Users\Application Data\InstallShield
  2008-12-27 23:08 . 2008-12-27 23:08 <REP> d-------- c:\windows\system32\AGEIA
  2008-12-27 23:00 . 2008-12-27 23:00 <REP> d-------- c:\program files\Focus
  2008-12-26 19:03 . 2008-12-26 19:03 244 --ah-c--- C:\sqmnoopt12.sqm
  2008-12-26 19:03 . 2008-12-26 19:03 232 --ah-c--- C:\sqmdata12.sqm
  
  .
  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2009-01-20 16:46 --------- d-----w c:\documents and settings\laurent anais\Application Data\OpenOffice.org2
  2009-01-18 13:43 3,532 -c--a-w C:\drmHeader.bin
  2009-01-14 19:44 4,184 --sha-w c:\windows\system32\KGyGaAvL.sys
  2009-01-14 19:10 --------- d-----w c:\documents and settings\laurent anais\Application Data\Corel
  2009-01-14 18:23 --------- d-----w c:\program files\Corel
  2009-01-11 15:28 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
  2009-01-11 15:25 --------- d-----w c:\program files\Lavasoft
  2009-01-11 13:23 --------- d--h--w c:\program files\InstallShield Installation Information
  2009-01-09 20:36 --------- d-----w c:\program files\DivX
  2009-01-04 17:54 2,516 --sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
  2009-01-04 17:53 88 --sh--r c:\documents and settings\All Users\Application Data\77AD716965.sys
  2008-12-27 22:08 279,712 ----a-w c:\windows\system32\drivers\atksgt.sys
  2008-12-27 22:08 25,888 ----a-w c:\windows\system32\drivers\lirsgt.sys
  2008-12-13 06:37 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
  2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
  2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
  2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll
  2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll
  2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
  2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll
  2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll
  2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll
  2008-12-03 20:57 --------- d-----w c:\program files\Micro Application
  2008-11-28 17:10 --------- d-----w c:\documents and settings\laurent anais\Application Data\InstallShield
  2008-11-28 17:08 --------- d-----w c:\program files\Eidos
  2008-11-06 16:37 524,288 ----a-w c:\windows\system32\DivXsm.exe
  2008-11-06 16:37 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
  2008-11-06 16:35 200,704 ----a-w c:\windows\system32\ssldivx.dll
  2008-11-06 16:35 1,044,480 ----a-w c:\windows\system32\libdivx.dll
  2008-11-06 16:33 823,296 ----a-w c:\windows\system32\divx_xx0c.dll
  2008-11-06 16:33 823,296 ----a-w c:\windows\system32\divx_xx07.dll
  2008-11-06 16:33 815,104 ----a-w c:\windows\system32\divx_xx0a.dll
  2008-11-06 16:33 802,816 ----a-w c:\windows\system32\divx_xx11.dll
  2008-11-06 16:33 684,032 ----a-w c:\windows\system32\DivX.dll
  2008-11-06 16:33 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
  2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
  2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
  2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
  2008-06-20 17:06 5,632 --sha-w c:\program files\Thumbs.db
  2008-06-16 19:23 2,648,090 ----a-w c:\program files\eMulePlus-1.2d.Installer.exe
  2008-05-16 18:42 6,115,448 ----a-w c:\program files\Firefox Setup 2.0.0.14.exe
  2008-05-15 18:10 35,203 ----a-w c:\program files\elephant.jpg
  2008-02-19 20:18 47,360 ----a-w c:\documents and settings\laurent anais\Application Data\pcouffin.sys
  2009-01-05 13:04 650,240 ----a-w c:\program files\mozilla firefox\components\nsdcads.dll
  2007-08-15 21:39 56 --sh--r c:\windows\system32\656971AD77.sys
  2008-08-30 15:34 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008083020080831\index.dat
  .
  
  ((((((((((((((((((((((((((((( snapshot@2009-01-15_19.28.42.03 )))))))))))))))))))))))))))))))))))))))))
  .
  + 2009-01-15 19:05:35 27,136 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\c6772fd12a581ad3be49e3f2a80b5622\Accessibility.ni.dll
  + 2009-01-15 19:05:39 884,736 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\a1d353edc300e3aff0784202f68a657b\AspNetMMCExt.ni.dll
  + 2009-01-15 19:05:41 237,568 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\c10ec9b4de2b366236ec83237dc31281\CustomMarshalers.ni.dll
  + 2009-01-15 19:05:40 15,360 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\837fe02bdcf637d5bf1e5ffb935ebb80\dfsvc.ni.exe
  + 2009-01-15 19:05:44 876,544 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\9710a3c0d11dd264c3a6b88977699e9b\Microsoft.Build.Engine.ni.dll
  + 2009-01-15 19:05:45 81,920 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\e2858a45971fb30b0c0523dbb52c1d4e\Microsoft.Build.Framework.ni.dll
  + 2009-01-15 19:05:50 1,695,744 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\63d69ffdf3c640d2d104a4b74e8115f8\Microsoft.Build.Tasks.ni.dll
  + 2009-01-15 19:05:51 167,936 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\11cb5418c06e30100616fbf205588489\Microsoft.Build.Utilities.ni.dll
  + 2009-01-15 19:05:55 1,740,800 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\923bd55258380eae77353d36a5a1b08f\Microsoft.VisualBasic.ni.dll
  + 2009-01-15 19:05:57 1,011,712 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\eee9b48577689e92db5a7b5c5de98d9b\System.Configuration.ni.dll
  + 2009-01-15 19:06:00 1,798,144 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\c7dea4895e1fa33d65e448c03de48d26\System.Deployment.ni.dll
  + 2009-01-15 19:06:03 1,224,704 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\914668b240550f529e54bb772c6fc881\System.DirectoryServices.ni.dll
  + 2009-01-15 19:06:05 512,000 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\f11bc82c09955cb8438d3885a99c297d\System.DirectoryServices.Protocols.ni.dll
  + 2009-01-15 19:06:07 659,456 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\646131eda5f21f4e6216733d49c22c56\System.EnterpriseServices.ni.dll
  + 2009-01-15 19:06:07 294,912 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\646131eda5f21f4e6216733d49c22c56\System.EnterpriseServices.Wrapper.dll
  + 2009-01-15 19:06:09 733,184 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\2b5994269cc5b996231c9b21afea9a91\System.Security.ni.dll
  + 2009-01-15 19:06:10 233,472 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\193ac978af569ad9ee45110b359961b9\System.ServiceProcess.ni.dll
  + 2009-01-15 19:06:12 679,936 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\12e0aa1030badf4524f897e3f57b037a\System.Transactions.ni.dll
  + 2009-01-15 19:06:42 2,342,912 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\37d87b3cab1c66ec4430ebb2abeaa570\System.Web.Mobile.ni.dll
  + 2009-01-15 19:06:43 237,568 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\b5b81faf46fc63c20d5339b36edd02fa\System.Web.RegularExpressions.ni.dll
  + 2009-01-15 19:06:47 1,986,560 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\38991368499e2109ea4099a0fe29c5a3\System.Web.Services.ni.dll
  + 2009-01-15 19:06:37 12,509,184 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\67cfb70213562afe2ca9b9066764af3a\System.Web.ni.dll
  + 2007-07-27 13:49:02 196,683 ----a-w c:\windows\system32\lnod32apiA.dll
  + 2007-07-27 13:49:02 225,355 ----a-w c:\windows\system32\lnod32apiW.dll
  + 2005-12-05 18:25:22 139,264 ----a-w c:\windows\system32\lnod32umc.dll
  + 2005-12-05 11:37:10 106,496 ----a-w c:\windows\system32\lnod32upd.dll
  + 2008-02-11 08:39:26 253,952 ----a-w c:\windows\system32\OnlineScannerDLLA.dll
  + 2008-02-11 08:39:18 237,568 ----a-w c:\windows\system32\OnlineScannerDLLW.dll
  + 2008-02-08 12:53:46 110,592 ----a-w c:\windows\system32\OnlineScannerLang.dll
  + 2008-02-05 07:48:04 77,824 ----a-w c:\windows\system32\OnlineScannerUninstaller.exe
  + 2004-12-07 09:11:34 258,352 ----a-w c:\windows\system32\unicows.dll
  .
  -- Instantané actualisé --
  .
  ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
  "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
  "SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-10-23 202024]
  "filehippo.com"="c:\program files\filehippo.com\UpdateChecker.exe" [2008-12-31 146432]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "LaunchApp"="Alaunch" [X]
  "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
  "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-12 45056]
  "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
  "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
  "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
  "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
  "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
  "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-04-28 401408]
  "AspireService"="c:\program files\Acer\Acer eMode Management\AspireService.exe" [2006-06-09 110592]
  "MediaSync"="c:\program files\Acer\Acer eConsole\MediaSync.exe" [2006-05-04 425984]
  "PCMService"="c:\program files\Acer TV-FM\PCMService.exe" [2006-03-29 143360]
  "ImageItEncrypt"="c:\windows\system32\ImageItEncrypt.exe" [2005-12-30 40960]
  "EPSON Stylus Photo R240 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE" [2005-04-25 98304]
  "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-07 77824]
  "ORAHSSSessionManager"="c:\program files\Orange HSS\SessionManager\SessionManager.exe" [2007-07-24 102400]
  "NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
  "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
  "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497]
  "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
  "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-07-18 185896]
  "SystrayORAHSS"="c:\program files\Orange HSS\Systray\SystrayApp.exe" [2007-07-24 94208]
  "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-04-17 196608]
  "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
  "Corel Photo Downloader"="c:\program files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-28 531272]
  "SiSPower"="SiSPower.dll" [2005-07-13 c:\windows\system32\SiSPower.dll]
  "AGRSMMSG"="AGRSMMSG.exe" [2004-04-13 c:\windows\AGRSMMSG.exe]
  "SoundMan"="SOUNDMAN.EXE" [2005-08-16 c:\windows\SOUNDMAN.EXE]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
  
  c:\documents and settings\laurent anais\Menu D‚marrer\Programmes\D‚marrage\
  OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]
  
  c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
  Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
  Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
  Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
  
  [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
  "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
  "msacm.dvacm"= c:\progra~1\FICHIE~1\ULEADS~1\vio\dvacm.acm
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "c:\\Program Files\\Acer TV-FM\\PowerCinema.exe"=
  "c:\\Program Files\\Acer TV-FM\\PCMService.exe"=
  "c:\\Program Files\\Messenger\\msmsgs.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "c:\\Program Files\\eMule\\eMule.exe"=
  "c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=
  "c:\\WINDOWS\\system32\\dpvsetup.exe"=
  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  "c:\\Program Files\\Fichiers communs\\Nero\\Nero Web\\SetupX.exe"=
  "c:\\Program Files\\Orange HSS\\Connectivity\\ConnectivityManager.exe"=
  
  R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-13 28544]
  S3 CAM1210;SM0121 USB 2.0 Video Camera;c:\windows\system32\drivers\cam1210.sys [2006-07-24 89856]
  S3 DMSKSSRh;DMSKSSRh;\??\c:\docume~1\LAUREN~1\LOCALS~1\Temp\DMSKSSRh.sys --> c:\docume~1\LAUREN~1\LOCALS~1\Temp\DMSKSSRh.sys [?]
  .
  Contenu du dossier 'Tâches planifiées'
  
  2009-01-17 c:\windows\Tasks\Update Checker.job
  - c:\progra~1\FILEHI~1.COM\UPDATE~1.EXE [2008-12-31 12:22]
  
  2009-01-20 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
  - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
  .
  .
  ------- Examen supplémentaire -------
  .
  mWindow Title =
  IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
  IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
  IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?8bebaba9299846cd8b3462399d909966
  IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?8bebaba9299846cd8b3462399d909966
  TCP: {6560E730-C9E6-4205-8C89-8699C603188E} = 192.168.1.1
  DPF: {D5D30A68-E230-49D9-B4D5-BF7532692945} - hxxps://clients.cdiscount.com/ediag/activex/CDiscount.cab
  FF - ProfilePath - c:\documents and settings\laurent anais\Application Data\Mozilla\Firefox\Profiles\suite.User0\
  FF - prefs.js: browser.search.defaulturl - hxxp://www2.yoog.com/search.php?q=
  FF - prefs.js: browser.search.selectedEngine - Yoog Search
  FF - prefs.js: browser.startup.homepage - hxxp://www.w-w-w-dot-com.com/start.php
  FF - prefs.js: keyword.URL - hxxp://www2.yoog.com/search.php?q=
  FF - component: c:\program files\Mozilla Firefox\components\nsdcads.dll
  FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
  
  ---- PARAMETRES FIREFOX ----
  FF - user.js: network.proxy.type - 0
  FF - user.js: browser.shell.checkDefaultBrowser - false
  FF - user.js: browser.search.selectedEngine - Yoog Search
  FF - user.js: keyword.URL - hxxp://www2.yoog.com/search.php?q=
  FF - user.js: keyword.enabled - true
  FF - user.js: browser.search.defaultenginename - Yoog Search
  FF - user.js: browser.search.defaulturl - hxxp://www2.yoog.com/search.php?q=
  .
  
  **************************************************************************
  
  catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2009-01-20 18:06:55
  Windows 5.1.2600 Service Pack 3 NTFS
  
  Recherche de processus cachés ...
  
  Recherche d'éléments en démarrage automatique cachés ...
  
  Recherche de fichiers cachés ...
  
  Scan terminé avec succès
  Fichiers cachés: 0
  
  **************************************************************************
  .
  --------------------- CLES DE REGISTRE BLOQUEES ---------------------
  
  [HKEY_USERS\S-1-5-21-430353115-455240563-1979012898-1006\Software\Microsoft\SystemCertificates\AddressBook*]
  @Allowed: (Read) (RestrictedCode)
  @Allowed: (Read) (RestrictedCode)
  .
  --------------------- DLLs chargées dans les processus actifs ---------------------
  
  - - - - - - - > 'winlogon.exe'(712)
  c:\windows\system32\Ati2evxx.dll
  .
  Heure de fin: 2009-01-20 18:08:54
  ComboFix-quarantined-files.txt 2009-01-20 17:08:52
  ComboFix2.txt 2009-01-17 19:58:56
  ComboFix3.txt 2009-01-15 18:29:49
  
  Avant-CF: 30 254 882 816 octets libres
  Après-CF: 30,248,501,248 octets libres
  
  272 --- E O F --- 2008-12-18 22:08:36
  
  0
  
  Réagir
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 32
eZula Contributeur
Tu es toujours dans le coin ?

