Virus croix blanche fond rouge

Bonjour,

Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
Procèdes comme ceci :
http://perso.orange.fr/rginformatique/section%20virus/demofairesontmessage.htm
A bientôt

Bonjour j'ai le meme problemes. je n'arrive pas à m'en debarrasser et celui ci fait buger mon pc à un point.. Pouvez vous m'aidez Svp

Bonjour,

Copie ou imprime les instructions avant

Déconnecte toi d'internet et ferme toutes tes applications.

Connecte les supports amovibles que tu mets en F: et G:

Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7fe84d4-8a2c-11dc-bd5c-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc0afde-eed0-11dc-bdc3-00038a000015}]

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

non

Re,

parce que deux clés qui mentionnet ce fichier soont encore en place.

Tu l'as trouvé ailleurs (le fichier) ?

nan pas la pourquoi ?

Bonjour,

supprime ToolsCleaner sur ton Bureau et C:\TCleaner.txt;

Tu avais bien branché tes clés USb et supports amovibles ?

Dans aucun tu trouves ce fichier : 9.cmd

c'est bon ??

[ Rapport ToolsCleaner version 2.2.4 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\Combofix.txt: trouvé !
C:\fixnavi.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\ADRIANO\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\ADRIANO\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\ADRIANO\Bureau\Antivirus\Navilog1.exe: trouvé !
C:\Documents and Settings\ADRIANO\Bureau\Antivirus\Navilog1.lnk: trouvé !
C:\Documents and Settings\ADRIANO\Bureau\Antivirus\HijackThis.exe: trouvé !
C:\Documents and Settings\ADRIANO\Bureau\Antivirus\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\ADRIANO\Bureau\Antivirus\hijackthis.log: trouvé !
C:\Documents and Settings\ADRIANO\Bureau\Antivirus\SmitFraudfix: trouvé !
C:\Documents and Settings\ADRIANO\Bureau\Virus\cleannavi.txt: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Mozilla Firefox\SmitFraudfix: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Program Files\trend micro\HijackThis.exe: trouvé !
C:\Program Files\trend micro\hijackthis.log: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\ADRIANO\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\ADRIANO\Bureau\Antivirus\Navilog1.exe: supprimé !
C:\Documents and Settings\ADRIANO\Bureau\Antivirus\Navilog1.lnk: supprimé !
C:\Documents and Settings\ADRIANO\Bureau\Antivirus\HijackThis.exe: supprimé !
C:\Documents and Settings\ADRIANO\Bureau\Antivirus\SmitFraudFix.exe: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Program Files\trend micro\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\fixnavi.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\Documents and Settings\ADRIANO\Bureau\hijackthis.log: supprimé !
C:\Documents and Settings\ADRIANO\Bureau\Antivirus\hijackthis.log: supprimé !
C:\Documents and Settings\ADRIANO\Bureau\Virus\cleannavi.txt: supprimé !
C:\Program Files\trend micro\hijackthis.log: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\ADRIANO\Bureau\Antivirus\SmitFraudfix: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\Mozilla Firefox\SmitFraudfix: supprimé !

Logfile of random's system information tool 1.04 (written by random/random)
Run by ADRIANO at 2008-10-21 08:32:04
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 69 GB (79%) free of 87 GB
Total RAM: 1023 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:32:13, on 21/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\ADRIANO\Bureau\RSIT.exe
C:\Documents and Settings\ADRIANO\Bureau\ADRIANO.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/2.0.2.20/cfweb_activex.camfrogweb.com-advanced-2.0.2.20_instmodule.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B74B9F77-8F92-4523-939F-843C2C8D714C}: NameServer = 192.168.1.1
O20 - AppInit_DLLs:
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\Fichiers communs\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

combofix :

ComboFix 08-10-17.01 - ADRIANO 2008-10-21 8:27:12.4 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.689 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\ADRIANO\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\ADRIANO\Bureau\CFscript.txt
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\9.cmd
C:\Autorun.inf
C:\WINDOWS\system32\ckvo1.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-21 au 2008-10-21 ))))))))))))))))))))))))))))))))))))
.

2008-10-18 21:43 . 2008-10-18 21:43 <REP> d-------- C:\Program Files\AskSBar
2008-10-18 21:43 . 2008-10-18 21:43 249,592 --a------ C:\WINDOWS\system32\cssdll32.dll
2008-10-18 21:42 . 2008-10-19 11:01 <REP> d-------- C:\Program Files\COMODO
2008-10-18 21:42 . 2008-10-19 10:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2008-10-18 21:42 . 2008-10-19 11:01 <REP> d-------- C:\Documents and Settings\ADRIANO\Application Data\Comodo
2008-10-18 20:28 . 2008-10-18 20:28 104,758 -r-hsc--- C:\2fiji.com
2008-10-18 10:52 . 2008-10-18 10:52 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-18 10:52 . 2008-10-18 10:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-18 10:52 . 2008-10-18 10:52 <REP> d-------- C:\Documents and Settings\ADRIANO\Application Data\Malwarebytes
2008-10-18 10:52 . 2008-10-16 20:25 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-18 10:52 . 2008-10-16 20:25 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-15 21:50 . 2008-10-15 22:58 <REP> d-------- C:\Program Files\Navilog1
2008-10-15 19:08 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-10-15 19:08 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-10-15 19:08 . 2008-09-08 23:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-10-15 19:08 . 2008-10-01 15:51 87,552 --a------ C:\WINDOWS\system32\VACFix.exe
2008-10-15 19:08 . 2008-10-10 08:58 82,944 --a------ C:\WINDOWS\system32\o4Patch.exe
2008-10-15 19:08 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-10-15 19:08 . 2008-10-10 08:58 82,944 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-10-15 19:08 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-10-15 19:08 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-10-15 19:08 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-10-15 19:08 . 2008-10-15 22:18 2,708 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-15 19:05 . 2008-10-15 19:05 102,278 -r-hsc--- C:\pnt.com
2008-10-15 08:44 . 2008-10-15 08:44 <REP> d----c--- C:\rsit
2008-10-15 08:44 . 2008-10-18 12:29 <REP> d-------- C:\Program Files\trend micro
2008-10-14 22:27 . 2008-10-14 22:27 0 --a------ C:\WINDOWS\system32\dllcache\SET1F1.tmp
2008-10-14 22:21 . 2007-02-28 18:08 2,139,648 --a--c--- C:\WINDOWS\system32\dllcache\OLDD.tmp
2008-10-14 21:39 . 2008-10-14 21:39 <REP> d-------- C:\Program Files\Avira
2008-10-14 21:39 . 2008-10-14 21:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-10-13 09:33 . 2008-10-13 10:01 <REP> d-------- C:\Program Files\emcipxf
2008-10-13 09:33 . 2008-10-13 09:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ghirkfml
2008-10-03 19:12 . 2008-10-03 19:12 6,066,176 --a------ C:\WINDOWS\system32\SETE6.tmp

