TROJAN GEN. WIN 32

Encore merciiiiiiiiiiiiiiiiii et bonne nuit à vous aussi ! ;-)

Désactiver/Réactiver la restauration système sert à supprimer les points de restauration. Les infections aiment bien s'y mettre.

Bonne nuit ;)

Ok, ToolsCleaner supprimé

et pour la désactivation et activation c'est en ordre aussi. En fait, je "bloquais" car je ne comprenais pas l'intérêt mais j'ai pris le temps de lire les explications et les choses sont claires maintenant ;-)

Merci pour les différents liens (prévention)

Promis, j'essaierai d'être vigilante à l'avenir ! ;-)

Tu peux supprimer ToolsCleaner.

Tu bloques où ?

ok pour le point 1 et 2 dont voici le rapport ci-après. Par contre, pour le point 3, moi pas comprendre ;-) :

[ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\lopR.txt: trouvé !
C:\Combofix: trouvé !
C:\Lop SD: trouvé !
C:\_OTM: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\CENZANO\Bureau\Raccourcis Bureau non utilisés\LopSD.exe: trouvé !
C:\Documents and Settings\CENZANO\Bureau\Raccourcis Bureau non utilisés\lopxp.lnk: trouvé !
C:\Documents and Settings\CENZANO\Bureau\Raccourcis Bureau non utilisés\UsbFix.lnk: trouvé !
C:\Documents and Settings\CENZANO\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\CENZANO\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
C:\Documents and Settings\CENZANO\Recent\UsbFix.lnk: trouvé !
C:\Lop SD\catchme.exe: trouvé !
C:\Lop SD\catchme.log: trouvé !
C:\Program Files\HijackThis: trouvé !
C:\Program Files\lopxp: trouvé !
C:\Program Files\HiJackThis\HijackThis.exe: trouvé !
C:\Program Files\HiJackThis\hijackthis.log: trouvé !
C:\Program Files\trend micro\HijackThis.exe: trouvé !
C:\Program Files\trend micro\hijackthis.log: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\CENZANO\Bureau\Raccourcis Bureau non utilisés\LopSD.exe: supprimé !
C:\Lop SD\catchme.exe: supprimé !
C:\Program Files\HiJackThis\HijackThis.exe: supprimé !
C:\Program Files\trend micro\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\lopR.txt: supprimé !
C:\Documents and Settings\CENZANO\Bureau\Raccourcis Bureau non utilisés\lopxp.lnk: supprimé !
C:\Documents and Settings\CENZANO\Bureau\Raccourcis Bureau non utilisés\UsbFix.lnk: supprimé !
C:\Documents and Settings\CENZANO\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
C:\Documents and Settings\CENZANO\Recent\UsbFix.lnk: supprimé !
C:\Lop SD\catchme.log: supprimé !
C:\Program Files\HiJackThis\hijackthis.log: supprimé !
C:\Program Files\trend micro\hijackthis.log: supprimé !
C:\Combofix: supprimé !
C:\Lop SD: supprimé !
C:\_OTM: supprimé !
C:\UsbFix: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\CENZANO\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Program Files\HijackThis: supprimé !
C:\Program Files\lopxp: supprimé !

1/

---> Désinstalle HijackThis.

---> Télécharge ToolsCleaner2 sur ton Bureau.
* Double-clique sur ToolsCleaner2.exe pour le lancer.
* Clique sur Recherche et laisse le scan agir.
* Clique sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options Facultatives.
* Clique sur Quitter pour obtenir le rapport.
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

2/

---> Télécharge et installe CCleaner Slim.
* Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage.

3/

---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger.

==Prévention==

Pour supprimer les popups d'AntiVir : Lien

Conserve MBAM. Il te servira à scanner les fichiers douteux en complément de l'antivirus et scanne le disque dur régulièrement.

Vérifie que les mises à jour automatiques sont bien activées (Menu Démarrer, clique droit sur Poste de travail, Propriétés, onglet Mises à jour automatiques).

Par rapport au P2P : Lien

Voici un dossier complet (A lire avec Adobe Reader ou Foxit Reader) : Lien

Sois plus vigilant(e) sur Internet ;)

Ok, ok, je vais nettoyer tout ça.

Il me semble que "mes" problèmes soient résolus ?! Je vous remercie vivement pour votre aide et votre patience (surtout ;o))

Je vois Winamp, Logitech, etc.

Trop de programmes au démarrage ??? Je n'ai (à ma connaissance) que Messenger et l'anti-virus...

Je trouve que tu as trop de programmes qui se lancent au démarrage.

Tu peux en désactiver avec CCleaner.

