Braviax et ces copains...

houlalala -  
Bonjour,

j 'ai la chance depuis quelques jours d'avoir braviax et ces petit copains sur mon pc ... malgres la lecture de nombreux post sur ce sujet je n'arrive pas a m'en debarasser tout seul...
si une ame charitable pouvait me donner un tit coup de main...
j 'ai heuresement la chance d'avoir deux pc a coté dont un seul connait les joie de braviax and co ! je suis actuellement sur l'autre pour trouvre la soluce...
merci d'avance

pour info j 'ai essayer avec toute une floppé d'anti spyware et cela n ' rien donné (juste queques coups mais braviax reviend ! (malware, pctool spyware doctor, spyware terminator...
et la je suis en train de faire tourner un sdfix...pour voir ...
j 'ai aussi telecharger hijackthis... mais n'est pas oser de peur de faire n'importe quoi ...
enfin mon antivirus est antivir derniere version ....

merci
Configuration: Windows XP
Firefox 3.5.2

34 réponses

Résumé de la discussion

Un utilisateur signale la présence persistante de Braviax et de ses variantes sur Windows XP, malgré de nombreux scans et l’usage d’anti-spyware, et cherche une solution fiable pour s’en débarrasser. Des approches en profondeur préconisent des outils spécialisés comme ComboFix et CFScript, avec sauvegarde et rapport avant toute action, afin de neutraliser les éléments infectieux sans compromettre le système. D’autres conseils suggèrent l’usage d’un pare-feu tiers, des scans via VirusTotal pour identifier les fichiers suspects et l’emploi de HijackThis avec prudence, tout en évitant des suppressions risquées. Enfin, des étapes complémentaires évoquent la purge de la restauration système et la vérification de fichiers système sensibles via des analyses en ligne, apportant une nuance utile sur le calendrier du nettoyage.

Bobot (l’IA à votre service)
  1. papyber Contributeur sécurité
    as tu un pare feu autre que celui de windows?
    si non installes en un en priorité et bloque les fichiers TMP qui veulent un accès à internet
    ensuite fais ceci

    Si tu es d'accord, je te conseille Online armor firewall free

    Lien téléchargement :
    http://www.tallemu.com/free-firewall-protection-software.html
    (Clique sur Download now (download.com) en bas à gauche pour télécharger le setup d'installation en version gratuite )
    Tutos :
    https://www.malekal.com/tutorial-online-armor-free/

    Note : Tu peux décocher la fonction Program guard, qui est une sorte de module HIPS donc un peu difficile à comprendre

    Télécharge ComboFix.exe (par sUBs) sur ton Bureau de la façon décrite dans le tutoriel que je te donne, c'est important
    https://forum.pcastuces.com/combofix___renommer_au_telechargement-f31s22.htm
    suis les consignes et poste le rapport obtenu
    0
    1. houlalala2001
      merci de ta reactivité
      mon pc est normalement branché a un hub qui fait firewall... enfin normalement
      je suis en train de faire tourner conbo fix resultat ds quelques minutes...
      0
      1. houlalala2001
        ComboFix 09-08-23.01 - julie 24/08/2009 19:55.1.1 - NTFSx86
        Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.502.87 [GMT 2:00]
        Running from: c:\documents and settings\julie\Bureau\bibitte.exe.exe
        AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
        AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
        FW: *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

        WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
        .

        ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
        .

        c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\oxokyk.db
        c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\tezyl.dl
        c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
        c:\program files\PC_Antispyware2010
        c:\program files\PC_Antispyware2010\AVEngn.dll
        c:\program files\PC_Antispyware2010\data\daily.cvd
        c:\program files\PC_Antispyware2010\htmlayout.dll
        c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
        c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcm80.dll
        c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcp80.dll
        c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcr80.dll
        c:\program files\PC_Antispyware2010\PC_Antispyware2010.cfg
        c:\program files\PC_Antispyware2010\PC_Antispyware2010.exe
        c:\program files\PC_Antispyware2010\pthreadVC2.dll
        c:\program files\PC_Antispyware2010\Uninstall.exe
        c:\program files\PC_Antispyware2010\wscui.cpl
        c:\program files\pdfforge Toolbar\SearchSettings.dll
        c:\windows\emMON.exe
        c:\windows\Installer\13c379.msp
        c:\windows\Installer\13c37a.msp
        c:\windows\Installer\13c37b.msp
        c:\windows\Installer\13c37c.msp
        c:\windows\Installer\13c37d.msp
        c:\windows\Installer\3b7d33.msp
        c:\windows\Installer\3b7d34.msp
        c:\windows\Installer\3b7d35.msp
        c:\windows\Installer\3b7d36.msp
        c:\windows\Installer\3b7d37.msp
        c:\windows\Installer\3b7d38.msp
        c:\windows\Installer\3b7d39.msp
        c:\windows\Installer\3b7d3a.msp
        c:\windows\Installer\3b7d3b.msp
        c:\windows\system32\_scui.cpl
        c:\windows\system32\braviax.exe
        c:\windows\system32\Drivers\bfmn.sys
        c:\windows\system32\mdm.exe
        c:\windows\system32\wisdstr.exe

