Un programme malveillant

fafyte -  
Bonjour,

Mon kaspersky pure a detecté un programme malveillant?
...et il me propose soit de le supprimer, soit de l'ignorer, soit de l'ajouter aux exclusions car il ne peut pas le réparer.que faire? merci de m'aider

PS :hacktool.win32.kiser.vt

52 réponses

Résumé de la discussion

Une détection par l'antivirus signale un programme potentiellement malveillant sous Windows, avec des options proposées : le supprimer, l'ignorer ou l'ajouter aux exclusions, ce qui suscite des choix délicats. Des outils et approches évoqués incluent Combofix, Ad Remover, Defogger et des procédures de restauration, bien que plusieurs participants signalent des blocages ou des retours difficiles après usage. Plusieurs contributions insistent sur la prudence avant d'agir et rappellent que des restaurations système peuvent réintroduire des éléments détectés, d'où l'intérêt d'obtenir un second avis. En cas de doute, il peut être préférable d'analyser le rapport généré par l'antivirus et de privilégier des solutions de nettoyage sûres, tout en évitant des mesures risquées pouvant perturber fortement le système.

Bobot (l’IA à votre service)
  2. gen-hackman
    ben je sais pas j'ai jamais vu une infection comme celle-là je la connais pas je peux pas te dire mais vu la difficulté qu'a Combofix qui est outil de pointe , un des plus lourds pour desinfecter un pc , pour virer ca .....!
    1. fafyte Auteur
      le problème de redémarrage que j t exposé tout a lheure c du a quoi? et si je refais l'analyse .? on peut tenter autre choses? merci bcp
    2. gen-hackman
      y 'a trop de degats je te dis ton systeme ne sera jamais stable
    3. fafyte Auteur
      ok merci beaucoup t'as essaye comme même je vais le formater et comme ça je serai tranquille,c gentil t as fais bcp pour moi ,je te mettrai au courent
    4. fafyte Auteur
      dis-moi est -ce que je peux réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"
  3. gen-hackman
    https://www.google.fr/search?q=comment+formater+un+pc&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:fr:official&client=firefox-a&gws_rd=ssl
    1. fafyte Auteur
      un lien sur google,tu peux pas etre plus precis stp
      et est ce que c urgent de le formater et c quoi le danger de le laisser comme ca? merci
    2. gen-hackman
      il va deconn$$$ de plus en plus jusqu'à plus demarrer
    3. fafyte Auteur
      je peux faire moi meme le formatage ,c pas dure? mais j'ai pas cd de reinstalation
    4. gen-hackman
      alors faut en acheter un
    5. fafyte Auteur
      ca coute combien ca?
  6. gen-hackman
    salut

    faut refaire ca :

    https://forums.commentcamarche.net/forum/affich-22169249-un-programme-malveillant?page=3#88
    1. fafyte Auteur
      je le nomme comment ?CFScript?
    2. fafyte Auteur
      j'ai commencer à faire le scan ,et il me demande si je veux la mise ajour de combofix je dis non et apres j'ai un fenetre :
      "la date actuelle est 2011-05-30 ,combofix est perimé ;cliquer sur oui pour le lancer en marche e,FONCTIONNALITE REDUITE ,cliquer sur non pour quitter "

      j'
    3. fafyte Auteur
      j'ai cliquer sur non et je prefere te demander ,je fais quoi ? merci
    4. gen-hackman
      fallait cliquer sur oui :) pour la mise à jour
    5. fafyte Auteur
      j'ai un souci ,j'ai fait ce que tu m'as demandé (deux fois) mais pour redémarrage il a un problème ,impossible de se redémarrer ,il ma propose une restauration de sysyteme ...pur le redemarer
  7. gen-hackman
    parce que combofix n'execute pas les commandes que je te demande de lui passer à travers le script
    1. fafyte Auteur
      bonjour,désolé de répondre que maintenant... dis-moi je fais quoi maintenant? et il est le probleme?
  8. gen-hackman
    salut désolé d'avoir une vie en dehors de CCM ^^

    t'es sur que t'as collé quelque chose dans le CFScript ?
    1. fafyte Auteur
      bonjour , oui j'ai collé le rapport pourQUOI,
  9. gen-hackman
    ben des fois faut prendre l'infection differemment pour qu'elle meure
    1. fafyte Auteur
      ok docteur ,je le ferai chez moi ce soir ;merci mille fois pour t conseille et a ce soir
    3. fafyte Auteur
      voila le nouveau rapport:

      ComboFix 11-05-24.06 - sofiane 26/05/2011 20:05:14.3.2 - x86
      Microsoft® Windows Vista(TM) Édition Familiale Basique 6.0.6002.2.1252.33.1036.18.1788.1048 [GMT 2:00]
      Lancé depuis: c:\users\sofiane\Desktop\sofiane.exe
      Commutateurs utilisés :: c:\users\sofiane\Desktop\CFScript.txt
      AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
      SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
      SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
      .
      .
      ((((((((((((((((((((((((((((( Fichiers créés du 2011-04-26 au 2011-05-26 ))))))))))))))))))))))))))))))))))))
      .
      .
      2011-05-26 18:22 . 2011-05-26 18:23 -------- d-----w- c:\users\sofiane\AppData\Local\temp
      2011-05-26 18:22 . 2011-05-26 18:22 -------- d-----w- c:\users\Default\AppData\Local\temp
      2011-05-25 21:00 . 2011-05-25 21:23 -------- d-----w- C:\sofiane
      2011-05-25 21:00 . 2011-05-26 18:03 -------- d-----w- C:\32788R22FWJFW
      2011-05-25 17:49 . 2011-05-25 19:06 -------- d-----w- C:\ComboFix
      2011-05-24 19:10 . 2011-05-24 19:10 -------- d-----w- c:\program files\Ad-Remover
      2011-05-24 18:36 . 2011-05-24 18:36 -------- d-----r- C:\MSOCache
      2011-05-24 15:44 . 2011-05-24 15:44 -------- d-----w- c:\program files\Axantum
      2011-05-23 22:54 . 2011-05-10 11:59 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
      2011-05-23 22:54 . 2011-05-10 12:03 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys
      2011-05-23 22:54 . 2011-05-10 12:02 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
      2011-05-23 22:54 . 2011-05-10 11:59 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
      2011-05-23 22:54 . 2011-05-10 12:03 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
      2011-05-23 22:54 . 2011-05-10 11:59 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
      2011-05-23 22:54 . 2011-05-10 12:10 40112 ----a-w- c:\windows\avastSS.scr
      2011-05-23 22:54 . 2011-05-10 12:10 199304 ----a-w- c:\windows\system32\aswBoot.exe
      2011-05-23 22:36 . 2011-05-23 22:37 -------- d-----w- C:\kleaner.tmp
      2011-05-23 01:40 . 2011-05-23 01:40 -------- d-----w- c:\programdata\AVAST Software
      2011-05-23 01:40 . 2011-05-23 01:40 -------- d-----w- c:\program files\AVAST Software
      2011-05-22 18:16 . 2011-05-22 18:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
      2011-05-10 21:17 . 2011-05-23 20:37 -------- d-----w- c:\program files\ZHPDiag
      2011-05-10 18:59 . 2011-05-10 21:21 -------- d-----w- c:\program files\Trend Micro
      2011-04-29 19:26 . 2011-05-24 13:18 -------- d-----w- c:\program files\JDownloader
      2011-04-29 19:04 . 2011-04-29 19:06 -------- d-----w- c:\program files\BitTorrent
      2011-04-29 19:02 . 2011-05-26 18:14 -------- d-----w- c:\users\sofiane\AppData\Roaming\BitTorrent
      .
      .
      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2011-04-08 07:25 . 2011-04-08 07:25 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
      2011-04-08 07:25 . 2011-04-08 07:25 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
      2011-04-08 07:25 . 2011-04-08 07:25 161792 ----a-w- c:\windows\system32\msls31.dll
      2011-04-08 07:25 . 2011-04-08 07:25 1126912 ----a-w- c:\windows\system32\wininet.dll
      2011-04-08 07:25 . 2011-04-08 07:25 86528 ----a-w- c:\windows\system32\iesysprep.dll
      2011-04-08 07:25 . 2011-04-08 07:25 63488 ----a-w- c:\windows\system32\tdc.ocx
      2011-04-08 07:25 . 2011-04-08 07:25 48640 ----a-w- c:\windows\system32\mshtmler.dll
      2011-04-08 07:25 . 2011-04-08 07:25 367104 ----a-w- c:\windows\system32\html.iec
      2011-04-08 07:25 . 2011-04-08 07:25 74752 ----a-w- c:\windows\system32\iesetup.dll
      2011-04-08 07:25 . 2011-04-08 07:25 420864 ----a-w- c:\windows\system32\vbscript.dll
      2011-04-08 07:25 . 2011-04-08 07:25 23552 ----a-w- c:\windows\system32\licmgr10.dll
      2011-04-08 07:25 . 2011-04-08 07:25 152064 ----a-w- c:\windows\system32\wextract.exe
      2011-04-08 07:25 . 2011-04-08 07:25 150528 ----a-w- c:\windows\system32\iexpress.exe
      2011-04-08 07:25 . 2011-04-08 07:25 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
      2011-04-08 07:25 . 2011-04-08 07:25 35840 ----a-w- c:\windows\system32\imgutil.dll
      2011-04-08 07:25 . 2011-04-08 07:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
      2011-04-08 07:25 . 2011-04-08 07:25 1797632 ----a-w- c:\windows\system32\jscript9.dll
      2011-04-08 07:25 . 2011-04-08 07:25 142848 ----a-w- c:\windows\system32\ieUnatt.exe
      2011-04-08 07:25 . 2011-04-08 07:25 11776 ----a-w- c:\windows\system32\mshta.exe
      2011-04-08 07:25 . 2011-04-08 07:25 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
      2011-04-08 07:25 . 2011-04-08 07:25 101888 ----a-w- c:\windows\system32\admparse.dll
      2011-04-08 07:23 . 2011-04-08 07:23 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
      2011-04-08 07:23 . 2011-04-08 07:23 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
      2011-04-08 07:23 . 2011-04-08 07:23 302592 ----a-w- c:\windows\system32\mfmp4src.dll
      2011-04-08 07:23 . 2011-04-08 07:23 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
      2011-04-08 07:23 . 2011-04-08 07:23 2873344 ----a-w- c:\windows\system32\mf.dll
      2011-04-08 07:23 . 2011-04-08 07:23 98816 ----a-w- c:\windows\system32\mfps.dll
      2011-04-08 07:23 . 2011-04-08 07:23 209920 ----a-w- c:\windows\system32\mfplat.dll
      2011-04-08 07:23 . 2011-04-08 07:23 586240 ----a-w- c:\windows\system32\stobject.dll
      2011-04-08 07:23 . 2011-04-08 07:23 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
      2011-04-08 07:23 . 2011-04-08 07:23 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
      2011-04-08 07:23 . 2011-04-08 07:23 797184 ----a-w- c:\windows\system32\FntCache.dll
      2011-04-08 07:23 . 2011-04-08 07:23 683008 ----a-w- c:\windows\system32\d2d1.dll
      2011-04-08 07:23 . 2011-04-08 07:23 486400 ----a-w- c:\windows\system32\d3d10level9.dll
      2011-04-08 07:23 . 2011-04-08 07:23 1068544 ----a-w- c:\windows\system32\DWrite.dll
      2011-04-08 07:23 . 2011-04-08 07:23 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
      2011-04-08 07:23 . 2011-04-08 07:23 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
      2011-04-08 07:23 . 2011-04-08 07:23 160768 ----a-w- c:\windows\system32\d3d10_1.dll
      2011-04-08 07:23 . 2011-04-08 07:23 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
      2011-04-08 07:23 . 2011-04-08 07:23 478720 ----a-w- c:\windows\system32\dxgi.dll
      2011-04-08 07:23 . 2011-04-08 07:23 37376 ----a-w- c:\windows\system32\cdd.dll
      2011-04-08 07:23 . 2011-04-08 07:23 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
      2011-04-08 07:23 . 2011-04-08 07:23 258048 ----a-w- c:\windows\system32\winspool.drv
      2011-04-08 07:23 . 2011-04-08 07:23 189952 ----a-w- c:\windows\system32\d3d10core.dll
      2011-04-08 07:23 . 2011-04-08 07:23 1029120 ----a-w- c:\windows\system32\d3d10.dll
      2011-04-08 07:23 . 2011-04-08 07:23 847360 ----a-w- c:\windows\system32\OpcServices.dll
      2011-04-08 07:23 . 2011-04-08 07:23 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
      2011-04-08 07:23 . 2011-04-08 07:23 1554432 ----a-w- c:\windows\system32\xpsservices.dll
      2011-04-08 07:23 . 2011-04-08 07:23 876032 ----a-w- c:\windows\system32\XpsPrint.dll
      2011-03-10 17:03 . 2011-04-15 23:01 1162240 ----a-w- c:\windows\system32\mfc42u.dll
      2011-03-10 17:03 . 2011-04-15 23:01 1136640 ----a-w- c:\windows\system32\mfc42.dll
      2011-03-03 15:42 . 2011-04-15 23:00 739328 ----a-w- c:\windows\system32\inetcomm.dll
      2011-03-03 13:25 . 2011-04-15 23:00 2041856 ----a-w- c:\windows\system32\win32k.sys
      2011-03-02 15:44 . 2011-04-15 23:00 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
      .
      .
      ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
      REGEDIT4
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
      @="{472083B0-C522-11CF-8763-00608CC02F24}"
      [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
      2011-05-10 12:10 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
      .
      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
      "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-18 2289664]
      "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
      "Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2009-06-20 955712]
      "BitTorrent"="c:\program files\BitTorrent\BitTorrent.exe" [2011-04-29 745848]
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
      "accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
      "PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-06-02 238984]
      "CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-21 24848]
      "PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-05-12 318488]
      "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
      "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
      "File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2008-05-14 10244096]
      "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-14 177456]
      "WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2008-05-24 197904]
      "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1314816]
      "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
      "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
      "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "EnableUIADesktopToggle"= 0 (0x0)
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
      "AppInit_DLLs"=c:\windows\System32\APSHook.dll
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
      @="Driver"
      .
      R3 010fb00948991fd9;010fb00948991fd9;c:\windows\TEMP\66803603ce8 [x]
      R3 0a988356fa58736e;0a988356fa58736e;c:\windows\TEMP\6880ebe26baf [x]
      R3 1336585094968e74;1336585094968e74;c:\windows\TEMP\688024ffc70f [x]
      R3 2156badedccb7c44;2156badedccb7c44;c:\windows\TEMP\6800aedef27c [x]
      R3 2b1e202b4be81fe7;2b1e202b4be81fe7;c:\windows\TEMP\6800e0b2f26c [x]
      R3 32f14afe3d2f951b;32f14afe3d2f951b;c:\windows\TEMP\6160420fbf3e [x]
      R3 3bac3f9da945b954;3bac3f9da945b954;c:\windows\TEMP\6880337b51a0 [x]
      R3 3c9c2b419e7f9264;3c9c2b419e7f9264;c:\windows\TEMP\68807f3b5c37 [x]
      R3 4f09fc6703efb549;4f09fc6703efb549;c:\windows\TEMP\6800e72914a0 [x]
      R3 7131f1e84717aa57;7131f1e84717aa57;c:\windows\TEMP\6800770506a4 [x]
      R3 72ca3562684bcfc4;72ca3562684bcfc4;c:\windows\TEMP\62007fcdbfe9 [x]
      R3 7f92339e138b8c4d;7f92339e138b8c4d;c:\windows\TEMP\68008c1055ee [x]
      R3 a23c43fdfad82e25;a23c43fdfad82e25;c:\windows\TEMP\6880709a126b [x]
      R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]
      R3 bf947525ff00178e;bf947525ff00178e;c:\windows\TEMP\68007c112280 [x]
      R3 d309889093fc42ba;d309889093fc42ba;c:\windows\TEMP\6880cbd9167c [x]
      R3 df5bc6917d56542f;df5bc6917d56542f;c:\windows\TEMP\680024b09222 [x]
      R3 ec894c2e32440e9d;ec894c2e32440e9d;c:\windows\TEMP\6880666215c2 [x]
      R3 f240fa0be613492d;f240fa0be613492d;c:\windows\TEMP\680092dca928 [x]
      R3 f58f296334cee734;f58f296334cee734;c:\windows\TEMP\6640d30ce376 [x]
      R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2008-09-15 7168]
      R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2008-09-15 110080]
      R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [2008-09-15 104960]
      S0 SafeBoot;SafeBoot; [x]
      S0 SbAlg;SbAlg; [x]
      S0 SbFsLock;SbFsLock; [x]
      S1 aswSnx;aswSnx; [x]
      S1 aswSP;aswSP; [x]
      S1 RsvLock;RsvLock; [x]
      S2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [2007-05-15 182576]
      S2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe [2008-01-21 21504]
      S2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe [2008-01-21 21504]
      S2 aswFsBlk;aswFsBlk; [x]
      S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-05-10 53592]
      S2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [2008-06-02 18944]
      S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2008-05-30 256512]
      S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2008-05-14 77824]
      S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-04-07 24936]
      S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2008-05-12 576024]
      S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]
      .
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
      LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
      Cognizance REG_MULTI_SZ ASBroker ASChannel
      HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
      LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
      2008-03-18 00:56 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
      .
      Contenu du dossier 'Tâches planifiées'
      .
      2011-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-764348856-769109338-2608236025-1004Core.job
      - c:\users\sofiane\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-02 00:14]
      .
      2011-05-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-764348856-769109338-2608236025-1004UA.job
      - c:\users\sofiane\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-02 00:14]
      .
      .
      ------- Examen supplémentaire -------
      .
      IE: &Recherche AOL Toolbar - c:\programdata\AOL\ieToolbar\resources\fr-FR\local\search.html
      IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
      IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      FF - ProfilePath - c:\users\sofiane\AppData\Roaming\Mozilla\Firefox\Profiles\ym5hkg64.default\
      FF - prefs.js: browser.search.defaulturl - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
      FF - prefs.js: browser.search.selectedEngine - Facemoods Search
      FF - prefs.js: browser.startup.homepage - hxxp://start.facemoods.com/?a=ddrnw
      FF - prefs.js: keyword.URL - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
      FF - user.js: yahoo.homepage.dontask - true
      .
      .
      **************************************************************************
      .
      catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2011-05-26 20:22
      Windows 6.0.6002 Service Pack 2 NTFS
      .
      Recherche de processus cachés ...
      .
      Recherche d'éléments en démarrage automatique cachés ...
      .
      Recherche de fichiers cachés ...
      .
      Scan terminé avec succès
      Fichiers cachés: 0
      .
      **************************************************************************
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]
      "ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\010fb00948991fd9]
      "ImagePath"="\??\c:\windows\TEMP\66803603ce8"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\0a988356fa58736e]
      "ImagePath"="\??\c:\windows\TEMP\6880ebe26baf"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\1336585094968e74]
      "ImagePath"="\??\c:\windows\TEMP\688024ffc70f"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\2156badedccb7c44]
      "ImagePath"="\??\c:\windows\TEMP\6800aedef27c"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\2b1e202b4be81fe7]
      "ImagePath"="\??\c:\windows\TEMP\6800e0b2f26c"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\32f14afe3d2f951b]
      "ImagePath"="\??\c:\windows\TEMP\6160420fbf3e"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3bac3f9da945b954]
      "ImagePath"="\??\c:\windows\TEMP\6880337b51a0"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3c9c2b419e7f9264]
      "ImagePath"="\??\c:\windows\TEMP\68807f3b5c37"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\4f09fc6703efb549]
      "ImagePath"="\??\c:\windows\TEMP\6800e72914a0"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\7131f1e84717aa57]
      "ImagePath"="\??\c:\windows\TEMP\6800770506a4"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\72ca3562684bcfc4]
      "ImagePath"="\??\c:\windows\TEMP\62007fcdbfe9"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\7f92339e138b8c4d]
      "ImagePath"="\??\c:\windows\TEMP\68008c1055ee"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\a23c43fdfad82e25]
      "ImagePath"="\??\c:\windows\TEMP\6880709a126b"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\bf947525ff00178e]
      "ImagePath"="\??\c:\windows\TEMP\68007c112280"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\d309889093fc42ba]
      "ImagePath"="\??\c:\windows\TEMP\6880cbd9167c"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\df5bc6917d56542f]
      "ImagePath"="\??\c:\windows\TEMP\680024b09222"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ec894c2e32440e9d]
      "ImagePath"="\??\c:\windows\TEMP\6880666215c2"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\f240fa0be613492d]
      "ImagePath"="\??\c:\windows\TEMP\680092dca928"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\f58f296334cee734]
      "ImagePath"="\??\c:\windows\TEMP\6640d30ce376"
      .
      --------------------- DLLs chargées dans les processus actifs ---------------------
      .
      - - - - - - - > 'winlogon.exe'(824)
      c:\windows\system32\APSHook.dll
      .
      - - - - - - - > 'lsass.exe'(700)
      c:\windows\system32\APSHook.dll
      .
      - - - - - - - > 'Explorer.exe'(3612)
      c:\program files\Hewlett-Packard\IAM\Bin\ItClient.dll
      c:\program files\Hewlett-Packard\File Sanitizer\HPPMDesktopIcon.dll
      .
      Heure de fin: 2011-05-26 20:35:37
      ComboFix-quarantined-files.txt 2011-05-26 18:35
      ComboFix2.txt 2011-05-25 21:23
      ComboFix3.txt 2011-05-25 19:46
      ComboFix4.txt 2011-05-23 20:00
      .
      Avant-CF: 51 008 536 576 octets libres
      Après-CF: 50 975 453 184 octets libres
      .
      - - End Of File - - E957B8CB44A840B05D859795937E0ECB
    4. fafyte Auteur
      alloooooooooooooooooo
    5. fafyte Auteur
      bonjour ,t pas disponible pour finir le travail...
  11. gen-hackman
    oui et je t'ai demandé de refaire avec ce que j'ai remis au dessus

    tu lis un peu ce que j'écris ?
    1. fafyte Auteur
      lol tu m'as demandé de le refaire? désolé j'ai du zapper ca! tu peux me renvoyer le lien et pourquoi je dois le refaire? juste pour savoir... là je suis a la mediatheque je me connecte en wifi mais la connexion est moyenne
  12. gen-hackman
    il est ou le rapport ?
    1. fafyte Auteur
      il était en deuxième page:

      le voila:
      ComboFix 11-05-24.06 - sofiane 25/05/2011 23:03:30.2.2 - x86
      Microsoft® Windows Vista(TM) Édition Familiale Basique 6.0.6002.2.1252.33.1036.18.1788.1069 [GMT 2:00]
      Lancé depuis: c:\users\sofiane\Desktop\sofiane.exe
      Commutateurs utilisés :: c:\users\sofiane\Desktop\CFScript.txt
      AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
      SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
      SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
      .
      FILE ::
      "C:\kleaner.tmp"
      .
      .
      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      c:\program files\BabylonToolbar
      c:\program files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbar.crx
      c:\program files\BittorrentBar_FR
      c:\program files\BittorrentBar_FR\BittorrentBar_FRToolbarHelper.exe
      c:\program files\BittorrentBar_FR\GottenAppsContextMenu.xml
      c:\program files\BittorrentBar_FR\INSTALL.LOG
      c:\program files\BittorrentBar_FR\OtherAppsContextMenu.xml
      c:\program files\BittorrentBar_FR\SharedAppsContextMenu.xml
      c:\program files\BittorrentBar_FR\tbBitt.dll
      c:\program files\BittorrentBar_FR\toolbar.cfg
      c:\program files\BittorrentBar_FR\ToolbarContextMenu.xml
      c:\program files\BittorrentBar_FR\UNWISE.EXE
      c:\program files\BittorrentBar_FR\UNWISE.INI
      .
      .
      ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      -------\Service_0115501252141232mcinstcleanup
      -------\Service_gmsee
      .
      .
      ((((((((((((((((((((((((((((( Fichiers créés du 2011-04-25 au 2011-05-25 ))))))))))))))))))))))))))))))))))))
      .
      .
      2011-05-25 21:12 . 2011-05-25 21:16 -------- d-----w- c:\users\sofiane\AppData\Local\temp
      2011-05-25 17:49 . 2011-05-25 19:06 -------- d-----w- C:\ComboFix
      2011-05-24 19:10 . 2011-05-24 19:10 -------- d-----w- c:\program files\Ad-Remover
      2011-05-24 18:36 . 2011-05-24 18:36 -------- d-----r- C:\MSOCache
      2011-05-24 15:44 . 2011-05-24 15:44 -------- d-----w- c:\program files\Axantum
      2011-05-23 22:54 . 2011-05-10 11:59 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
      2011-05-23 22:54 . 2011-05-10 12:03 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys
      2011-05-23 22:54 . 2011-05-10 12:02 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
      2011-05-23 22:54 . 2011-05-10 11:59 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
      2011-05-23 22:54 . 2011-05-10 12:03 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
      2011-05-23 22:54 . 2011-05-10 11:59 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
      2011-05-23 22:54 . 2011-05-10 12:10 40112 ----a-w- c:\windows\avastSS.scr
      2011-05-23 22:54 . 2011-05-10 12:10 199304 ----a-w- c:\windows\system32\aswBoot.exe
      2011-05-23 22:36 . 2011-05-23 22:37 -------- d-----w- C:\kleaner.tmp
      2011-05-23 01:40 . 2011-05-23 01:40 -------- d-----w- c:\programdata\AVAST Software
      2011-05-23 01:40 . 2011-05-23 01:40 -------- d-----w- c:\program files\AVAST Software
      2011-05-22 18:16 . 2011-05-22 18:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
      2011-05-10 21:17 . 2011-05-23 20:37 -------- d-----w- c:\program files\ZHPDiag
      2011-05-10 18:59 . 2011-05-10 21:21 -------- d-----w- c:\program files\Trend Micro
      2011-04-29 19:26 . 2011-05-24 13:18 -------- d-----w- c:\program files\JDownloader
      2011-04-29 19:04 . 2011-04-29 19:06 -------- d-----w- c:\program files\BitTorrent
      2011-04-29 19:02 . 2011-05-25 20:53 -------- d-----w- c:\users\sofiane\AppData\Roaming\BitTorrent
      .
      .
      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2011-04-08 07:25 . 2011-04-08 07:25 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
      2011-04-08 07:25 . 2011-04-08 07:25 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
      2011-04-08 07:25 . 2011-04-08 07:25 161792 ----a-w- c:\windows\system32\msls31.dll
      2011-04-08 07:25 . 2011-04-08 07:25 1126912 ----a-w- c:\windows\system32\wininet.dll
      2011-04-08 07:25 . 2011-04-08 07:25 86528 ----a-w- c:\windows\system32\iesysprep.dll
      2011-04-08 07:25 . 2011-04-08 07:25 63488 ----a-w- c:\windows\system32\tdc.ocx
      2011-04-08 07:25 . 2011-04-08 07:25 48640 ----a-w- c:\windows\system32\mshtmler.dll
      2011-04-08 07:25 . 2011-04-08 07:25 367104 ----a-w- c:\windows\system32\html.iec
      2011-04-08 07:25 . 2011-04-08 07:25 74752 ----a-w- c:\windows\system32\iesetup.dll
      2011-04-08 07:25 . 2011-04-08 07:25 420864 ----a-w- c:\windows\system32\vbscript.dll
      2011-04-08 07:25 . 2011-04-08 07:25 23552 ----a-w- c:\windows\system32\licmgr10.dll
      2011-04-08 07:25 . 2011-04-08 07:25 152064 ----a-w- c:\windows\system32\wextract.exe
      2011-04-08 07:25 . 2011-04-08 07:25 150528 ----a-w- c:\windows\system32\iexpress.exe
      2011-04-08 07:25 . 2011-04-08 07:25 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
      2011-04-08 07:25 . 2011-04-08 07:25 35840 ----a-w- c:\windows\system32\imgutil.dll
      2011-04-08 07:25 . 2011-04-08 07:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
      2011-04-08 07:25 . 2011-04-08 07:25 1797632 ----a-w- c:\windows\system32\jscript9.dll
      2011-04-08 07:25 . 2011-04-08 07:25 142848 ----a-w- c:\windows\system32\ieUnatt.exe
      2011-04-08 07:25 . 2011-04-08 07:25 11776 ----a-w- c:\windows\system32\mshta.exe
      2011-04-08 07:25 . 2011-04-08 07:25 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
      2011-04-08 07:25 . 2011-04-08 07:25 101888 ----a-w- c:\windows\system32\admparse.dll
      2011-04-08 07:23 . 2011-04-08 07:23 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
      2011-04-08 07:23 . 2011-04-08 07:23 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
      2011-04-08 07:23 . 2011-04-08 07:23 302592 ----a-w- c:\windows\system32\mfmp4src.dll
      2011-04-08 07:23 . 2011-04-08 07:23 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
      2011-04-08 07:23 . 2011-04-08 07:23 2873344 ----a-w- c:\windows\system32\mf.dll
      2011-04-08 07:23 . 2011-04-08 07:23 98816 ----a-w- c:\windows\system32\mfps.dll
      2011-04-08 07:23 . 2011-04-08 07:23 209920 ----a-w- c:\windows\system32\mfplat.dll
      2011-04-08 07:23 . 2011-04-08 07:23 586240 ----a-w- c:\windows\system32\stobject.dll
      2011-04-08 07:23 . 2011-04-08 07:23 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
      2011-04-08 07:23 . 2011-04-08 07:23 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
      2011-04-08 07:23 . 2011-04-08 07:23 797184 ----a-w- c:\windows\system32\FntCache.dll
      2011-04-08 07:23 . 2011-04-08 07:23 683008 ----a-w- c:\windows\system32\d2d1.dll
      2011-04-08 07:23 . 2011-04-08 07:23 486400 ----a-w- c:\windows\system32\d3d10level9.dll
      2011-04-08 07:23 . 2011-04-08 07:23 1068544 ----a-w- c:\windows\system32\DWrite.dll
      2011-04-08 07:23 . 2011-04-08 07:23 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
      2011-04-08 07:23 . 2011-04-08 07:23 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
      2011-04-08 07:23 . 2011-04-08 07:23 160768 ----a-w- c:\windows\system32\d3d10_1.dll
      2011-04-08 07:23 . 2011-04-08 07:23 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
      2011-04-08 07:23 . 2011-04-08 07:23 478720 ----a-w- c:\windows\system32\dxgi.dll
      2011-04-08 07:23 . 2011-04-08 07:23 37376 ----a-w- c:\windows\system32\cdd.dll
      2011-04-08 07:23 . 2011-04-08 07:23 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
      2011-04-08 07:23 . 2011-04-08 07:23 258048 ----a-w- c:\windows\system32\winspool.drv
      2011-04-08 07:23 . 2011-04-08 07:23 189952 ----a-w- c:\windows\system32\d3d10core.dll
      2011-04-08 07:23 . 2011-04-08 07:23 1029120 ----a-w- c:\windows\system32\d3d10.dll
      2011-04-08 07:23 . 2011-04-08 07:23 847360 ----a-w- c:\windows\system32\OpcServices.dll
      2011-04-08 07:23 . 2011-04-08 07:23 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
      2011-04-08 07:23 . 2011-04-08 07:23 1554432 ----a-w- c:\windows\system32\xpsservices.dll
      2011-04-08 07:23 . 2011-04-08 07:23 876032 ----a-w- c:\windows\system32\XpsPrint.dll
      2011-03-10 17:03 . 2011-04-15 23:01 1162240 ----a-w- c:\windows\system32\mfc42u.dll
      2011-03-10 17:03 . 2011-04-15 23:01 1136640 ----a-w- c:\windows\system32\mfc42.dll
      2011-03-03 15:42 . 2011-04-15 23:00 739328 ----a-w- c:\windows\system32\inetcomm.dll
      2011-03-03 13:25 . 2011-04-15 23:00 2041856 ----a-w- c:\windows\system32\win32k.sys
      2011-03-02 15:44 . 2011-04-15 23:00 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
      .
      .
      ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
      REGEDIT4
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
      @="{472083B0-C522-11CF-8763-00608CC02F24}"
      [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
      2011-05-10 12:10 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
      .
      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
      "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-18 2289664]
      "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
      "Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2009-06-20 955712]
      "BitTorrent"="c:\program files\BitTorrent\BitTorrent.exe" [2011-04-29 745848]
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
      "accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
      "PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-06-02 238984]
      "CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-21 24848]
      "PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-05-12 318488]
      "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
      "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
      "File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2008-05-14 10244096]
      "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-14 177456]
      "WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2008-05-24 197904]
      "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1314816]
      "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
      "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
      "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "EnableUIADesktopToggle"= 0 (0x0)
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
      @="Driver"
      .
      R3 010fb00948991fd9;010fb00948991fd9;c:\windows\TEMP\66803603ce8 [x]
      R3 0a988356fa58736e;0a988356fa58736e;c:\windows\TEMP\6880ebe26baf [x]
      R3 1336585094968e74;1336585094968e74;c:\windows\TEMP\688024ffc70f [x]
      R3 2156badedccb7c44;2156badedccb7c44;c:\windows\TEMP\6800aedef27c [x]
      R3 2b1e202b4be81fe7;2b1e202b4be81fe7;c:\windows\TEMP\6800e0b2f26c [x]
      R3 32f14afe3d2f951b;32f14afe3d2f951b;c:\windows\TEMP\6160420fbf3e [x]
      R3 3bac3f9da945b954;3bac3f9da945b954;c:\windows\TEMP\6880337b51a0 [x]
      R3 3c9c2b419e7f9264;3c9c2b419e7f9264;c:\windows\TEMP\68807f3b5c37 [x]
      R3 4f09fc6703efb549;4f09fc6703efb549;c:\windows\TEMP\6800e72914a0 [x]
      R3 7131f1e84717aa57;7131f1e84717aa57;c:\windows\TEMP\6800770506a4 [x]
      R3 72ca3562684bcfc4;72ca3562684bcfc4;c:\windows\TEMP\62007fcdbfe9 [x]
      R3 7f92339e138b8c4d;7f92339e138b8c4d;c:\windows\TEMP\68008c1055ee [x]
      R3 a23c43fdfad82e25;a23c43fdfad82e25;c:\windows\TEMP\6880709a126b [x]
      R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]
      R3 bf947525ff00178e;bf947525ff00178e;c:\windows\TEMP\68007c112280 [x]
      R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]
      R3 d309889093fc42ba;d309889093fc42ba;c:\windows\TEMP\6880cbd9167c [x]
      R3 df5bc6917d56542f;df5bc6917d56542f;c:\windows\TEMP\680024b09222 [x]
      R3 ec894c2e32440e9d;ec894c2e32440e9d;c:\windows\TEMP\6880666215c2 [x]
      R3 f240fa0be613492d;f240fa0be613492d;c:\windows\TEMP\680092dca928 [x]
      R3 f58f296334cee734;f58f296334cee734;c:\windows\TEMP\6640d30ce376 [x]
      R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2008-09-15 7168]
      R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2008-09-15 110080]
      R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [2008-09-15 104960]
      S0 SafeBoot;SafeBoot; [x]
      S0 SbAlg;SbAlg; [x]
      S0 SbFsLock;SbFsLock; [x]
      S1 aswSnx;aswSnx; [x]
      S1 aswSP;aswSP; [x]
      S1 RsvLock;RsvLock; [x]
      S2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [2007-05-15 182576]
      S2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe [2008-01-21 21504]
      S2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe [2008-01-21 21504]
      S2 aswFsBlk;aswFsBlk; [x]
      S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-05-10 53592]
      S2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [2008-06-02 18944]
      S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2008-05-30 256512]
      S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2008-05-14 77824]
      S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-04-07 24936]
      S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2008-05-12 576024]
      .
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
      LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
      Cognizance REG_MULTI_SZ ASBroker ASChannel
      HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
      LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
      2008-03-18 00:56 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
      .
      Contenu du dossier 'Tâches planifiées'
      .
      2011-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-764348856-769109338-2608236025-1004Core.job
      - c:\users\sofiane\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-02 00:14]
      .
      2011-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-764348856-769109338-2608236025-1004UA.job
      - c:\users\sofiane\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-02 00:14]
      .
      .
      ------- Examen supplémentaire -------
      .
      IE: &Recherche AOL Toolbar - c:\programdata\AOL\ieToolbar\resources\fr-FR\local\search.html
      IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
      IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      FF - ProfilePath - c:\users\sofiane\AppData\Roaming\Mozilla\Firefox\Profiles\ym5hkg64.default\
      FF - prefs.js: browser.search.defaulturl - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
      FF - prefs.js: browser.search.selectedEngine - Facemoods Search
      FF - prefs.js: browser.startup.homepage - hxxp://start.facemoods.com/?a=ddrnw
      FF - prefs.js: keyword.URL - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
      FF - user.js: yahoo.homepage.dontask - true
      .
      - - - - ORPHELINS SUPPRIMES - - - -
      .
      AddRemove-BittorrentBar_FR Toolbar - c:\progra~1\BITTOR~2\UNWISE.EXE
      .
      .
      .
      **************************************************************************
      .
      catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2011-05-25 23:16
      Windows 6.0.6002 Service Pack 2 NTFS
      .
      Recherche de processus cachés ...
      .
      Recherche d'éléments en démarrage automatique cachés ...
      .
      Recherche de fichiers cachés ...
      .
      Scan terminé avec succès
      Fichiers cachés: 0
      .
      **************************************************************************
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]
      "ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\010fb00948991fd9]
      "ImagePath"="\??\c:\windows\TEMP\66803603ce8"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\0a988356fa58736e]
      "ImagePath"="\??\c:\windows\TEMP\6880ebe26baf"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\1336585094968e74]
      "ImagePath"="\??\c:\windows\TEMP\688024ffc70f"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\2156badedccb7c44]
      "ImagePath"="\??\c:\windows\TEMP\6800aedef27c"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\2b1e202b4be81fe7]
      "ImagePath"="\??\c:\windows\TEMP\6800e0b2f26c"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\32f14afe3d2f951b]
      "ImagePath"="\??\c:\windows\TEMP\6160420fbf3e"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3bac3f9da945b954]
      "ImagePath"="\??\c:\windows\TEMP\6880337b51a0"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3c9c2b419e7f9264]
      "ImagePath"="\??\c:\windows\TEMP\68807f3b5c37"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\4f09fc6703efb549]
      "ImagePath"="\??\c:\windows\TEMP\6800e72914a0"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\7131f1e84717aa57]
      "ImagePath"="\??\c:\windows\TEMP\6800770506a4"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\72ca3562684bcfc4]
      "ImagePath"="\??\c:\windows\TEMP\62007fcdbfe9"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\7f92339e138b8c4d]
      "ImagePath"="\??\c:\windows\TEMP\68008c1055ee"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\a23c43fdfad82e25]
      "ImagePath"="\??\c:\windows\TEMP\6880709a126b"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\bf947525ff00178e]
      "ImagePath"="\??\c:\windows\TEMP\68007c112280"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\d309889093fc42ba]
      "ImagePath"="\??\c:\windows\TEMP\6880cbd9167c"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\df5bc6917d56542f]
      "ImagePath"="\??\c:\windows\TEMP\680024b09222"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ec894c2e32440e9d]
      "ImagePath"="\??\c:\windows\TEMP\6880666215c2"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\f240fa0be613492d]
      "ImagePath"="\??\c:\windows\TEMP\680092dca928"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\f58f296334cee734]
      "ImagePath"="\??\c:\windows\TEMP\6640d30ce376"
      .
      --------------------- DLLs chargées dans les processus actifs ---------------------
      .
      - - - - - - - > 'Explorer.exe'(2952)
      c:\program files\Hewlett-Packard\IAM\Bin\ItClient.dll
      c:\program files\Hewlett-Packard\File Sanitizer\HPPMDesktopIcon.dll
      .
      ------------------------ Autres processus actifs ------------------------
      .
      c:\windows\system32\Ati2evxx.exe
      c:\windows\system32\Ati2evxx.exe
      c:\program files\AVAST Software\Avast\AvastSvc.exe
      c:\windows\system32\WLANExt.exe
      c:\windows\system32\AEADISRV.EXE
      c:\windows\system32\agrsmsvc.exe
      c:\program files\ActivIdentity\ActivClient\acevents.exe
      c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      c:\program files\Common Files\LightScribe\LSSrvc.exe
      c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
      c:\windows\servicing\TrustedInstaller.exe
      c:\program files\Hewlett-Packard\IAM\Bin\AsGHost.exe
      c:\windows\system32\conime.exe
      c:\windows\PEV.exe
      c:\windows\system32\wbem\unsecapp.exe
      c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
      .
      **************************************************************************
      .
      Heure de fin: 2011-05-25 23:23:39 - La machine a redémarré
      ComboFix-quarantined-files.txt 2011-05-25 21:23
      ComboFix2.txt 2011-05-25 19:46
      ComboFix3.txt 2011-05-23 20:00
      .
      Avant-CF: 53 143 408 640 octets libres
      Après-CF: 53 219 856 384 octets libres
      .
      - - End Of File - - 8A4E4E981FEE44D59A582132EA62DC48
  13. gen-hackman
    je sais pas comment t'as fait ton compte mais tu t'es mis dans un drole de caca....