Il semble bien fonctionné, oui. Je n'ai plus ces pop-up. Il semble être un peu plus rapide que ces derniers jours (bien que je le trouve encore un peu lent surtout au démarrage)

Le PC fonctionne bien ?

Voici :

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : mobile AMD Athlon(tm) XP2400+ )
BIOS : PhoenixBIOS 4.0 Release 6.0
USER : CENZANO ( Administrator )
BOOT : Normal boot
Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:27 Go (Free:13 Go)
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( sam. 22/08/2009| 4:35 )

--------------------\\ Listing des dossiers dans APPLIC~1

[20/08/2009|01:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[20/08/2009|01:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
[17/12/2007|19:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
[09/10/2008|16:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EmailNotifier
[10/05/2009|23:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[22/08/2009|01:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
[01/08/2008|15:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
[19/08/2009|23:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[18/11/2006|18:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[19/02/2009|06:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[30/10/2006|17:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[01/08/2008|15:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nokia
[11/02/2009|17:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
[03/01/2009|12:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
[24/02/2008|05:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prevx
[30/10/2006|16:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[09/05/2009|14:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
[14/01/2007|15:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
[15/08/2008|12:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[13/10/2007|15:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Support.com
[14/01/2007|15:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Teleca
[22/08/2009|02:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[08/11/2006|21:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[07/02/2007|17:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[26/02/2008|16:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[28/02/2008|21:11] C:\DOCUME~1\CENZANO\APPLIC~1\Adobe
[07/05/2008|23:24] C:\DOCUME~1\CENZANO\APPLIC~1\AdobeUM
[03/06/2009|18:27] C:\DOCUME~1\CENZANO\APPLIC~1\DivX
[09/10/2008|16:24] C:\DOCUME~1\CENZANO\APPLIC~1\EmailNotifier
[01/11/2006|19:16] C:\DOCUME~1\CENZANO\APPLIC~1\FotoWire
[24/02/2008|21:16] C:\DOCUME~1\CENZANO\APPLIC~1\Google
[20/02/2007|17:58] C:\DOCUME~1\CENZANO\APPLIC~1\Help
[31/10/2006|01:19] C:\DOCUME~1\CENZANO\APPLIC~1\Identities
[30/10/2006|16:52] C:\DOCUME~1\CENZANO\APPLIC~1\InterTrust
[02/12/2007|16:24] C:\DOCUME~1\CENZANO\APPLIC~1\InterVideo
[29/12/2008|03:38] C:\DOCUME~1\CENZANO\APPLIC~1\iPodder
[14/02/2007|17:09] C:\DOCUME~1\CENZANO\APPLIC~1\Jasc
[15/08/2008|12:56] C:\DOCUME~1\CENZANO\APPLIC~1\Lavasoft
[02/08/2008|15:09] C:\DOCUME~1\CENZANO\APPLIC~1\LimeWire
[01/11/2006|17:10] C:\DOCUME~1\CENZANO\APPLIC~1\Macromedia
[19/08/2009|23:47] C:\DOCUME~1\CENZANO\APPLIC~1\Malwarebytes
[29/01/2008|16:16] C:\DOCUME~1\CENZANO\APPLIC~1\Media Player Classic
[28/05/2009|11:25] C:\DOCUME~1\CENZANO\APPLIC~1\Megaupload
[19/12/2008|16:05] C:\DOCUME~1\CENZANO\APPLIC~1\Microsoft
[28/01/2008|14:36] C:\DOCUME~1\CENZANO\APPLIC~1\Mozilla
[02/08/2008|12:55] C:\DOCUME~1\CENZANO\APPLIC~1\MSN6
[06/10/2008|22:03] C:\DOCUME~1\CENZANO\APPLIC~1\MySpace
[03/01/2009|12:03] C:\DOCUME~1\CENZANO\APPLIC~1\Nokia
[17/01/2008|14:22] C:\DOCUME~1\CENZANO\APPLIC~1\PC Suite
[24/02/2008|05:41] C:\DOCUME~1\CENZANO\APPLIC~1\PC Tools
[10/11/2008|00:48] C:\DOCUME~1\CENZANO\APPLIC~1\Real
[15/03/2007|18:08] C:\DOCUME~1\CENZANO\APPLIC~1\Screenshot Sender
[10/05/2009|14:22] C:\DOCUME~1\CENZANO\APPLIC~1\Skype
[10/05/2009|14:17] C:\DOCUME~1\CENZANO\APPLIC~1\skypePM
[14/01/2007|15:47] C:\DOCUME~1\CENZANO\APPLIC~1\Sony Ericsson
[20/07/2008|19:08] C:\DOCUME~1\CENZANO\APPLIC~1\Sun
[14/01/2007|15:48] C:\DOCUME~1\CENZANO\APPLIC~1\Teleca
[16/02/2007|23:49] C:\DOCUME~1\CENZANO\APPLIC~1\Template
[28/01/2008|14:36] C:\DOCUME~1\CENZANO\APPLIC~1\Thunderbird