0

Réagir
1. belette88
  
  oui je sui toujours la. je vous ai envoyé le rapport ke vous m'aviez demandé en attente de votre reponse
  
  0
  
  Réagir
Réponse 6 / 32
eZula Contributeur
poste le contenu du fichier GenProc\outil\uninstall.html

0

Réagir
1. belette88
  
  ~~ Programmes installés ~~
  
  "AAC Decoder"
  "Acer eConsole"
  "Acer eMode Management"
  "Acer WLAN 11g USB Dongle"
  "Acer WLAN 11g USB Dongle"
  "Adobe Flash Player 9 ActiveX"
  "Adobe Flash Player ActiveX"
  "Adobe Reader 7.1.0"
  "Adobe Shockwave Player"
  "Agere Systems PCI Soft Modem"
  "Assistant de connexion Windows Live"
  "ATI - Utilitaire de désinstallation du logiciel"
  "ATI AVIVO Codecs"
  "ATI Catalyst Control Center"
  "ATI Display Driver"
  "ATI Parental Control & Encoder"
  "AutoUpdate"
  "Avira AntiVir Personal - Free Antivirus"
  "Barre d'outils Outlook de Windows Live (Windows Live Toolbar)"
  "Bloqueur de fenêtres pop-up (Windows Live Toolbar)"
  "Catalyst Control Center Core Implementation"
  "Catalyst Control Center Graphics Full Existing"
  "Catalyst Control Center Graphics Full New"
  "Catalyst Control Center Graphics Light"
  "Catalyst Control Center Graphics Previews Common"
  "Catalyst Control Center Localization Chinese Standard"
  "Catalyst Control Center Localization Chinese Traditional"
  "Catalyst Control Center Localization Czech"
  "Catalyst Control Center Localization Danish"
  "Catalyst Control Center Localization Dutch"
  "Catalyst Control Center Localization Finnish"
  "Catalyst Control Center Localization French"
  "Catalyst Control Center Localization German"
  "Catalyst Control Center Localization Greek"
  "Catalyst Control Center Localization Hungarian"
  "Catalyst Control Center Localization Italian"
  "Catalyst Control Center Localization Japanese"
  "Catalyst Control Center Localization Korean"
  "Catalyst Control Center Localization Norwegian"
  "Catalyst Control Center Localization Polish"
  "Catalyst Control Center Localization Portuguese"
  "Catalyst Control Center Localization Russian"
  "Catalyst Control Center Localization Spanish"
  "Catalyst Control Center Localization Swedish"
  "Catalyst Control Center Localization Thai"
  "Catalyst Control Center Localization Turkish"
  "ccc-core-preinstall"
  "ccc-core-static"
  "ccc-utility"
  "CCC Help Chinese Standard"
  "CCC Help Chinese Traditional"
  "CCC Help English"
  "CCleaner (remove only)"
  "Cooking Dash"
  "Corel Paint Shop Pro Photo X2"
  "Correctif pour Lecteur Windows Media 11 (KB939683)"
  "Correctif pour Windows Internet Explorer 7 (KB947864)"
  "Correctif pour Windows XP (KB952287)"
  "DivX Codec"
  "DivX Converter"
  "DivX Converter"
  "DivX Player"
  "DivX Plus DirectShow Filters"
  "DivX Version Checker"
  "DivX Web Player"
  "Détecteur de flux Windows Live Toolbar (Windows Live Toolbar)"
  "eMule Plus 1.2d"
  "EPSON Attach To Email"
  "EPSON Attach To Email"
  "EPSON Easy Photo Print"
  "EPSON File Manager"
  "EPSON Logiciel imprimante"
  "EPSON Scan Assistant"
  "EPSON Web-To-Page"
  "Extension de Windows Live Toolbar (Windows Live Toolbar)"
  "filehippo.com Update Checker"
  "Galerie de photos Windows Live"
  "Google Toolbar for Internet Explorer"
  "Guide d'utilisation ESPR240"
  "H.264 Decoder"
  "High Definition Audio Driver Package - KB888111"
  "HijackThis 2.0.2"
  "Hotfix for Windows Media Format 11 SDK (KB929399)"
  "Hotfix for Windows XP (KB915800-v4)"
  "Le Mystère de la Momie"
  "Lecteur Windows Media 11"
  "Les Chevaliers de Baphomet - Le Manuscrit de Voynich"
  "LightScribe 1.4.124.1"
  "Macrogaming SweetIM 2.1"
  "Managed DirectX (0901)"
  "Menus intelligents (Windows Live Toolbar)"
  "Messenger Plus! Live & Sponsor (CiD)"
  "Micro Application - Cartes de visite"
  "Microsoft .NET Framework 1.1 French Language Pack"
  "Microsoft .NET Framework 1.1 Hotfix (KB928366)"
  "Microsoft .NET Framework 1.1"
  "Microsoft .NET Framework 1.1"
  "Microsoft .NET Framework 2.0 Language Pack - FRA"
  "Microsoft .NET Framework 2.0 Service Pack 1"
  "Microsoft Compression Client Pack 1.0 for Windows XP"
  "Microsoft Internationalized Domain Names Mitigation APIs"
  "Microsoft National Language Support Downlevel APIs"
  "Microsoft Silverlight"
  "Microsoft SQL Server 2005 Compact Edition [ENU]"
  "Microsoft User-Mode Driver Framework Feature Pack 1.0"
  "Microsoft Visual C++ 2005 Redistributable"
  "Microsoft Visual C++ 2005 Redistributable"
  "Microsoft XML Parser"
  "Microsoft XML Parser"
  "Mise à jour de sécurité pour Lecteur Windows Media (KB911564)"
  "Mise à jour de sécurité pour Lecteur Windows Media (KB952069)"
  "Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)"
  "Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)"
  "Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)"
  "Mise à jour de sécurité pour Lecteur Windows Media 9 (KB936782)"
  "Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)"
  "Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)"
  "Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)"
  "Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)"
  "Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)"
  "Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)"
  "Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)"
  "Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)"
  "Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)"
  "Mise à jour de sécurité pour Windows XP (KB938464)"
  "Mise à jour de sécurité pour Windows XP (KB941569)"
  "Mise à jour de sécurité pour Windows XP (KB946648)"
  "Mise à jour de sécurité pour Windows XP (KB950760)"
  "Mise à jour de sécurité pour Windows XP (KB950762)"
  "Mise à jour de sécurité pour Windows XP (KB950974)"
  "Mise à jour de sécurité pour Windows XP (KB951066)"
  "Mise à jour de sécurité pour Windows XP (KB951376-v2)"
  "Mise à jour de sécurité pour Windows XP (KB951376)"
  "Mise à jour de sécurité pour Windows XP (KB951698)"
  "Mise à jour de sécurité pour Windows XP (KB951748)"
  "Mise à jour de sécurité pour Windows XP (KB952954)"
  "Mise à jour de sécurité pour Windows XP (KB953839)"
  "Mise à jour de sécurité pour Windows XP (KB954211)"
  "Mise à jour de sécurité pour Windows XP (KB954459)"
  "Mise à jour de sécurité pour Windows XP (KB954600)"
  "Mise à jour de sécurité pour Windows XP (KB955069)"
  "Mise à jour de sécurité pour Windows XP (KB956391)"
  "Mise à jour de sécurité pour Windows XP (KB956802)"
  "Mise à jour de sécurité pour Windows XP (KB956803)"
  "Mise à jour de sécurité pour Windows XP (KB956841)"
  "Mise à jour de sécurité pour Windows XP (KB957095)"
  "Mise à jour de sécurité pour Windows XP (KB957097)"
  "Mise à jour de sécurité pour Windows XP (KB958644)"
  "Mise à jour de sécurité pour Windows XP (KB958687)"
  "Mise à jour pour Windows XP (KB951072-v2)"
  "Mise à jour pour Windows XP (KB951978)"
  "Mise à jour pour Windows XP (KB955839)"
  "MKV Splitter"
  "Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA"
  "Mozilla Firefox (3.0.5)"
  "MSN"
  "MSXML 4.0 SP2 (KB936181)"
  "MSXML 4.0 SP2 (KB954430)"
  "Navigation par onglets (Windows Live Toolbar)"
  "Nero 8"
  "neroxml"
  "NTI Backup NOW! 4"
  "NTI Backup NOW! 4"
  "NTI CD & DVD-Maker"
  "NTI CD & DVD-Maker"
  "NVIDIA GAME System Software 2.8.1"
  "OneCare Advisor (Windows Live Toolbar)"
  "OpenOffice.org 2.3"
  "Orange - Logiciels Internet"
  "Panda ActiveScan 2.0"
  "PhotoFiltre"
  "PowerDVD"
  "QuickTime"
  "RealPlayer"
  "Realtek AC'97 Audio"
  "Security Update for CAPICOM (KB931906)"
  "Security Update for CAPICOM (KB931906)"
  "Shockwave Director 10.4"
  "Shockwave Flash"
  "SiSAGP driver"
  "Skins"
  "Spybot - Search & Destroy"
  "SweetIM For Internet Explorer 3.0b"
  "Tomb Raider: Underworld 1.0"
  "VC80CRTRedist - 8.0.50727.762"
  "VCRedistSetup"
  "WebFldrs XP"
  "Windows Genuine Advantage Validation Tool (KB892130)"
  "Windows Genuine Advantage Validation Tool (KB892130)"
  "Windows Imaging Component"
  "Windows Internet Explorer 7"
  "Windows Live Favorites pour Windows Live Toolbar"
  "Windows Live installer"
  "Windows Live Messenger"
  "Windows Live Toolbar"
  "Windows Live Toolbar"
  "Windows Media Format 11 runtime"
  "Windows Media Format 11 runtime"
  "Windows Media Player 11"
  "Windows Search 4.0"
  "Windows XP Service Pack 3"
  "winvi (remove only) "
  "Yahoo! Toolbar"
  hex(2):45,00,53,00,45,00,54,00,20,00,4f,00,6e,00,6c,00,69,00,6e,\
  
  C:\Program Files\Acer
  C:\Program Files\Acer TV-FM
  C:\Program Files\Acer WLAN 11g USB Dongle
  C:\Program Files\Adobe
  C:\Program Files\antivirus
  C:\Program Files\ATI Technologies
  C:\Program Files\Avira
  C:\Program Files\CCleaner
  C:\Program Files\Corel
  C:\Program Files\CyberLink
  C:\Program Files\directx
  C:\Program Files\DivX
  C:\Program Files\Eidos
  C:\Program Files\Eidos Interactive
  C:\Program Files\elephant.jpg
  C:\Program Files\eMule
  C:\Program Files\eMulePlus-1.2d.Installer.exe
  C:\Program Files\Enigma Software Group
  C:\Program Files\EPSON
  C:\Program Files\EsetOnlineScanner
  C:\Program Files\Fichiers communs
  C:\Program Files\filehippo.com
  C:\Program Files\Firefox Setup 2.0.0.14.exe
  C:\Program Files\Focus
  C:\Program Files\Google
  C:\Program Files\Internet Explorer
  C:\Program Files\Lavasoft
  C:\Program Files\Macrogaming
  C:\Program Files\Malwarebytes' Anti-Malware
  C:\Program Files\Managed DirectX (0901)
  C:\Program Files\Messenger
  C:\Program Files\Messenger Plus! Live
  C:\Program Files\Micro Application
  C:\Program Files\Microsoft CAPICOM 2.1.0.2
  C:\Program Files\microsoft frontpage
  C:\Program Files\Microsoft Silverlight
  C:\Program Files\Microsoft SQL Server Compact Edition
  C:\Program Files\Movie Maker
  C:\Program Files\Mozilla Firefox
  C:\Program Files\MSN
  C:\Program Files\MSN Gaming Zone
  C:\Program Files\MSXML 4.0
  C:\Program Files\Nero
  C:\Program Files\NetMeeting
  C:\Program Files\NewTech Infosystems
  C:\Program Files\Norton AntiVirus
  C:\Program Files\Oberon Media
  C:\Program Files\Oca History Tool
  C:\Program Files\Online Services
  C:\Program Files\OpenOffice.org 2.3
  C:\Program Files\orange
  C:\Program Files\Orange HSS
  C:\Program Files\Outlook Express
  C:\Program Files\Panda Security
  C:\Program Files\PhotoFiltre
  C:\Program Files\QuickTime
  C:\Program Files\Real
  C:\Program Files\Realtek AC97
  C:\Program Files\Services en ligne
  C:\Program Files\Spybot - Search & Destroy
  C:\Program Files\Sunbelt Software
  C:\Program Files\Techcity
  C:\Program Files\THQ
  C:\Program Files\Trend Micro
  C:\Program Files\Windows Desktop Search
  C:\Program Files\Windows Live
  C:\Program Files\Windows Live Favorites
  C:\Program Files\windows live photo
  C:\Program Files\Windows Live Toolbar
  C:\Program Files\Windows Media Connect 2
  C:\Program Files\Windows Media Player
  C:\Program Files\Windows NT
  C:\Program Files\xerox
  C:\Program Files\Yahoo!
  C:\Program Files\Zylom Games
  
  0
  
  Réagir
Réponse 7 / 32
eZula Contributeur
hé bien retélécharge GenProc http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip lance-le. S'il propose un rapport autre qu'un simple scan en ligne, poste-le. Sinon poste le contenu du fichier GenProc\outil\uninstall.html

0

Réagir
1. belette88
  
  Rapport GenProc 2.336 [1] - 17/01/2009 - Windows XP
  
  GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :
  
  Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
  - coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
  - C:\Program Files\EsetOnlineScanner\log.txt
  
  __________________________________________________________________________________________________________
  
  Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
  
  0
  
  Réagir

eZula Contributeur

non le problème c'est qu'il est sali ton Firefox, regarde le log combofix

FF - prefs.js: browser.search.defaulturl - hxxp://www2.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search
FF - prefs.js: browser.startup.homepage - hxxp://www.w-w-w-dot-com.com/start.php
FF - prefs.js: keyword.URL - hxxp://www2.yoog.com/search.php?q=
FF - component: c:\program files\Mozilla Firefox\components\nsdcads.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll

---- PARAMETRES FIREFOX ----
FF - user.js: network.proxy.type - 0
FF - user.js: browser.shell.checkDefaultBrowser - false
FF - user.js: browser.search.selectedEngine - Yoog Search
FF - user.js: keyword.URL - hxxp://www2.yoog.com/search.php?q=
FF - user.js: keyword.enabled - true
FF - user.js: browser.search.defaultenginename - Yoog Search
FF - user.js: browser.search.defaulturl - hxxp://www2.yoog.com/search.php?q=

YoogSearch c'est pas franchement recommandable. Supprimer FF et son profil permettra de retrouver un navigateur sain, car bien évidemment l'idée après c'est de le réinstaller.

