Infecté par rootkit

Tout d'abord merci de m'avoir autant aidé, mais je n'est rien sous la main pour graver, et la personne utilisant le pc en a besoin rapidement. Mon patron ma dit de reformater, je vais recupérer sur clé usb les quelques fichiers importants.

J'aurais aimé pouvoir continuer l'opération pour comprendre un peu mieux ce rootkit mais bon.

Encore merci .

"No TDSS infection detected"

Elle est bien bonne :D

La suite se corse un peu...

*telecharges OTLPE.iso

» utilise ton utilitaire de gravure pour graver l'image , il faut utiliser l'option fichier\ graver iso \ graver image, ça peut etre different en fonction des utilitaires de gravures , mais le principe reste le meme.Ne pas graver comme disk de données /!\

exemple avec burner30.zip | à dezipper avant de le lançer!(clic droit executer en tant qu'administrateur avec Vista)

*cocher dans advanced options : close disc(finalize) et eject after write|erase

http://imagesup.org/image

exemple Nero:

http://imagesup.org/image

http://imagesup.org/image

cliquer ouvrir pour demarrer la gravure

* demarrer sur le cdrom crée de Reatogo|OTLPE , voir exemple: https://forum.malekal.com/viewtopic.php?t=9447&start=

http://imagesup.org/image

http://imagesup.org/image

http://imagesup.org/image

http://imagesup.org/image

* une fois le bureau de reatogo chargé , tu lances OTLPE , l'icone jaune

* Double-click sur l'icone OTLPE
* quand demandé "Do you wish to load the remote registry", select Yes
* quand demandé "Do you wish to load remote user profile(s) for scanning", select Yes
* verifier que "Automatically Load All Remaining Users" est sélectionné et press OK

http://imagesup.org/image

o sous Custom Scan box http://imagesup.org/image copie_colle le contenu du cadre ci dessous:


netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
http.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
CREATERESTOREPOINT


* clic Run Scan pour demarrer le scan.
* une fois terminé , le fichier se trouve là C:\OTL.txt
* copie_colle le contenu dans ta prochaine reponse

voila le log:
Norman TDSS Cleaner
Version 1.9.1
Copyright © 1990 - 2010, Norman ASA. Built 2010/04/19 17:13:08

Norman Scanner Engine Version: 6.04.08
Nvcbin.def Version: 6.04.00, Date: 2010/04/19 17:13:08, Variants: 55545

Scan started: 27/04/2010 10:50:15

Running pre-scan cleanup routine:
Operating System: Microsoft Windows XP Professional 5.1.2600 Service Pack 3
Logged on user: POSTE105\john

Running anti-TDSS module:

No TDSS infection detected

TDSS scan complete. Will now scan for related malware

Scanning bootsectors...

Number of sectors found: 1
Number of sectors scanned: 1
Number of sectors not scanned: 0
Number of infections found: 0
Number of infections removed: 0
Total scanning time: 0s 31ms

Scanning running processes and process memory...

Number of processes/threads found: 3248
Number of processes/threads scanned: 3247
Number of processes/threads not scanned: 1
Number of infected processes/threads terminated: 0
Total scanning time: 21s

Scanning file system...

Scanning: prescan

Scanning: C:\WINDOWS\system32\drivers\*

Scanning: postscan

Running post-scan cleanup routine:

Number of files found: 346
Number of archives unpacked: 0
Number of files scanned: 345
Number of files not scanned: 1
Number of files skipped due to exclude list: 0
Number of infected files found: 0
Number of infected files repaired/deleted: 0
Number of infections removed: 0
Total scanning time: 3s 968ms

On enchaine.

* Télécharge Norman TDSS Cleaner
* Lance le programme
* Si il demande de redémarre fais le, et poste le rapport si il y a

voici le log ComboFix:
ComboFix 10-04-21.01 - john 27/04/2010 9:59.6.1 - x86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.895.738 [GMT 2:00]
Lancé depuis: c:\documents and settings\john\Bureau\testCombo.exe
Commutateurs utilisés :: c:\documents and settings\john\Bureau\CFScript.txt

FILE ::
"c:\windows\system32\aadebcf4_z.dll"
"c:\windows\TMP5.tmp"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\aadebcf4_z.dll
c:\windows\TMP5.tmp

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MFJAIMQA
-------\Service_mfjaimqa

((((((((((((((((((((((((((((( Fichiers créés du 2010-03-27 au 2010-04-27 ))))))))))))))))))))))))))))))))))))
.