[31/10/2006|01:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[31/10/2006|01:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[20/08/2009|02:16] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
[28/01/2008|14:44] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[31/10/2006|01:19] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[22/08/2009 02:50][--a------] C:\WINDOWS\tasks\Google Software Updater.job
[22/08/2009 01:13][--ah-----] C:\WINDOWS\tasks\User_Feed_Synchronization-{B2DB3515-4508-44FC-997E-4A80316FCAD8}.job
[22/08/2009 02:50][--ah-----] C:\WINDOWS\tasks\SA.DAT
[30/08/2002 04:00][-rah-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[04/03/2007|17:49] C:\Program Files\Adobe
[03/02/2008|14:20] C:\Program Files\Alwil Software
[31/10/2006|00:49] C:\Program Files\ASUS
[20/08/2009|01:59] C:\Program Files\Avira
[10/05/2009|13:42] C:\Program Files\CA VMN Anti-Spyware
[13/10/2007|15:55] C:\Program Files\Common Files
[30/10/2006|16:52] C:\Program Files\COMPAQ
[31/10/2006|01:19] C:\Program Files\ComPlus Applications
[31/10/2006|09:53] C:\Program Files\CONEXANT
[03/01/2009|12:00] C:\Program Files\DIFX
[03/06/2009|18:22] C:\Program Files\DivX
[03/02/2008|14:10] C:\Program Files\ESET
[22/08/2009|02:43] C:\Program Files\Fichiers communs
[10/05/2009|23:27] C:\Program Files\Google
[30/10/2006|16:59] C:\Program Files\Hewlett-Packard
[26/02/2008|15:33] C:\Program Files\HiJackThis
[15/08/2008|12:57] C:\Program Files\Hitman Pro
[30/10/2006|16:45] C:\Program Files\hp photosmart
[30/10/2006|16:54] C:\Program Files\HPQ
[02/06/2009|15:41] C:\Program Files\InstallShield Installation Information
[31/07/2009|17:04] C:\Program Files\Internet Explorer
[30/10/2006|16:52] C:\Program Files\InterVideo
[20/02/2007|17:03] C:\Program Files\Jasc Software Inc
[20/08/2009|01:31] C:\Program Files\Java
[27/12/2008|14:38] C:\Program Files\Juice
[29/01/2008|16:13] C:\Program Files\K-Lite Codec Pack
[01/11/2006|19:16] C:\Program Files\Logitech
[27/02/2008|01:01] C:\Program Files\Lopxp
[19/08/2009|23:47] C:\Program Files\Malwarebytes' Anti-Malware
[07/09/2008|10:19] C:\Program Files\Messenger
[08/07/2009|22:10] C:\Program Files\Messenger Plus! Live
[18/11/2006|18:21] C:\Program Files\MessengerPlus! 3
[19/12/2008|16:02] C:\Program Files\Microsoft
[16/05/2007|18:30] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[31/10/2006|01:19] C:\Program Files\microsoft frontpage
[31/10/2006|01:29] C:\Program Files\Microsoft Office
[19/12/2008|16:01] C:\Program Files\Microsoft Office Outlook Connector
[01/08/2009|12:06] C:\Program Files\Microsoft Silverlight
[09/10/2008|15:12] C:\Program Files\Microsoft SQL Server Compact Edition
[19/12/2008|15:58] C:\Program Files\Microsoft Sync Framework
[30/10/2006|16:51] C:\Program Files\Microsoft Works
[31/10/2006|01:29] C:\Program Files\Microsoft.NET
[07/09/2008|04:29] C:\Program Files\Movie Maker
[09/08/2009|20:59] C:\Program Files\MSBuild
[09/05/2009|13:45] C:\Program Files\MSN
[31/10/2006|01:19] C:\Program Files\MSN Gaming Zone