    y'a pas tout qui a été enlever on recommence avec ca dans le texte pareil comme tout à l'heure


    __________________________________________________
    =>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <=
    =>il est fort déconseillé de le transposer sur un autre ordinateur !<=
    ----------------------------------------------------------------------------

    Toujours avec toutes les protections désactivées, fais ceci :

    ▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
    ▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

    ----------------------------------------------------------
    KillAll::

    file::
    C:\kleaner.tmp

    Registry::
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\010fb00948991fd9]
    [--HKEY_LOCAL_MACHINE\system\ControlSet001\Services\0a988356fa58736e]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\1336585094968e74]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\2156badedccb7c44]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\2b1e202b4be81fe7]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\32f14afe3d2f951b]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3bac3f9da945b954]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3c9c2b419e7f9264]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\4f09fc6703efb549]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\7131f1e84717aa57]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\72ca3562684bcfc4]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\7f92339e138b8c4d]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\a23c43fdfad82e25]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\bf947525ff00178e]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\d309889093fc42ba]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\df5bc6917d56542f]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ec894c2e32440e9d]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\f240fa0be613492d]
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\f58f296334cee734]

    Driver::
    RsvLock
    SafeBoot
    SbAlg
    010fb00948991fd9;010fb00948991fd9R3
    1336585094968e74;1336585094968e74
    2156badedccb7c44;2156badedccb7c44
    2b1e202b4be81fe7;2b1e202b4be81fe7
    32f14afe3d2f951b;32f14afe3d2f951b
    3bac3f9da945b954;3bac3f9da945b954
    3c9c2b419e7f9264;3c9c2b419e7f9264
    4f09fc6703efb549;4f09fc6703efb549
    7131f1e84717aa57;7131f1e84717aa57
    72ca3562684bcfc4;72ca3562684bcfc4
    7f92339e138b8c4d;7f92339e138b8c4d
    a23c43fdfad82e25;a23c43fdfad82e25
    bf947525ff00178e;bf947525ff00178e
    d309889093fc42ba;d309889093fc42ba
    df5bc6917d56542f;df5bc6917d56542f
    ec894c2e32440e9d;ec894c2e32440e9d
    f240fa0be613492d;f240fa0be613492d
    f58f296334cee734;f58f296334cee734
    SbFsLock

    ------------------------------------------------------------------

    ▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
    ▶ Quitte le Bloc Notes

    ▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix

    ▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
    ▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
    ▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

    G3?-?@¢??@?......Concepteur de List_Kill'em...Pre_Scan....MBR_Repair....
    1. fafyte Auteur
      bonjour, mais c bon je t envoyé le rapport ,j'ai suivi ce que tu m'as demandé de faire et tout s'est bien passé .je t posté le rapport ,tu lis au moins ce je t'envoies????bizarre
  14. gen-hackman
    oué

    le bloc notes tu dois l'apeller CFScript

    après une fois qu il est fermé tu le glisses sur l'icone rouge et blanche que tu viens d'utiliser , le logiel va se relancer et prendre en compte ce qu'il y a dans le papier que tu as glissé dessus

    laisse faire comme la premiere fois et à la fin il va surement te faire redemarrer , une fois que tu auras redemarré , tu reviens mettre le rapport , pareil que tout à l'heure
    1. fafyte Auteur
      voila c fait :