        .
        ((((((((((((((((((((((((( Files Created from 2009-07-24 to 2009-08-24 )))))))))))))))))))))))))))))))
        .

        2009-08-24 17:05 . 2009-08-24 17:05 579584 ----a-w- c:\windows\system32\dllcache\user32.dll
        2009-08-24 17:03 . 2009-08-24 17:03 -------- d-----w- c:\windows\ERUNT
        2009-08-22 18:33 . 2009-08-22 18:33 -------- d-----w- c:\windows\system32\XPSViewer
        2009-08-22 18:33 . 2009-08-22 18:33 -------- d-----w- c:\program files\MSBuild
        2009-08-22 18:32 . 2009-08-22 18:32 -------- d-----w- c:\program files\Reference Assemblies
        2009-08-22 18:31 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
        2009-08-22 18:31 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
        2009-08-22 18:31 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
        2009-08-22 18:31 . 2009-08-22 18:32 -------- d-----w- C:\f24615ca3c2e5b69549c0e
        2009-08-22 18:31 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
        2009-08-22 18:31 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
        2009-08-22 18:31 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
        2009-08-22 18:31 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
        2009-08-22 18:31 . 2009-08-23 08:44 -------- d-----w- c:\windows\SxsCaPendDel
        2009-08-22 17:19 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\julie\Application Data\Simply Super Software\Trojan Remover\bsi18.exe
        2009-08-22 15:50 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\julie\Application Data\Simply Super Software\Trojan Remover\jug16.exe
        2009-08-22 14:21 . 2009-08-22 14:21 -------- d-----w- c:\documents and settings\LocalService\Menu Démarrer
        2009-08-22 14:18 . 2009-08-22 14:49 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
        2009-08-22 14:18 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
        2009-08-22 14:18 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
        2009-08-22 14:18 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
        2009-08-22 14:16 . 2009-08-22 14:16 -------- d-----w- c:\program files\Avira
        2009-08-22 14:16 . 2009-08-22 14:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
        2009-08-22 14:16 . 2008-08-07 13:27 4224 ----a-w- c:\windows\system32\drivers\beep.sys
        2009-08-22 14:16 . 2008-08-07 13:27 4224 ----a-w- c:\windows\system32\dllcache\beep.sys
        2009-08-22 13:50 . 2009-08-22 13:50 -------- d-----w- c:\windows\system32\wbem\Repository
        2009-08-22 13:49 . 2009-08-22 13:49 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
        2009-08-22 13:49 . 2009-08-22 13:49 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
        2009-08-22 13:49 . 2009-08-22 13:49 -------- d-----w- c:\documents and settings\julie\Application Data\Simply Super Software
        2009-08-22 10:19 . 2009-08-24 17:43 117760 ----a-w- c:\documents and settings\julie\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
        2009-08-22 10:12 . 2009-08-22 13:49 -------- d-----w- c:\program files\SUPERAntiSpyware
        2009-08-22 10:12 . 2009-08-22 10:12 -------- d-----w- c:\documents and settings\julie\Application Data\SUPERAntiSpyware.com
        2009-08-22 10:06 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\julie\Application Data\Simply Super Software\Trojan Remover\bqk2C.exe
        2009-08-22 09:58 . 2005-08-25 23:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
        2009-08-22 09:58 . 2006-05-25 13:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
        2009-08-22 09:58 . 2006-06-19 11:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
        2009-08-22 09:58 . 2002-03-05 23:00 75264 ----a-w- c:\windows\system32\unacev2.dll
        2009-08-22 09:58 . 2003-02-02 18:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
        2009-08-22 09:57 . 2009-08-22 09:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
        2009-08-22 09:57 . 2009-08-22 13:49 -------- d-----w- c:\program files\Trojan Remover
        2009-08-22 09:57 . 2009-08-22 09:57 -------- d-----w- c:\program files\Trend Micro
        2009-08-22 07:12 . 2008-12-11 06:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
        2009-08-22 07:12 . 2009-04-03 08:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
        2009-08-22 07:12 . 2008-12-18 09:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
        2009-08-22 07:12 . 2009-08-24 17:44 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
        2009-08-22 07:12 . 2009-08-22 07:12 -------- d-----w- c:\program files\Fichiers communs\PC Tools
        2009-08-22 07:12 . 2008-12-10 09:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
        2009-08-22 07:11 . 2009-08-24 17:14 -------- d-----w- c:\program files\Spyware Doctor
        2009-08-22 07:11 . 2009-08-22 07:11 -------- d-----w- c:\documents and settings\julie\Application Data\PC Tools
        2009-08-22 07:11 . 2009-08-22 07:11 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
        2009-08-03 21:33 . 2009-08-03 21:33 -------- d-----w- c:\documents and settings\julie\Application Data\Malwarebytes
        2009-08-03 21:33 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
        2009-08-03 21:33 . 2009-08-03 21:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
        2009-08-03 21:33 . 2009-08-03 21:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
        2009-08-03 21:33 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
        2009-08-03 16:09 . 2009-08-24 17:39 626336 ----a-w- c:\windows\system32\dllcache\ntfs.sys