[29/01/2008|19:07] C:\Program Files\MSXML 4.0
[01/08/2008|15:15] C:\Program Files\MSXML 6.0
[30/10/2006|17:13] C:\Program Files\MUSICMATCH
[28/10/2008|15:35] C:\Program Files\MySpace
[07/09/2008|04:22] C:\Program Files\NetMeeting
[28/01/2008|14:36] C:\Program Files\Netscape
[03/01/2009|12:45] C:\Program Files\Nokia
[17/08/2009|11:29] C:\Program Files\Outlook Express
[03/01/2009|12:00] C:\Program Files\PC Connectivity Solution
[28/01/2008|14:36] C:\Program Files\Qualcomm
[02/06/2009|10:53] C:\Program Files\QuickTime
[10/11/2008|00:45] C:\Program Files\Real
[09/08/2009|20:58] C:\Program Files\Reference Assemblies
[31/10/2006|01:19] C:\Program Files\Services en ligne
[09/05/2009|14:19] C:\Program Files\Skype
[14/01/2007|15:43] C:\Program Files\Sony Ericsson
[16/08/2008|00:29] C:\Program Files\Spybot - Search & Destroy
[24/02/2008|06:09] C:\Program Files\Spyware Doctor
[29/07/2008|00:07] C:\Program Files\Sun
[30/10/2006|16:50] C:\Program Files\Synaptics
[20/08/2009|01:45] C:\Program Files\trend micro
[31/10/2006|01:19] C:\Program Files\Uninstall Information
[25/01/2009|14:53] C:\Program Files\Unity
[02/07/2007|16:28] C:\Program Files\VirtualDJ
[09/08/2007|17:11] C:\Program Files\Visicom Media
[06/07/2007|18:39] C:\Program Files\Vodafone
[03/05/2009|13:09] C:\Program Files\Winamp Toolbar
[19/02/2009|06:49] C:\Program Files\Windows Live
[29/01/2008|19:04] C:\Program Files\Windows Live Favorites
[19/12/2008|15:48] C:\Program Files\Windows Live SkyDrive
[09/10/2008|15:11] C:\Program Files\Windows Live Toolbar
[31/07/2008|01:08] C:\Program Files\Windows Media Connect 2
[07/09/2008|04:22] C:\Program Files\Windows Media Player
[07/09/2008|04:22] C:\Program Files\Windows NT
[31/10/2006|00:09] C:\Program Files\WindowsUpdate
[31/10/2006|01:19] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[07/05/2008|23:27] C:\Program Files\Fichiers communs\Adobe
[03/02/2008|14:07] C:\Program Files\Fichiers communs\BitDefender
[31/10/2006|01:29] C:\Program Files\Fichiers communs\DESIGNER
[03/06/2009|18:20] C:\Program Files\Fichiers communs\DivX Shared
[01/11/2006|19:16] C:\Program Files\Fichiers communs\FotoWire
[14/01/2007|15:41] C:\Program Files\Fichiers communs\InstallShield
[01/11/2006|19:14] C:\Program Files\Fichiers communs\Logitech
[20/06/2009|13:48] C:\Program Files\Fichiers communs\Microsoft Shared
[31/10/2006|01:19] C:\Program Files\Fichiers communs\MSSoap
[31/10/2006|01:19] C:\Program Files\Fichiers communs\ODBC
[30/03/2009|11:07] C:\Program Files\Fichiers communs\Real
[10/05/2009|13:38] C:\Program Files\Fichiers communs\Scanner
[31/10/2006|01:19] C:\Program Files\Fichiers communs\Services
[09/05/2009|14:19] C:\Program Files\Fichiers communs\Skype
[31/10/2006|01:19] C:\Program Files\Fichiers communs\SpeechEngines
[19/12/2008|16:01] C:\Program Files\Fichiers communs\System
[09/10/2008|15:00] C:\Program Files\Fichiers communs\Windows Live
[26/02/2008|16:38] C:\Program Files\Fichiers communs\WindowsLiveInstaller
[30/03/2009|11:08] C:\Program Files\Fichiers communs\xing shared