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-18 18:20 --------- d-----w C:\Documents and Settings\ADRIANO\Application Data\BitTorrent
2008-10-16 17:37 --------- d-----w C:\Program Files\eMule
2008-10-15 22:25 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-10-15 22:24 --------- d-----w C:\Program Files\Norton Internet Security
2008-10-03 17:12 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-15 15:39 1,846,144 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-15 15:39 1,846,144 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2008-08-30 10:58 --------- d-----w C:\Documents and Settings\ADRIANO\Application Data\DNA
2008-08-30 09:01 --------- d-----w C:\Program Files\DNA
2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-08-28 10:04 333,056 ------w C:\WINDOWS\system32\dllcache\srv.sys
2008-08-27 09:11 3,593,216 ----a-w C:\WINDOWS\system32\SETDE.tmp
2008-08-27 09:11 3,593,216 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-08-25 08:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-08-25 08:38 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-23 05:56 635,848 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-08-14 13:39 2,188,032 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:39 2,188,032 ------w C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-08-14 13:39 2,144,768 ------w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-08-14 13:39 2,065,024 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-14 13:39 2,065,024 ------w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-08-14 13:39 2,022,912 ------w C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-08-14 09:51 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys
2007-01-25 02:52 65,536 ----a-w C:\Program Files\Fichiers communs\NMSAccessU.exe
.

((((((((((((((((((((((((((((( snapshot_2008-10-18_16.44.37,62 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-21 06:22:35 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5d0.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-10-18 66912]

[HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2008-10-18 21:43 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360]
"kamsoft"="C:\WINDOWS\system32\ckvo.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-03-10 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-03-10 688218]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-01 7118848]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-05 C:\WINDOWS\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\APPS\\Inventime\\my.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 NMSAccessU;NMSAccessU;C:\Program Files\Fichiers communs\NMSAccessU.exe [2007-01-25 65536]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-05 14336]
R3 CIR;Hid Device;C:\WINDOWS\system32\DRIVERS\CIR.sys [2005-05-20 5120]
R3 kbd;Keyboard;C:\WINDOWS\system32\DRIVERS\kbd.sys [2005-05-20 21504]
R3 LVHybrid;LVHybrid service;C:\WINDOWS\system32\DRIVERS\LVHybrid.sys [2005-06-14 800000]
R3 Slazldrv;SmartLink AMR_PCI Driver;C:\WINDOWS\system32\DRIVERS\SLDRV\slazldrv.sys [2005-01-05 226768]
S3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 162176]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 20096]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-03-08 307968]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 w550bus;Sony Ericsson W550 driver (WDM);C:\WINDOWS\system32\DRIVERS\w550bus.sys [2005-07-15 60928]
S3 w550mdfl;Sony Ericsson W550 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w550mdfl.sys [2005-07-15 8336]
S3 w550mdm;Sony Ericsson W550 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\w550mdm.sys [2005-07-15 96672]
S3 w550mgmt;Sony Ericsson W550 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\w550mgmt.sys [2005-07-15 88080]
S3 w550obex;Sony Ericsson W550 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\w550obex.sys [2005-07-15 85952]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7fe84d4-8a2c-11dc-bd5c-00038a000015}]
\Shell\AutoRun\command - G:\9.cmd
\Shell\explore\Command - G:\9.cmd
\Shell\open\Command - G:\9.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc0afde-eed0-11dc-bdc3-00038a000015}]
\Shell\AutoRun\command - F:\9.cmd
\Shell\explore\Command - F:\9.cmd
\Shell\open\Command - F:\9.cmd
.
Contenu du dossier 'Tâches planifiées'

2008-10-21 C:\WINDOWS\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-03-03 10:42]

2008-10-20 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-21 08:28:58
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySqlInventime]
"ImagePath"="c:\mysql\bin\mysqld-max-nt MySqlInventime"
.
Heure de fin: 2008-10-21 8:30:12
ComboFix-quarantined-files.txt 2008-10-21 06:30:08
ComboFix2.txt 2008-10-18 16:21:31
ComboFix3.txt 2008-10-18 14:45:09
ComboFix4.txt 2008-10-15 21:58:14

Avant-CF: 71 534 624 768 octets libres
Après-CF: 72,348,184,576 octets libres

188 --- E O F --- 2008-10-16 05:37:54

Bonjour,

un oubli de ma part :

Copie ou imprime les instructions avant

Déconnecte toi d'internet et ferme toutes tes applications.

Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7fe84d4-8a2c-11dc-bd5c-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc0afde-eed0-11dc-bdc3-00038a000015}]

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.

Nettoyage des outils :

* Télécharge ToolsCleaner par A.Rothstein & dj QUIOU sur ton Bureau.

http://pc-system.fr/
hxxp://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
hxxp://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe

* Clique sur Recherche et laisse le scan se terminer.

* Clique, sur Suppression pour finaliser.

* Tu peux, si tu le souhaites, te servir des Options facultatives.

* Clique sur Quitter, pour que le rapport puisse se créer.

* Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

c'est bon maintenant ?