Peux-tu poster le contenu du fichier internet GenProc\outi`\uninstall.html ? (attention pas le fichier batch, le fichier internet)

belette88
ou je les trouve pour les supprimer et comment je trouve le fichier internet genproc

0

Réagir

Réponse 9 / 32
eZula Contributeur
Tu y tiens à Firefox, avec sa configuration actuelle ? je veux dire, si on le supprime mais que tu restaures ses marque-pages, ça te poserait un problème (tu perdrais les mots de passe, le thème, les modules complémentaires.. sauf les marque-pages)

0

Réagir
1. belette88
  
  c mon moteur de recherche j'utise pas exploreur internet donc oui j'y tien. les virus c'est a cause ke je garde mes mot de passe en memoire? si c ca alors tampi pour les mot de passe, c'etai pour pa les oublié. je doi faire koi
  
  0
  
  Réagir
Réponse 10 / 32
eZula Contributeur
Qu'est-ce que tu vois dans ce dossier c:\documents and settings\All Users\Application Data\533936372 ?

0

Réagir
1. belette88
  
  3 fichiers : config.udb , init.udb , langs.udb
  
  0
  
  Réagir
Réponse 11 / 32
eZula Contributeur
Bon, il m'énerve ce driver, pas le précédent mais ce DMSKSSRh.sys. Ca n'a rien à faire dans un répertoire de fichiers temporaires.

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes en italique :

Driver::
DMSKSSRh

File::
c:\docume~1\LAUREN~1\LOCALS~1\Temp\DMSKSSRh.sys

Enregistre ce fichier sous le nom CFScript

[*]Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture [img]http://apu.mabul.org/up/apu/2008/08/12/img-191202xzrpd.gif[/img]
[*]Une fenêtre bleue va apparaître : au message "Type 1 to continue, or 2 to abort", tape 1 puis valide.
[*]Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal.
Ne touche à rien tant que le scan n'est pas terminé.
[*]Une fois le scan achevé, un rapport va s'afficher : poste son contenu.
[*]Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

0

Réagir
1. belette88
  
  ComboFix 09-01-17.02 - laurent anais 2009-01-17 20:49:05.2 - NTFSx86
  Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1023.197 [GMT 1:00]
  Lancé depuis: c:\documents and settings\laurent anais\Bureau\ComboFix.exe
  Commutateurs utilisés :: c:\documents and settings\laurent anais\Bureau\CFScript
  AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Outdated)
  * Un nouveau point de restauration a été créé
  
  FILE ::
  c:\docume~1\LAUREN~1\LOCALS~1\Temp\DMSKSSRh.sys
  .
  
  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  c:\windows\admintxt.txt
  c:\windows\service.exe
  
  .
  ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  -------\Legacy_DMSKSSRH
  -------\Service_DMSKSSRh
  
  ((((((((((((((((((((((((((((( Fichiers créés du 2008-12-17 au 2009-01-17 ))))))))))))))))))))))))))))))))))))
  .
  
  2009-01-14 20:10 . 2009-01-14 20:10 88 -r-hs---- c:\windows\system32\77AD716965.sys
  2009-01-14 19:27 . 2009-01-14 19:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Corel
  2009-01-14 19:23 . 2009-01-14 19:25 <REP> d-------- c:\program files\Fichiers communs\Corel
  2009-01-14 19:11 . 2009-01-14 19:11 <REP> d-------- c:\program files\PhotoFiltre
  2009-01-14 19:00 . 2009-01-14 19:00 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Windows Search
  2009-01-14 18:02 . 2009-01-14 18:02 <REP> d-------- c:\windows\system32\GroupPolicy
  2009-01-14 18:02 . 2009-01-14 18:02 <REP> d-------- c:\program files\Windows Desktop Search
  2009-01-14 18:02 . 2009-01-14 18:02 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Windows Desktop Search
  2009-01-14 18:01 . 2008-03-07 18:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
  2009-01-14 18:01 . 2008-03-07 18:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
  2009-01-14 18:01 . 2008-03-07 18:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
  2009-01-13 23:02 . 2003-03-16 00:15 90,112 --a------ c:\windows\unvise32.exe
  2009-01-13 22:52 . 2009-01-13 22:52 <REP> d-------- c:\program files\THQ
  2009-01-13 22:12 . 2009-01-13 22:12 <REP> d-------- c:\program files\Microsoft Silverlight
  2009-01-13 21:21 . 2009-01-13 21:21 <REP> d-------- c:\program files\filehippo.com
  2009-01-13 18:34 . 2009-01-17 16:02 <REP> d----c--- C:\Baphomet
  2009-01-13 18:14 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
  2009-01-13 18:13 . 2009-01-13 18:13 <REP> d-------- c:\program files\Panda Security
  2009-01-12 22:02 . 2009-01-14 18:53 <REP> d-------- c:\program files\Trend Micro
  2009-01-12 21:41 . 2009-01-12 21:41 579,584 --a------ c:\windows\system32\dllcache\user32.dll
  2009-01-12 21:39 . 2009-01-14 19:42 <REP> d-------- c:\windows\ERUNT
  2009-01-12 21:39 . 2009-01-17 12:16 <REP> d----c--- C:\Backups
  2009-01-11 21:34 . 2009-01-11 22:02 <REP> d-------- c:\program files\Spybot - Search & Destroy
  2009-01-11 21:34 . 2009-01-12 21:54 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
  2009-01-11 21:29 . 2009-01-11 21:29 <REP> d-------- c:\program files\Yahoo!
  2009-01-11 21:29 . 2009-01-11 21:29 <REP> d-------- c:\program files\CCleaner
  2009-01-11 21:29 . 2009-01-11 21:29 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Yahoo!
  2009-01-11 21:29 . 2009-01-14 17:55 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
  2009-01-11 21:07 . 2009-01-11 21:07 <REP> d-------- c:\windows\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
  2009-01-11 21:07 . 2009-01-11 21:11 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Deskbar_{80FA45F7-B41F-470c-86A3-A38414374191}
  2009-01-11 20:50 . 2009-01-11 21:01 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
  2009-01-11 20:50 . 2009-01-11 20:50 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
  2009-01-11 20:40 . 2009-01-11 20:40 <REP> d-------- c:\program files\Enigma Software Group
  2009-01-11 16:23 . 2009-01-11 16:23 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
  2009-01-11 14:26 . 2009-01-13 17:18 <REP> d-------- c:\documents and settings\All Users\Application Data\533936372
  2009-01-11 12:13 . 2009-01-11 12:13 268 --ah-c--- C:\sqmdata14.sqm
  2009-01-11 12:13 . 2009-01-11 12:13 244 --ah-c--- C:\sqmnoopt14.sqm
  2009-01-10 11:46 . 2009-01-10 11:46 268 --ah-c--- C:\sqmdata13.sqm
  2009-01-10 11:46 . 2009-01-10 11:46 244 --ah-c--- C:\sqmnoopt13.sqm
  2009-01-07 21:49 . 2009-01-07 21:49 <REP> d----c--- C:\TMOTM
  2009-01-07 21:44 . 2004-04-16 20:24 61,440 --a------ c:\windows\system32\ISUSPM.cpl
  2009-01-01 17:52 . 2009-01-01 17:52 <REP> d----c--- C:\MicroGaming
  2008-12-27 23:09 . 2008-12-27 23:09 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Games
  2008-12-27 23:09 . 2008-12-27 23:09 <REP> d-------- c:\documents and settings\All Users\Application Data\InstallShield
  2008-12-27 23:08 . 2008-12-27 23:08 <REP> d-------- c:\windows\system32\AGEIA
  2008-12-27 23:00 . 2008-12-27 23:00 <REP> d-------- c:\program files\Focus
  2008-12-26 19:03 . 2008-12-26 19:03 244 --ah-c--- C:\sqmnoopt12.sqm
  2008-12-26 19:03 . 2008-12-26 19:03 232 --ah-c--- C:\sqmdata12.sqm
  
  .
  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2009-01-17 19:55 --------- d-----w c:\documents and settings\laurent anais\Application Data\OpenOffice.org2
  2009-01-14 19:10 --------- d-----w c:\documents and settings\laurent anais\Application Data\Corel
  2009-01-14 18:23 --------- d-----w c:\program files\Corel
  2009-01-11 15:28 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
  2009-01-11 15:25 --------- d-----w c:\program files\Lavasoft
  2009-01-11 13:23 --------- d--h--w c:\program files\InstallShield Installation Information
  2009-01-09 20:36 --------- d-----w c:\program files\DivX
  2009-01-04 17:54 2,516 --sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
  2009-01-04 17:53 88 --sh--r c:\documents and settings\All Users\Application Data\77AD716965.sys
  2008-12-27 22:08 279,712 ----a-w c:\windows\system32\drivers\atksgt.sys
  2008-12-27 22:08 25,888 ----a-w c:\windows\system32\drivers\lirsgt.sys
  2008-12-23 18:42 3,532 -c--a-w C:\drmHeader.bin
  2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
  2008-12-03 20:57 --------- d-----w c:\program files\Micro Application
  2008-11-28 17:10 --------- d-----w c:\documents and settings\laurent anais\Application Data\InstallShield
  2008-11-28 17:08 --------- d-----w c:\program files\Eidos
  2008-06-20 17:06 5,632 --sha-w c:\program files\Thumbs.db
  2008-06-16 19:23 2,648,090 ----a-w c:\program files\eMulePlus-1.2d.Installer.exe
  2008-05-16 18:42 6,115,448 ----a-w c:\program files\Firefox Setup 2.0.0.14.exe
  2008-05-15 18:10 35,203 ----a-w c:\program files\elephant.jpg
  2008-02-19 20:18 47,360 ----a-w c:\documents and settings\laurent anais\Application Data\pcouffin.sys
  2009-01-05 13:04 650,240 ----a-w c:\program files\mozilla firefox\components\nsdcads.dll
  2007-08-15 21:39 56 --sh--r c:\windows\system32\656971AD77.sys
  2008-08-30 15:34 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008083020080831\index.dat
  .
  
  ((((((((((((((((((((((((((((( snapshot@2009-01-15_19.28.42.03 )))))))))))))))))))))))))))))))))))))))))
  .
  + 2009-01-15 19:05:35 27,136 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\c6772fd12a581ad3be49e3f2a80b5622\Accessibility.ni.dll
  + 2009-01-15 19:05:39 884,736 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\a1d353edc300e3aff0784202f68a657b\AspNetMMCExt.ni.dll
  + 2009-01-15 19:05:41 237,568 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\c10ec9b4de2b366236ec83237dc31281\CustomMarshalers.ni.dll
  + 2009-01-15 19:05:40 15,360 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\837fe02bdcf637d5bf1e5ffb935ebb80\dfsvc.ni.exe
  + 2009-01-15 19:05:44 876,544 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\9710a3c0d11dd264c3a6b88977699e9b\Microsoft.Build.Engine.ni.dll
  + 2009-01-15 19:05:45 81,920 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\e2858a45971fb30b0c0523dbb52c1d4e\Microsoft.Build.Framework.ni.dll
  + 2009-01-15 19:05:50 1,695,744 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\63d69ffdf3c640d2d104a4b74e8115f8\Microsoft.Build.Tasks.ni.dll
  + 2009-01-15 19:05:51 167,936 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\11cb5418c06e30100616fbf205588489\Microsoft.Build.Utilities.ni.dll
  + 2009-01-15 19:05:55 1,740,800 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\923bd55258380eae77353d36a5a1b08f\Microsoft.VisualBasic.ni.dll
  + 2009-01-15 19:05:57 1,011,712 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\eee9b48577689e92db5a7b5c5de98d9b\System.Configuration.ni.dll
  + 2009-01-15 19:06:00 1,798,144 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\c7dea4895e1fa33d65e448c03de48d26\System.Deployment.ni.dll
  + 2009-01-15 19:06:03 1,224,704 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\914668b240550f529e54bb772c6fc881\System.DirectoryServices.ni.dll
  + 2009-01-15 19:06:05 512,000 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\f11bc82c09955cb8438d3885a99c297d\System.DirectoryServices.Protocols.ni.dll
  + 2009-01-15 19:06:07 659,456 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\646131eda5f21f4e6216733d49c22c56\System.EnterpriseServices.ni.dll
  + 2009-01-15 19:06:07 294,912 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\646131eda5f21f4e6216733d49c22c56\System.EnterpriseServices.Wrapper.dll
  + 2009-01-15 19:06:09 733,184 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\2b5994269cc5b996231c9b21afea9a91\System.Security.ni.dll
  + 2009-01-15 19:06:10 233,472 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\193ac978af569ad9ee45110b359961b9\System.ServiceProcess.ni.dll
  + 2009-01-15 19:06:12 679,936 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\12e0aa1030badf4524f897e3f57b037a\System.Transactions.ni.dll
  + 2009-01-15 19:06:42 2,342,912 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\37d87b3cab1c66ec4430ebb2abeaa570\System.Web.Mobile.ni.dll
  + 2009-01-15 19:06:43 237,568 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\b5b81faf46fc63c20d5339b36edd02fa\System.Web.RegularExpressions.ni.dll
  + 2009-01-15 19:06:47 1,986,560 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\38991368499e2109ea4099a0fe29c5a3\System.Web.Services.ni.dll
  + 2009-01-15 19:06:37 12,509,184 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\67cfb70213562afe2ca9b9066764af3a\System.Web.ni.dll
  .
  ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
  "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
  "SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-10-23 202024]
  "filehippo.com"="c:\program files\filehippo.com\UpdateChecker.exe" [2008-12-31 146432]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "LaunchApp"="Alaunch" [X]
  "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
  "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-12 45056]
  "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
  "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
  "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
  "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
  "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
  "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-04-28 401408]
  "AspireService"="c:\program files\Acer\Acer eMode Management\AspireService.exe" [2006-06-09 110592]
  "MediaSync"="c:\program files\Acer\Acer eConsole\MediaSync.exe" [2006-05-04 425984]
  "PCMService"="c:\program files\Acer TV-FM\PCMService.exe" [2006-03-29 143360]
  "ImageItEncrypt"="c:\windows\system32\ImageItEncrypt.exe" [2005-12-30 40960]
  "EPSON Stylus Photo R240 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE" [2005-04-25 98304]
  "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-07 77824]
  "ORAHSSSessionManager"="c:\program files\Orange HSS\SessionManager\SessionManager.exe" [2007-07-24 102400]
  "NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
  "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
  "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497]
  "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
  "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-07-18 185896]
  "SystrayORAHSS"="c:\program files\Orange HSS\Systray\SystrayApp.exe" [2007-07-24 94208]
  "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-04-17 196608]
  "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
  "Corel Photo Downloader"="c:\program files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-28 531272]
  "SiSPower"="SiSPower.dll" [2005-07-13 c:\windows\system32\SiSPower.dll]
  "AGRSMMSG"="AGRSMMSG.exe" [2004-04-13 c:\windows\AGRSMMSG.exe]
  "SoundMan"="SOUNDMAN.EXE" [2005-08-16 c:\windows\SOUNDMAN.EXE]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
  