--------------------\\ Process

( 56 Processes )

iexplore.exe ~ [PID:3700]
iexplore.exe ~ [PID:404]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\CENZANO\Cookies\cenzano@advertstream[1].txt

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-22 04:38:22
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 106

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[F:330][D:7]-> C:\DOCUME~1\CENZANO\LOCALS~1\Temp
[F:579][D:0]-> C:\DOCUME~1\CENZANO\Cookies
[F:1674][D:4]-> C:\DOCUME~1\CENZANO\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - sam. 22/08/2009| 4:42 - Option : [1]

--------------------\\ Fin du rapport a 4:42:09

--> Menu Démarrer > Exécuter > Tape combofix /u et valide.

--> Télécharge Lop S&D (par Eric_71 & Angeldark) sur ton Bureau.

--> Double-clique dessus pour lancer l'installation.

--> Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau.
(Sous Vista, il faut cliquer droit sur le raccourci de Lop S&D et choisir Exécuter en tant qu'administrateur)

--> Sélectionne la langue souhaitée, puis choisis l'option 1 (Recherche).

--> Patiente jusqu'à la fin du scan.

--> Poste le rapport généré (C:\lopR.txt).

Voici :

ComboFix 09-08-20.07 - CENZANO 22/08/2009 2:37.2.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.32.1036.18.446.190 [GMT 2:00]
Running from: c:\documents and settings\CENZANO\Bureau\ComboFix.exe
Command switches used :: c:\documents and settings\CENZANO\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\windows\system32\drivers\DnsFilter.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Gram 32 Drv Wipe
c:\documents and settings\CENZANO\Application Data\VMNTOOLBAR
c:\documents and settings\CENZANO\Application Data\VMNTOOLBAR\Brussels_BE_weather.txt
c:\program files\DDnsFilter
c:\program files\DDnsFilter\DDnsFilter.dll
c:\windows\system32\drivers\DnsFilter.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DDNSFILTER
-------\Legacy_DNSFILTER
-------\Service_ddnsfilter
-------\Service_DnsFilter
-------\Service_SfX

((((((((((((((((((((((((( Files Created from 2009-07-22 to 2009-08-22 )))))))))))))))))))))))))))))))
.

2009-08-20 00:16 . 2009-08-20 00:16 -------- d-----r- c:\documents and settings\LocalService\Favoris
2009-08-19 23:59 . 2009-07-28 14:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-19 23:59 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-08-19 23:59 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-08-19 23:59 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-08-19 23:59 . 2009-08-19 23:59 -------- d-----w- c:\program files\Avira
2009-08-19 23:59 . 2009-08-19 23:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-08-19 21:47 . 2009-08-19 21:47 -------- d-----w- c:\documents and settings\CENZANO\Application Data\Malwarebytes
2009-08-19 21:47 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-19 21:47 . 2009-08-19 21:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-19 21:47 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-19 21:47 . 2009-08-19 21:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-19 21:21 . 2009-08-19 21:21 -------- d-----w- C:\_OTM
2009-08-19 20:57 . 2009-08-19 23:45 -------- d-----w- c:\program files\trend micro
2009-08-19 20:57 . 2009-08-19 20:58 -------- d-----w- C:\rsit
2009-08-19 19:36 . 2009-08-19 19:36 -------- d-----w- C:\UsbFix
2009-08-12 07:16 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
2009-08-09 19:02 . 2009-08-09 19:02 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2009-08-09 19:00 . 2009-08-09 19:00 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-09 18:59 . 2009-08-09 18:59 -------- d-----w- c:\program files\MSBuild
2009-08-09 18:58 . 2009-08-09 18:58 -------- d-----w- c:\program files\Reference Assemblies
2009-08-09 18:56 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-09 18:56 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-09 18:56 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-09 18:56 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-09 18:56 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-09 18:56 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-09 18:56 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-09 18:56 . 2009-08-09 18:57 -------- d-----w- C:\30bcd657059f25d6b2
2009-08-09 18:40 . 2009-08-09 18:40 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-06 08:53 . 2009-08-06 08:53 -------- d-----w- c:\documents and settings\CENZANO\Local Settings\Application Data\Deployment
2009-08-05 11:12 . 2009-08-05 11:12 152576 ----a-w- c:\documents and settings\CENZANO\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-05 09:00 . 2009-08-05 09:00 205312 ------w- c:\windows\system32\dllcache\mswebdvd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-22 00:53 . 2008-02-24 03:42 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-21 23:09 . 2009-05-10 21:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-19 23:31 . 2007-07-02 14:43 -------- d-----w- c:\program files\Java
2009-08-10 07:02 . 2006-10-31 16:34 61592 ----a-w- c:\documents and settings\CENZANO\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-09 19:15 . 2002-09-16 14:59 91128 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-09 19:15 . 2002-09-16 14:59 524276 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-05 09:00 . 2002-08-30 02:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-01 10:06 . 2008-12-19 14:02 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-25 03:23 . 2008-11-29 15:52 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:03 . 2002-08-30 02:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-19 23:09 286208 ------w- c:\windows\system32\wmpdxm.dll
2009-07-08 20:10 . 2006-11-29 19:56 -------- d-----w- c:\program files\Messenger Plus! Live
2009-07-03 16:57 . 2006-06-23 12:28 915456 ------w- c:\windows\system32\wininet.dll
2009-06-25 08:26 . 2002-08-30 02:00 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2002-08-30 02:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2002-08-30 02:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2002-08-30 02:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2002-08-30 02:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2005-06-15 17:51 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2002-08-30 02:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:40 . 2002-08-30 02:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2002-08-30 02:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 10:44 . 2002-08-30 02:00 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:14 . 2002-08-30 02:00 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2002-08-30 02:00 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2002-08-30 02:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:10 . 2002-08-30 02:00 1297408 ----a-w- c:\windows\system32\quartz.dll
2008-05-04 19:54 . 2008-05-04 19:54 72 ----a-w- c:\program files\0008813279620-01_04.ram
2008-02-26 13:02 . 2008-02-26 13:02 318369 ----a-w- c:\program files\HiJackThis.zip
.