        .
        (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2009-08-24 18:04 . 2009-06-10 20:38 -------- d-----w- c:\program files\pdfforge Toolbar
        2009-08-24 17:42 . 2006-10-07 10:53 48648 ----a-w- c:\documents and settings\julie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
        2009-08-24 17:39 . 2004-08-20 09:23 626336 ----a-w- c:\windows\system32\drivers\ntfs.sys
        2009-08-22 18:40 . 2004-08-20 09:24 564702 ----a-w- c:\windows\system32\perfh00C.dat
        2009-08-22 18:40 . 2004-08-20 09:24 108842 ----a-w- c:\windows\system32\perfc00C.dat
        2009-08-22 07:26 . 2008-09-13 08:56 -------- d-----w- c:\program files\Bonjour
        2009-07-20 21:13 . 2007-12-26 22:12 -------- d-----w- c:\program files\TrackMania Nations ESWC
        2009-07-10 11:54 . 2009-01-17 15:46 -------- d-----w- c:\program files\Windows Desktop Search
        2009-06-16 14:40 . 2004-08-20 09:24 119808 ----a-w- c:\windows\system32\t2embed.dll
        2009-06-16 14:40 . 2004-08-20 09:23 81920 ----a-w- c:\windows\system32\fontsub.dll
        2009-06-10 20:07 . 2009-06-10 20:07 73216 ----a-w- c:\windows\cadkasdeinst01f.exe
        2009-06-03 19:10 . 2004-08-20 09:24 1297408 ----a-w- c:\windows\system32\quartz.dll
        1999-04-06 12:27 . 1999-04-06 12:27 99840 ----a-w- c:\program files\Fichiers communs\IRAABOUT.DLL
        1998-12-09 02:53 . 1998-12-09 02:53 70144 ----a-w- c:\program files\Fichiers communs\IRAMDMTR.DLL
        1998-12-09 02:53 . 1998-12-09 02:53 48640 ----a-w- c:\program files\Fichiers communs\IRALPTTR.DLL
        1998-12-09 02:53 . 1998-12-09 02:53 31744 ----a-w- c:\program files\Fichiers communs\IRAWEBTR.DLL
        1998-12-09 02:53 . 1998-12-09 02:53 186368 ----a-w- c:\program files\Fichiers communs\IRAREG.DLL
        1998-12-09 02:53 . 1998-12-09 02:53 17920 ----a-w- c:\program files\Fichiers communs\IRASRIAL.DLL
        2006-10-08 12:27 . 2006-10-08 12:27 1682 --sha-w- c:\windows\system32\KGyGaAvL.sys
        .