2010-04-27 07:01 . 2010-04-27 07:13 -------- d-----w- C:\testCombo7863t
2010-04-26 15:46 . 2010-04-26 15:48 -------- d-----w- C:\testCombo
2010-04-26 10:46 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-26 10:46 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-26 10:46 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-26 10:46 . 2010-04-14 16:31 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-04-26 10:46 . 2010-04-14 16:31 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-04-26 10:46 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-26 10:46 . 2010-04-14 16:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-04-26 10:46 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-26 10:46 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-26 10:46 . 2010-04-26 10:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-04-26 08:07 . 2010-04-26 08:07 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-04-26 08:07 . 2010-04-26 08:07 -------- d-----r- c:\documents and settings\LocalService\Favoris
2010-04-26 07:14 . 2010-04-26 07:14 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-26 07:13 . 2010-04-26 07:13 -------- d-----w- c:\documents and settings\john\Application Data\Malwarebytes
2010-04-26 07:13 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-26 07:13 . 2010-04-26 07:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-26 07:13 . 2010-04-26 07:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-26 07:13 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-26 06:58 . 2008-04-13 09:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-04-26 06:58 . 2008-04-13 09:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-04-26 06:58 . 2008-04-13 09:41 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-04-26 06:58 . 2008-04-13 09:41 8192 ----a-w- c:\windows\system32\dllcache\changer.sys
2010-04-01 15:34 . 2010-04-01 15:34 -------- d-----w- c:\program files\EZFace
2010-03-29 06:36 . 2009-10-23 15:28 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-27 06:46 . 2004-08-03 23:00 574464 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-26 10:46 . 2008-08-11 12:16 -------- d-----w- c:\program files\Alwil Software
2010-04-26 08:06 . 2010-04-26 08:06 4922 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2010-04-26 08:06 . 2006-01-26 20:35 568780 ----a-w- c:\windows\system32\perfh00C.dat
2010-04-26 08:06 . 2006-01-26 20:35 108874 ----a-w- c:\windows\system32\perfc00C.dat
2010-04-07 09:31 . 2008-02-08 13:59 -------- d-----w- c:\program files\Google
.

((((((((((((((((((((((((((((( SnapShot@2010-04-26_10.38.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-11 22:02 . 2009-07-11 22:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-11 22:05 . 2009-07-11 22:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
+ 2009-07-11 22:05 . 2009-07-11 22:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
+ 2010-04-27 08:11 . 2010-04-27 08:11 16384 c:\windows\temp\Perflib_Perfdata_a8.dat
+ 2009-07-11 22:02 . 2009-07-11 22:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
+ 2009-07-11 22:05 . 2009-07-11 22:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2010-04-26 10:46 . 2010-04-26 10:46 219648 c:\windows\Installer\f53b8.msi
+ 2010-04-26 11:43 . 2010-04-26 11:43 219648 c:\windows\Installer\f311d.msi
+ 2009-07-11 22:02 . 2009-07-11 22:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 68856]
"Google Update"="c:\documents and settings\john\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-21 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mouse Suite 98 Daemon"="ICO.EXE" [2005-04-13 49152]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-15 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Administrateur\Menu D'marrer\Programmes\D'marrage\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]

c:\documents and settings\Administrateur\Menu D'marrer\Programmes\D'marrage\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 d344bus;d344bus;c:\windows\system32\drivers\d344bus.sys [22/05/2008 15:44 137216]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [26/04/2010 12:46 162768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26/04/2010 12:46 19024]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [22/05/2007 16:59 30336]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [18/11/2009 15:13 135664]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [11/12/2009 16:43 238960]
S3 rk_remover-boot;rk_remover-boot;\??\c:\windows\system32\drivers\rk_remover.sys --> c:\windows\system32\drivers\rk_remover.sys [?]
S4 d344prt;d344prt;c:\windows\system32\drivers\d344prt.sys [22/05/2008 15:44 5248]
.
Contenu du dossier 'Tâches planifiées'

2010-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-18 13:13]

2010-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-18 13:13]

2010-04-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3136234265-601822484-2454817574-1008Core.job
- c:\documents and settings\john\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 06:30]

2010-04-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3136234265-601822484-2454817574-1008UA.job
- c:\documents and settings\john\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 06:30]