((((((((((((((((((((((((((((( SnapShot@2009-08-22_00.01.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-22 00:50 . 2009-08-22 00:50 16384 c:\windows\temp\Perflib_Perfdata_6a8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-09 67128]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-10 39408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Desktop Zoom"="c:\program files\HPQ\Desktop Zoom\hpwinadj.exe" [2002-10-09 249856]
"PreloadApp"="c:\hp\drivers\printers\photosmart\hphprld.exe" [2001-12-12 36864]
"srmclean"="c:\cpqs\Scom\srmclean.exe" [2001-07-24 36864]
"TV Now"="c:\program files\HPQ\Notebook Utilities\TvNow.exe" [2002-11-07 253952]
"Display Settings"="c:\program files\HPQ\Notebook Utilities\hptasks.exe" [2002-08-15 45056]
"QT4HPOT"="c:\progra~1\HPQ\ONE-TO~1\OneTouch.EXE" [2002-10-14 98304]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2002-09-09 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2002-09-09 557056]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2002-10-23 176197]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [2001-07-19 52736]
"Control Center"="c:\program files\ASUS\WLAN Card Utilities\Center.exe" [2004-11-04 1569280]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-02-01 1103240]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-02-06 454000]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-03-30 198160]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-10 68592]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-06-02 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2002-06-11 28672]
"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2002-06-11 286720]
"CARPService"="carpserv.exe" - c:\windows\system32\carpserv.exe [2003-05-21 4608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [19/12/2008 16:00 55136]
R3 ASNDIS5;ASNDIS5 Protocol Driver;c:\windows\system32\ASNDIS5.sys [30/10/2006 22:41 16269]
R3 CALIAUD;Conexant AMC 3D ENVIRONMENTAL AUDIO;c:\windows\system32\drivers\caliaud.sys [30/10/2006 16:24 291328]
R3 CALIHALA;CALIHALA;c:\windows\system32\drivers\calihal.sys [30/10/2006 16:24 244608]
R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;c:\windows\system32\drivers\DP83815.sys [18/03/2003 9:29 16512]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [29/01/2008 0:20 476416]
.
Contents of the 'Scheduled Tasks' folder

2009-08-22 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-10 21:24]

2009-08-21 c:\windows\Tasks\User_Feed_Synchronization-{B2DB3515-4508-44FC-997E-4A80316FCAD8}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
mWindow Title = Telenet Internet
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-22 02:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????9?1?5?5??p???? ?X#B?????????????l|B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\System32\\FM20ENU.DLL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3252)
c:\program files\Google\Quick Search Box\bin\1.2.1137.3514\qsb.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Windows Live\Family Safety\fsssvc.exe
c:\windows\system32\HPConfig.exe
c:\program files\HPQ\Notebook Utilities\HPWirelessMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\HPQ\One-Touch\ONETOUCH.EXE
c:\windows\system32\WGATray.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-08-22 3:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-22 01:06
ComboFix2.txt 2009-08-22 00:12

Pre-Run: 11.837.353.984 octets libres
Post-Run: 11.794.280.448 octets libres

227 --- E O F --- 2009-08-17 12:27

/!\ Seul joyauduciel peut suivre cette procédure. /!\

1/

---> Ouvre le Bloc-notes.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :

KillAll::

Driver::
ddnsfilter
DnsFilter

File::
c:\windows\system32\drivers\DnsFilter.sys

Folder::
c:\documents and settings\All Users\Application Data\Gram 32 Drv Wipe
c:\program files\DDnsFilter
c:\documents and settings\CENZANO\Application Data\VMNTOOLBAR

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8085:TCP"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
"ddnsfilter"=-

--> Colle la sélection dans le Bloc-notes.

--> Enregistre ce fichier sur le Bureau (Impératif).

--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.

2/

--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

--> Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

--> Une fois le scan achevé, un rapport va s'afficher : poste-le.

--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt

Ok, je vois, je viens de supprimer la même infection sur un autre forum.

Je reviens d'ici 2 minutes.