  c:\documents and settings\laurent anais\Menu D‚marrer\Programmes\D‚marrage\
  OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]
  
  c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
  Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
  Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
  Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
  
  [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
  "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
  "msacm.dvacm"= c:\progra~1\FICHIE~1\ULEADS~1\vio\dvacm.acm
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "c:\\Program Files\\Acer TV-FM\\PowerCinema.exe"=
  "c:\\Program Files\\Acer TV-FM\\PCMService.exe"=
  "c:\\Program Files\\Messenger\\msmsgs.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "c:\\Program Files\\eMule\\eMule.exe"=
  "c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=
  "c:\\WINDOWS\\system32\\dpvsetup.exe"=
  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  "c:\\Program Files\\Fichiers communs\\Nero\\Nero Web\\SetupX.exe"=
  "c:\\Program Files\\Orange HSS\\Connectivity\\ConnectivityManager.exe"=
  
  R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-13 28544]
  S3 CAM1210;SM0121 USB 2.0 Video Camera;c:\windows\system32\drivers\cam1210.sys [2006-07-24 89856]
  .
  Contenu du dossier 'Tâches planifiées'
  
  2009-01-17 c:\windows\Tasks\Update Checker.job
  - c:\progra~1\FILEHI~1.COM\UPDATE~1.EXE [2008-12-31 12:22]
  
  2009-01-17 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
  - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
  .
  .
  ------- Examen supplémentaire -------
  .
  mWindow Title =
  IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
  IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
  IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?8bebaba9299846cd8b3462399d909966
  IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?8bebaba9299846cd8b3462399d909966
  TCP: {6560E730-C9E6-4205-8C89-8699C603188E} = 192.168.1.1
  
  O16 -: {D5D30A68-E230-49D9-B4D5-BF7532692945} - hxxps://clients.cdiscount.com/ediag/activex/CDiscount.cab
  c:\windows\Downloaded Program Files\CDiscount.inf
  FF - ProfilePath - c:\documents and settings\laurent anais\Application Data\Mozilla\Firefox\Profiles\suite.User0\
  FF - prefs.js: browser.search.defaulturl - hxxp://www2.yoog.com/search.php?q=
  FF - prefs.js: browser.search.selectedEngine - Yoog Search
  FF - prefs.js: browser.startup.homepage - hxxp://www.w-w-w-dot-com.com/start.php
  FF - prefs.js: keyword.URL - hxxp://www2.yoog.com/search.php?q=
  FF - component: c:\program files\Mozilla Firefox\components\nsdcads.dll
  FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
  
  ---- PARAMETRES FIREFOX ----
  FF - user.js: network.proxy.type - 0
  FF - user.js: browser.shell.checkDefaultBrowser - false
  FF - user.js: browser.search.selectedEngine - Yoog Search
  FF - user.js: keyword.URL - hxxp://www2.yoog.com/search.php?q=
  FF - user.js: keyword.enabled - true
  FF - user.js: browser.search.defaultenginename - Yoog Search
  FF - user.js: browser.search.defaulturl - hxxp://www2.yoog.com/search.php?q=
  .
  
  **************************************************************************
  
  catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2009-01-17 20:55:03
  Windows 5.1.2600 Service Pack 3 NTFS
  
  Recherche de processus cachés ...
  
  Recherche d'éléments en démarrage automatique cachés ...
  
  Recherche de fichiers cachés ...
  
  Scan terminé avec succès
  Fichiers cachés: 0
  
  **************************************************************************
  .
  --------------------- CLES DE REGISTRE BLOQUEES ---------------------
  
  [HKEY_USERS\S-1-5-21-430353115-455240563-1979012898-1006\Software\Microsoft\SystemCertificates\AddressBook*]
  @Allowed: (Read) (RestrictedCode)
  @Allowed: (Read) (RestrictedCode)
  .
  --------------------- DLLs chargées dans les processus actifs ---------------------
  
  - - - - - - - > 'winlogon.exe'(708)
  c:\windows\system32\Ati2evxx.dll
  .
  ------------------------ Autres processus actifs ------------------------
  .
  c:\windows\system32\ati2evxx.exe
  c:\windows\system32\ati2evxx.exe
  c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  c:\program files\Acer\Acer eConsole\MediaServerService.exe
  c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
  c:\program files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
  c:\program files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
  c:\program files\Fichiers communs\France Telecom\Shared Modules\FTRTSVC\[u]0/u\FTRTSVC.exe
  c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
  c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
  c:\windows\system32\PSIService.exe
  c:\windows\system32\searchindexer.exe
  c:\program files\Acer TV-FM\Kernel\TV\CLSched.exe
  c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
  c:\program files\OpenOffice.org 2.3\program\soffice.exe
  c:\program files\OpenOffice.org 2.3\program\soffice.bin
  c:\program files\Fichiers communs\Nero\Lib\NMIndexingService.exe
  c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
  c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
  c:\program files\Windows Live\Messenger\usnsvc.exe
  .
  **************************************************************************
  .
  Heure de fin: 2009-01-17 20:58:54 - La machine a redémarré
  ComboFix-quarantined-files.txt 2009-01-17 19:58:50
  ComboFix2.txt 2009-01-15 18:29:49
  
  Avant-CF: 32 750 424 064 octets libres
  Après-CF: 32,753,180,672 octets libres
  
  272 --- E O F --- 2008-12-18 22:08:36
  
  0
  
  Réagir
Réponse 12 / 32
eZula Contributeur
virustotal c:\windows\system32\77AD716965.sys

0

Réagir
1. belette88
  
  Fichier 77AD716965.sys reçu le 2009.01.17 20:27:09 (CET)
  Antivirus Version Dernière mise à jour Résultat
  a-squared 4.0.0.73 2009.01.17 -
  AhnLab-V3 2009.1.15.0 2009.01.17 -
  AntiVir 7.9.0.57 2009.01.17 -
  Authentium 5.1.0.4 2009.01.16 -
  Avast 4.8.1281.0 2009.01.16 -
  AVG 8.0.0.229 2009.01.16 -
  BitDefender 7.2 2009.01.17 -
  CAT-QuickHeal 10.00 2009.01.17 -
  ClamAV 0.94.1 2009.01.17 -
  Comodo 934 2009.01.17 -
  DrWeb 4.44.0.09170 2009.01.17 -
  eSafe 7.0.17.0 2009.01.15 -
  eTrust-Vet 31.6.6312 2009.01.17 -
  F-Prot 4.4.4.56 2009.01.16 -
  F-Secure 8.0.14470.0 2009.01.17 -
  Fortinet 3.117.0.0 2009.01.15 -
  GData 19 2009.01.17 -
  Ikarus T3.1.1.45.0 2009.01.17 -
  K7AntiVirus 7.10.594 2009.01.17 -
  Kaspersky 7.0.0.125 2009.01.17 -
  McAfee 5498 2009.01.17 -
  McAfee+Artemis 5498 2009.01.17 -
  Microsoft None 2009.01.17 -
  NOD32 3773 2009.01.17 -
  Norman 5.93.01 2009.01.16 -
  nProtect 2009.1.8.0 2009.01.16 -
  Panda 9.5.1.2 2009.01.17 -
  PCTools 4.4.2.0 2009.01.17 -
  Rising 21.12.52.00 2009.01.17 -
  SecureWeb-Gateway 6.7.6 2009.01.17 -
  Sophos 4.37.0 2009.01.17 -
  Sunbelt 3.2.1835.2 2009.01.16 -
  Symantec 10 2009.01.17 -
  TheHacker 6.3.1.5.221 2009.01.17 -
  TrendMicro 8.700.0.1004 2009.01.16 -
  VBA32 3.12.8.10 2009.01.17 -
  ViRobot 2009.1.17.1563 2009.01.17 -
  VirusBuster 4.5.11.0 2009.01.17 -
  Information additionnelle
  File size: 88 bytes
  MD5...: 1ffa379c00b57de94e108d48733a9857
  SHA1..: 64d7f85b6917cc6c5a537ee5de047b16cad0b309
  SHA256: d678afc538aa20781f2e867d04186a7d41d73beb3fdcaa1292a10634f4f0d712
  SHA512: b5ab2f36d28bb9cb43c5653ec9deb67c887bb4eef9289adf5d9f217b3f63a3a0<br>730be5cf06b030a41c77831e0737756cbc1bc090c2790f808a31170325f09eff<br>
  ssdeep: 3:hl/hdYf6NrMn:9dRNrMn<br>
  PEiD..: -
  TrID..: File type identification<br>MS Flight Simulator Aircraft Performance Info (100.0%)
  PEInfo: -
  
  0
  
  Réagir
Réponse 13 / 32
eZula Contributeur
ce fichier sur virustotal c:\windows\system32\77AD716965.sys ?

commen tu as fait pour ramasser toutes ces saletés ?

0

Réagir
1. belette88
  
  c'est bizzar il a ete cree le 14/ 01 /2009 comment g pu encore en avoir. il fau ke je le suprime?
  ca fai seulement un an ke j'ai internet et g toujours eu cet antivirus par au debut je les supprimé au lieu de les mettre en quarantine et je mettait appliqué pour les autre esque ke ca applique pour tou le ten ou juste pendan ce scanne
  
  0
  
  Réagir
Réponse 14 / 32
eZula Contributeur
[*] Télécharge [url=http://download.bleepingcomputer.com/sUBs/ComboFix.exe][color=red][b]combofix.exe[/b][/color][/url] (sUBs) sur ton Bureau
[*] Double clique [b]combofix.exe[/b].
[*] Tape sur la touche [b]Y[/b] (Yes) pour démarrer le scan.
[*] Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

[b][u]NOTE :[/b][/u] Le rapport se trouve également ici : C:\[b]Combofix.txt[/b]

0

Réagir
1. belette88
  
  ComboFix 09-01-13.04 - laurent anais 2009-01-15 19:18:10.1 - NTFSx86
  Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1023.370 [GMT 1:00]
  Lancé depuis: c:\documents and settings\laurent anais\Bureau\ComboFix.exe
  AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Outdated)
  * Un nouveau point de restauration a été créé
  .
  
  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  c:\documents and settings\laurent anais\Application Data\inst.exe
  c:\documents and settings\laurent anais\Bureau\System Security.lnk
  c:\documents and settings\laurent anais\Menu Démarrer\Programmes\System Security
  c:\documents and settings\laurent anais\Menu Démarrer\Programmes\System Security\System Security.lnk
  c:\windows\Downloaded Program Files\setup.inf
  c:\windows\system32\404Fix.exe
  c:\windows\system32\cont_dcads-remove.exe
  c:\windows\system32\dumphive.exe
  c:\windows\system32\IEDFix.C.exe
  c:\windows\system32\IEDFix.exe
  c:\windows\system32\o4Patch.exe
  c:\windows\system32\Process.exe
  c:\windows\system32\SrchSTS.exe
  c:\windows\system32\tmp.reg
  c:\windows\system32\VACFix.exe
  c:\windows\system32\VCCLSID.exe
  c:\windows\system32\WS2Fix.exe
  
  .
  ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  -------\Legacy_BOONTY_GAMES
  -------\Service_Boonty Games
  
  ((((((((((((((((((((((((((((( Fichiers créés du 2008-12-15 au 2009-01-15 ))))))))))))))))))))))))))))))))))))
  .
  