2010-04-27 c:\windows\Tasks\User_Feed_Synchronization-{C559A810-C6C3-4249-85CF-66A7272D9D9E}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
TCP: {8834C4ED-D914-410F-A084-AF4EE0DDA5C3} = 192.168.0.1
FF - ProfilePath - c:\documents and settings\john\Application Data\Mozilla\Firefox\Profiles\o0upzg5e.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
pref(dom.disable_open_during_load, false);c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-27 10:11
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8558C918]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf754ef28
\Driver\ACPI -> ACPI.sys @ 0xf73becb8
\Driver\atapi -> 0x8558c918
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: Marvell Yukon 88E8071 PCI-E Gigabit Ethernet Controller -> SendCompleteHandler -> NDIS.sys @ 0xf725cbb0
PacketIndicateHandler -> NDIS.sys @ 0xf724ba0d
SendHandler -> NDIS.sys @ 0xf725fb40
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø*€|ÿÿÿÿ*€|é*9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(984)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\windows\system32\PSIService.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\ICO.EXE
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
.
**************************************************************************
.
Heure de fin: 2010-04-27 10:15:32 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-04-27 08:15
ComboFix2.txt 2010-04-27 07:13
ComboFix3.txt 2010-04-26 16:21
ComboFix4.txt 2010-04-26 15:04
ComboFix5.txt 2010-04-27 07:52

Avant-CF: 117 235 613 696 octets libres
Après-CF: 116 156 542 976 octets libres

- - End Of File - - 64D3EFF6F175D4D29F67D136217DA011

pour le TDSS je pense pas... au pire tu auras une infection USB, c'est bénin.

Merci le ComboFix tourne, par contre il y a un risque de transmission par clé usb car pour faire certaines manips je dois transférer les exécutables ou log grâce à une clé entre les deux pc.

Fais ceci

= Copier ce texte qui est en gras


Driver::
mfjaimqa
File::
c:\windows\TMP5.tmp
c:\windows\system32\aadebcf4_z.dll
FireFox::
FF - ProfilePath - c:\documents and settings\john\Application Data\Mozilla\Firefox\Profiles\o0upzg5e.default\
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=


------------------------------

= Ouvrir le Bloc-Notes
= Clic-droit ==> coller
= Faire ==> fichier ==> enregistrer sous ==> choisir Bureau
= Le nommer CFScript.txt
= Fermer le bloc-note
= prendre ce Bloc-note qui est sur le bureau par un clic-gauche continu
= L'amener dans Combofix et relacher le clic
= Combofix se relance seul
= mettre le rapport dans la réponse

Voila le log combofix:

ComboFix 10-04-21.01 - john 27/04/2010 9:06.5.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.895.630 [GMT 2:00]
Lancé depuis: c:\documents and settings\john\Bureau\testCombo.exe
.

((((((((((((((((((((((((((((( Fichiers créés du 2010-03-27 au 2010-04-27 ))))))))))))))))))))))))))))))))))))
.