        ------- Sigcheck -------

        [-] 2007-02-09 11:23 574976 05AB81909514BFD69CBB1F2C147CF6B9 c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
        [-] 2007-02-09 11:10 574464 19A811EF5F1ED5C926A028CE107FF1AF c:\windows\$NtServicePackUninstall$\ntfs.sys
        [7] 2004-08-05 11:00 574592 B78BE402C3F63DD55521F73876951CDD c:\windows\$NtUninstallKB930916$\ntfs.sys
        [7] 2008-04-13 19:15 574976 78A08DD6A8D65E697C18E1DB01C5CDCA c:\windows\ServicePackFiles\i386\ntfs.sys
        [-] 2009-08-24 17:39 626336 E86D39DA8D7B1F24A79418C6650C0290 c:\windows\system32\dllcache\ntfs.sys
        [-] 2009-08-24 17:39 626336 E86D39DA8D7B1F24A79418C6650C0290 c:\windows\system32\drivers\ntfs.sys
        .
        ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* empty entries & legit default entries are not shown
        REGEDIT4

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
        "{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files\pdfforge Toolbar\WidgiToolbarIE.dll" [2009-05-04 650752]

        [HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "TomTomHOME.exe"="c:\program files\TomTom HOME 2\HOMERunner.exe" [2008-12-09 234856]
        "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-08-05 1830128]
        "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
        "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "WireLessMouse"="c:\program files\Multimedia Keyboard & Mouse Driver\StartAutorun.exe" [2005-11-30 94208]
        "WireLessKeyboard"="c:\program files\Multimedia Keyboard & Mouse Driver\StartAutorun.exe" [2005-11-30 94208]
        "TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2009-08-04 1068424]
        "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
        "SearchSettings"="c:\program files\pdfforge Toolbar\SearchSettings.exe" [2009-03-30 970240]
        "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
        "PMCRemote"="c:\program files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe" [2005-07-06 61440]
        "PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]
        "MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 1117184]
        "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
        "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
        "ISUSPM Startup"="c:\program files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
        "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
        "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
        "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
        "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
        "DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2003-10-02 81920]
        "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
        "SDFix"="c:\sdfix\RunThis.bat" [2008-11-05 964661]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

        c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
        Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-10-21 110592]
        Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
        Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
        Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308]
        Symantec Fax Starter Edition Port.lnk - c:\program files\Microsoft Office\Office\1036\OLFSNT40.EXE [1999-4-6 46080]
        Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

        [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
        "ForceClassicControlPanel"= 1 (0x1)

        [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
        "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
        "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
        2008-12-22 10:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
        @=""

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
        @=""

        [HKEY_LOCAL_MACHINE\software\microsoft\security center]
        "UpdatesDisableNotify"=dword:00000001

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
        "DisableMonitoring"=dword:00000001

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
        "DisableMonitoring"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
        "c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
        "c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=
        "c:\\Program Files\\Empire Interactive\\FlatOut\\flatout.exe"=
        "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
        "c:\\Program Files\\iTunes\\iTunes.exe"=

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
        "10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
        "10426:UDP"= 10426:UDP:SingleClick ICC

        R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [22/08/2009 09:12 130936]
        R0 pnpshark;pnpshark;c:\windows\system32\drivers\pnpshark.sys [02/10/2003 04:16 119552]
        R0 st3shark;st3shark;c:\windows\system32\drivers\st3shark.sys [27/09/2003 15:37 5504]
        R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [05/08/2009 16:06 9968]
        R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [05/08/2009 16:06 74480]
        R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [22/08/2009 16:18 108289]
        R2 hnmwrlspkt;HomeNet Manager Wireless Protocol;c:\windows\system32\drivers\hnm_wrls_pkt.sys [12/01/2006 23:27 13696]
        R2 wsppkt;Wireless Security Protocol;c:\windows\system32\drivers\wsp_pkt.sys [12/01/2006 23:29 13568]
        R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [05/08/2009 16:06 7408]
        S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [03/08/2009 23:33 38160]
        S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [20/04/2009 21:46 18176]
        S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [20/04/2009 21:46 7680]
        S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [22/08/2009 09:11 348752]