      ComboFix 11-05-24.06 - sofiane 25/05/2011 23:03:30.2.2 - x86
      Microsoft® Windows Vista(TM) Édition Familiale Basique 6.0.6002.2.1252.33.1036.18.1788.1069 [GMT 2:00]
      Lancé depuis: c:\users\sofiane\Desktop\sofiane.exe
      Commutateurs utilisés :: c:\users\sofiane\Desktop\CFScript.txt
      AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
      SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
      SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
      .
      FILE ::
      "C:\kleaner.tmp"
      .
      .
      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      c:\program files\BabylonToolbar
      c:\program files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbar.crx
      c:\program files\BittorrentBar_FR
      c:\program files\BittorrentBar_FR\BittorrentBar_FRToolbarHelper.exe
      c:\program files\BittorrentBar_FR\GottenAppsContextMenu.xml
      c:\program files\BittorrentBar_FR\INSTALL.LOG
      c:\program files\BittorrentBar_FR\OtherAppsContextMenu.xml
      c:\program files\BittorrentBar_FR\SharedAppsContextMenu.xml
      c:\program files\BittorrentBar_FR\tbBitt.dll
      c:\program files\BittorrentBar_FR\toolbar.cfg
      c:\program files\BittorrentBar_FR\ToolbarContextMenu.xml
      c:\program files\BittorrentBar_FR\UNWISE.EXE
      c:\program files\BittorrentBar_FR\UNWISE.INI
      .
      .
      ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      -------\Service_0115501252141232mcinstcleanup
      -------\Service_gmsee
      .
      .
      ((((((((((((((((((((((((((((( Fichiers créés du 2011-04-25 au 2011-05-25 ))))))))))))))))))))))))))))))))))))
      .
      .
      2011-05-25 21:12 . 2011-05-25 21:16 -------- d-----w- c:\users\sofiane\AppData\Local\temp
      2011-05-25 17:49 . 2011-05-25 19:06 -------- d-----w- C:\ComboFix
      2011-05-24 19:10 . 2011-05-24 19:10 -------- d-----w- c:\program files\Ad-Remover
      2011-05-24 18:36 . 2011-05-24 18:36 -------- d-----r- C:\MSOCache
      2011-05-24 15:44 . 2011-05-24 15:44 -------- d-----w- c:\program files\Axantum
      2011-05-23 22:54 . 2011-05-10 11:59 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
      2011-05-23 22:54 . 2011-05-10 12:03 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys
      2011-05-23 22:54 . 2011-05-10 12:02 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
      2011-05-23 22:54 . 2011-05-10 11:59 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
      2011-05-23 22:54 . 2011-05-10 12:03 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
      2011-05-23 22:54 . 2011-05-10 11:59 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
      2011-05-23 22:54 . 2011-05-10 12:10 40112 ----a-w- c:\windows\avastSS.scr
      2011-05-23 22:54 . 2011-05-10 12:10 199304 ----a-w- c:\windows\system32\aswBoot.exe
      2011-05-23 22:36 . 2011-05-23 22:37 -------- d-----w- C:\kleaner.tmp
      2011-05-23 01:40 . 2011-05-23 01:40 -------- d-----w- c:\programdata\AVAST Software
      2011-05-23 01:40 . 2011-05-23 01:40 -------- d-----w- c:\program files\AVAST Software
      2011-05-22 18:16 . 2011-05-22 18:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
      2011-05-10 21:17 . 2011-05-23 20:37 -------- d-----w- c:\program files\ZHPDiag
      2011-05-10 18:59 . 2011-05-10 21:21 -------- d-----w- c:\program files\Trend Micro
      2011-04-29 19:26 . 2011-05-24 13:18 -------- d-----w- c:\program files\JDownloader
      2011-04-29 19:04 . 2011-04-29 19:06 -------- d-----w- c:\program files\BitTorrent
      2011-04-29 19:02 . 2011-05-25 20:53 -------- d-----w- c:\users\sofiane\AppData\Roaming\BitTorrent
      .
      .
      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2011-04-08 07:25 . 2011-04-08 07:25 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
      2011-04-08 07:25 . 2011-04-08 07:25 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
      2011-04-08 07:25 . 2011-04-08 07:25 161792 ----a-w- c:\windows\system32\msls31.dll
      2011-04-08 07:25 . 2011-04-08 07:25 1126912 ----a-w- c:\windows\system32\wininet.dll
      2011-04-08 07:25 . 2011-04-08 07:25 86528 ----a-w- c:\windows\system32\iesysprep.dll
      2011-04-08 07:25 . 2011-04-08 07:25 63488 ----a-w- c:\windows\system32\tdc.ocx
      2011-04-08 07:25 . 2011-04-08 07:25 48640 ----a-w- c:\windows\system32\mshtmler.dll
      2011-04-08 07:25 . 2011-04-08 07:25 367104 ----a-w- c:\windows\system32\html.iec
      2011-04-08 07:25 . 2011-04-08 07:25 74752 ----a-w- c:\windows\system32\iesetup.dll
      2011-04-08 07:25 . 2011-04-08 07:25 420864 ----a-w- c:\windows\system32\vbscript.dll
      2011-04-08 07:25 . 2011-04-08 07:25 23552 ----a-w- c:\windows\system32\licmgr10.dll
      2011-04-08 07:25 . 2011-04-08 07:25 152064 ----a-w- c:\windows\system32\wextract.exe
      2011-04-08 07:25 . 2011-04-08 07:25 150528 ----a-w- c:\windows\system32\iexpress.exe
      2011-04-08 07:25 . 2011-04-08 07:25 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
      2011-04-08 07:25 . 2011-04-08 07:25 35840 ----a-w- c:\windows\system32\imgutil.dll
      2011-04-08 07:25 . 2011-04-08 07:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
      2011-04-08 07:25 . 2011-04-08 07:25 1797632 ----a-w- c:\windows\system32\jscript9.dll
      2011-04-08 07:25 . 2011-04-08 07:25 142848 ----a-w- c:\windows\system32\ieUnatt.exe
      2011-04-08 07:25 . 2011-04-08 07:25 11776 ----a-w- c:\windows\system32\mshta.exe
      2011-04-08 07:25 . 2011-04-08 07:25 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
      2011-04-08 07:25 . 2011-04-08 07:25 101888 ----a-w- c:\windows\system32\admparse.dll
      2011-04-08 07:23 . 2011-04-08 07:23 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
      2011-04-08 07:23 . 2011-04-08 07:23 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
      2011-04-08 07:23 . 2011-04-08 07:23 302592 ----a-w- c:\windows\system32\mfmp4src.dll
      2011-04-08 07:23 . 2011-04-08 07:23 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
      2011-04-08 07:23 . 2011-04-08 07:23 2873344 ----a-w- c:\windows\system32\mf.dll
      2011-04-08 07:23 . 2011-04-08 07:23 98816 ----a-w- c:\windows\system32\mfps.dll
      2011-04-08 07:23 . 2011-04-08 07:23 209920 ----a-w- c:\windows\system32\mfplat.dll
      2011-04-08 07:23 . 2011-04-08 07:23 586240 ----a-w- c:\windows\system32\stobject.dll
      2011-04-08 07:23 . 2011-04-08 07:23 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
      2011-04-08 07:23 . 2011-04-08 07:23 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
      2011-04-08 07:23 . 2011-04-08 07:23 797184 ----a-w- c:\windows\system32\FntCache.dll
      2011-04-08 07:23 . 2011-04-08 07:23 683008 ----a-w- c:\windows\system32\d2d1.dll
      2011-04-08 07:23 . 2011-04-08 07:23 486400 ----a-w- c:\windows\system32\d3d10level9.dll
      2011-04-08 07:23 . 2011-04-08 07:23 1068544 ----a-w- c:\windows\system32\DWrite.dll
      2011-04-08 07:23 . 2011-04-08 07:23 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
      2011-04-08 07:23 . 2011-04-08 07:23 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
      2011-04-08 07:23 . 2011-04-08 07:23 160768 ----a-w- c:\windows\system32\d3d10_1.dll
      2011-04-08 07:23 . 2011-04-08 07:23 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
      2011-04-08 07:23 . 2011-04-08 07:23 478720 ----a-w- c:\windows\system32\dxgi.dll
      2011-04-08 07:23 . 2011-04-08 07:23 37376 ----a-w- c:\windows\system32\cdd.dll
      2011-04-08 07:23 . 2011-04-08 07:23 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
      2011-04-08 07:23 . 2011-04-08 07:23 258048 ----a-w- c:\windows\system32\winspool.drv
      2011-04-08 07:23 . 2011-04-08 07:23 189952 ----a-w- c:\windows\system32\d3d10core.dll
      2011-04-08 07:23 . 2011-04-08 07:23 1029120 ----a-w- c:\windows\system32\d3d10.dll
      2011-04-08 07:23 . 2011-04-08 07:23 847360 ----a-w- c:\windows\system32\OpcServices.dll
      2011-04-08 07:23 . 2011-04-08 07:23 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
      2011-04-08 07:23 . 2011-04-08 07:23 1554432 ----a-w- c:\windows\system32\xpsservices.dll
      2011-04-08 07:23 . 2011-04-08 07:23 876032 ----a-w- c:\windows\system32\XpsPrint.dll
      2011-03-10 17:03 . 2011-04-15 23:01 1162240 ----a-w- c:\windows\system32\mfc42u.dll
      2011-03-10 17:03 . 2011-04-15 23:01 1136640 ----a-w- c:\windows\system32\mfc42.dll
      2011-03-03 15:42 . 2011-04-15 23:00 739328 ----a-w- c:\windows\system32\inetcomm.dll
      2011-03-03 13:25 . 2011-04-15 23:00 2041856 ----a-w- c:\windows\system32\win32k.sys
      2011-03-02 15:44 . 2011-04-15 23:00 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
      .
      .
      ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
      REGEDIT4
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
      @="{472083B0-C522-11CF-8763-00608CC02F24}"
      [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
      2011-05-10 12:10 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
      .
      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
      "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-18 2289664]
      "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
      "Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2009-06-20 955712]
      "BitTorrent"="c:\program files\BitTorrent\BitTorrent.exe" [2011-04-29 745848]
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
      "accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
      "PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-06-02 238984]
      "CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-21 24848]
      "PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-05-12 318488]
      "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
      "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
      "File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2008-05-14 10244096]
      "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-14 177456]
      "WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2008-05-24 197904]
      "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1314816]
      "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
      "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
      "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "EnableUIADesktopToggle"= 0 (0x0)
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
      @="Driver"
      .
      R3 010fb00948991fd9;010fb00948991fd9;c:\windows\TEMP\66803603ce8 [x]
      R3 0a988356fa58736e;0a988356fa58736e;c:\windows\TEMP\6880ebe26baf [x]
      R3 1336585094968e74;1336585094968e74;c:\windows\TEMP\688024ffc70f [x]
      R3 2156badedccb7c44;2156badedccb7c44;c:\windows\TEMP\6800aedef27c [x]
      R3 2b1e202b4be81fe7;2b1e202b4be81fe7;c:\windows\TEMP\6800e0b2f26c [x]
      R3 32f14afe3d2f951b;32f14afe3d2f951b;c:\windows\TEMP\6160420fbf3e [x]
      R3 3bac3f9da945b954;3bac3f9da945b954;c:\windows\TEMP\6880337b51a0 [x]
      R3 3c9c2b419e7f9264;3c9c2b419e7f9264;c:\windows\TEMP\68807f3b5c37 [x]
      R3 4f09fc6703efb549;4f09fc6703efb549;c:\windows\TEMP\6800e72914a0 [x]
      R3 7131f1e84717aa57;7131f1e84717aa57;c:\windows\TEMP\6800770506a4 [x]
      R3 72ca3562684bcfc4;72ca3562684bcfc4;c:\windows\TEMP\62007fcdbfe9 [x]
      R3 7f92339e138b8c4d;7f92339e138b8c4d;c:\windows\TEMP\68008c1055ee [x]
      R3 a23c43fdfad82e25;a23c43fdfad82e25;c:\windows\TEMP\6880709a126b [x]
      R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]
      R3 bf947525ff00178e;bf947525ff00178e;c:\windows\TEMP\68007c112280 [x]
      R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]
      R3 d309889093fc42ba;d309889093fc42ba;c:\windows\TEMP\6880cbd9167c [x]
      R3 df5bc6917d56542f;df5bc6917d56542f;c:\windows\TEMP\680024b09222 [x]
      R3 ec894c2e32440e9d;ec894c2e32440e9d;c:\windows\TEMP\6880666215c2 [x]
      R3 f240fa0be613492d;f240fa0be613492d;c:\windows\TEMP\680092dca928 [x]
      R3 f58f296334cee734;f58f296334cee734;c:\windows\TEMP\6640d30ce376 [x]
      R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2008-09-15 7168]
      R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2008-09-15 110080]
      R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [2008-09-15 104960]
      S0 SafeBoot;SafeBoot; [x]
      S0 SbAlg;SbAlg; [x]
      S0 SbFsLock;SbFsLock; [x]
      S1 aswSnx;aswSnx; [x]
      S1 aswSP;aswSP; [x]
      S1 RsvLock;RsvLock; [x]
      S2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [2007-05-15 182576]
      S2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe [2008-01-21 21504]
      S2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe [2008-01-21 21504]
      S2 aswFsBlk;aswFsBlk; [x]
      S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-05-10 53592]
      S2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [2008-06-02 18944]
      S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2008-05-30 256512]
      S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2008-05-14 77824]
      S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-04-07 24936]
      S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2008-05-12 576024]
      .
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
      LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
      Cognizance REG_MULTI_SZ ASBroker ASChannel
      HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
      LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
      2008-03-18 00:56 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
      .
      Contenu du dossier 'Tâches planifiées'
      .
      2011-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-764348856-769109338-2608236025-1004Core.job
      - c:\users\sofiane\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-02 00:14]
      .
      2011-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-764348856-769109338-2608236025-1004UA.job
      - c:\users\sofiane\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-02 00:14]
      .
      .
      ------- Examen supplémentaire -------
      .
      IE: &Recherche AOL Toolbar - c:\programdata\AOL\ieToolbar\resources\fr-FR\local\search.html
      IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
      IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      FF - ProfilePath - c:\users\sofiane\AppData\Roaming\Mozilla\Firefox\Profiles\ym5hkg64.default\
      FF - prefs.js: browser.search.defaulturl - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
      FF - prefs.js: browser.search.selectedEngine - Facemoods Search
      FF - prefs.js: browser.startup.homepage - hxxp://start.facemoods.com/?a=ddrnw
      FF - prefs.js: keyword.URL - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
      FF - user.js: yahoo.homepage.dontask - true
      .
      - - - - ORPHELINS SUPPRIMES - - - -
      .
      AddRemove-BittorrentBar_FR Toolbar - c:\progra~1\BITTOR~2\UNWISE.EXE
      .
      .
      .
      **************************************************************************
      .
      catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2011-05-25 23:16
      Windows 6.0.6002 Service Pack 2 NTFS
      .
      Recherche de processus cachés ...
      .
      Recherche d'éléments en démarrage automatique cachés ...
      .
      Recherche de fichiers cachés ...
      .
      Scan terminé avec succès
      Fichiers cachés: 0
      .
      **************************************************************************
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]
      "ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\010fb00948991fd9]
      "ImagePath"="\??\c:\windows\TEMP\66803603ce8"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\0a988356fa58736e]
      "ImagePath"="\??\c:\windows\TEMP\6880ebe26baf"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\1336585094968e74]
      "ImagePath"="\??\c:\windows\TEMP\688024ffc70f"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\2156badedccb7c44]
      "ImagePath"="\??\c:\windows\TEMP\6800aedef27c"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\2b1e202b4be81fe7]
      "ImagePath"="\??\c:\windows\TEMP\6800e0b2f26c"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\32f14afe3d2f951b]
      "ImagePath"="\??\c:\windows\TEMP\6160420fbf3e"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3bac3f9da945b954]
      "ImagePath"="\??\c:\windows\TEMP\6880337b51a0"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3c9c2b419e7f9264]
      "ImagePath"="\??\c:\windows\TEMP\68807f3b5c37"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\4f09fc6703efb549]
      "ImagePath"="\??\c:\windows\TEMP\6800e72914a0"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\7131f1e84717aa57]
      "ImagePath"="\??\c:\windows\TEMP\6800770506a4"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\72ca3562684bcfc4]
      "ImagePath"="\??\c:\windows\TEMP\62007fcdbfe9"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\7f92339e138b8c4d]
      "ImagePath"="\??\c:\windows\TEMP\68008c1055ee"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\a23c43fdfad82e25]
      "ImagePath"="\??\c:\windows\TEMP\6880709a126b"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\bf947525ff00178e]
      "ImagePath"="\??\c:\windows\TEMP\68007c112280"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\d309889093fc42ba]
      "ImagePath"="\??\c:\windows\TEMP\6880cbd9167c"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\df5bc6917d56542f]
      "ImagePath"="\??\c:\windows\TEMP\680024b09222"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ec894c2e32440e9d]
      "ImagePath"="\??\c:\windows\TEMP\6880666215c2"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\f240fa0be613492d]
      "ImagePath"="\??\c:\windows\TEMP\680092dca928"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\f58f296334cee734]
      "ImagePath"="\??\c:\windows\TEMP\6640d30ce376"
      .
      --------------------- DLLs chargées dans les processus actifs ---------------------
      .
      - - - - - - - > 'Explorer.exe'(2952)
      c:\program files\Hewlett-Packard\IAM\Bin\ItClient.dll
      c:\program files\Hewlett-Packard\File Sanitizer\HPPMDesktopIcon.dll
      .
      ------------------------ Autres processus actifs ------------------------
      .
      c:\windows\system32\Ati2evxx.exe
      c:\windows\system32\Ati2evxx.exe
      c:\program files\AVAST Software\Avast\AvastSvc.exe
      c:\windows\system32\WLANExt.exe
      c:\windows\system32\AEADISRV.EXE
      c:\windows\system32\agrsmsvc.exe
      c:\program files\ActivIdentity\ActivClient\acevents.exe
      c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      c:\program files\Common Files\LightScribe\LSSrvc.exe
      c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
      c:\windows\servicing\TrustedInstaller.exe
      c:\program files\Hewlett-Packard\IAM\Bin\AsGHost.exe
      c:\windows\system32\conime.exe
      c:\windows\PEV.exe
      c:\windows\system32\wbem\unsecapp.exe
      c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
      .
      **************************************************************************
      .
      Heure de fin: 2011-05-25 23:23:39 - La machine a redémarré
      ComboFix-quarantined-files.txt 2011-05-25 21:23
      ComboFix2.txt 2011-05-25 19:46
      ComboFix3.txt 2011-05-23 20:00
      .
      Avant-CF: 53 143 408 640 octets libres
      Après-CF: 53 219 856 384 octets libres
      .
      - - End Of File - - 8A4E4E981FEE44D59A582132EA62DC48
    2. fafyte Auteur
      et c'est quoi la prochaine étape?
  15. gen-hackman