2010-04-26 15:46 . 2010-04-26 15:48 -------- d-----w- C:\testCombo
2010-04-26 10:46 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-26 10:46 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-26 10:46 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-26 10:46 . 2010-04-14 16:31 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-04-26 10:46 . 2010-04-14 16:31 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-04-26 10:46 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-26 10:46 . 2010-04-14 16:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-04-26 10:46 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-26 10:46 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-26 10:46 . 2010-04-26 10:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-04-26 08:07 . 2010-04-26 08:07 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-04-26 08:07 . 2010-04-26 08:07 -------- d-----r- c:\documents and settings\LocalService\Favoris
2010-04-26 07:14 . 2010-04-26 07:14 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-26 07:13 . 2010-04-26 07:13 -------- d-----w- c:\documents and settings\john\Application Data\Malwarebytes
2010-04-26 07:13 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-26 07:13 . 2010-04-26 07:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-26 07:13 . 2010-04-26 07:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-26 07:13 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-26 06:58 . 2008-04-13 09:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-04-26 06:58 . 2008-04-13 09:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-04-26 06:58 . 2008-04-13 09:41 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-04-26 06:58 . 2008-04-13 09:41 8192 ----a-w- c:\windows\system32\dllcache\changer.sys
2010-04-01 15:34 . 2010-04-01 15:34 -------- d-----w- c:\program files\EZFace
2010-03-29 06:36 . 2009-10-23 15:28 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-27 06:46 . 2004-08-03 23:00 574464 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-26 10:46 . 2008-08-11 12:16 -------- d-----w- c:\program files\Alwil Software
2010-04-26 08:07 . 2010-04-26 08:07 574464 ----a-w- c:\windows\TMP5.tmp
2010-04-26 08:06 . 2010-04-26 08:06 4922 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2010-04-26 08:06 . 2006-01-26 20:35 568780 ----a-w- c:\windows\system32\perfh00C.dat
2010-04-26 08:06 . 2006-01-26 20:35 108874 ----a-w- c:\windows\system32\perfc00C.dat
2010-04-07 09:31 . 2008-02-08 13:59 -------- d-----w- c:\program files\Google
2008-08-11 08:12 . 2008-08-11 08:12 23 --sha-w- c:\windows\system32\aadebcf4_z.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-04-26_10.38.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-11 22:02 . 2009-07-11 22:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-11 22:05 . 2009-07-11 22:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
+ 2009-07-11 22:05 . 2009-07-11 22:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
+ 2010-04-26 16:29 . 2010-04-26 16:29 16384 c:\windows\temp\Perflib_Perfdata_90.dat
+ 2009-07-11 22:02 . 2009-07-11 22:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
+ 2009-07-11 22:05 . 2009-07-11 22:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2010-04-26 10:46 . 2010-04-26 10:46 219648 c:\windows\Installer\f53b8.msi
+ 2010-04-26 11:43 . 2010-04-26 11:43 219648 c:\windows\Installer\f311d.msi
+ 2009-07-11 22:02 . 2009-07-11 22:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 68856]
"Google Update"="c:\documents and settings\john\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-21 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mouse Suite 98 Daemon"="ICO.EXE" [2005-04-13 49152]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-15 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Administrateur\Menu D'marrer\Programmes\D'marrage\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]

c:\documents and settings\Administrateur\Menu D'marrer\Programmes\D'marrage\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 d344bus;d344bus;c:\windows\system32\drivers\d344bus.sys [22/05/2008 15:44 137216]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [26/04/2010 12:46 162768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26/04/2010 12:46 19024]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [22/05/2007 16:59 30336]
S0 mfjaimqa;mfjaimqa; [x]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [18/11/2009 15:13 135664]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [11/12/2009 16:43 238960]
S3 rk_remover-boot;rk_remover-boot;\??\c:\windows\system32\drivers\rk_remover.sys --> c:\windows\system32\drivers\rk_remover.sys [?]
S4 d344prt;d344prt;c:\windows\system32\drivers\d344prt.sys [22/05/2008 15:44 5248]
.
Contenu du dossier 'Tâches planifiées'

2010-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-18 13:13]

2010-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-18 13:13]

2010-04-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3136234265-601822484-2454817574-1008Core.job
- c:\documents and settings\john\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 06:30]

2010-04-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3136234265-601822484-2454817574-1008UA.job
- c:\documents and settings\john\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 06:30]

2010-04-27 c:\windows\Tasks\User_Feed_Synchronization-{C559A810-C6C3-4249-85CF-66A7272D9D9E}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
TCP: {8834C4ED-D914-410F-A084-AF4EE0DDA5C3} = 192.168.0.1
FF - ProfilePath - c:\documents and settings\john\Application Data\Mozilla\Firefox\Profiles\o0upzg5e.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
pref(dom.disable_open_during_load, false);c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-27 09:12
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8529C930]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7520f28
\Driver\ACPI -> ACPI.sys @ 0xf7390cb8
\Driver\atapi -> 0x8529c930
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: Marvell Yukon 88E8071 PCI-E Gigabit Ethernet Controller -> SendCompleteHandler -> NDIS.sys @ 0xf722ebb0
PacketIndicateHandler -> NDIS.sys @ 0xf721da0d
SendHandler -> NDIS.sys @ 0xf7231b40
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø*€|ÿÿÿÿ*€|é*9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(948)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2010-04-27 09:13:51
ComboFix-quarantined-files.txt 2010-04-27 07:13
ComboFix2.txt 2010-04-26 16:21
ComboFix3.txt 2010-04-26 15:04
ComboFix4.txt 2010-04-26 14:27
ComboFix5.txt 2010-04-27 07:01

Avant-CF: 116 321 554 432 octets libres
Après-CF: 116 275 499 008 octets libres

- - End Of File - - 5BC5482F9ACC098C6D76FA15C09E39C7

Est ce que la console de récupération a été installée par Combofix?
Si oui, alors démarre dessus (tu as le choix au démarrage)

Une fois dedans, taper:

fixmbr

puis

shutdown -r -t 00

Au redémarrage, refait un combofix.