        --- Other Services/Drivers In Memory ---

        *Deregistered* - mchInjDrv
        .
        Contents of the 'Scheduled Tasks' folder

        2009-08-03 c:\windows\Tasks\AppleSoftwareUpdate.job
        - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]

        2009-01-20 c:\windows\Tasks\PMCS_Wakeup633680891563033113.job
        - c:\program files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe [2007-12-23 21:48]
        .
        - - - - ORPHANS REMOVED - - - -

        HKLM-Run-DMXLauncher - c:\program files\Dell\Media Experience\DMXLauncher.exe
        HKLM-Run-PC Antispyware 2010 - c:\program files\PC_Antispyware2010\PC_Antispyware2010.exe
        HKLM-Run-Regedit32 - c:\windows\system32\regedit.exe

        .
        ------- Supplementary Scan -------
        .
        uStart Page = hxxp://www.google.com
        mStart Page = hxxp://www.google.com
        uInternet Connection Wizard,ShellNext = hxxp://www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=0060928
        uInternet Settings,ProxyOverride = *.local
        IE: SYSTRAN: &Effacer le cache de traduction - c:\program files\Systran\Premium\menuClearCache.html
        IE: SYSTRAN: &Options - c:\program files\Systran\Premium\menuConfigure.html
        IE: SYSTRAN: &Traduire - c:\program files\Systran\Premium\menuTranslate.html
        IE: SYSTRAN: En&registrement - c:\program files\Systran\Premium\menuRegister.html
        IE: SYSTRAN: Rechercher les &mises à jour - c:\program files\Systran\Premium\menuUpdate.html
        IE: SYSTRAN: Traduire les &cadres - c:\program files\Systran\Premium\menuTranslateAll.html
        IE: {{703436F1-3E1F-11d3-8F6B-00105A2A1D59} - c:\program files\Systran\Premium\MenuTranslate.html
        IE: {{703436F2-3E1F-11d3-8F6B-00105A2A1D59} - c:\program files\Systran\Premium\MenuTranslateAll.html
        IE: {{703436F3-3E1F-11d3-8F6B-00105A2A1D59} - c:\program files\Systran\Premium\MenuConfigure.html
        IE: {{703436F4-3E1F-11d3-8F6B-00105A2A1D59} - c:\program files\Systran\Premium\MenuClearCache.html
        IE: {{703436F5-3E1F-11d3-8F6B-00105A2A1D59} - c:\program files\Systran\Premium\MenuRegister.html
        IE: {{703436F6-3E1F-11d3-8F6B-00105A2A1D59} - c:\program files\Systran\Premium\MenuUpdates.html
        FF - ProfilePath - c:\documents and settings\julie\Application Data\Mozilla\Firefox\Profiles\ejhu05ya.default\
        FF - component: c:\program files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}\components\pdfforgeToolbarFF.dll
        FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll
        .

        **************************************************************************

        catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2009-08-24 20:05
        Windows 5.1.2600 Service Pack 3 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        --------------------- LOCKED REGISTRY KEYS ---------------------