Logfile of random's system information tool 1.04 (written by random/random)
Run by ADRIANO at 2008-10-18 18:30:18
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 70 GB (80%) free of 87 GB
Total RAM: 1023 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:30:21, on 18/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\ADRIANO\Bureau\RSIT.exe
C:\Documents and Settings\ADRIANO\Bureau\ADRIANO.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/2.0.2.20/cfweb_activex.camfrogweb.com-advanced-2.0.2.20_instmodule.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B74B9F77-8F92-4523-939F-843C2C8D714C}: NameServer = 192.168.1.1
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\Fichiers communs\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

ComboFix 08-10-17.01 - ADRIANO 2008-10-18 18:13:18.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.606 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\ADRIANO\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\ADRIANO\Bureau\CFscript.txt
* Un nouveau point de restauration a été créé

FILE ::
C:\2fiji.com
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\2fiji.com
C:\Program Files\Everest Poker
C:\Program Files\Everest Poker\cstart-tmp.exe
C:\Program Files\Everest Poker\CStart.exe
C:\Program Files\Everest Poker\data\fonts\kgp-en.ttf
C:\Program Files\Everest Poker\data\mp-lobby\fr.gvt
C:\Program Files\Everest Poker\data\mp-lobby\shared.gvt
C:\Program Files\Everest Poker\data\mp-poker\background\default.gvt
C:\Program Files\Everest Poker\data\mp-poker\fr\bitmaps.gvt
C:\Program Files\Everest Poker\data\mp-poker\fr\mp-poker_strings.txt
C:\Program Files\Everest Poker\data\mp-poker\fr\mp-poker_tutorial.txt
C:\Program Files\Everest Poker\data\mp-poker\shared.gvt
C:\Program Files\Everest Poker\data\shared\fr\country.txt
C:\Program Files\Everest Poker\data\shared\fr\language.txt
C:\Program Files\Everest Poker\data\shared\fr\ordinal.txt
C:\Program Files\Everest Poker\data\shared\shared\bitmaps\btn_scroll.gvt
C:\Program Files\Everest Poker\data\shared\shared\bitmaps\check.art
C:\Program Files\Everest Poker\data\shared\shared\bitmaps\chips.art
C:\Program Files\Everest Poker\data\shared\shared\sounds\button.ogg
C:\Program Files\Everest Poker\data\shared\shared\sounds\carddeal.ogg
C:\Program Files\Everest Poker\data\shared\shared\sounds\cardflip.ogg
C:\Program Files\Everest Poker\data\shared\shared\sounds\chipclick.ogg
C:\Program Files\Everest Poker\data\startup\en\startup_strings.txt
C:\Program Files\Everest Poker\data\startup\fr\cstart.txt
C:\Program Files\Everest Poker\data\startup\fr\startup_strings.txt
C:\Program Files\Everest Poker\data\startup\shared\bitmaps\splash_poker.art
C:\Program Files\Everest Poker\data\startup\shared\icons\ep.ico
C:\Program Files\Everest Poker\data\startup\shared\sounds\alert.ogg
C:\Program Files\Everest Poker\Everest Poker.exe
C:\Program Files\Everest Poker\gvbase.dll
C:\Program Files\Everest Poker\gvgfx-dib.dll
C:\Program Files\Everest Poker\gvgfx.dll
C:\Program Files\Everest Poker\gvmain.dll
C:\Program Files\Everest Poker\gvnetwork.dll
C:\Program Files\Everest Poker\gvsound.dll
C:\Program Files\Everest Poker\history\10.txt
C:\Program Files\Everest Poker\history\100.txt
C:\Program Files\Everest Poker\history\101.txt
C:\Program Files\Everest Poker\history\102.txt
C:\Program Files\Everest Poker\history\103.txt
C:\Program Files\Everest Poker\history\104.txt
C:\Program Files\Everest Poker\history\105.txt
C:\Program Files\Everest Poker\history\106.txt
C:\Program Files\Everest Poker\history\107.txt
C:\Program Files\Everest Poker\history\108.txt
C:\Program Files\Everest Poker\history\109.txt
C:\Program Files\Everest Poker\history\11.txt
C:\Program Files\Everest Poker\history\110.txt
C:\Program Files\Everest Poker\history\111.txt
C:\Program Files\Everest Poker\history\112.txt
C:\Program Files\Everest Poker\history\113.txt
C:\Program Files\Everest Poker\history\114.txt
C:\Program Files\Everest Poker\history\115.txt
C:\Program Files\Everest Poker\history\116.txt
C:\Program Files\Everest Poker\history\117.txt
C:\Program Files\Everest Poker\history\118.txt
C:\Program Files\Everest Poker\history\119.txt
C:\Program Files\Everest Poker\history\12.txt
C:\Program Files\Everest Poker\history\120.txt
C:\Program Files\Everest Poker\history\121.txt
C:\Program Files\Everest Poker\history\122.txt
C:\Program Files\Everest Poker\history\123.txt
C:\Program Files\Everest Poker\history\124.txt
C:\Program Files\Everest Poker\history\125.txt
C:\Program Files\Everest Poker\history\126.txt
C:\Program Files\Everest Poker\history\127.txt
C:\Program Files\Everest Poker\history\128.txt
C:\Program Files\Everest Poker\history\129.txt
C:\Program Files\Everest Poker\history\13.txt
C:\Program Files\Everest Poker\history\130.txt
C:\Program Files\Everest Poker\history\131.txt
C:\Program Files\Everest Poker\history\132.txt
C:\Program Files\Everest Poker\history\133.txt
C:\Program Files\Everest Poker\history\134.txt
C:\Program Files\Everest Poker\history\135.txt
C:\Program Files\Everest Poker\history\136.txt
C:\Program Files\Everest Poker\history\137.txt
C:\Program Files\Everest Poker\history\138.txt
C:\Program Files\Everest Poker\history\139.txt
C:\Program Files\Everest Poker\history\14.txt
C:\Program Files\Everest Poker\history\140.txt
C:\Program Files\Everest Poker\history\141.txt
C:\Program Files\Everest Poker\history\142.txt
C:\Program Files\Everest Poker\history\143.txt
C:\Program Files\Everest Poker\history\144.txt
C:\Program Files\Everest Poker\history\145.txt
C:\Program Files\Everest Poker\history\146.txt
C:\Program Files\Everest Poker\history\147.txt
C:\Program Files\Everest Poker\history\148.txt
C:\Program Files\Everest Poker\history\149.txt
C:\Program Files\Everest Poker\history\150.txt