Tu as le rapport Deffoger?

Tu as essayé Gmer en mode sans échec?

Bonjour,
J'ai lancé Defogger , le pc à redémarrer.
Malheureusement, gmer rencontre toujours une erreur.

Telécharge sur le bureau Defogger

= Double click sur Defogger
= Une fenêtre apparait clique Disable
= Redemarre ton PC si demandé

----------

refaire un scan Gmer.

Ecoute, je crois que je pourrais pas en venir à bout tout seul.
J'attends des conseils de la dream team, je reviens te voir, ou quelqu'un d'autre prendra la suite.. ok?

Voici le log de testCombo.exe :

ComboFix 10-04-21.01 - john 26/04/2010 18:07:24.4.1 - x86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.895.737 [GMT 2:00]
Lancé depuis: c:\documents and settings\john\Bureau\testCombo.exe
.

((((((((((((((((((((((((((((( Fichiers créés du 2010-03-26 au 2010-04-26 ))))))))))))))))))))))))))))))))))))
.

2010-04-26 15:46 . 2010-04-26 15:48 -------- d-----w- C:\testCombo
2010-04-26 10:46 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-26 10:46 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-26 10:46 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-26 10:46 . 2010-04-14 16:31 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-04-26 10:46 . 2010-04-14 16:31 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-04-26 10:46 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-26 10:46 . 2010-04-14 16:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-04-26 10:46 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-26 10:46 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-26 10:46 . 2010-04-26 10:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-04-26 08:07 . 2010-04-26 08:07 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-04-26 08:07 . 2010-04-26 08:07 -------- d-----r- c:\documents and settings\LocalService\Favoris
2010-04-26 07:14 . 2010-04-26 07:14 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-26 07:13 . 2010-04-26 07:13 -------- d-----w- c:\documents and settings\john\Application Data\Malwarebytes
2010-04-26 07:13 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-26 07:13 . 2010-04-26 07:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-26 07:13 . 2010-04-26 07:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-26 07:13 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-26 06:58 . 2008-04-13 09:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-04-26 06:58 . 2008-04-13 09:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-04-26 06:58 . 2008-04-13 09:41 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-04-26 06:58 . 2008-04-13 09:41 8192 ----a-w- c:\windows\system32\dllcache\changer.sys
2010-04-01 15:34 . 2010-04-01 15:34 -------- d-----w- c:\program files\EZFace
2010-03-29 06:36 . 2009-10-23 15:28 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-26 10:46 . 2008-08-11 12:16 -------- d-----w- c:\program files\Alwil Software
2010-04-26 08:07 . 2010-04-26 08:07 574464 ----a-w- c:\windows\TMP5.tmp
2010-04-26 08:07 . 2004-08-03 23:00 574464 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-26 08:06 . 2010-04-26 08:06 4922 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2010-04-26 08:06 . 2006-01-26 20:35 568780 ----a-w- c:\windows\system32\perfh00C.dat
2010-04-26 08:06 . 2006-01-26 20:35 108874 ----a-w- c:\windows\system32\perfc00C.dat
2010-04-07 09:31 . 2008-02-08 13:59 -------- d-----w- c:\program files\Google
2008-08-11 08:12 . 2008-08-11 08:12 23 --sha-w- c:\windows\system32\aadebcf4_z.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-04-26_10.38.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-11 22:02 . 2009-07-11 22:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-11 22:05 . 2009-07-11 22:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
+ 2009-07-11 22:05 . 2009-07-11 22:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
+ 2009-07-11 22:05 . 2009-07-11 22:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2010-04-26 10:46 . 2010-04-26 10:46 219648 c:\windows\Installer\f53b8.msi
+ 2010-04-26 11:43 . 2010-04-26 11:43 219648 c:\windows\Installer\f311d.msi
+ 2009-07-11 22:02 . 2009-07-11 22:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 68856]
"Google Update"="c:\documents and settings\john\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-21 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mouse Suite 98 Daemon"="ICO.EXE" [2005-04-13 49152]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-15 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Administrateur\Menu D'marrer\Programmes\D'marrage\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]