J'ai réussi à télécharge ComboFix ! Yessssssssssss ! Voici le rapport :

ComboFix 09-08-20.07 - CENZANO 22/08/2009 1:36.1.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.32.1036.18.446.142 [GMT 2:00]
Running from: c:\documents and settings\CENZANO\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\CENZANO\LOCALS~1\Temp\install_flash_player.exe
c:\recycler\S-1-5-21-776561741-789336058-1060284298-1003
c:\windows\0101120101464857.xe
c:\windows\0101120101464950.xe
c:\windows\0101120101465653.xe
c:\windows\Installer\268902.msp
c:\windows\Installer\268915.msp
c:\windows\Installer\2b8c8.msp
c:\windows\Installer\59bb62.msp
c:\windows\Installer\75cf9.msp
c:\windows\Installer\79cda4.msp
c:\windows\Installer\7b3012.msp
c:\windows\Installer\8363b5.msp
c:\windows\Installer\a6e202.msp
c:\windows\Installer\dca98c.msp
c:\windows\Installer\dca9a1.msp
c:\windows\prxid93ps.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SfX

((((((((((((((((((((((((( Files Created from 2009-07-22 to 2009-08-22 )))))))))))))))))))))))))))))))
.

2009-08-20 00:16 . 2009-08-20 00:16 -------- d-----r- c:\documents and settings\LocalService\Favoris
2009-08-19 23:59 . 2009-07-28 14:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-19 23:59 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-08-19 23:59 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-08-19 23:59 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-08-19 23:59 . 2009-08-19 23:59 -------- d-----w- c:\program files\Avira
2009-08-19 23:59 . 2009-08-19 23:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-08-19 21:47 . 2009-08-19 21:47 -------- d-----w- c:\documents and settings\CENZANO\Application Data\Malwarebytes
2009-08-19 21:47 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-19 21:47 . 2009-08-19 21:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-19 21:47 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-19 21:47 . 2009-08-19 21:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-19 21:21 . 2009-08-19 21:21 -------- d-----w- C:\_OTM
2009-08-19 20:57 . 2009-08-19 23:45 -------- d-----w- c:\program files\trend micro
2009-08-19 20:57 . 2009-08-19 20:58 -------- d-----w- C:\rsit
2009-08-19 20:53 . 2009-08-19 20:53 -------- d-----w- c:\documents and settings\CENZANO\Application Data\VMNTOOLBAR
2009-08-19 19:36 . 2009-08-19 19:36 -------- d-----w- C:\UsbFix
2009-08-19 10:12 . 2009-08-19 10:12 38016 ----a-w- c:\windows\system32\drivers\DnsFilter.sys
2009-08-19 10:12 . 2009-08-19 10:12 -------- d-----w- c:\program files\DDnsFilter
2009-08-12 07:16 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
2009-08-09 19:02 . 2009-08-09 19:02 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2009-08-09 19:00 . 2009-08-09 19:00 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-09 18:59 . 2009-08-09 18:59 -------- d-----w- c:\program files\MSBuild
2009-08-09 18:58 . 2009-08-09 18:58 -------- d-----w- c:\program files\Reference Assemblies
2009-08-09 18:56 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-09 18:56 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-09 18:56 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-09 18:56 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-09 18:56 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-09 18:56 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-09 18:56 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-09 18:56 . 2009-08-09 18:57 -------- d-----w- C:\30bcd657059f25d6b2
2009-08-09 18:40 . 2009-08-09 18:40 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-06 08:53 . 2009-08-06 08:53 -------- d-----w- c:\documents and settings\CENZANO\Local Settings\Application Data\Deployment
2009-08-05 11:12 . 2009-08-05 11:12 152576 ----a-w- c:\documents and settings\CENZANO\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-05 09:00 . 2009-08-05 09:00 205312 ------w- c:\windows\system32\dllcache\mswebdvd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-21 23:58 . 2008-02-24 03:42 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-21 23:09 . 2009-05-10 21:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-20 14:41 . 2007-08-03 17:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Gram 32 Drv Wipe
2009-08-19 23:31 . 2007-07-02 14:43 -------- d-----w- c:\program files\Java
2009-08-10 07:02 . 2006-10-31 16:34 61592 ----a-w- c:\documents and settings\CENZANO\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-09 19:15 . 2002-09-16 14:59 91128 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-09 19:15 . 2002-09-16 14:59 524276 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-05 09:00 . 2002-08-30 02:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-01 10:06 . 2008-12-19 14:02 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-25 03:23 . 2008-11-29 15:52 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:03 . 2002-08-30 02:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-19 23:09 286208 ------w- c:\windows\system32\wmpdxm.dll
2009-07-08 20:10 . 2006-11-29 19:56 -------- d-----w- c:\program files\Messenger Plus! Live
2009-07-03 16:57 . 2006-06-23 12:28 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-25 08:26 . 2002-08-30 02:00 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2002-08-30 02:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2002-08-30 02:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2002-08-30 02:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2002-08-30 02:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2005-06-15 17:51 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2002-08-30 02:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:40 . 2002-08-30 02:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2002-08-30 02:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 10:44 . 2002-08-30 02:00 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:14 . 2002-08-30 02:00 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2002-08-30 02:00 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2002-08-30 02:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:10 . 2002-08-30 02:00 1297408 ----a-w- c:\windows\system32\quartz.dll
2008-05-04 19:54 . 2008-05-04 19:54 72 ----a-w- c:\program files\0008813279620-01_04.ram
2008-02-26 13:02 . 2008-02-26 13:02 318369 ----a-w- c:\program files\HiJackThis.zip
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-09 67128]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-10 39408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Desktop Zoom"="c:\program files\HPQ\Desktop Zoom\hpwinadj.exe" [2002-10-09 249856]
"PreloadApp"="c:\hp\drivers\printers\photosmart\hphprld.exe" [2001-12-12 36864]
"srmclean"="c:\cpqs\Scom\srmclean.exe" [2001-07-24 36864]
"TV Now"="c:\program files\HPQ\Notebook Utilities\TvNow.exe" [2002-11-07 253952]
"Display Settings"="c:\program files\HPQ\Notebook Utilities\hptasks.exe" [2002-08-15 45056]
"QT4HPOT"="c:\progra~1\HPQ\ONE-TO~1\OneTouch.EXE" [2002-10-14 98304]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2002-09-09 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2002-09-09 557056]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2002-10-23 176197]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [2001-07-19 52736]
"Control Center"="c:\program files\ASUS\WLAN Card Utilities\Center.exe" [2004-11-04 1569280]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-02-01 1103240]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-02-06 454000]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-03-30 198160]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-10 68592]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-06-02 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2002-06-11 28672]
"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2002-06-11 286720]
"CARPService"="carpserv.exe" - c:\windows\system32\carpserv.exe [2003-05-21 4608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-3-9 67128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8085:TCP"= 8085:TCP:ddnsfilter