  2009-01-14 20:10 . 2009-01-14 20:10 88 -r-hs---- c:\windows\system32\77AD716965.sys
  2009-01-14 19:27 . 2009-01-14 19:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Corel
  2009-01-14 19:23 . 2009-01-14 19:25 <REP> d-------- c:\program files\Fichiers communs\Corel
  2009-01-14 19:11 . 2009-01-14 19:11 <REP> d-------- c:\program files\PhotoFiltre
  2009-01-14 19:00 . 2009-01-14 19:00 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Windows Search
  2009-01-14 18:02 . 2009-01-14 18:02 <REP> d-------- c:\windows\system32\GroupPolicy
  2009-01-14 18:02 . 2009-01-14 18:02 <REP> d-------- c:\program files\Windows Desktop Search
  2009-01-14 18:02 . 2009-01-14 18:02 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Windows Desktop Search
  2009-01-14 18:01 . 2008-03-07 18:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
  2009-01-14 18:01 . 2008-03-07 18:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
  2009-01-14 18:01 . 2008-03-07 18:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
  2009-01-14 18:01 . 2009-01-14 18:02 1,374 --a------ c:\windows\imsins.BAK
  2009-01-13 23:02 . 2003-03-16 00:15 90,112 --a------ c:\windows\unvise32.exe
  2009-01-13 22:52 . 2009-01-13 22:52 <REP> d-------- c:\program files\THQ
  2009-01-13 22:12 . 2009-01-13 22:12 <REP> d-------- c:\program files\Microsoft Silverlight
  2009-01-13 21:21 . 2009-01-13 21:21 <REP> d-------- c:\program files\filehippo.com
  2009-01-13 18:34 . 2009-01-14 21:22 <REP> d----c--- C:\Baphomet
  2009-01-13 18:14 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
  2009-01-13 18:13 . 2009-01-13 18:13 <REP> d-------- c:\program files\Panda Security
  2009-01-12 22:02 . 2009-01-14 18:53 <REP> d-------- c:\program files\Trend Micro
  2009-01-12 21:41 . 2009-01-12 21:41 579,584 --a------ c:\windows\system32\dllcache\user32.dll
  2009-01-12 21:39 . 2009-01-14 19:42 <REP> d-------- c:\windows\ERUNT
  2009-01-12 21:39 . 2009-01-12 21:51 <REP> d----c--- C:\Backups
  2009-01-11 21:34 . 2009-01-11 22:02 <REP> d-------- c:\program files\Spybot - Search & Destroy
  2009-01-11 21:34 . 2009-01-12 21:54 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
  2009-01-11 21:29 . 2009-01-11 21:29 <REP> d-------- c:\program files\Yahoo!
  2009-01-11 21:29 . 2009-01-11 21:29 <REP> d-------- c:\program files\CCleaner
  2009-01-11 21:29 . 2009-01-11 21:29 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Yahoo!
  2009-01-11 21:29 . 2009-01-14 17:55 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
  2009-01-11 21:07 . 2009-01-11 21:07 <REP> d-------- c:\windows\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
  2009-01-11 21:07 . 2009-01-11 21:11 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Deskbar_{80FA45F7-B41F-470c-86A3-A38414374191}
  2009-01-11 20:50 . 2009-01-11 21:01 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
  2009-01-11 20:50 . 2009-01-11 20:50 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
  2009-01-11 20:40 . 2009-01-11 20:40 <REP> d-------- c:\program files\Enigma Software Group
  2009-01-11 16:23 . 2009-01-11 16:23 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
  2009-01-11 14:26 . 2009-01-13 17:18 <REP> d-------- c:\documents and settings\All Users\Application Data\533936372
  2009-01-11 12:13 . 2009-01-11 12:13 268 --ah-c--- C:\sqmdata14.sqm
  2009-01-11 12:13 . 2009-01-11 12:13 244 --ah-c--- C:\sqmnoopt14.sqm
  2009-01-10 11:46 . 2009-01-10 11:46 268 --ah-c--- C:\sqmdata13.sqm
  2009-01-10 11:46 . 2009-01-10 11:46 244 --ah-c--- C:\sqmnoopt13.sqm
  2009-01-07 21:49 . 2009-01-07 21:49 <REP> d----c--- C:\TMOTM
  2009-01-07 21:44 . 2004-04-16 20:24 61,440 --a------ c:\windows\system32\ISUSPM.cpl
  2009-01-01 17:52 . 2009-01-01 17:52 <REP> d----c--- C:\MicroGaming
  2008-12-27 23:09 . 2008-12-27 23:09 <REP> d-------- c:\documents and settings\laurent anais\Application Data\Games
  2008-12-27 23:09 . 2008-12-27 23:09 <REP> d-------- c:\documents and settings\All Users\Application Data\InstallShield
  2008-12-27 23:08 . 2008-12-27 23:08 <REP> d-------- c:\windows\system32\AGEIA
  2008-12-27 23:00 . 2008-12-27 23:00 <REP> d-------- c:\program files\Focus
  2008-12-26 19:03 . 2008-12-26 19:03 244 --ah-c--- C:\sqmnoopt12.sqm
  2008-12-26 19:03 . 2008-12-26 19:03 232 --ah-c--- C:\sqmdata12.sqm
  
  .
  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2009-01-15 18:26 --------- d-----w c:\documents and settings\laurent anais\Application Data\OpenOffice.org2
  2009-01-14 19:10 --------- d-----w c:\documents and settings\laurent anais\Application Data\Corel
  2009-01-14 18:23 --------- d-----w c:\program files\Corel
  2009-01-11 15:28 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
  2009-01-11 15:25 --------- d-----w c:\program files\Lavasoft
  2009-01-11 13:23 --------- d--h--w c:\program files\InstallShield Installation Information
  2009-01-09 20:36 --------- d-----w c:\program files\DivX
  2009-01-04 17:54 2,516 --sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
  2009-01-04 17:53 88 --sh--r c:\documents and settings\All Users\Application Data\77AD716965.sys
  2008-12-27 22:08 279,712 ----a-w c:\windows\system32\drivers\atksgt.sys
  2008-12-27 22:08 25,888 ----a-w c:\windows\system32\drivers\lirsgt.sys
  2008-12-23 18:42 3,532 -c--a-w C:\drmHeader.bin
  2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
  2008-12-03 20:57 --------- d-----w c:\program files\Micro Application
  2008-11-28 17:10 --------- d-----w c:\documents and settings\laurent anais\Application Data\InstallShield
  2008-11-28 17:08 --------- d-----w c:\program files\Eidos
  2008-06-20 17:06 5,632 --sha-w c:\program files\Thumbs.db
  2008-06-16 19:23 2,648,090 ----a-w c:\program files\eMulePlus-1.2d.Installer.exe
  2008-05-16 18:42 6,115,448 ----a-w c:\program files\Firefox Setup 2.0.0.14.exe
  2008-05-15 18:10 35,203 ----a-w c:\program files\elephant.jpg
  2008-02-19 20:18 47,360 ----a-w c:\documents and settings\laurent anais\Application Data\pcouffin.sys
  2009-01-05 13:04 650,240 ----a-w c:\program files\mozilla firefox\components\nsdcads.dll
  2007-08-15 21:39 56 --sh--r c:\windows\system32\656971AD77.sys
  2008-08-30 15:34 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008083020080831\index.dat
  .
  
  ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
  "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
  "SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-10-23 202024]
  "filehippo.com"="c:\program files\filehippo.com\UpdateChecker.exe" [2008-12-31 146432]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "LaunchApp"="Alaunch" [X]
  "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
  "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-12 45056]
  "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
  "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
  "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
  "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
  "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
  "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-04-28 401408]
  "AspireService"="c:\program files\Acer\Acer eMode Management\AspireService.exe" [2006-06-09 110592]
  "MediaSync"="c:\program files\Acer\Acer eConsole\MediaSync.exe" [2006-05-04 425984]
  "PCMService"="c:\program files\Acer TV-FM\PCMService.exe" [2006-03-29 143360]
  "ImageItEncrypt"="c:\windows\system32\ImageItEncrypt.exe" [2005-12-30 40960]
  "EPSON Stylus Photo R240 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE" [2005-04-25 98304]
  "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-07 77824]
  "ORAHSSSessionManager"="c:\program files\Orange HSS\SessionManager\SessionManager.exe" [2007-07-24 102400]
  "NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
  "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
  "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497]
  "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
  "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-07-18 185896]
  "SystrayORAHSS"="c:\program files\Orange HSS\Systray\SystrayApp.exe" [2007-07-24 94208]
  "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-04-17 196608]
  "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
  "Corel Photo Downloader"="c:\program files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-28 531272]
  "SiSPower"="SiSPower.dll" [2005-07-13 c:\windows\system32\SiSPower.dll]
  "AGRSMMSG"="AGRSMMSG.exe" [2004-04-13 c:\windows\AGRSMMSG.exe]
  "SoundMan"="SOUNDMAN.EXE" [2005-08-16 c:\windows\SOUNDMAN.EXE]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
  
  c:\documents and settings\laurent anais\Menu D‚marrer\Programmes\D‚marrage\
  OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]
  
  c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
  Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
  Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
  Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
  
  [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
  "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
  "msacm.dvacm"= c:\progra~1\FICHIE~1\ULEADS~1\vio\dvacm.acm
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "c:\\Program Files\\Acer TV-FM\\PowerCinema.exe"=
  "c:\\Program Files\\Acer TV-FM\\PCMService.exe"=
  "c:\\Program Files\\Messenger\\msmsgs.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "c:\\Program Files\\eMule\\eMule.exe"=
  "c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=
  "c:\\WINDOWS\\system32\\dpvsetup.exe"=
  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  "c:\\Program Files\\Fichiers communs\\Nero\\Nero Web\\SetupX.exe"=
  "c:\\Program Files\\Orange HSS\\Connectivity\\ConnectivityManager.exe"=
  
  R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-13 28544]
  S3 CAM1210;SM0121 USB 2.0 Video Camera;c:\windows\system32\drivers\cam1210.sys [2006-07-24 89856]
  S3 DMSKSSRh;DMSKSSRh;\??\c:\docume~1\LAUREN~1\LOCALS~1\Temp\DMSKSSRh.sys --> c:\docume~1\LAUREN~1\LOCALS~1\Temp\DMSKSSRh.sys [?]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
  \Shell\AutoRun\command - E:\setup.exe
  .
  Contenu du dossier 'Tâches planifiées'
  
  2009-01-13 c:\windows\Tasks\Update Checker.job
  - c:\progra~1\FILEHI~1.COM\UPDATE~1.EXE [2008-12-31 12:22]
  
  2009-01-15 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
  - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
  .
  .
  ------- Examen supplémentaire -------
  .
  mWindow Title =
  IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
  IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
  IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?8bebaba9299846cd8b3462399d909966
  IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?8bebaba9299846cd8b3462399d909966
  TCP: {6560E730-C9E6-4205-8C89-8699C603188E} = 192.168.1.1
  
  O16 -: {D5D30A68-E230-49D9-B4D5-BF7532692945} - hxxps://clients.cdiscount.com/ediag/activex/CDiscount.cab
  c:\windows\Downloaded Program Files\CDiscount.inf
  FF - ProfilePath - c:\documents and settings\laurent anais\Application Data\Mozilla\Firefox\Profiles\suite.User0\
  FF - prefs.js: browser.search.defaulturl - hxxp://www2.yoog.com/search.php?q=
  FF - prefs.js: browser.search.selectedEngine - Yoog Search
  FF - prefs.js: browser.startup.homepage - hxxp://www.w-w-w-dot-com.com/start.php
  FF - prefs.js: keyword.URL - hxxp://www2.yoog.com/search.php?q=
  FF - component: c:\program files\Mozilla Firefox\components\nsdcads.dll
  FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
  
  ---- PARAMETRES FIREFOX ----
  FF - user.js: network.proxy.type - 0
  FF - user.js: browser.shell.checkDefaultBrowser - false
  FF - user.js: browser.search.selectedEngine - Yoog Search
  FF - user.js: keyword.URL - hxxp://www2.yoog.com/search.php?q=
  FF - user.js: keyword.enabled - true
  FF - user.js: browser.search.defaultenginename - Yoog Search
  FF - user.js: browser.search.defaulturl - hxxp://www2.yoog.com/search.php?q=
  .
  
  **************************************************************************
  
  catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2009-01-15 19:25:30
  Windows 5.1.2600 Service Pack 3 NTFS
  
  Recherche de processus cachés ...
  
  Recherche d'éléments en démarrage automatique cachés ...
  
  Recherche de fichiers cachés ...
  
  Scan terminé avec succès
  Fichiers cachés: 0
  
  **************************************************************************
  .
  --------------------- CLES DE REGISTRE BLOQUEES ---------------------
  
  [HKEY_USERS\S-1-5-21-430353115-455240563-1979012898-1006\Software\Microsoft\SystemCertificates\AddressBook*]
  @Allowed: (Read) (RestrictedCode)
  @Allowed: (Read) (RestrictedCode)
  .
  --------------------- DLLs chargées dans les processus actifs ---------------------
  
  - - - - - - - > 'winlogon.exe'(708)
  c:\windows\system32\Ati2evxx.dll
  .
  ------------------------ Autres processus actifs ------------------------
  .
  c:\windows\system32\ati2evxx.exe
  c:\windows\system32\ati2evxx.exe
  c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  c:\program files\Acer\Acer eConsole\MediaServerService.exe
  c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
  c:\program files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
  c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
  c:\program files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
  c:\program files\Fichiers communs\France Telecom\Shared Modules\FTRTSVC\[u]0/u\FTRTSVC.exe
  c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
  c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
  c:\windows\system32\PSIService.exe
  c:\program files\Acer TV-FM\Kernel\TV\CLSched.exe
  c:\windows\system32\searchindexer.exe
  c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
  c:\progra~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\[u]0/u\AlertModule.exe
  c:\program files\OpenOffice.org 2.3\program\soffice.exe
  c:\program files\Fichiers communs\Nero\Lib\NMIndexingService.exe
  c:\program files\OpenOffice.org 2.3\program\soffice.bin
  c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
  c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
  c:\program files\Windows Live\Messenger\usnsvc.exe
  .
  **************************************************************************
  .
  Heure de fin: 2009-01-15 19:29:46 - La machine a redémarré
  ComboFix-quarantined-files.txt 2009-01-15 18:29:42
  
  Avant-CF: 23 882 002 432 octets libres
  Après-CF: 23,828,774,912 octets libres
  
  WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
  [boot loader]
  timeout=2
  default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
  [operating systems]
  c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
  multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
  
  271 --- E O F --- 2008-12-18 22:08:36
  
  0
  
  Réagir
Réponse 15 / 32
eZula Contributeur
Télécharge OAD http://sosvirus.changelog.fr/OAD.exe sur ton bureau, puis double clique sur le OAD pour le lancer
- nom de fichier à rechercher : DMSKSSRh
- Type de recherche : sélectionne l'option 6 puis valide par Entrée
OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il ait terminé : le rapport de recherche s'affichera automatiquement, colle-le dans ta prochaine réponse.