c:\documents and settings\Administrateur\Menu D'marrer\Programmes\D'marrage\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 d344bus;d344bus;c:\windows\system32\drivers\d344bus.sys [22/05/2008 15:44 137216]
R0 d344prt;d344prt;c:\windows\system32\drivers\d344prt.sys [22/05/2008 15:44 5248]
S0 mfjaimqa;mfjaimqa; [x]
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [26/04/2010 12:46 162768]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26/04/2010 12:46 19024]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [18/11/2009 15:13 135664]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [11/12/2009 16:43 238960]
S3 rk_remover-boot;rk_remover-boot;\??\c:\windows\system32\drivers\rk_remover.sys --> c:\windows\system32\drivers\rk_remover.sys [?]
S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [22/05/2007 16:59 30336]
.
Contenu du dossier 'Tâches planifiées'

2010-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-18 13:13]

2010-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-18 13:13]

2010-04-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3136234265-601822484-2454817574-1008Core.job
- c:\documents and settings\john\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 06:30]

2010-04-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3136234265-601822484-2454817574-1008UA.job
- c:\documents and settings\john\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 06:30]

2010-04-26 c:\windows\Tasks\User_Feed_Synchronization-{C559A810-C6C3-4249-85CF-66A7272D9D9E}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
TCP: {8834C4ED-D914-410F-A084-AF4EE0DDA5C3} = 192.168.0.1
FF - ProfilePath - c:\documents and settings\john\Application Data\Mozilla\Firefox\Profiles\o0upzg5e.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
pref(dom.disable_open_during_load, false);c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-26 18:16
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x85767438]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7733f28
\Driver\ACPI -> ACPI.sys @ 0xf7683cb8
\Driver\atapi -> 0x85767438
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø*€|ÿÿÿÿ*€|é*9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(256)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2010-04-26 18:21:19
ComboFix-quarantined-files.txt 2010-04-26 16:21
ComboFix2.txt 2010-04-26 15:04
ComboFix3.txt 2010-04-26 14:27
ComboFix4.txt 2010-04-26 10:40

Avant-CF: 117 296 930 816 octets libres
Après-CF: 117 248 987 136 octets libres

- - End Of File - - C40A2EF6B1ADCC9A4DEFA08AACAE9B40

Ya comme un truc bizarre qui se passe.... Combo et MBR jouent à cache-cache :D
Supprime Combofix,

Retélécharge le et renomme le testCombo.exe au moment de l'enregistrement sur le bureau. Puis refait un scan avec.
Je vais me renseigner, car là je vais être à cours d'arguments.

La ligne original MBR restored successfully n'est pas apparut , voici le log:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

Merci

Si Gmer n'est pas déjà sur le bureau, le mettre:
*Téléchargez mbr.exe de Gmer sur le Bureau : mbr.exe

Ensuite

*cliquer sur le Menu démarrer --> Exécuter, et tapez la commande suivante :
*Sous XP : "%userprofile%\Bureau\mbr" -f
*Sous Vista/Seven : "%userprofile%\Desktop\mbr" -f
*Dans le mbr.log cette ligne apparaîtra : original MBR restored successfully !
*Postez le rapport

Voici le log ComboFix:

ComboFix 10-04-21.01 - john 26/04/2010 16:51:03.4.1 - x86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.895.740 [GMT 2:00]
Lancé depuis: c:\documents and settings\john\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés du 2010-03-26 au 2010-04-26 ))))))))))))))))))))))))))))))))))))
.