    __________________________________________________
    =>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <=
    =>il est fort déconseillé de le transposer sur un autre ordinateur !<=
    ----------------------------------------------------------------------------

    Toujours avec toutes les protections désactivées, fais ceci :

    ▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
    ▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

    ----------------------------------------------------------
    KillAll::

    File::
    C:\kleaner.tmp

    Rootkit::
    c:\windows\System32\drivers\yckbam.sys

    Folder::
    c:\program files\BabylonToolbar
    c:\program files\BittorrentBar_FR
    c:\program files\facemoods.com
    c:\windows\TEMP

    Registry::
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task"=-
    "HP Software Update"=-
    "SunJavaUpdateSched"=-
    "facemoods"=-
    [-HKEY_CLASSES_ROOT\clsid\{db4e9724-f518-4dfd-9c7c-78b52103cab9}]
    [-HKEY_CLASSES_ROOT\facemoods.dskBnd.1]
    [-HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
    [-HKEY_CLASSES_ROOT\facemoods.dskBnd]
    [-HKEY_CLASSES_ROOT\clsid\{ef79f67a-6ad7-4715-a0f8-932fca442023}]
    [-HKEY_CLASSES_ROOT\clsid\{9ec204df-0e48-4c32-816e-2e928a4fd9c2}]
    [-HKEY_CLASSES_ROOT\IEToolbar.Toolbar]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{9ec204df-0e48-4c32-816e-2e928a4fd9c2}"=-
    "{ef79f67a-6ad7-4715-a0f8-932fca442023}"=-
    "{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}"=-
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ef79f67a-6ad7-4715-a0f8-932fca442023}]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}]
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{ef79f67a-6ad7-4715-a0f8-932fca442023}"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=""

    Driver::
    gmsee
    0115501252141232mcinstcleanup
    010fb00948991fd9;010fb00948991fd9
    0a988356fa58736e;0a988356fa58736e
    1336585094968e74;1336585094968e74
    2156badedccb7c44;2156badedccb7c44
    2b1e202b4be81fe7;2b1e202b4be81fe7
    32f14afe3d2f951b;32f14afe3d2f951b
    3bac3f9da945b954;3bac3f9da945b954
    3c9c2b419e7f9264;3c9c2b419e7f9264
    4f09fc6703efb549;4f09fc6703efb549
    7131f1e84717aa57;7131f1e84717aa57
    72ca3562684bcfc4;72ca3562684bcfc4
    7f92339e138b8c4d;7f92339e138b8c4d
    a23c43fdfad82e25;a23c43fdfad82e25
    f947525ff00178e;bf947525ff00178e
    d309889093fc42ba;d309889093fc42ba
    df5bc6917d56542f;df5bc6917d56542f
    ec894c2e32440e9d;ec894c2e32440e9d
    f240fa0be613492d;f240fa0be613492d
    f58f296334cee734;f58f296334cee734

    DDS::
    uInternet Settings,ProxyOverride = <local>

    RegLock::
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]


    ------------------------------------------------------------------

    ▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
    ▶ Quitte le Bloc Notes

    ▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix

    ▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
    ▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
    ▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

    1. fafyte Auteur
      bon ,d'abord j'enregistre ça dans bloc-note ;

      KillAll::

      File::
      C:\kleaner.tmp

      Rootkit::
      c:\windows\System32\drivers\yckbam.sys

      Folder::
      c:\program files\BabylonToolbar
      c:\program files\BittorrentBar_FR
      c:\program files\facemoods.com
      c:\windows\TEMP

      Registry::
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "QuickTime Task"=-
      "HP Software Update"=-
      "SunJavaUpdateSched"=-
      "facemoods"=-
      [-HKEY_CLASSES_ROOT\clsid\{db4e9724-f518-4dfd-9c7c-78b52103cab9}]
      [-HKEY_CLASSES_ROOT\facemoods.dskBnd.1]
      [-HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
      [-HKEY_CLASSES_ROOT\facemoods.dskBnd]
      [-HKEY_CLASSES_ROOT\clsid\{ef79f67a-6ad7-4715-a0f8-932fca442023}]
      [-HKEY_CLASSES_ROOT\clsid\{9ec204df-0e48-4c32-816e-2e928a4fd9c2}]
      [-HKEY_CLASSES_ROOT\IEToolbar.Toolbar]
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      "{9ec204df-0e48-4c32-816e-2e928a4fd9c2}"=-
      "{ef79f67a-6ad7-4715-a0f8-932fca442023}"=-
      "{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}"=-
      [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ef79f67a-6ad7-4715-a0f8-932fca442023}]
      [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}]
      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
      "{ef79f67a-6ad7-4715-a0f8-932fca442023}"=-
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
      "AppInit_DLLs"=""

      Driver::
      gmsee
      0115501252141232mcinstcleanup
      010fb00948991fd9;010fb00948991fd9
      0a988356fa58736e;0a988356fa58736e
      1336585094968e74;1336585094968e74
      2156badedccb7c44;2156badedccb7c44
      2b1e202b4be81fe7;2b1e202b4be81fe7
      32f14afe3d2f951b;32f14afe3d2f951b
      3bac3f9da945b954;3bac3f9da945b954
      3c9c2b419e7f9264;3c9c2b419e7f9264
      4f09fc6703efb549;4f09fc6703efb549
      7131f1e84717aa57;7131f1e84717aa57
      72ca3562684bcfc4;72ca3562684bcfc4
      7f92339e138b8c4d;7f92339e138b8c4d
      a23c43fdfad82e25;a23c43fdfad82e25
      f947525ff00178e;bf947525ff00178e
      d309889093fc42ba;d309889093fc42ba
      df5bc6917d56542f;df5bc6917d56542f
      ec894c2e32440e9d;ec894c2e32440e9d
      f240fa0be613492d;f240fa0be613492d
      f58f296334cee734;f58f296334cee734

      DDS::
      uInternet Settings,ProxyOverride = <local>

      RegLock::
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]

      C CA?
  16. gen-hackman
    je t'avertis qu'on va le remettre sur pied mais t'as interet à faire attention car là tu as vraiment installé n'importe quoi , va falloir que t'apprennes à te servir d'un pc lol !

    ton pc à la gangraine , un vrai carnage !!
    G3?-?@¢??@?......Concepteur de List_Kill'em...Pre_Scan....MBR_Repair....
    1. gen-hackman
      comment ca devait etre galere avec ce pc pour surfer !!!!!!!!

      bon 5mn je t'envoie la suite

      regarde ce que j'ai marqué juste ua dessus
  17. gen-hackman
    non on le fera à la fiin ca

    j'etudie ton log
    1. fafyte Auteur
      ok merci ,t très gentil que dieu te garde
    2. fafyte Auteur
      vers la fin ,j'ai vu que des fichiers étaient supprimes,je les ai noté:
      c:/programm/facemodds.com1.4.17.7/hh/facemoods/.dll
      c:/programm/facemodds.com1.4.17.7/hh/facemoodsapps.dll
      c:/programm/facemodds.com1.4.17.7/hh/facemoodEng.all
      c:/programm/facemodds.com1.4.17.7/hh/facemoodSrv.exe
      c:/programm/facemodds.com1.4.17.7/hh/facemoodprogramme data/SysRerserve.ini