R?2 ddnsfilter;ddnsfilter;c:\windows\sySTEM32\SvchoSt.ExE -k ddnsfilter [30/08/2002 4:00 14336]
R1 DnsFilter;DnsFilter;c:\windows\system32\drivers\DnsFilter.sys [19/08/2009 12:12 38016]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [20/08/2009 1:59 108289]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [19/12/2008 16:00 55136]
R2 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [6/02/2009 19:08 533360]
R3 ASNDIS5;ASNDIS5 Protocol Driver;c:\windows\system32\ASNDIS5.sys [30/10/2006 22:41 16269]
R3 CALIAUD;Conexant AMC 3D ENVIRONMENTAL AUDIO;c:\windows\system32\drivers\caliaud.sys [30/10/2006 16:24 291328]
R3 CALIHALA;CALIHALA;c:\windows\system32\drivers\calihal.sys [30/10/2006 16:24 244608]
R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;c:\windows\system32\drivers\DP83815.sys [18/03/2003 9:29 16512]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [29/01/2008 0:20 476416]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [24/02/2008 5:41 747912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
ddnsfilter REG_MULTI_SZ ddnsfilter
.
Contents of the 'Scheduled Tasks' folder

2009-08-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-10 21:24]

2009-08-21 c:\windows\Tasks\User_Feed_Synchronization-{B2DB3515-4508-44FC-997E-4A80316FCAD8}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{A057A204-BACC-4D26-8287-79A187E26987} - (no file)
HKCU-Run-PcSync - c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
mWindow Title = Telenet Internet
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-22 02:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????9?1?5?5??????? ?X#B?????????????l|B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\System32\\FM20ENU.DLL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2156)
c:\program files\Google\Quick Search Box\bin\1.2.1137.3514\qsb.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\HPConfig.exe
c:\program files\HPQ\Notebook Utilities\HPWirelessMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\HPQ\One-Touch\ONETOUCH.EXE
c:\program files\Logitech\Video\FxSvr2.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\WGATray.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-08-22 2:12 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-22 00:12

Pre-Run: 6.645.624.832 octets libres
Post-Run: 11.829.534.720 octets libres

244 --- E O F --- 2009-08-17 12:27

Essaie de le télécharger depuis un autre PC puis transfère-le avec une clé USB par exemple.

Même problème rencontré avec ce lien --> impossible de télécharger ComboFix ;-(