0

Réagir
1. belette88
  
  15/01/2009 ---- 19:02:57,90
  
  ----------------------------------
  §§§§§§ [DMSKSSRh] §§§§§§
  ----------------------------------
  [X] Registre
  
  -------------- [ ] rapide
  -- Fichier --- [ ] disque systeme
  ------------- [X] complete
  
  ********************
  [Registre]
  ********************
  
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DMSKSSRH]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DMSKSSRh]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DMSKSSRh]
  "DisplayName"="DMSKSSRh"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DMSKSSRh\Security]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_DMSKSSRH]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\DMSKSSRh]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\DMSKSSRh]
  "DisplayName"="DMSKSSRh"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\DMSKSSRh\Security]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DMSKSSRH]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DMSKSSRh]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DMSKSSRh]
  "DisplayName"="DMSKSSRh"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DMSKSSRh\Security]
  
  [HKEY_USERS\S-1-5-21-430353115-455240563-1979012898-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\sys]
  "a"="C:\\Documents and Settings\\laurent anais\\Local Settings\\Temp\\DMSKSSRh.sys"
  
  *******************
  [Fichier]
  *******************
  
  c:\Documents and Settings\laurent anais\Local Settings\Temp\DMSKSSRh.sys
  
  *********************
  [Même date]
  *********************
  
  Aucun fichier créé à la même date détecté
  
  Outil Aide Diagnostic By !aur3n7 Version 1.1
  ----------------------------------
  §§§§§ Fin Rapport §§§§§
  ----------------------------------
  
  0
  
  Réagir
Réponse 16 / 32
eZula Contributeur
je ne sais pas du tout ce que c'est ce fichier. Quand est-ce qu'il a été installé ? (regarde ses propriétés)

0

Réagir
1. belette88
  
  08/06/2004
  
  0
  
  Réagir
Réponse 17 / 32
belette88
c grave docteur ;)

0

Réagir
Réponse 18 / 32
eZula Contributeur
Fais ce test en mode sans échec avec prise en charge réseau

0

Réagir
1. belette88
  
  Fichier DMSKSSRh.sys reçu le 2009.01.14 19:58:40 (CET)
  Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
  Résultat: 0/39 (0%)
  en train de charger les informations du serveur...
  Votre fichier est dans la file d'attente, en position: 2.
  L'heure estimée de démarrage est entre 46 et 66 secondes.
  Ne fermez pas la fenêtre avant la fin de l'analyse.
  L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
  Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
  Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
  les résultats seront affichés au fur et à mesure de leur génération.
  Formaté Formaté
  Impression des résultats Impression des résultats
  Votre fichier a expiré ou n'existe pas.
  Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.
  
  Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
  Email:
  
  Antivirus Version Dernière mise à jour Résultat
  a-squared 4.0.0.73 2009.01.14 -
  AhnLab-V3 2009.1.15.0 2009.01.14 -
  AntiVir 7.9.0.54 2009.01.14 -
  Authentium 5.1.0.4 2009.01.14 -
  Avast 4.8.1281.0 2009.01.14 -
  AVG 8.0.0.229 2009.01.14 -
  BitDefender 7.2 2009.01.14 -
  CAT-QuickHeal 10.00 2009.01.14 -
  ClamAV 0.94.1 2009.01.14 -
  Comodo 931 2009.01.14 -
  DrWeb 4.44.0.09170 2009.01.14 -
  eSafe 7.0.17.0 2009.01.14 -
  eTrust-Vet 31.6.6307 2009.01.14 -
  F-Prot 4.4.4.56 2009.01.14 -
  F-Secure 8.0.14470.0 2009.01.14 -
  Fortinet 3.117.0.0 2009.01.14 -
  GData 19 2009.01.14 -
  Ikarus T3.1.1.45.0 2009.01.14 -
  K7AntiVirus 7.10.584 2009.01.09 -
  Kaspersky 7.0.0.125 2009.01.14 -
  McAfee 5495 2009.01.14 -
  McAfee+Artemis 5495 2009.01.14 -
  Microsoft 1.4205 2009.01.14 -
  NOD32 3766 2009.01.14 -
  Norman 5.93.01 2009.01.13 -
  nProtect 2009.1.8.0 2009.01.14 -
  Panda 9.5.1.2 2009.01.14 -
  PCTools 4.4.2.0 2009.01.14 -
  Prevx1 V2 2009.01.14 -
  Rising 21.12.22.00 2009.01.14 -
  SecureWeb-Gateway 6.7.6 2009.01.14 -
  Sophos 4.37.0 2009.01.14 -
  Sunbelt 3.2.1831.2 2009.01.09 -
  Symantec 10 2009.01.14 -
  TheHacker 6.3.1.4.219 2009.01.14 -
  TrendMicro 8.700.0.1004 2009.01.14 -
  VBA32 3.12.8.10 2009.01.13 -
  ViRobot 2009.1.14.1559 2009.01.14 -
  VirusBuster 4.5.11.0 2009.01.14 -
  Information additionnelle
  File size: 15872 bytes
  MD5...: 5012f080fccf701e2cd6b045ac7814d9
  SHA1..: 2e8265294f3deea45512a44958eeac38c41f5453
  SHA256: 3a3be5c491f88554493c0959634bb83146204b7dc378dcbf98e210bfb12981e5
  SHA512: dc63875844f44a5a618c907f4781bfed65d6589281310414bdc7395a3be12070
  419588ce849f217456e99429e9200f3a3c6533cfcfd2247b46912c3fd2b63256
  ssdeep: 384:Xxx7JMPV4lPO3EIUdq0bGy1Mj1JnkKgD78eskN3x:hMPV0PcEIx0NKVgDggN
  PEiD..: -
  TrID..: File type identification
  Generic Win/DOS Executable (49.9%)
  DOS Executable Generic (49.8%)
  Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
  PEInfo: PE Structure information
  
  ( base data )
  entrypointaddress.: 0x11610
  timedatestamp.....: 0x3f7854e4 (Mon Sep 29 15:51:00 2003)
  machinetype.......: 0x14c (I386)
  
  ( 5 sections )
  name viradd virsiz rawdsiz ntrpy md5
  .text 0x1000 0x2ad8 0x2c00 6.24 c12e8d8c4517f713f15a74c3ac9702f2
  .rdata 0x4000 0x174 0x200 2.79 e95e9f70800834aeb47553cb8707d1c0
  .data 0x5000 0xfb8 0x200 0.90 c8516e380d34a9d1adaa1d28666759a6
  INIT 0x6000 0x41a 0x600 4.04 cde9446cecd43fa840c47229083fbb84
  .reloc 0x7000 0x352 0x400 3.13 d21511bcad53ff0e98c70a4776af203d
  
  ( 2 imports )
  > ntoskrnl.exe: IoGetDeviceObjectPointer, RtlInitUnicodeString, ZwClose, ZwCreateFile, IoRegisterDriverReinitialization, IofCompleteRequest, IoRegisterShutdownNotification, IoCreateDevice, IoDeleteDevice, IoDeleteSymbolicLink, KeWaitForSingleObject, IofCallDriver, IoBuildSynchronousFsdRequest, KeInitializeEvent, ZwQueryValueKey, ZwOpenKey, RtlAppendUnicodeToString, KeQuerySystemTime, IoFreeWorkItem, IoQueueWorkItem, IoAllocateWorkItem, MmMapLockedPagesSpecifyCache, RtlCompareMemory, ObfDereferenceObject, IoFreeMdl, MmUnlockPages, MmMapLockedPages, MmProbeAndLockPages, IoAllocateMdl, _except_handler3, MmUnmapLockedPages, RtlUnicodeStringToAnsiString, RtlFreeAnsiString, ExFreePool, IoBuildDeviceIoControlRequest, ExAllocatePoolWithTag
  > HAL.dll: KeQueryPerformanceCounter
  
  ( 0 exports )
  CWSandbox info: <a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=5012f080fccf701e2cd6b045ac7814d9' target='_blank'>http://research.sunbelt-software.com/...
  
  0
  
  Réagir
Réponse 19 / 32
eZula Contributeur
Fais scanner ce fichier sur Virustotal par curiosité :

C:\DOCUME~1\LAUREN~1\LOCALS~1\Temp\DMSKSSRh.sys

0

Réagir
1. belette88
  
  il me le fait beugger
  
  0
  
  Réagir
Réponse 20 / 32
eZula Contributeur
Lance HijackThis -> "Open the Misc tool section" -> coche les deux cases "list..." puis clique sur "Generate Startup list". Un rapport conséquent va s'ouvrir, poste-le.

0

Réagir
1. belette88
  
  StartupList report, 14/01/2009, 18:54:04
  StartupList version: 1.52.2
  Started from : C:\Program Files\Trend Micro\HijackThis\HijackThis.EXE
  Detected: Windows XP SP3 (WinNT 5.01.2600)
  Detected: Internet Explorer v7.00 (7.00.6000.16762)
  * Using default options
  * Including empty and uninteresting sections
  * Showing rarely important sections
  ==================================================
  
  Running processes:
  
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
  C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
  C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
  C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
  C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
  C:\WINDOWS\system32\SearchIndexer.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
  C:\Program Files\Acer\Acer eMode Management\AspireService.exe
  C:\Program Files\Acer\Acer eConsole\MediaSync.exe
  C:\Program Files\Acer TV-FM\PCMService.exe
  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
  C:\Program Files\Orange HSS\Systray\SystrayApp.exe
  C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
  C:\Program Files\filehippo.com\UpdateChecker.exe
  C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
  C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
  C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
  C:\Program Files\Windows Desktop Search\WindowsSearch.exe
  C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
  C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
  C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
  C:\WINDOWS\system32\SearchProtocolHost.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\eMule\eMule.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  --------------------------------------------------
  
  Listing of startup folders:
  
  Shell folders Startup:
  [C:\Documents and Settings\laurent anais\Menu Démarrer\Programmes\Démarrage]
  OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
  
  Shell folders AltStartup:
  *Folder not found*
  
  User shell folders Startup:
  *Folder not found*
  
  User shell folders AltStartup:
  *Folder not found*
  
  Shell folders Common Startup:
  [C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
  Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
  Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
  
  Shell folders Common AltStartup:
  *Folder not found*
  
  User shell folders Common Startup:
  *Folder not found*
  
  User shell folders Alternate Common Startup:
  *Folder not found*
  
  --------------------------------------------------
  
  Checking Windows NT UserInit:
  
  [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  UserInit = C:\WINDOWS\system32\userinit.exe,
  
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
  *Registry key not found*
  
  [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  *Registry value not found*
  
  [HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
  *Registry key not found*
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  
  LaunchApp = Alaunch
  ntiMUI = C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
  RemoteControl = "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  IMJPMIG8.1 = "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  MSPY2002 = C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  PHIME2002ASync = C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  PHIME2002A = C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  SiSPower = Rundll32.exe SiSPower.dll,ModeAgent
  eRecoveryService = C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
  AspireService = C:\Program Files\Acer\Acer eMode Management\AspireService.exe
  MediaSync = C:\Program Files\Acer\Acer eConsole\MediaSync.exe
  PCMService = "C:\Program Files\Acer TV-FM\PCMService.exe"
  ImageItEncrypt = C:\WINDOWS\system32\ImageItEncrypt.exe
  EPSON Stylus Photo R240 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE /P30 "EPSON Stylus Photo R240 Series" /O6 "USB001" /M "Stylus Photo R240"
  QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
  AGRSMMSG = AGRSMMSG.exe
  ORAHSSSessionManager = C:\Program Files\Orange HSS\SessionManager\SessionManager.exe
  NeroFilterCheck = C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
  NBKeyScan = "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
  avgnt = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
  StartCCC = "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
  SoundMan = SOUNDMAN.EXE
  TkBellExe = "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
  SystrayORAHSS = "C:\Program Files\Orange HSS\Systray\SystrayApp.exe"
  ISUSPM Startup = C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
  ISUSScheduler = "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
  
  *No values found*
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
  
  *No values found*
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
  
  *No values found*
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  
  *Registry key not found*
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  
  CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe
  MsnMsgr = "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  SweetIM = C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} = "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
  filehippo.com = "C:\Program Files\filehippo.com\UpdateChecker.exe" /background
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
  
  *No values found*
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
  
  *Registry key not found*
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
  
  *No values found*
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  
  *Registry key not found*
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
  
  *Registry key not found*
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
  
  *Registry key not found*
  
  --------------------------------------------------
  
  Autorun entries in Registry subkeys of:
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  *No subkeys found*
  
  --------------------------------------------------
  
  Autorun entries in Registry subkeys of:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
  *No subkeys found*
  
  --------------------------------------------------
  
  Autorun entries in Registry subkeys of:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
  *No subkeys found*
  
  --------------------------------------------------
  
  Autorun entries in Registry subkeys of:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
  *No subkeys found*
  
  --------------------------------------------------
  
  Autorun entries in Registry subkeys of:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  *Registry key not found*
  
  --------------------------------------------------
  
  Autorun entries in Registry subkeys of:
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  *No subkeys found*
  
  --------------------------------------------------
  
  Autorun entries in Registry subkeys of:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
  *No subkeys found*
  
  --------------------------------------------------
  
  Autorun entries in Registry subkeys of:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
  *Registry key not found*
  
  --------------------------------------------------
  
  Autorun entries in Registry subkeys of:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
  *No subkeys found*
  