      SUPPRESSION DE DOSSIER:
      c:/programmedata:facemoods
  18. gen-hackman
    clic droit sur le lien , enregistrer la cible du lien sous....=> le nom que tu veux => sur ton bureau
    1. fafyte Auteur
      c bon! ouf ! c réussi! voila le rapport:
      ComboFix 11-05-24.06 - sofiane 25/05/2011 21:09:07.1.2 - x86
      Microsoft® Windows Vista(TM) Édition Familiale Basique 6.0.6002.2.1252.33.1036.18.1788.1012 [GMT 2:00]
      Lancé depuis: c:\users\sofiane\Desktop\sofiane.exe
      AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
      SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
      SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
      .
      .
      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      c:\program files\facemoods.com
      c:\program files\facemoods.com\facemoods\1.4.17.7\bh\facemoods.dll
      c:\program files\facemoods.com\facemoods\1.4.17.7\facemoodsApp.dll
      c:\program files\facemoods.com\facemoods\1.4.17.7\facemoodsEng.dll
      c:\program files\facemoods.com\facemoods\1.4.17.7\facemoodssrv.exe
      c:\program files\facemoods.com\facemoods\1.4.17.7\facemoodsTlbr.dll
      c:\program files\facemoods.com\facemoods\1.4.17.7\uninstall.exe
      c:\programdata\sysReserve.ini
      .
      .
      ((((((((((((((((((((((((((((( Fichiers créés du 2011-04-25 au 2011-05-25 ))))))))))))))))))))))))))))))))))))
      .
      .
      2011-05-25 19:26 . 2011-05-25 19:32 -------- d-----w- c:\users\sofiane\AppData\Local\temp
      2011-05-25 19:26 . 2011-05-25 19:26 -------- d-----w- c:\users\Default\AppData\Local\temp
      2011-05-25 17:49 . 2011-05-25 19:06 -------- d-----w- C:\ComboFix
      2011-05-24 19:10 . 2011-05-24 19:10 -------- d-----w- c:\program files\Ad-Remover
      2011-05-24 18:36 . 2011-05-24 18:36 -------- d-----r- C:\MSOCache
      2011-05-24 15:44 . 2011-05-24 15:44 -------- d-----w- c:\program files\Axantum
      2011-05-23 22:54 . 2011-05-10 11:59 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
      2011-05-23 22:54 . 2011-05-10 12:03 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys
      2011-05-23 22:54 . 2011-05-10 12:02 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
      2011-05-23 22:54 . 2011-05-10 11:59 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
      2011-05-23 22:54 . 2011-05-10 12:03 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
      2011-05-23 22:54 . 2011-05-10 11:59 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
      2011-05-23 22:54 . 2011-05-10 12:10 40112 ----a-w- c:\windows\avastSS.scr
      2011-05-23 22:54 . 2011-05-10 12:10 199304 ----a-w- c:\windows\system32\aswBoot.exe
      2011-05-23 22:36 . 2011-05-23 22:37 -------- d-----w- C:\kleaner.tmp
      2011-05-23 01:40 . 2011-05-23 01:40 -------- d-----w- c:\programdata\AVAST Software
      2011-05-23 01:40 . 2011-05-23 01:40 -------- d-----w- c:\program files\AVAST Software
      2011-05-22 18:16 . 2011-05-22 18:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
      2011-05-22 18:15 . 2011-05-22 18:15 -------- d-----w- c:\program files\BabylonToolbar
      2011-05-10 21:17 . 2011-05-23 20:37 -------- d-----w- c:\program files\ZHPDiag
      2011-05-10 18:59 . 2011-05-10 21:21 -------- d-----w- c:\program files\Trend Micro
      2011-04-29 19:26 . 2011-05-24 13:18 -------- d-----w- c:\program files\JDownloader
      2011-04-29 19:05 . 2011-04-29 19:08 -------- d-----w- c:\program files\BittorrentBar_FR
      2011-04-29 19:04 . 2011-04-29 19:06 -------- d-----w- c:\program files\BitTorrent
      2011-04-29 19:02 . 2011-05-25 19:27 -------- d-----w- c:\users\sofiane\AppData\Roaming\BitTorrent
      .
      .
      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2011-04-08 07:25 . 2011-04-08 07:25 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
      2011-04-08 07:25 . 2011-04-08 07:25 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
      2011-04-08 07:25 . 2011-04-08 07:25 161792 ----a-w- c:\windows\system32\msls31.dll
      2011-04-08 07:25 . 2011-04-08 07:25 1126912 ----a-w- c:\windows\system32\wininet.dll
      2011-04-08 07:25 . 2011-04-08 07:25 86528 ----a-w- c:\windows\system32\iesysprep.dll
      2011-04-08 07:25 . 2011-04-08 07:25 63488 ----a-w- c:\windows\system32\tdc.ocx
      2011-04-08 07:25 . 2011-04-08 07:25 48640 ----a-w- c:\windows\system32\mshtmler.dll
      2011-04-08 07:25 . 2011-04-08 07:25 367104 ----a-w- c:\windows\system32\html.iec
      2011-04-08 07:25 . 2011-04-08 07:25 74752 ----a-w- c:\windows\system32\iesetup.dll
      2011-04-08 07:25 . 2011-04-08 07:25 420864 ----a-w- c:\windows\system32\vbscript.dll
      2011-04-08 07:25 . 2011-04-08 07:25 23552 ----a-w- c:\windows\system32\licmgr10.dll
      2011-04-08 07:25 . 2011-04-08 07:25 152064 ----a-w- c:\windows\system32\wextract.exe
      2011-04-08 07:25 . 2011-04-08 07:25 150528 ----a-w- c:\windows\system32\iexpress.exe
      2011-04-08 07:25 . 2011-04-08 07:25 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
      2011-04-08 07:25 . 2011-04-08 07:25 35840 ----a-w- c:\windows\system32\imgutil.dll
      2011-04-08 07:25 . 2011-04-08 07:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
      2011-04-08 07:25 . 2011-04-08 07:25 1797632 ----a-w- c:\windows\system32\jscript9.dll
      2011-04-08 07:25 . 2011-04-08 07:25 142848 ----a-w- c:\windows\system32\ieUnatt.exe
      2011-04-08 07:25 . 2011-04-08 07:25 11776 ----a-w- c:\windows\system32\mshta.exe
      2011-04-08 07:25 . 2011-04-08 07:25 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
      2011-04-08 07:25 . 2011-04-08 07:25 101888 ----a-w- c:\windows\system32\admparse.dll
      2011-04-08 07:23 . 2011-04-08 07:23 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
      2011-04-08 07:23 . 2011-04-08 07:23 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
      2011-04-08 07:23 . 2011-04-08 07:23 302592 ----a-w- c:\windows\system32\mfmp4src.dll
      2011-04-08 07:23 . 2011-04-08 07:23 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
      2011-04-08 07:23 . 2011-04-08 07:23 2873344 ----a-w- c:\windows\system32\mf.dll
      2011-04-08 07:23 . 2011-04-08 07:23 98816 ----a-w- c:\windows\system32\mfps.dll
      2011-04-08 07:23 . 2011-04-08 07:23 209920 ----a-w- c:\windows\system32\mfplat.dll
      2011-04-08 07:23 . 2011-04-08 07:23 586240 ----a-w- c:\windows\system32\stobject.dll
      2011-04-08 07:23 . 2011-04-08 07:23 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
      2011-04-08 07:23 . 2011-04-08 07:23 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
      2011-04-08 07:23 . 2011-04-08 07:23 797184 ----a-w- c:\windows\system32\FntCache.dll
      2011-04-08 07:23 . 2011-04-08 07:23 683008 ----a-w- c:\windows\system32\d2d1.dll
      2011-04-08 07:23 . 2011-04-08 07:23 486400 ----a-w- c:\windows\system32\d3d10level9.dll
      2011-04-08 07:23 . 2011-04-08 07:23 1068544 ----a-w- c:\windows\system32\DWrite.dll
      2011-04-08 07:23 . 2011-04-08 07:23 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
      2011-04-08 07:23 . 2011-04-08 07:23 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
      2011-04-08 07:23 . 2011-04-08 07:23 160768 ----a-w- c:\windows\system32\d3d10_1.dll
      2011-04-08 07:23 . 2011-04-08 07:23 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
      2011-04-08 07:23 . 2011-04-08 07:23 478720 ----a-w- c:\windows\system32\dxgi.dll
      2011-04-08 07:23 . 2011-04-08 07:23 37376 ----a-w- c:\windows\system32\cdd.dll
      2011-04-08 07:23 . 2011-04-08 07:23 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
      2011-04-08 07:23 . 2011-04-08 07:23 258048 ----a-w- c:\windows\system32\winspool.drv
      2011-04-08 07:23 . 2011-04-08 07:23 189952 ----a-w- c:\windows\system32\d3d10core.dll
      2011-04-08 07:23 . 2011-04-08 07:23 1029120 ----a-w- c:\windows\system32\d3d10.dll
      2011-04-08 07:23 . 2011-04-08 07:23 847360 ----a-w- c:\windows\system32\OpcServices.dll
      2011-04-08 07:23 . 2011-04-08 07:23 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
      2011-04-08 07:23 . 2011-04-08 07:23 1554432 ----a-w- c:\windows\system32\xpsservices.dll
      2011-04-08 07:23 . 2011-04-08 07:23 876032 ----a-w- c:\windows\system32\XpsPrint.dll
      2011-03-10 17:03 . 2011-04-15 23:01 1162240 ----a-w- c:\windows\system32\mfc42u.dll
      2011-03-10 17:03 . 2011-04-15 23:01 1136640 ----a-w- c:\windows\system32\mfc42.dll
      2011-03-03 15:42 . 2011-04-15 23:00 739328 ----a-w- c:\windows\system32\inetcomm.dll
      2011-03-03 13:25 . 2011-04-15 23:00 2041856 ----a-w- c:\windows\system32\win32k.sys
      2011-03-02 15:44 . 2011-04-15 23:00 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
      .
      .
      ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
      REGEDIT4
      .
      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
      "{ef79f67a-6ad7-4715-a0f8-932fca442023}"= "c:\program files\BittorrentBar_FR\tbBitt.dll" [2010-12-09 3911776]
      .
      [HKEY_CLASSES_ROOT\clsid\{ef79f67a-6ad7-4715-a0f8-932fca442023}]
      .
      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}]
      c:\program files\facemoods.com\facemoods\1.4.17.7\bh\facemoods.dll [BU]
      .
      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ef79f67a-6ad7-4715-a0f8-932fca442023}]
      2010-12-09 10:51 3911776 ----a-w- c:\program files\BittorrentBar_FR\tbBitt.dll
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      "{9ec204df-0e48-4c32-816e-2e928a4fd9c2}"= "mscoree.dll" [2009-11-08 297808]
      "{ef79f67a-6ad7-4715-a0f8-932fca442023}"= "c:\program files\BittorrentBar_FR\tbBitt.dll" [2010-12-09 3911776]
      "{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}"= "c:\program files\facemoods.com\facemoods\1.4.17.7\facemoodsTlbr.dll" [BU]
      .
      [HKEY_CLASSES_ROOT\clsid\{9ec204df-0e48-4c32-816e-2e928a4fd9c2}]
      [HKEY_CLASSES_ROOT\IEToolbar.Toolbar]
      .
      [HKEY_CLASSES_ROOT\clsid\{ef79f67a-6ad7-4715-a0f8-932fca442023}]
      .
      [HKEY_CLASSES_ROOT\clsid\{db4e9724-f518-4dfd-9c7c-78b52103cab9}]
      [HKEY_CLASSES_ROOT\facemoods.dskBnd.1]
      [HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
      [HKEY_CLASSES_ROOT\facemoods.dskBnd]
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
      @="{472083B0-C522-11CF-8763-00608CC02F24}"
      [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
      2011-05-10 12:10 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
      .
      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
      "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-18 2289664]
      "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
      "Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2009-06-20 955712]
      "BitTorrent"="c:\program files\BitTorrent\BitTorrent.exe" [2011-04-29 745848]
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
      "accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
      "PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-06-02 238984]
      "CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-21 24848]
      "PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-05-12 318488]
      "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
      "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
      "File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2008-05-14 10244096]
      "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-14 177456]
      "WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2008-05-24 197904]
      "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
      "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-01-12 49208]
      "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1314816]
      "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
      "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
      "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