C:\Program Files\Everest Poker\history\151.txt
C:\Program Files\Everest Poker\history\152.txt
C:\Program Files\Everest Poker\history\153.txt
C:\Program Files\Everest Poker\history\154.txt
C:\Program Files\Everest Poker\history\155.txt
C:\Program Files\Everest Poker\history\156.txt
C:\Program Files\Everest Poker\history\157.txt
C:\Program Files\Everest Poker\history\158.txt
C:\Program Files\Everest Poker\history\159.txt
C:\Program Files\Everest Poker\history\16.txt
C:\Program Files\Everest Poker\history\160.txt
C:\Program Files\Everest Poker\history\161.txt
C:\Program Files\Everest Poker\history\162.txt
C:\Program Files\Everest Poker\history\163.txt
C:\Program Files\Everest Poker\history\164.txt
C:\Program Files\Everest Poker\history\165.txt
C:\Program Files\Everest Poker\history\166.txt
C:\Program Files\Everest Poker\history\167.txt
C:\Program Files\Everest Poker\history\168.txt
C:\Program Files\Everest Poker\history\169.txt
C:\Program Files\Everest Poker\history\170.txt
C:\Program Files\Everest Poker\history\171.txt
C:\Program Files\Everest Poker\history\172.txt
C:\Program Files\Everest Poker\history\173.txt
C:\Program Files\Everest Poker\history\174.txt
C:\Program Files\Everest Poker\history\175.txt
C:\Program Files\Everest Poker\history\176.txt
C:\Program Files\Everest Poker\history\177.txt
C:\Program Files\Everest Poker\history\178.txt
C:\Program Files\Everest Poker\history\179.txt
C:\Program Files\Everest Poker\history\18.txt
C:\Program Files\Everest Poker\history\180.txt
C:\Program Files\Everest Poker\history\181.txt
C:\Program Files\Everest Poker\history\182.txt
C:\Program Files\Everest Poker\history\183.txt
C:\Program Files\Everest Poker\history\2.txt
C:\Program Files\Everest Poker\history\20.txt
C:\Program Files\Everest Poker\history\21.txt
C:\Program Files\Everest Poker\history\23.txt
C:\Program Files\Everest Poker\history\24.txt
C:\Program Files\Everest Poker\history\25.txt
C:\Program Files\Everest Poker\history\26.txt
C:\Program Files\Everest Poker\history\27.txt
C:\Program Files\Everest Poker\history\28.txt
C:\Program Files\Everest Poker\history\3.txt
C:\Program Files\Everest Poker\history\31.txt
C:\Program Files\Everest Poker\history\33.txt
C:\Program Files\Everest Poker\history\34.txt
C:\Program Files\Everest Poker\history\35.txt
C:\Program Files\Everest Poker\history\36.txt
C:\Program Files\Everest Poker\history\37.txt
C:\Program Files\Everest Poker\history\38.txt
C:\Program Files\Everest Poker\history\39.txt
C:\Program Files\Everest Poker\history\4.txt
C:\Program Files\Everest Poker\history\40.txt
C:\Program Files\Everest Poker\history\41.txt
C:\Program Files\Everest Poker\history\42.txt
C:\Program Files\Everest Poker\history\43.txt
C:\Program Files\Everest Poker\history\44.txt
C:\Program Files\Everest Poker\history\45.txt
C:\Program Files\Everest Poker\history\46.txt
C:\Program Files\Everest Poker\history\47.txt
C:\Program Files\Everest Poker\history\48.txt
C:\Program Files\Everest Poker\history\49.txt
C:\Program Files\Everest Poker\history\5.txt
C:\Program Files\Everest Poker\history\50.txt
C:\Program Files\Everest Poker\history\51.txt
C:\Program Files\Everest Poker\history\52.txt
C:\Program Files\Everest Poker\history\53.txt
C:\Program Files\Everest Poker\history\54.txt
C:\Program Files\Everest Poker\history\55.txt
C:\Program Files\Everest Poker\history\56.txt
C:\Program Files\Everest Poker\history\57.txt
C:\Program Files\Everest Poker\history\58.txt
C:\Program Files\Everest Poker\history\59.txt
C:\Program Files\Everest Poker\history\6.txt
C:\Program Files\Everest Poker\history\60.txt
C:\Program Files\Everest Poker\history\61.txt
C:\Program Files\Everest Poker\history\62.txt
C:\Program Files\Everest Poker\history\63.txt
C:\Program Files\Everest Poker\history\64.txt
C:\Program Files\Everest Poker\history\65.txt
C:\Program Files\Everest Poker\history\66.txt
C:\Program Files\Everest Poker\history\67.txt
C:\Program Files\Everest Poker\history\68.txt
C:\Program Files\Everest Poker\history\69.txt
C:\Program Files\Everest Poker\history\7.txt
C:\Program Files\Everest Poker\history\70.txt
C:\Program Files\Everest Poker\history\71.txt
C:\Program Files\Everest Poker\history\72.txt
C:\Program Files\Everest Poker\history\73.txt
C:\Program Files\Everest Poker\history\74.txt
C:\Program Files\Everest Poker\history\75.txt
C:\Program Files\Everest Poker\history\76.txt
C:\Program Files\Everest Poker\history\77.txt
C:\Program Files\Everest Poker\history\78.txt
C:\Program Files\Everest Poker\history\79.txt
C:\Program Files\Everest Poker\history\8.txt
C:\Program Files\Everest Poker\history\80.txt
C:\Program Files\Everest Poker\history\81.txt
C:\Program Files\Everest Poker\history\82.txt
C:\Program Files\Everest Poker\history\83.txt
C:\Program Files\Everest Poker\history\84.txt
C:\Program Files\Everest Poker\history\85.txt
C:\Program Files\Everest Poker\history\86.txt
C:\Program Files\Everest Poker\history\87.txt
C:\Program Files\Everest Poker\history\88.txt
C:\Program Files\Everest Poker\history\89.txt
C:\Program Files\Everest Poker\history\9.txt
C:\Program Files\Everest Poker\history\90.txt
C:\Program Files\Everest Poker\history\91.txt
C:\Program Files\Everest Poker\history\92.txt
C:\Program Files\Everest Poker\history\93.txt
C:\Program Files\Everest Poker\history\94.txt
C:\Program Files\Everest Poker\history\95.txt
C:\Program Files\Everest Poker\history\96.txt
C:\Program Files\Everest Poker\history\97.txt
C:\Program Files\Everest Poker\history\98.txt
C:\Program Files\Everest Poker\history\99.txt
C:\Program Files\Everest Poker\init.ini
C:\Program Files\Everest Poker\log.dat
C:\Program Files\Everest Poker\settings.ini
C:\Program Files\Everest Poker\toc_fr.ini
C:\Program Files\Everest Poker\var\content-fr.dat