  --------------------------------------------------
  
  Autorun entries in Registry subkeys of:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  *Registry key not found*
  
  --------------------------------------------------
  
  Autorun entries in Registry subkeys of:
  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
  *Registry key not found*
  
  --------------------------------------------------
  
  Autorun entries in Registry subkeys of:
  HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
  *Registry key not found*
  
  --------------------------------------------------
  
  File association entry for .EXE:
  HKEY_CLASSES_ROOT\exefile\shell\open\command
  
  (Default) = "%1" %*
  
  --------------------------------------------------
  
  File association entry for .COM:
  HKEY_CLASSES_ROOT\comfile\shell\open\command
  
  (Default) = "%1" %*
  
  --------------------------------------------------
  
  File association entry for .BAT:
  HKEY_CLASSES_ROOT\batfile\shell\open\command
  
  (Default) = "%1" %*
  
  --------------------------------------------------
  
  File association entry for .PIF:
  HKEY_CLASSES_ROOT\piffile\shell\open\command
  
  (Default) = "%1" %*
  
  --------------------------------------------------
  
  File association entry for .SCR:
  HKEY_CLASSES_ROOT\scrfile\shell\open\command
  
  (Default) = "%1" /S
  
  --------------------------------------------------
  
  File association entry for .HTA:
  HKEY_CLASSES_ROOT\htafile\shell\open\command
  
  (Default) = C:\WINDOWS\system32\mshta.exe "%1" %*
  
  --------------------------------------------------
  
  File association entry for .TXT:
  HKEY_CLASSES_ROOT\txtfile\shell\open\command
  
  (Default) = %SystemRoot%\system32\NOTEPAD.EXE %1
  
  --------------------------------------------------
  
  Enumerating Active Setup stub paths:
  HKLM\Software\Microsoft\Active Setup\Installed Components
  (* = disabled by HKCU twin)
  
  [<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *
  StubPath = C:\WINDOWS\system32\ieudinit.exe
  
  [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
  StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP
  
  [>{26923b43-4d38-484f-9b9e-de460746276c}] *
  StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
  
  [>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] *
  StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
  
  [>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
  StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
  
  [>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
  StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
  
  [{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
  StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
  
  [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
  StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
  
  [{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
  StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
  
  [{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
  StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
  
  [{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
  StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
  
  [{7790769C-0471-11d2-AF11-00C04FA35D02}] *
  StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
  
  [{89820200-ECBD-11cf-8B85-00AA005B4340}] *
  StubPath = regsvr32.exe /s /n /i:U shell32.dll
  
  [{89820200-ECBD-11cf-8B85-00AA005B4383}] *
  StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
  
  [{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
  StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
  
  [{8b15971b-5355-4c82-8c07-7e181ea07608}] *
  StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
  
  --------------------------------------------------
  
  Enumerating ICQ Agent Autostart apps:
  HKCU\Software\Mirabilis\ICQ\Agent\Apps
  
  *Registry key not found*
  
  --------------------------------------------------
  
  Load/Run keys from C:\WINDOWS\WIN.INI:
  
  load=*INI section not found*
  run=*INI section not found*
  
  Load/Run keys from Registry:
  
  HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
  HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
  HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
  HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
  HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
  HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
  HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
  HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
  HKCU\..\Windows NT\CurrentVersion\Windows: load=
  HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
  HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
  HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
  HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
  
  --------------------------------------------------
  
  Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
  
  Shell=*INI section not found*
  SCRNSAVE.EXE=*INI section not found*
  drivers=*INI section not found*
  
  Shell & screensaver key from Registry:
  
  Shell=Explorer.exe
  SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
  drivers=*Registry value not found*
  
  Policies Shell key:
  
  HKCU\..\Policies: Shell=*Registry value not found*
  HKLM\..\Policies: Shell=*Registry value not found*
  
  --------------------------------------------------
  
  Checking for EXPLORER.EXE instances:
  
  C:\WINDOWS\Explorer.exe: PRESENT!
  
  C:\Explorer.exe: not present
  C:\WINDOWS\Explorer\Explorer.exe: not present
  C:\WINDOWS\System\Explorer.exe: not present
  C:\WINDOWS\System32\Explorer.exe: not present
  C:\WINDOWS\Command\Explorer.exe: not present
  C:\WINDOWS\Fonts\Explorer.exe: not present
  
  --------------------------------------------------
  
  Checking for superhidden extensions:
  
  .lnk: HIDDEN! (arrow overlay: yes)
  .pif: HIDDEN! (arrow overlay: yes)
  .exe: not hidden
  .com: not hidden
  .bat: not hidden
  .hta: not hidden
  .scr: not hidden
  .shs: HIDDEN!
  .shb: HIDDEN!
  .vbs: not hidden
  .vbe: not hidden
  .wsh: not hidden
  .scf: HIDDEN! (arrow overlay: NO!)
  .url: HIDDEN! (arrow overlay: yes)
  .js: not hidden
  .jse: not hidden
  
  --------------------------------------------------
  
  Verifying REGEDIT.EXE integrity:
  
  - Regedit.exe found in C:\WINDOWS
  - .reg open command is normal (regedit.exe %1)
  - Regedit.exe has no CompanyName property! It is either missing or named something else.
  - Regedit.exe has no OriginalFilename property! It is either missing or named something else.
  - Regedit.exe has no FileDescription property! It is either missing or named something else.
  
  Registry check failed!
  
  --------------------------------------------------
  
  Enumerating Browser Helper Objects:
  
  (no name) - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll - {02478D38-C3F9-4efb-9B51-7695ECA05670}
  (no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
  SWEETIE - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}
  (no name) - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll - {3049C3E9-B461-4BC5-8870-4C09146192CA}
  (no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
  (no name) - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}
  (no name) - c:\program files\google\googletoolbar2.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
  (no name) - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
  (no name) - C:\Program Files\Windows Live Toolbar\msntb.dll - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
  (no name) - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}
  (no name) - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
  
  --------------------------------------------------
  
  Enumerating Task Scheduler jobs:
  
  Update Checker.job
  Vérifier les mises à jour de Windows Live Toolbar.job
  
  --------------------------------------------------
  
  Enumerating Download Program Files:
  
  [Windows Live Photo Upload Control]
  InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll
  CODEBASE = http://cid-6458b673273913bc.spaces.live.com/PhotoUpload/MsnPUpld.cab
  
  [{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
  CODEBASE = http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
  
  [ScorchPlugin Class]
  InProcServer32 = C:\Program Files\Sibelius Software\Scorch\ActiveXPlugin\ScorchAxPlugin.dll
  CODEBASE = http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
  
  [Oberon Flash Game Host]
  InProcServer32 = C:\WINDOWS\Downloaded Program Files\OberonGameHost.dll
  CODEBASE = http://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
  
  [Shockwave Flash Object]
  InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx
  CODEBASE = http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  
  [CDiscountObj Class]
  InProcServer32 = C:\Progra~1\Techcity\CDiscount\CDiscount.dll
  CODEBASE = https://order.cdiscount.com/Account/LoginLight.html?referrer=https://clients.cdiscount.com%2Ferror%2F404.aspx%3F404%3Bhttp%3A%2F%2Fclients.cdiscount.com%3A100%2Fediag%2Factivex%2Fcdiscount.cab
  
  [FlashXControl Object]
  InProcServer32 = C:\WINDOWS\system32\FlashAX\FlashAX.ocx
  CODEBASE = https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
  
  [Flash Casino Helper Object]
  InProcServer32 = C:\WINDOWS\system32\FlashAX2\FlashAX2.ocx
  CODEBASE = https://casino.microgaming.com/casino/FlashAX2.cab
  
  --------------------------------------------------
  
  Enumerating Winsock LSP files:
  
  NameSpace #1: C:\WINDOWS\System32\mswsock.dll
  NameSpace #2: C:\WINDOWS\System32\winrnr.dll
  NameSpace #3: C:\WINDOWS\System32\mswsock.dll
  Protocol #1: C:\WINDOWS\system32\mswsock.dll
  Protocol #2: C:\WINDOWS\system32\mswsock.dll
  Protocol #3: C:\WINDOWS\system32\mswsock.dll
  Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
  Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
  Protocol #6: C:\WINDOWS\system32\mswsock.dll
  Protocol #7: C:\WINDOWS\system32\mswsock.dll
  Protocol #8: C:\WINDOWS\system32\mswsock.dll
  Protocol #9: C:\WINDOWS\system32\mswsock.dll
  Protocol #10: C:\WINDOWS\system32\mswsock.dll
  Protocol #11: C:\WINDOWS\system32\mswsock.dll
  Protocol #12: C:\WINDOWS\system32\mswsock.dll
  Protocol #13: C:\WINDOWS\system32\mswsock.dll
  