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,66,a2,57,65,91,
        2a,c4,29,2e,e8,e1,00,eb,16,2b,de,ac,d2,6f,f8,d9,f2,bc,4a,e2,63,26,f1,3f,c8,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,7b,5d,b1,d1,ad,
        4e,46,6c,46,47,15,b0,92,4b,c7,ef,37,f3,6c,b8,e8,f0,52,3d,6a,9c,d6,61,af,45,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,0a,c5,fb,0c,77,
        35,77,ad,7a,45,05,fd,91,e8,6f,31,f0,e5,33,8d,e6,3e,e1,4a,ff,7c,85,e0,43,d4,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,77,2e,4d,1c,3d,
        d3,aa,be,6b,65,49,6a,7e,99,74,f7,46,fe,41,ca,d1,22,66,37,86,8c,21,01,be,91,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,02,3d,0f,61,78,
        50,1b,2f,e9,02,6c,fa,fb,1d,47,57,5e,f6,60,b7,29,a1,55,97,f5,1d,4d,73,a8,13,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,e2,f6,24,53,bb,
        b8,0e,8d,50,93,e5,ab,ec,6a,4e,ab,d7,70,62,e7,a7,26,a4,f2,df,20,58,62,78,6b,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,56,35,29,31,ca,
        4a,79,24,97,20,4e,9a,c7,f1,35,ee,f6,44,b9,96,7f,ca,38,c4,fb,a7,78,e6,12,2f,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,3c,98,86,b3,6b,
        e5,e8,cc,aa,52,c6,00,84,3c,26,64,50,92,61,0c,7b,26,21,d6,01,3a,48,fc,e8,04,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,c2,45,0e,f8,6a,
        fb,b9,2c,b2,46,9a,e2,1b,fe,1b,94,85,61,c0,7a,c1,a1,b3,7e,f6,0f,4e,58,98,5b,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,df,97,b2,ab,a9,
        3d,c9,51,37,a4,aa,c3,a6,15,56,0a,da,04,73,3e,64,65,fb,4c,3d,ce,ea,26,2d,45,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,aa,21,a9,dc,78,
        77,12,0e,f8,31,0f,a9,5f,a0,ec,fb,d9,f4,ad,9e,aa,24,39,46,2a,b7,cc,b5,b9,7f,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "8a8aec57dd6508a385616fbc86791ec2"=hex:05,73,21,dd,54,d8,4a,c5,eb,ef,e0,d3,97,
        17,e6,04,05,73,21,dd,54,d8,4a,c5,15,82,b3,3c,42,8e,3d,d5,6c,43,2d,1e,aa,22,\

        [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
        @DACL=(02 0000)
        "Installed"="1"

        [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
        @DACL=(02 0000)
        "NoChange"="1"
        "Installed"="1"

        [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
        @DACL=(02 0000)
        "Installed"="1"
        .
        --------------------- DLLs Loaded Under Running Processes ---------------------

        - - - - - - - > 'winlogon.exe'(648)
        c:\program files\SUPERAntiSpyware\SASWINLO.dll
        .
        Completion time: 2009-08-24 20:11
        ComboFix-quarantined-files.txt 2009-08-24 18:10

        Pre-Run: 17 404 084 224 octets libres
        Post-Run: 17 536 483 328 octets libres

        350 --- E O F --- 2009-08-22 18:43
        0
        1. papyber Contributeur sécurité
          on continue
          fais examiner ces fichiers sur virus total, attention même s'ils sont infectés ne les supprime pas, ce sont des fichiers systèmes et tu planterais irrémédiablement ton PC, je veux simplement savoir s'ils sont sains ou pas, s'ils sont infectés on les réparera ensuite!
          http://www.virustotal.com/en/indexf.html
          c:\windows\$hf­_mig$\KB930916\SP2QFE\ntfs.sys
          c:\windows\$Nt­ServicePackUninstall$\ntfs.sys
          c:\windows\$Nt­UninstallKB930916$\ntfs.sys
          c:\windows\Ser­vicePackFiles\i386\ntfs.sys
          c:\windows\sys­tem32\dllcache\ntfs.sys
          c:\windows\sys­tem32\drivers\ntfs.sys
          c:\windows\system32\dllcache\user32.dl­l
          c:\windows\system32\xpsshhdr.dll
          c:\windows\system32\dllcache\xpsshhdr.­dll
          c:\windows\system32\xpssvcs.dll
          c:\windows\system32\dllcache\xpssvcs.­dll
          c:\windows\system32\drivers\beep.sys
          c:\windows\system32\dllcache\beep.sys
          0
          2. houlalala2001
            voila pour le premier fichier :
            analisis/0c8c8bcd891e410cf66665db99209b8f11ae995572cea740ec29377459cfbeeb-1243573984
            0
            1. papyber Contributeur sécurité
              le rapport est incomplet, je ne vois pas s'il est ou pas infecté...
              0
              1. houlalala2001
                Antivirus Version Dernière mise à jour Résultat
                AhnLab-V3 5.0.0.2 2009.08.24 -
                AntiVir 7.9.1.3 2009.08.24 -
                Antiy-AVL 2.0.3.7 2009.08.24 -
                Authentium 5.1.2.4 2009.08.23 -
                Avast 4.8.1335.0 2009.08.24 -
                AVG 8.5.0.406 2009.08.24 -
                BitDefender 7.2 2009.08.24 -
                CAT-QuickHeal 10.00 2009.08.24 -
                ClamAV 0.94.1 2009.08.24 -
                Comodo 2079 2009.08.24 -
                DrWeb 5.0.0.12182 2009.08.24 -
                eSafe 7.0.17.0 2009.08.24 -
                eTrust-Vet 31.6.6697 2009.08.24 -
                F-Prot 4.4.4.56 2009.08.23 -
                F-Secure 8.0.14470.0 2009.08.24 -
                Fortinet 3.120.0.0 2009.08.24 -
                GData 19 2009.08.24 -
                Ikarus T3.1.1.68.0 2009.08.24 -
                Jiangmin 11.0.800 2009.08.23 -
                K7AntiVirus 7.10.826 2009.08.24 -
                Kaspersky 7.0.0.125 2009.08.24 -
                McAfee 5719 2009.08.24 -
                McAfee+Artemis 5719 2009.08.24 -
                McAfee-GW-Edition 6.8.5 2009.08.24 -
                Microsoft 1.4903 2009.08.24 -
                Norman 2009.08.24 -
                nProtect 2009.1.8.0 2009.08.24 -
                Panda 10.0.0.14 2009.08.24 -
                PCTools 4.4.2.0 2009.08.24 -
                Prevx 3.0 2009.08.24 -
                Rising 21.43.62.00 2009.08.24 -
                Sophos 4.44.0 2009.08.24 -
                Sunbelt 3.2.1858.2 2009.08.24 -
                Symantec 1.4.4.12 2009.08.24 -
                TheHacker 6.3.4.3.386 2009.08.22 -
                pardon je colle tout :