      "facemoods"="c:\program files\facemoods.com\facemoods\1.4.17.7\facemoodssrv.exe" [BU]
      "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "EnableUIADesktopToggle"= 0 (0x0)
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
      "AppInit_DLLs"=c:\windows\System32\APSHook.dll c:\windows\System32\APSHook.dll c:\windows\System32\APSHook.dll
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
      @="Driver"
      .
      R0 gmsee;gmsee;c:\windows\System32\drivers\yckbam.sys [x]
      R2 0115501252141232mcinstcleanup;McAfee Application Installer Cleanup (0115501252141232);c:\users\sofiane\AppData\Local\Temp\011550~1.EXE [x]
      R3 010fb00948991fd9;010fb00948991fd9;c:\windows\TEMP\66803603ce8 [x]
      R3 0a988356fa58736e;0a988356fa58736e;c:\windows\TEMP\6880ebe26baf [x]
      R3 1336585094968e74;1336585094968e74;c:\windows\TEMP\688024ffc70f [x]
      R3 2156badedccb7c44;2156badedccb7c44;c:\windows\TEMP\6800aedef27c [x]
      R3 2b1e202b4be81fe7;2b1e202b4be81fe7;c:\windows\TEMP\6800e0b2f26c [x]
      R3 32f14afe3d2f951b;32f14afe3d2f951b;c:\windows\TEMP\6160420fbf3e [x]
      R3 3bac3f9da945b954;3bac3f9da945b954;c:\windows\TEMP\6880337b51a0 [x]
      R3 3c9c2b419e7f9264;3c9c2b419e7f9264;c:\windows\TEMP\68807f3b5c37 [x]
      R3 4f09fc6703efb549;4f09fc6703efb549;c:\windows\TEMP\6800e72914a0 [x]
      R3 7131f1e84717aa57;7131f1e84717aa57;c:\windows\TEMP\6800770506a4 [x]
      R3 72ca3562684bcfc4;72ca3562684bcfc4;c:\windows\TEMP\62007fcdbfe9 [x]
      R3 7f92339e138b8c4d;7f92339e138b8c4d;c:\windows\TEMP\68008c1055ee [x]
      R3 a23c43fdfad82e25;a23c43fdfad82e25;c:\windows\TEMP\6880709a126b [x]
      R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]
      R3 bf947525ff00178e;bf947525ff00178e;c:\windows\TEMP\68007c112280 [x]
      R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]
      R3 d309889093fc42ba;d309889093fc42ba;c:\windows\TEMP\6880cbd9167c [x]
      R3 df5bc6917d56542f;df5bc6917d56542f;c:\windows\TEMP\680024b09222 [x]
      R3 ec894c2e32440e9d;ec894c2e32440e9d;c:\windows\TEMP\6880666215c2 [x]
      R3 f240fa0be613492d;f240fa0be613492d;c:\windows\TEMP\680092dca928 [x]
      R3 f58f296334cee734;f58f296334cee734;c:\windows\TEMP\6640d30ce376 [x]
      R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2008-09-15 7168]
      R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2008-09-15 110080]
      R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [2008-09-15 104960]
      S0 SafeBoot;SafeBoot; [x]
      S0 SbAlg;SbAlg; [x]
      S0 SbFsLock;SbFsLock; [x]
      S1 aswSnx;aswSnx; [x]
      S1 aswSP;aswSP; [x]
      S1 RsvLock;RsvLock; [x]
      S2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [2007-05-15 182576]
      S2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe [2008-01-21 21504]
      S2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe [2008-01-21 21504]
      S2 aswFsBlk;aswFsBlk; [x]
      S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-05-10 53592]
      S2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [2008-06-02 18944]
      S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2008-05-30 256512]
      S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2008-05-14 77824]
      S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-04-07 24936]
      S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2008-05-12 576024]
      .
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
      LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
      Cognizance REG_MULTI_SZ ASBroker ASChannel
      HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
      LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
      2008-03-18 00:56 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
      .
      Contenu du dossier 'Tâches planifiées'
      .
      2011-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-764348856-769109338-2608236025-1004Core.job
      - c:\users\sofiane\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-02 00:14]
      .
      2011-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-764348856-769109338-2608236025-1004UA.job
      - c:\users\sofiane\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-02 00:14]
      .
      .
      ------- Examen supplémentaire -------
      .
      uInternet Settings,ProxyOverride = <local>
      IE: &Recherche AOL Toolbar - c:\programdata\AOL\ieToolbar\resources\fr-FR\local\search.html
      IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
      IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      FF - ProfilePath - c:\users\sofiane\AppData\Roaming\Mozilla\Firefox\Profiles\ym5hkg64.default\
      FF - prefs.js: browser.search.defaulturl - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
      FF - prefs.js: browser.search.selectedEngine - Facemoods Search
      FF - prefs.js: browser.startup.homepage - hxxp://start.facemoods.com/?a=ddrnw
      FF - prefs.js: keyword.URL - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
      FF - user.js: yahoo.homepage.dontask - true
      .
      - - - - ORPHELINS SUPPRIMES - - - -
      .
      Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
      WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
      .
      .
      .
      **************************************************************************
      .
      catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2011-05-25 21:32
      Windows 6.0.6002 Service Pack 2 NTFS
      .
      Recherche de processus cachés ...
      .
      Recherche d'éléments en démarrage automatique cachés ...
      .
      Recherche de fichiers cachés ...
      .
      Scan terminé avec succès
      Fichiers cachés: 0
      .
      **************************************************************************
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]
      "ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\010fb00948991fd9]
      "ImagePath"="\??\c:\windows\TEMP\66803603ce8"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\0a988356fa58736e]
      "ImagePath"="\??\c:\windows\TEMP\6880ebe26baf"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\1336585094968e74]
      "ImagePath"="\??\c:\windows\TEMP\688024ffc70f"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\2156badedccb7c44]
      "ImagePath"="\??\c:\windows\TEMP\6800aedef27c"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\2b1e202b4be81fe7]
      "ImagePath"="\??\c:\windows\TEMP\6800e0b2f26c"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\32f14afe3d2f951b]
      "ImagePath"="\??\c:\windows\TEMP\6160420fbf3e"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3bac3f9da945b954]
      "ImagePath"="\??\c:\windows\TEMP\6880337b51a0"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3c9c2b419e7f9264]
      "ImagePath"="\??\c:\windows\TEMP\68807f3b5c37"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\4f09fc6703efb549]
      "ImagePath"="\??\c:\windows\TEMP\6800e72914a0"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\7131f1e84717aa57]
      "ImagePath"="\??\c:\windows\TEMP\6800770506a4"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\72ca3562684bcfc4]
      "ImagePath"="\??\c:\windows\TEMP\62007fcdbfe9"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\7f92339e138b8c4d]
      "ImagePath"="\??\c:\windows\TEMP\68008c1055ee"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\a23c43fdfad82e25]
      "ImagePath"="\??\c:\windows\TEMP\6880709a126b"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\bf947525ff00178e]
      "ImagePath"="\??\c:\windows\TEMP\68007c112280"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\d309889093fc42ba]
      "ImagePath"="\??\c:\windows\TEMP\6880cbd9167c"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\df5bc6917d56542f]
      "ImagePath"="\??\c:\windows\TEMP\680024b09222"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ec894c2e32440e9d]
      "ImagePath"="\??\c:\windows\TEMP\6880666215c2"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\f240fa0be613492d]
      "ImagePath"="\??\c:\windows\TEMP\680092dca928"
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\f58f296334cee734]
      "ImagePath"="\??\c:\windows\TEMP\6640d30ce376"
      .
      --------------------- CLES DE REGISTRE BLOQUEES ---------------------
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000
      "MSCurrentCountry"=dword:000000b5
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000
      .
      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000
      .
      --------------------- DLLs chargées dans les processus actifs ---------------------
      .
      - - - - - - - > 'Explorer.exe'(2756)
      c:\program files\Hewlett-Packard\IAM\Bin\ItClient.dll
      c:\program files\Hewlett-Packard\File Sanitizer\HPPMDesktopIcon.dll
      .
      ------------------------ Autres processus actifs ------------------------
      .
      c:\windows\system32\Ati2evxx.exe
      c:\windows\system32\Ati2evxx.exe
      c:\program files\AVAST Software\Avast\AvastSvc.exe
      c:\windows\system32\WLANExt.exe
      c:\windows\system32\AEADISRV.EXE
      c:\windows\system32\agrsmsvc.exe
      c:\program files\ActivIdentity\ActivClient\acevents.exe
      c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      c:\program files\Common Files\LightScribe\LSSrvc.exe
      c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
      c:\program files\Hewlett-Packard\IAM\Bin\AsGHost.exe
      c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
      c:\windows\system32\wbem\unsecapp.exe
      .
      **************************************************************************
      .
      Heure de fin: 2011-05-25 21:46:24 - La machine a redémarré
      ComboFix-quarantined-files.txt 2011-05-25 19:46
      ComboFix2.txt 2011-05-23 20:00
      .
      Avant-CF: 53 671 395 328 octets libres
      Après-CF: 53 372 964 864 octets libres
      .
      - - End Of File - - 338DC4FC7BDD1DEF1D87F0F73DC9091E
    2. fafyte Auteur
      est-ce que je réactive le logiciel avec Defogger? merci
  19. gen-hackman
    y'a pas de console de recuperation sous vista cette partie n'est que pour Xp :D
    2. fafyte Auteur
      impossible de renomer combofix car dés que je clique sur le lien il s'exécute directement et commence l'analyse et j'ai pas la page pour son enregistrement.
  20. gen-hackman
    https://forums.commentcamarche.net/forum/affich-22169249-un-programme-malveillant?full#14
    1. fafyte Auteur
      merci et juste une question ,comment enregistrer et renommer combofix?
    2. gen-hackman
      cluic droit sur le lien , enregistrer la cible du lien sous.....un nom...=> sur le bureau
    3. fafyte Auteur
      je suis sur le site de bleeping-computer ,j'ai lu la procedure et je voudrais savoir si j'echoue a l'installation de la console de recuperation et sachant que j'ai pas de CD d'instalation vista ,je fais quoi?
  21. gen-hackman
    ad remover a "purifié" tes navigateurs d'Adwares

    comme je disais pour combofix il suffisait de redemarrer le pc et tout rentre dans l'ordre donc si tu as fait une restauration tu as restauré tous les virus avec donc => Combofix
    1. fafyte Auteur
      et tu me conseilles de le refaire? et si c les cas explique moi bien et en détail ,je suis désolé de te déranger comme ça mais comprend-moi je connais pas grand choses? et si je le refais est-ce qu'il y a un risque comme la dernière fois?
    2. gen-hackman
      s'il te refais pareil , avec le meme message tu redémarres et c'est tout bon

      tu t'affoles pour rien en vérité :)
    3. fafyte Auteur
      ok je le refais ce soir ,stp explique-moi la procédure en détail. que dieu te garde
  • 1
  • 2
  • 3

Discussions similaires

TV LG "Non programmé"
Chantal Joubert

7 réponses
ma tv lg affiche "non programmé"
sacado

3 réponses
Message Fransat : Pas de droits
Clem6464

4 réponses
Code Programme national ENTV : Key biss
hafid-daylo

58 réponses