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-18 au 2008-10-18 ))))))))))))))))))))))))))))))))))))
.

2008-10-18 10:52 . 2008-10-18 10:52 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-18 10:52 . 2008-10-18 10:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-18 10:52 . 2008-10-18 10:52 <REP> d-------- C:\Documents and Settings\ADRIANO\Application Data\Malwarebytes
2008-10-18 10:52 . 2008-10-16 20:25 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-18 10:52 . 2008-10-16 20:25 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-15 21:50 . 2008-10-15 22:58 <REP> d-------- C:\Program Files\Navilog1
2008-10-15 19:08 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-10-15 19:08 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-10-15 19:08 . 2008-09-08 23:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-10-15 19:08 . 2008-10-01 15:51 87,552 --a------ C:\WINDOWS\system32\VACFix.exe
2008-10-15 19:08 . 2008-10-10 08:58 82,944 --a------ C:\WINDOWS\system32\o4Patch.exe
2008-10-15 19:08 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-10-15 19:08 . 2008-10-10 08:58 82,944 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-10-15 19:08 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-10-15 19:08 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-10-15 19:08 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-10-15 19:08 . 2008-10-15 22:18 2,708 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-15 19:05 . 2008-10-15 19:05 102,278 -r-hsc--- C:\pnt.com
2008-10-15 08:44 . 2008-10-15 08:44 <REP> d----c--- C:\rsit
2008-10-15 08:44 . 2008-10-18 12:29 <REP> d-------- C:\Program Files\trend micro
2008-10-14 22:27 . 2008-10-14 22:27 0 --a------ C:\WINDOWS\system32\dllcache\SET1F1.tmp
2008-10-14 22:21 . 2007-02-28 18:08 2,139,648 --a--c--- C:\WINDOWS\system32\dllcache\OLDD.tmp
2008-10-14 21:39 . 2008-10-14 21:39 <REP> d-------- C:\Program Files\Avira
2008-10-14 21:39 . 2008-10-14 21:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-10-13 09:33 . 2008-10-13 10:01 <REP> d-------- C:\Program Files\emcipxf
2008-10-13 09:33 . 2008-10-13 09:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ghirkfml
2008-10-03 19:12 . 2008-10-03 19:12 6,066,176 --a------ C:\WINDOWS\system32\SETE6.tmp

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-18 16:12 --------- d-----w C:\Documents and Settings\ADRIANO\Application Data\BitTorrent
2008-10-16 17:37 --------- d-----w C:\Program Files\eMule
2008-10-15 22:25 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-10-15 22:24 --------- d-----w C:\Program Files\Norton Internet Security
2008-08-30 10:58 --------- d-----w C:\Documents and Settings\ADRIANO\Application Data\DNA
2008-08-30 09:01 --------- d-----w C:\Program Files\DNA
2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2007-01-25 02:52 65,536 ----a-w C:\Program Files\Fichiers communs\NMSAccessU.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\Documents and Settings\All Users\Application Data\ghirkfml ----

---- Directory of C:\Program Files\emcipxf ----

((((((((((((((((((((((((((((( snapshot_2008-10-18_16.44.37,62 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-18 16:16:48 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5d8.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-03-10 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-03-10 688218]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-01 7118848]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-05 C:\WINDOWS\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\APPS\\Inventime\\my.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 NMSAccessU;NMSAccessU;C:\Program Files\Fichiers communs\NMSAccessU.exe [2007-01-25 65536]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-05 14336]
R3 CIR;Hid Device;C:\WINDOWS\system32\DRIVERS\CIR.sys [2005-05-20 5120]
R3 kbd;Keyboard;C:\WINDOWS\system32\DRIVERS\kbd.sys [2005-05-20 21504]
R3 LVHybrid;LVHybrid service;C:\WINDOWS\system32\DRIVERS\LVHybrid.sys [2005-06-14 800000]
R3 Slazldrv;SmartLink AMR_PCI Driver;C:\WINDOWS\system32\DRIVERS\SLDRV\slazldrv.sys [2005-01-05 226768]
S3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 162176]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 20096]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-03-08 307968]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 w550bus;Sony Ericsson W550 driver (WDM);C:\WINDOWS\system32\DRIVERS\w550bus.sys [2005-07-15 60928]
S3 w550mdfl;Sony Ericsson W550 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w550mdfl.sys [2005-07-15 8336]
S3 w550mdm;Sony Ericsson W550 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\w550mdm.sys [2005-07-15 96672]
S3 w550mgmt;Sony Ericsson W550 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\w550mgmt.sys [2005-07-15 88080]
S3 w550obex;Sony Ericsson W550 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\w550obex.sys [2005-07-15 85952]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7fe84d4-8a2c-11dc-bd5c-00038a000015}]
\Shell\AutoRun\command - G:\9.cmd
\Shell\explore\Command - G:\9.cmd
\Shell\open\Command - G:\9.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc0afde-eed0-11dc-bdc3-00038a000015}]
\Shell\AutoRun\command - F:\9.cmd
\Shell\explore\Command - F:\9.cmd
\Shell\open\Command - F:\9.cmd
.
Contenu du dossier 'Tâches planifiées'

2008-10-18 C:\WINDOWS\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-03-03 10:42]

2008-10-18 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
.
- - - - ORPHELINS SUPPRIMES - - - -

ShellExecuteHooks-{C5F43BEF-CE2F-46D8-AFE6-A647BACD1F09} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-18 18:17:14
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySqlInventime]
"ImagePath"="c:\mysql\bin\mysqld-max-nt MySqlInventime"
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\APPS\HIDSERVICE\HidService.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\PAStiSvc.exe
C:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2008-10-18 18:21:30 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-10-18 16:21:26
ComboFix2.txt 2008-10-18 14:45:09
ComboFix3.txt 2008-10-15 21:58:14

Avant-CF: 72 623 935 488 octets libres
Après-CF: 73,423,806,464 octets libres

396 --- E O F --- 2008-10-16 05:37:54

Re,

encore du travail.