  --------------------------------------------------
  
  Enumerating Windows NT/2000/XP services
  
  Acer Media Server: "C:\Program Files\Acer\Acer eConsole\MediaServerService.exe" (autostart)
  Pilote ACPI Microsoft: system32\DRIVERS\ACPI.sys (system)
  Suppresseur d'écho acoustique (Noyau Microsoft): system32\drivers\aec.sys (manual start)
  PPdus ASPI Shell: system32\drivers\Afc.sys (manual start)
  AFD: \SystemRoot\System32\drivers\afd.sys (system)
  Agere Systems Soft Modem: system32\DRIVERS\AGRSM.sys (manual start)
  Service for Realtek AC97 Audio (WDM): system32\drivers\ALCXWDM.SYS (manual start)
  Avertissement: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
  Service de la passerelle de la couche Application: %SystemRoot%\System32\alg.exe (manual start)
  AntiVir PersonalEdition Classic Scheduler: "C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe" (autostart)
  AntiVir PersonalEdition Classic Guard: "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe" (autostart)
  Gestion d'applications: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
  Aspi32: System32\drivers\aspi32.sys (autostart)
  Service d'état ASP.NET: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (manual start)
  Pilote de média asynchrone RAS: system32\DRIVERS\asyncmac.sys (manual start)
  Contrôleur de disque dur IDE/ESDI standard: system32\DRIVERS\atapi.sys (system)
  Ati HotKey Poller: %SystemRoot%\system32\Ati2evxx.exe (autostart)
  ATI Smart: C:\WINDOWS\system32\ati2sgag.exe (autostart)
  ati2mtag: system32\DRIVERS\ati2mtag.sys (manual start)
  atksgt: system32\DRIVERS\atksgt.sys (autostart)
  Protocole client ATM ARP: system32\DRIVERS\atmarpc.sys (manual start)
  Audio Windows: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Pilote audio Stub: system32\DRIVERS\audstub.sys (manual start)
  avgio: \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys (system)
  avgntflt: \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys (manual start)
  avipbb: system32\DRIVERS\avipbb.sys (system)
  Service de transfert intelligent en arrière-plan: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  Boonty Games: "C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" (manual start)
  Explorateur d'ordinateur: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  SM0121 USB 2.0 Video Camera: System32\Drivers\cam1210.sys (manual start)
  catchme: \??\C:\DOCUME~1\LAUREN~1\LOCALS~1\Temp\catchme.sys (manual start)
  Décodeur sous-titre fermé: system32\DRIVERS\CCDECODE.sys (manual start)
  Pilote de CD-ROM: system32\DRIVERS\cdrom.sys (system)
  Service d'indexation: %SystemRoot%\system32\cisvc.exe (manual start)
  CyberLink Background Capture Service (CBCS): "C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe" (autostart)
  Gestionnaire de l'Album: %SystemRoot%\system32\clipsrv.exe (disabled)
  .NET Runtime Optimization Service v2.0.50727_X86: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (autostart)
  CyberLink Task Scheduler (CTS): "C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe" (autostart)
  Application système COM+: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
  Services de cryptographie: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  CyberLink Media Library Service: "C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe" (autostart)
  Lanceur de processus serveur DCOM: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
  Client DHCP: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  Pilote de disque: system32\DRIVERS\disk.sys (system)
  Service d'administration du Gestionnaire de disque logique: %SystemRoot%\System32\dmadmin.exe /com (manual start)
  dmboot: System32\drivers\dmboot.sys (disabled)
  dmio: System32\drivers\dmio.sys (disabled)
  dmload: System32\drivers\dmload.sys (disabled)
  Gestionnaire de disque logique: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  DMSKSSRh: \??\C:\DOCUME~1\LAUREN~1\LOCALS~1\Temp\DMSKSSRh.sys (manual start)
  Synthétiseur DLS du noyau Microsoft: system32\drivers\DMusic.sys (manual start)
  Client DNS: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
  Configuration automatique de réseau câblé: %SystemRoot%\System32\svchost.exe -k dot3svc (manual start)
  Filtre de décodeur DRM (Noyau Microsoft): system32\drivers\drmkaud.sys (manual start)
  Service Protocole EAP (Extensible Authentication Protocol): %SystemRoot%\System32\svchost.exe -k eapsvcs (manual start)
  Service de rapport d'erreurs: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Journal des événements: %SystemRoot%\system32\services.exe (autostart)
  Système d'événements de COM+: C:\WINDOWS\system32\svchost.exe -k netsvcs (manual start)
  Compatibilité avec le Changement rapide d'utilisateur: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  Fax: %systemroot%\system32\fxssvc.exe (autostart)
  FltMgr: system32\drivers\fltmgr.sys (system)
  Pilote du Gestionnaire de volume: system32\DRIVERS\ftdisk.sys (system)
  France Telecom Routing Table Service: "C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe" (autostart)
  Classificateur de paquets générique: system32\DRIVERS\msgpc.sys (manual start)
  Google Updater Service: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" (manual start)
  ATI Function Driver for High Definition Audio Service: system32\drivers\AtiHdAud.sys (manual start)
  Pilote de bus Microsoft UAA pour High Definition Audio: system32\DRIVERS\HDAudBus.sys (manual start)
  Aide et support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Pilote de classe HID Microsoft: system32\DRIVERS\hidusb.sys (manual start)
  Service Gestion des clés et des certificats d'intégrité: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  HTTP: System32\Drivers\HTTP.sys (manual start)
  HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
  Pilote pour clavier i8042 et souris sur port PS/2: system32\DRIVERS\i8042prt.sys (system)
  Pilote de filtre de gravure CD: system32\DRIVERS\imapi.sys (system)
  Service COM de gravage de CD IMAPI: C:\WINDOWS\system32\imapi.exe (manual start)
  int15.sys: \??\C:\Acer\Empowering Technology\eRecovery\int15.sys (manual start)
  Pilote de processeur Intel: system32\DRIVERS\intelppm.sys (system)
  Pilote du pare-feu Windows IPv6: system32\drivers\ip6fw.sys (manual start)
  Pilote de filtre de trafic IP: system32\DRIVERS\ipfltdrv.sys (manual start)
  Pilote de tunnelage IP dans IP: system32\DRIVERS\ipinip.sys (manual start)
  Traducteur d'adresses réseau IP: system32\DRIVERS\ipnat.sys (manual start)
  Pilote IPSEC: system32\DRIVERS\ipsec.sys (system)
  Service énumérateur IR: system32\DRIVERS\irenum.sys (manual start)
  Pilote de bus Plug-and-Play ISA/EISA: system32\DRIVERS\isapnp.sys (system)
  Pilote de la classe Clavier: system32\DRIVERS\kbdclass.sys (system)
  Pilote HID de clavier: system32\DRIVERS\kbdhid.sys (system)
  Mélangeur audio Wave de noyau Microsoft: system32\drivers\kmixer.sys (manual start)
  Serveur: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  Station de travail: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  LightScribeService Direct Disc Labeling Service: "C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe" (autostart)
  lirsgt: system32\DRIVERS\lirsgt.sys (autostart)
  Assistance TCP/IP NetBIOS: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
  Affichage des messages: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
  Partage de Bureau à distance NetMeeting: C:\WINDOWS\system32\mnmsrvc.exe (manual start)
  Pilote de la classe Souris: system32\DRIVERS\mouclass.sys (system)
  Redirecteur client WebDav: system32\DRIVERS\mrxdav.sys (manual start)
  MRXSMB: system32\DRIVERS\mrxsmb.sys (system)
  Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (manual start)
  Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)
  Proxy de service de répartition Microsoft: system32\drivers\MSKSSRV.sys (manual start)
  Proxy d'horloge de répartition Microsoft: system32\drivers\MSPCLOCK.sys (manual start)
  Proxy de gestion de qualité de répartition Microsoft: system32\drivers\MSPQM.sys (manual start)
  Pilote BIOS de gestion de systèmes Microsoft: system32\DRIVERS\mssmbios.sys (manual start)
  Convertisseur en T/site-à-site de répartition Microsoft: system32\drivers\MSTEE.sys (manual start)
  Codec NABTS/FEC VBI: system32\DRIVERS\NABTSFEC.sys (manual start)
  Agent de protection d'accès réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  Connection TV/vidéo Microsoft: system32\DRIVERS\NdisIP.sys (manual start)
  Pilote TAPI NDIS d'accès distant: system32\DRIVERS\ndistapi.sys (manual start)
  NDIS mode utilisateur E/S Protocole: system32\DRIVERS\ndisuio.sys (manual start)
  Pilote réseau étendu NDIS d'accès distant: system32\DRIVERS\ndiswan.sys (manual start)
  Nero BackItUp Scheduler 3: C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (autostart)
  Interface NetBIOS: system32\DRIVERS\netbios.sys (system)
  NetBIOS sur TCP/IP: system32\DRIVERS\netbt.sys (system)
  DDE réseau: %SystemRoot%\system32\netdde.exe (disabled)
  DSDM DDE réseau: %SystemRoot%\system32\netdde.exe (disabled)
  Ouverture de session réseau: %SystemRoot%\system32\lsass.exe (manual start)
  Connexions réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  NLA (Network Location Awareness): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
  NMIndexingService: "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe" (manual start)
  Upper Class Filter Driver: system32\DRIVERS\NTIDrvr.sys (manual start)
  Fournisseur de la prise en charge de sécurité LM NT: %SystemRoot%\system32\lsass.exe (manual start)
  Stockage amovible: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
  Pilote de filtre de trafic IPX: system32\DRIVERS\nwlnkflt.sys (manual start)
  Pilote de transfert de trafic IPX: system32\DRIVERS\nwlnkfwd.sys (manual start)
  Pilote de port parallèle: system32\DRIVERS\parport.sys (manual start)
  pavboot: system32\drivers\pavboot.sys (system)
  PCAMPR5 NDIS Protocol Driver: \??\C:\WINDOWS\system32\PCAMPR5.SYS (manual start)
  PCANDIS5 NDIS Protocol Driver: \??\C:\WINDOWS\system32\PCANDIS5.SYS (manual start)
  Pilote de bus PCI: system32\DRIVERS\pci.sys (system)
  PCIIde: system32\DRIVERS\pciide.sys (system)
  Low level access layer for CD devices: System32\Drivers\pcouffin.sys (manual start)
  Plug-and-Play: %SystemRoot%\system32\services.exe (autostart)
  Services IPSEC: %SystemRoot%\system32\lsass.exe (autostart)
  Miniport réseau étendu (PPTP): system32\DRIVERS\raspptp.sys (manual start)
  StarForce Protection Environment Driver v6: \SystemRoot\System32\drivers\prodrv06.sys (system)
  StarForce Protection Helper Driver v2: System32\drivers\prohlp02.sys (system)
  StarForce Protection Synchronization Driver v1: System32\drivers\prosync1.sys (system)
  Emplacement protégé: %SystemRoot%\system32\lsass.exe (autostart)
  Planificateur de paquets QoS: system32\DRIVERS\psched.sys (manual start)
  Pilote de liaison parallèle directe: system32\DRIVERS\ptilink.sys (manual start)
  PxHelp20: System32\Drivers\PxHelp20.sys (system)
  Pilote de connexion automatique d'accès distant: system32\DRIVERS\rasacd.sys (system)
  Gestionnaire de connexion automatique d'accès distant: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
  Miniport réseau étendu (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)
  Gestionnaire de connexions d'accès distant: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
  Pilote PPPOE d'accès à distance: system32\DRIVERS\raspppoe.sys (manual start)
  Parallèle direct: system32\DRIVERS\raspti.sys (manual start)
  Rdbss: system32\DRIVERS\rdbss.sys (system)
  RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
  Gestionnaire de session d'aide sur le Bureau à distance: C:\WINDOWS\system32\sessmgr.exe (manual start)
  Pilote de filtre de lecture digitale de CD audio: system32\DRIVERS\redbook.sys (system)
  Routage et accès distant: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
  Microsoft Legacy Modem Driver: System32\Drivers\RootMdm.sys (manual start)
  Localisateur d'appels de procédure distante (RPC): %SystemRoot%\system32\locator.exe (manual start)
  Appel de procédure distante (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
  QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)
  Realtek 10/100/1000 NIC Family all in one NDIS XP Driver: system32\DRIVERS\Rtlnicxp.sys (manual start)
  Gestionnaire de comptes de sécurité: %SystemRoot%\system32\lsass.exe (autostart)
  Carte à puce: %SystemRoot%\System32\SCardSvr.exe (manual start)
  Schedule: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Secdrv: system32\DRIVERS\secdrv.sys (autostart)
  Connexion secondaire: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Notification d'événement système: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  Pilote de filtre Serenum: system32\DRIVERS\serenum.sys (manual start)
  Pilote de port série: system32\DRIVERS\serial.sys (system)
  StarForce Protection Environment Driver (version 1.x): System32\drivers\sfdrv01.sys (system)
  StarForce Protection Helper Driver: System32\drivers\sfhlp01.sys (system)
  StarForce Protection Helper Driver (version 2.x): System32\drivers\sfhlp02.sys (system)
  StarForce Protection Synchronization Driver (version 4.x): System32\drivers\sfsync04.sys (system)
  StarForce Protection VFS Driver (version 2.x): System32\drivers\sfvfs02.sys (system)
  Pare-feu Windows / Partage de connexion Internet: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  Détection matériel noyau: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Détrameur décalage BDA: system32\DRIVERS\SLIP.sys (manual start)
  Pilote de filtrage Sony USB (SONYPVU1): system32\DRIVERS\SONYPVU1.SYS (manual start)
  Splitter audio du noyau Microsoft: system32\drivers\splitter.sys (manual start)
  Spouleur d'impression: %SystemRoot%\system32\spoolsv.exe (autostart)
  Pilote de filtre de restauration système: system32\DRIVERS\sr.sys (system)
  Service de restauration système: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  Srv: system32\DRIVERS\srv.sys (manual start)
  Service de découvertes SSDP: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
  ssmdrv: system32\DRIVERS\ssmdrv.sys (system)
  Acquisition d'image Windows (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)
  BDA IPSink: system32\DRIVERS\StreamIP.sys (manual start)
  Pilote de bus logiciel: system32\DRIVERS\swenum.sys (manual start)
  Synthétiseur de table de sons GC noyau Microsoft: system32\drivers\swmidi.sys (manual start)
  MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{E2322CF5-FB50-4514-B1AF-08997D4D03C3} (manual start)
  Périphérique audio système du noyau Microsoft: system32\drivers\sysaudio.sys (manual start)
  Journaux et alertes de performance: %SystemRoot%\system32\smlogsvc.exe (manual start)
  Téléphonie: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  Pilote du protocole TCP/IP: system32\DRIVERS\tcpip.sys (system)
  Pilote de périphérique terminal: system32\DRIVERS\termdd.sys (system)
  Services Terminal Server: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
  Thèmes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Client de suivi de lien distribué: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  Filtre AGP version 3.5 Microsoft: system32\DRIVERS\uagp35.sys (system)
  Pilote de mise à jour microcode: system32\DRIVERS\update.sys (manual start)
  Hôte de périphérique universel Plug-and-Play: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
  Onduleur: %SystemRoot%\System32\ups.exe (manual start)
  Pilote parent générique USB Microsoft: system32\DRIVERS\usbccgp.sys (manual start)
  Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0: system32\DRIVERS\usbehci.sys (manual start)
  Concentrateur USB2: system32\DRIVERS\usbhub.sys (manual start)
  Pilote miniport de contrôleur hôte ouvert USB Microsoft: system32\DRIVERS\usbohci.sys (manual start)
  Classe d'imprimantes USB Microsoft: system32\DRIVERS\usbprint.sys (manual start)
  Pilote de stockage de masse USB: system32\DRIVERS\USBSTOR.SYS (manual start)
  Service Messenger Sharing Folders USN Journal Reader: "C:\Program Files\Windows Live\Messenger\usnsvc.exe" (manual start)
  Carte vidéo VGA.: \SystemRoot\System32\drivers\vga.sys (system)
  Cliché instantané de volume: %SystemRoot%\System32\vssvc.exe (manual start)
  Horloge Windows: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Pilote ARP IP d'accès distant: system32\DRIVERS\wanarp.sys (manual start)
  Pilote WINMM de compatibilité audio WDM Microsoft: system32\drivers\wdmaud.sys (manual start)
  WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
  Infrastructure de gestion Windows: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
  Windows Live Setup Service: "C:\Program Files\Windows Live\installer\WLSetupSvc.exe" (manual start)
  Service de numéro de série du lecteur multimédia portable: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  Carte de performance WMI: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)
  Service Partage réseau du Lecteur Windows Media: "C:\Program Files\Windows Media Player\WMPNetwk.exe" (manual start)
  Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0: \SystemRoot\System32\drivers\ws2ifsl.sys (system)
  Centre de sécurité: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Windows Search: %systemroot%\system32\SearchIndexer.exe /Embedding (autostart)
  Codec Teletext standard: system32\DRIVERS\WSTCODEC.SYS (manual start)
  Mises à jour automatiques: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
  Windows Driver Foundation - User-mode Driver Framework Platform Driver: system32\DRIVERS\WudfPf.sys (manual start)
  Windows Driver Foundation - User-mode Driver Framework Reflector: system32\DRIVERS\wudfrd.sys (manual start)
  Windows Driver Foundation - User-mode Driver Framework: %SystemRoot%\system32\svchost.exe -k WudfServiceGroup (manual start)
  Configuration automatique sans fil: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Service d'approvisionnement réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS): system32\DRIVERS\zd1211Bu.sys (manual start)
  ZyDAS ZD1211 IEEE 802.11b+g Wireless LAN Driver (USB)(ZyDAS): system32\DRIVERS\zd1211u.sys (manual start)
  ZDPSp50 NDIS Protocol Driver: System32\Drivers\ZDPSp50.sys (manual start)
  
  --------------------------------------------------
  
  Enumerating Windows NT logon/logoff scripts:
  *No scripts set to run*
  
  Windows NT checkdisk command:
  BootExecute = autocheck autochk *
  
  Windows NT 'Wininit.ini':
  PendingFileRenameOperations: *Registry value not found*
  
  --------------------------------------------------
  
  Enumerating ShellServiceObjectDelayLoad items:
  
  PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
  CDBurn: C:\WINDOWS\system32\SHELL32.dll
  WebCheck: C:\WINDOWS\system32\webcheck.dll
  SysTray: C:\WINDOWS\system32\stobject.dll
  WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
  
  --------------------------------------------------
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
  
  *Registry key not found*
  
  --------------------------------------------------
  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
  
  *Registry key not found*
  
  --------------------------------------------------
  
  End of report, 42 449 bytes
  Report generated in 0,516 seconds
  
  Command line options:
  /verbose - to add additional info on each section
  /complete - to include empty sections and unsuspicious data
  /full - to include several rarely-important sections
  /force9x - to include Win9x-only startups even if running on WinNT
  /forcent - to include WinNT-only startups even if running on Win9x
  /forceall - to include all Win9x and WinNT startups, regardless of platform
  /history - to list version history only
  
  0
  
  Réagir
- 1
- 2
Suivant

Virus system security et sur bureau

32 réponses

Discussions similaires

Newsletters