2010-04-26 10:46 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-26 10:46 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-26 10:46 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-26 10:46 . 2010-04-14 16:31 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-04-26 10:46 . 2010-04-14 16:31 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-04-26 10:46 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-26 10:46 . 2010-04-14 16:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-04-26 10:46 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-26 10:46 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-26 10:46 . 2010-04-26 10:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-04-26 08:07 . 2010-04-26 08:07 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-04-26 08:07 . 2010-04-26 08:07 -------- d-----r- c:\documents and settings\LocalService\Favoris
2010-04-26 07:14 . 2010-04-26 07:14 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-26 07:13 . 2010-04-26 07:13 -------- d-----w- c:\documents and settings\john\Application Data\Malwarebytes
2010-04-26 07:13 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-26 07:13 . 2010-04-26 07:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-26 07:13 . 2010-04-26 07:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-26 07:13 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-26 06:58 . 2008-04-13 09:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-04-26 06:58 . 2008-04-13 09:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-04-26 06:58 . 2008-04-13 09:41 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-04-26 06:58 . 2008-04-13 09:41 8192 ----a-w- c:\windows\system32\dllcache\changer.sys
2010-04-01 15:34 . 2010-04-01 15:34 -------- d-----w- c:\program files\EZFace
2010-03-29 06:36 . 2009-10-23 15:28 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-26 10:46 . 2008-08-11 12:16 -------- d-----w- c:\program files\Alwil Software
2010-04-26 08:07 . 2010-04-26 08:07 574464 ----a-w- c:\windows\TMP5.tmp
2010-04-26 08:07 . 2004-08-03 23:00 574464 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-26 08:06 . 2010-04-26 08:06 4922 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2010-04-26 08:06 . 2006-01-26 20:35 568780 ----a-w- c:\windows\system32\perfh00C.dat
2010-04-26 08:06 . 2006-01-26 20:35 108874 ----a-w- c:\windows\system32\perfc00C.dat
2010-04-07 09:31 . 2008-02-08 13:59 -------- d-----w- c:\program files\Google
2008-08-11 08:12 . 2008-08-11 08:12 23 --sha-w- c:\windows\system32\aadebcf4_z.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-04-26_10.38.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-11 22:02 . 2009-07-11 22:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-11 22:05 . 2009-07-11 22:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
+ 2009-07-11 22:05 . 2009-07-11 22:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
+ 2009-07-11 22:05 . 2009-07-11 22:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2010-04-26 10:46 . 2010-04-26 10:46 219648 c:\windows\Installer\f53b8.msi
+ 2010-04-26 11:43 . 2010-04-26 11:43 219648 c:\windows\Installer\f311d.msi
+ 2009-07-11 22:02 . 2009-07-11 22:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
+ 2009-07-11 22:02 . 2009-07-11 22:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 68856]
"Google Update"="c:\documents and settings\john\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-21 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mouse Suite 98 Daemon"="ICO.EXE" [2005-04-13 49152]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-15 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Administrateur\Menu D'marrer\Programmes\D'marrage\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]

c:\documents and settings\Administrateur\Menu D'marrer\Programmes\D'marrage\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 d344bus;d344bus;c:\windows\system32\drivers\d344bus.sys [22/05/2008 15:44 137216]
R0 d344prt;d344prt;c:\windows\system32\drivers\d344prt.sys [22/05/2008 15:44 5248]
S0 mfjaimqa;mfjaimqa; [x]
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [26/04/2010 12:46 162768]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26/04/2010 12:46 19024]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [18/11/2009 15:13 135664]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [11/12/2009 16:43 238960]
S3 rk_remover-boot;rk_remover-boot;\??\c:\windows\system32\drivers\rk_remover.sys --> c:\windows\system32\drivers\rk_remover.sys [?]
S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [22/05/2007 16:59 30336]
.
Contenu du dossier 'Tâches planifiées'

2010-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-18 13:13]

2010-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-18 13:13]

2010-04-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3136234265-601822484-2454817574-1008Core.job
- c:\documents and settings\john\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 06:30]

2010-04-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3136234265-601822484-2454817574-1008UA.job
- c:\documents and settings\john\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 06:30]

2010-04-26 c:\windows\Tasks\User_Feed_Synchronization-{C559A810-C6C3-4249-85CF-66A7272D9D9E}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
TCP: {8834C4ED-D914-410F-A084-AF4EE0DDA5C3} = 192.168.0.1
FF - ProfilePath - c:\documents and settings\john\Application Data\Mozilla\Firefox\Profiles\o0upzg5e.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
pref(dom.disable_open_during_load, false);c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-26 16:59
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x85767438]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7733f28
\Driver\ACPI -> ACPI.sys @ 0xf7683cb8
\Driver\atapi -> 0x85767438
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø*€|ÿÿÿÿ*€|é*9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(256)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2010-04-26 17:04:42
ComboFix-quarantined-files.txt 2010-04-26 15:04
ComboFix2.txt 2010-04-26 14:27
ComboFix3.txt 2010-04-26 10:40

Avant-CF: 117 353 709 568 octets libres
Après-CF: 117 306 740 736 octets libres

- - End Of File - - E77D8B71DB31DE2C0CD2CAA1EDFADC1D

Refait un Combofix.