Insère les supports amovibles susceptibles d'avoir été infecté sur F: et G: (clé USB, DD externe)

Copie ou imprime les instructions avant

Déconnecte toi d'internet et ferme toutes tes applications.

Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

KillAll::

DirLook::
C:\Program Files\emcipxf
C:\Documents and Settings\All Users\Application Data\ghirkfml

Folder::
C:\Program Files\Everest Poker

File::
C:\2fiji.com
%System%\ckvo.exe
%System%\ckvo0.dll
%System%\ckvo2.dll
%Temp%\help1.rar
%System%\Bitkv0.dll
%Temp%\cc12.txt
%Temp%\cc11.txt
%Temp%\8.txt
%Temp%\dfas
%System%\ddr.exe
G:\9.cmd
F:\9.cmd

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
kamsoft =-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
CheckedValue =dword:0x00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C5F43BEF-CE2F-46D8-AFE6-A647BACD1F09}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{C5F43BEF-CE2F-46D8-AFE6-A647BACD1F09} =-

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.

ComboFix 08-10-17.01 - ADRIANO 2008-10-18 16:41:54.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.652 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\ADRIANO\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\9.cmd
C:\Autorun.inf
C:\WINDOWS\system32\_000006_.tmp.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-18 au 2008-10-18 ))))))))))))))))))))))))))))))))))))
.

2008-10-18 10:52 . 2008-10-18 10:52 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-18 10:52 . 2008-10-18 10:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-18 10:52 . 2008-10-18 10:52 <REP> d-------- C:\Documents and Settings\ADRIANO\Application Data\Malwarebytes
2008-10-18 10:52 . 2008-10-16 20:25 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-18 10:52 . 2008-10-16 20:25 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-18 10:48 . 2008-10-18 10:48 104,758 -r-hsc--- C:\2fiji.com
2008-10-15 21:50 . 2008-10-15 22:58 <REP> d-------- C:\Program Files\Navilog1
2008-10-15 19:08 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-10-15 19:08 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-10-15 19:08 . 2008-09-08 23:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-10-15 19:08 . 2008-10-01 15:51 87,552 --a------ C:\WINDOWS\system32\VACFix.exe
2008-10-15 19:08 . 2008-10-10 08:58 82,944 --a------ C:\WINDOWS\system32\o4Patch.exe
2008-10-15 19:08 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-10-15 19:08 . 2008-10-10 08:58 82,944 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-10-15 19:08 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-10-15 19:08 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-10-15 19:08 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-10-15 19:08 . 2008-10-15 22:18 2,708 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-15 19:05 . 2008-10-15 19:05 102,278 -r-hsc--- C:\pnt.com
2008-10-15 08:44 . 2008-10-15 08:44 <REP> d----c--- C:\rsit
2008-10-15 08:44 . 2008-10-18 12:29 <REP> d-------- C:\Program Files\trend micro
2008-10-14 22:27 . 2008-10-14 22:27 0 --a------ C:\WINDOWS\system32\dllcache\SET1F1.tmp
2008-10-14 22:21 . 2007-02-28 18:08 2,139,648 --a--c--- C:\WINDOWS\system32\dllcache\OLDD.tmp
2008-10-14 21:39 . 2008-10-14 21:39 <REP> d-------- C:\Program Files\Avira
2008-10-14 21:39 . 2008-10-14 21:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-10-13 09:33 . 2008-10-13 10:01 <REP> d-------- C:\Program Files\emcipxf
2008-10-13 09:33 . 2008-10-13 09:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ghirkfml
2008-10-03 19:12 . 2008-10-03 19:12 6,066,176 --a------ C:\WINDOWS\system32\SETE6.tmp

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-18 09:27 --------- d-----w C:\Program Files\Everest Poker
2008-10-16 18:07 --------- d-----w C:\Documents and Settings\ADRIANO\Application Data\BitTorrent
2008-10-16 17:37 --------- d-----w C:\Program Files\eMule
2008-10-15 22:25 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-10-15 22:24 --------- d-----w C:\Program Files\Norton Internet Security
2008-10-03 17:12 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-15 15:39 1,846,144 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-15 15:39 1,846,144 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2008-08-30 10:58 --------- d-----w C:\Documents and Settings\ADRIANO\Application Data\DNA
2008-08-30 09:01 --------- d-----w C:\Program Files\DNA
2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-08-28 10:04 333,056 ------w C:\WINDOWS\system32\dllcache\srv.sys
2008-08-27 09:11 3,593,216 ----a-w C:\WINDOWS\system32\SETDE.tmp
2008-08-27 09:11 3,593,216 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-08-25 08:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-08-25 08:38 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-23 05:56 635,848 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-08-14 13:39 2,188,032 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:39 2,188,032 ------w C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-08-14 13:39 2,144,768 ------w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-08-14 13:39 2,065,024 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-14 13:39 2,065,024 ------w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-08-14 13:39 2,022,912 ------w C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-08-14 09:51 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2007-01-25 02:52 65,536 ----a-w C:\Program Files\Fichiers communs\NMSAccessU.exe
.

((((((((((((((((((((((((((((( snapshot@2008-10-15_23.57.42.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-02-28 16:08:15 2,139,648 -c--a-w C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe
+ 2008-08-14 13:39:07 2,144,768 ----a-w C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe
- 2007-02-28 16:08:25 2,061,440 -c--a-w C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
+ 2008-08-14 13:39:12 2,065,024 ----a-w C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
- 2007-02-28 16:08:11 2,019,328 -c--a-w C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe
+ 2008-08-14 13:39:03 2,022,912 ----a-w C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe
- 2007-02-28 16:08:21 2,184,192 -c--a-w C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
+ 2008-08-14 13:39:11 2,188,032 ----a-w C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
+ 2008-06-23 16:28:17 124,928 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\advpack.dll
+ 2008-06-23 16:28:17 347,136 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\dxtmsft.dll
+ 2008-06-23 16:28:17 214,528 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\dxtrans.dll
+ 2008-06-23 16:28:17 133,120 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\extmgr.dll
+ 2008-06-23 16:28:17 63,488 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\icardie.dll
+ 2008-06-23 09:21:30 70,656 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ie4uinit.exe
+ 2008-06-23 16:28:18 153,088 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieakeng.dll
+ 2008-06-23 16:28:18 230,400 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieaksie.dll
+ 2008-06-21 05:23:54 161,792 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieakui.dll
+ 2008-06-23 16:28:18 383,488 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieapfltr.dll
+ 2008-06-23 16:28:18 384,512 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\iedkcs32.dll
+ 2008-06-23 16:28:19 6,066,176 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieframe.dll
+ 2008-06-23 16:28:19 44,544 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\iernonce.dll
+ 2008-06-23 16:28:20 267,776 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\iertutil.dll
+ 2008-06-23 09:20:26 13,824 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieudinit.exe
+ 2008-06-23 09:21:49 625,664 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe
+ 2008-06-23 16:28:20 27,648 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\jsproxy.dll
+ 2008-06-23 16:28:20 459,264 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\msfeeds.dll
+ 2008-06-23 16:28:20 52,224 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\msfeedsbs.dll
+ 2008-06-24 08:28:24 3,592,192 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\mshtml.dll
+ 2008-06-23 16:28:22 477,696 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\mshtmled.dll
+ 2008-06-23 16:28:22 193,024 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\msrating.dll
+ 2008-06-23 16:28:22 671,232 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\mstime.dll
+ 2008-06-23 16:28:22 102,912 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\occache.dll
+ 2008-06-23 16:28:22 44,544 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\pngfilt.dll
+ 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\updspapi.dll
+ 2008-06-23 16:28:22 105,984 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\url.dll
+ 2008-06-23 16:28:23 1,159,680 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\urlmon.dll
+ 2008-06-23 16:28:23 233,472 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\webcheck.dll
+ 2008-06-23 16:28:23 826,368 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\wininet.dll
- 2008-06-23 16:28:17 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
+ 2008-08-26 08:11:45 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
- 2008-06-23 16:28:17 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-08-26 08:11:45 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
- 2008-06-23 16:28:17 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-08-26 08:11:45 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-06-23 16:28:17 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-08-26 08:11:45 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2008-06-23 16:28:17 133,120 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-08-26 08:11:45 133,120 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2008-06-23 16:28:17 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
+ 2008-08-26 08:11:45 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
- 2008-06-23 16:28:18 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-08-26 08:11:45 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2008-06-23 16:28:18 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-08-26 08:11:45 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2008-06-23 16:28:18 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
+ 2008-08-26 08:11:46 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2008-06-23 16:28:18 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-08-26 08:11:46 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2008-06-23 16:28:19 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-08-26 08:11:48 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2008-06-23 16:28:20 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
+ 2008-08-26 08:11:48 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
- 2008-06-23 16:28:20 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-08-26 08:11:49 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2008-06-23 16:28:20 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-08-26 08:11:49 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
- 2008-06-23 16:28:20 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
+ 2008-08-26 08:11:49 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
- 2008-06-23 16:28:22 477,696 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-08-26 08:11:52 477,696 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-06-23 16:28:22 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-08-26 08:11:52 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-06-23 16:28:22 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-08-26 08:11:52 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll
- 2008-06-23 16:28:22 102,912 ------w C:\WINDOWS\system32\dllcache\occache.dll
+ 2008-08-26 08:11:52 102,912 ------w C:\WINDOWS\system32\dllcache\occache.dll
- 2008-06-23 16:28:22 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-08-26 08:11:52 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2008-06-23 16:28:22 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
+ 2008-08-26 08:11:52 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
- 2008-06-23 16:28:23 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-08-26 08:11:53 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-06-23 16:28:23 233,472 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-08-26 08:11:53 233,472 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2008-06-23 16:28:23 826,368 ------w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-08-26 08:11:54 826,368 ------w C:\WINDOWS\system32\dllcache\wininet.dll
- 2008-06-20 10:44:38 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
+ 2008-08-14 09:51:43 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
- 2008-06-23 16:28:17 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-08-26 08:11:45 347,136 ------w C:\WINDOWS\system32\dxtmsft.dll
- 2008-06-23 16:28:17 214,528 ------w C:\WINDOWS\system32\dxtrans.dll
+ 2008-08-26 08:11:45 214,528 ------w C:\WINDOWS\system32\dxtrans.dll
- 2008-06-23 16:28:17 133,120 ------w C:\WINDOWS\system32\extmgr.dll
+ 2008-08-26 08:11:45 133,120 ------w C:\WINDOWS\system32\extmgr.dll
- 2008-04-12 08:13:37 313,968 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-10-16 01:12:12 313,968 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2008-06-23 16:28:17 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
+ 2008-08-26 08:11:45 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
- 2008-06-23 09:21:30 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe
+ 2008-08-25 08:39:40 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe
- 2008-06-23 16:28:18 153,088 ------w C:\WINDOWS\system32\ieakeng.dll
+ 2008-08-26 08:11:45 153,088 ------w C:\WINDOWS\system32\ieakeng.dll
- 2008-06-23 16:28:18 230,400 ------w C:\WINDOWS\system32\ieaksie.dll
+ 2008-08-26 08:11:45 230,400 ------w C:\WINDOWS\system32\ieaksie.dll
- 2008-06-21 05:23:54 161,792 ------w C:\WINDOWS\system32\ieakui.dll
+ 2008-08-23 05:54:51 161,792 ------w C:\WINDOWS\system32\ieakui.dll
- 2008-06-23 16:28:18 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
+ 2008-08-26 08:11:46 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
- 2008-06-23 16:28:18 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll
+ 2008-08-26 08:11:46 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll
- 2008-06-23 16:28:19 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
+ 2008-10-03 17:12:27 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
- 2008-06-23 16:28:19 44,544 ------w C:\WINDOWS\system32\iernonce.dll
+ 2008-08-26 08:11:48 44,544 ------w C:\WINDOWS\system32\iernonce.dll
- 2008-06-23 16:28:20 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
+ 2008-08-26 08:11:48 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2008-06-23 09:20:26 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-08-25 08:38:00 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2008-06-23 16:28:20 27,648 ------w C:\WINDOWS\system32\jsproxy.dll
+ 2008-08-26 08:11:49 27,648 ------w C:\WINDOWS\system32\jsproxy.dll
- 2008-08-26 20:28:12 16,208,504 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-10-07 19:19:40 16,721,856 ----a-w C:\WINDOWS\system32\MRT.exe
- 2008-06-23 16:28:20 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
+ 2008-08-26 08:11:49 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
- 2008-06-23 16:28:20 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-08-26 08:11:49 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2008-06-24 08:28:24 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-08-27 09:11:52 3,593,216 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2008-06-23 16:28:22 477,696 ------w C:\WINDOWS\system32\mshtmled.dll
+ 2008-08-26 08:11:52 477,696 ------w C:\WINDOWS\system32\mshtmled.dll
- 2008-06-23 16:28:22 193,024 ------w C:\WINDOWS\system32\msrating.dll
+ 2008-08-26 08:11:52 193,024 ------w C:\WINDOWS\system32\msrating.dll
- 2008-06-23 16:28:22 671,232 ------w C:\WINDOWS\system32\mstime.dll
+ 2008-08-26 08:11:52 671,232 ------w C:\WINDOWS\system32\mstime.dll
- 2008-06-23 16:28:22 102,912 ------w C:\WINDOWS\system32\occache.dll
+ 2008-08-26 08:11:52 102,912 ------w C:\WINDOWS\system32\occache.dll
- 2008-06-23 16:28:22 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-08-26 08:11:52 44,544 ------w C:\WINDOWS\system32\pngfilt.dll
- 2007-11-30 12:39:29 18,296 ------w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 11:19:06 18,296 ------w C:\WINDOWS\system32\spmsg.dll
- 2008-06-23 16:28:22 105,984 ----a-w C:\WINDOWS\system32\url.dll
+ 2008-08-26 08:11:52 105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2008-06-23 16:28:23 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-08-26 08:11:53 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2008-06-23 16:28:23 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-08-26 08:11:53 233,472 ------w C:\WINDOWS\system32\webcheck.dll
- 2008-06-23 16:28:23 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
+ 2008-08-26 08:11:54 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
+ 2008-10-18 10:28:07 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5dc.dat
.
-- Instantané actualisé --
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-03-10 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-03-10 688218]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-01 7118848]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-05 C:\WINDOWS\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{C5F43BEF-CE2F-46D8-AFE6-A647BACD1F09}"= "C:\WINDOWS\system32\Bitkv0.dll" [2007-06-13 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\APPS\\Inventime\\my.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 NMSAccessU;NMSAccessU;C:\Program Files\Fichiers communs\NMSAccessU.exe [2007-01-25 65536]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-05 14336]
R3 CIR;Hid Device;C:\WINDOWS\system32\DRIVERS\CIR.sys [2005-05-20 5120]
R3 kbd;Keyboard;C:\WINDOWS\system32\DRIVERS\kbd.sys [2005-05-20 21504]
R3 LVHybrid;LVHybrid service;C:\WINDOWS\system32\DRIVERS\LVHybrid.sys [2005-06-14 800000]
R3 Slazldrv;SmartLink AMR_PCI Driver;C:\WINDOWS\system32\DRIVERS\SLDRV\slazldrv.sys [2005-01-05 226768]
S3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 162176]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 20096]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-03-08 307968]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 w550bus;Sony Ericsson W550 driver (WDM);C:\WINDOWS\system32\DRIVERS\w550bus.sys [2005-07-15 60928]
S3 w550mdfl;Sony Ericsson W550 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w550mdfl.sys [2005-07-15 8336]
S3 w550mdm;Sony Ericsson W550 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\w550mdm.sys [2005-07-15 96672]
S3 w550mgmt;Sony Ericsson W550 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\w550mgmt.sys [2005-07-15 88080]
S3 w550obex;Sony Ericsson W550 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\w550obex.sys [2005-07-15 85952]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7fe84d4-8a2c-11dc-bd5c-00038a000015}]
\Shell\AutoRun\command - G:\9.cmd
\Shell\explore\Command - G:\9.cmd
\Shell\open\Command - G:\9.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc0afde-eed0-11dc-bdc3-00038a000015}]
\Shell\AutoRun\command - F:\9.cmd
\Shell\explore\Command - F:\9.cmd
\Shell\open\Command - F:\9.cmd
.
Contenu du dossier 'Tâches planifiées'

2008-10-18 C:\WINDOWS\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-03-03 10:42]

2008-10-18 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\ADRIANO\Application Data\Mozilla\Firefox\Profiles\2hx1b838.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.fr
FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-18 16:43:33
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySqlInventime]
"ImagePath"="c:\mysql\bin\mysqld-max-nt MySqlInventime"
.
Heure de fin: 2008-10-18 16:45:07
ComboFix-quarantined-files.txt 2008-10-18 14:45:03
ComboFix2.txt 2008-10-15 21:58:14

Avant-CF: 73 960 923 136 octets libres
Après-CF: 73,931,390,976 octets libres

353 --- E O F --- 2008-10-16 05:37:54

Re,

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le Bureau.

Ferme tes applications et double-clique sur Combofix sur ton bureau pour le lancer.

Il va te dire que tu devrais installer la console d récupération (recovery console).

Fais le.

Ensuite

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

... ?