                TrendMicro 8.950.0.1094 2009.08.24 -
                VBA32 3.12.10.9 2009.08.24 -
                ViRobot 2009.8.24.1899 2009.08.24 -
                VirusBuster 4.6.5.0 2009.08.24 -
                Information additionnelle
                File size: 574976 bytes
                MD5...: 05ab81909514bfd69cbb1f2c147cf6b9
                SHA1..: b0675b0d3e62077d34db57045aabc070816f229c
                SHA256: 0c8c8bcd891e410cf66665db99209b8f11ae995572cea740ec29377459cfbeeb
                ssdeep: 12288:hRm2vSpqnu22TjDB1p3v1p0bCuTlu2o096mNom:78p+u2yd1p/HcCrru6m
                No
                PEiD..: -
                RDS...: NSRL Reference Data Set
                -
                pdfid.: -
                trid..: Win32 Executable Generic (68.0%)
                Generic Win/DOS Executable (15.9%)
                DOS Executable Generic (15.9%)
                Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
                0
                1. papyber Contributeur sécurité
                  stp donne moi le chemin de chaque fichier avec le rapport
                  pour celui ci qui est bon je pense que c'est le 1er ntfs...
                  0
                  1. houlalala2001
                    ok désolé ... donc :

                    c:\windows\$Nt­ServicePackUninstall$\ntfs.sys
                    MD5: 19a811ef5f1ed5c926a028ce107ff1af
                    First received: 2009.02.16 07:57:28 UTC
                    Date 2009.08.21 11:02:31 UTC [>3D]
                    Résultats 0/41
                    Permalink: analisis/97606850041de4e568188fb28aa3d5b10a4e96db9551a77bc3a17ed67d5d4474-1250852551

                    c:\windows\$Nt­UninstallKB930916$\ntfs.sys

                    MD5: b78be402c3f63dd55521f73876951cdd
                    First received: 2009.02.14 09:13:45 UTC
                    Date 2009.08.24 18:47:24 UTC [<1D]
                    Résultats 0/40
                    Permalink: analisis/020d75527b4814c544820d29ca064e94f2fcb7b1ba011d63e9d2bfd4cf91ba61-1251139644
                    0
                    1. houlalala2001
                      la suite :

                      c:\windows\Ser­vicePackFiles\i386\ntfs.sys

                      MD5: 19a811ef5f1ed5c926a028ce107ff1af
                      First received: 2009.02.16 07:57:28 UTC
                      Date 2009.08.21 11:02:31 UTC [>3D]
                      Résultats 0/41
                      Permalink: analisis/97606850041de4e568188fb28aa3d5b10a4e96db9551a77bc3a17ed67d5d4474-1250852551
                      0
                      1. houlalala2001
                        c:\windows\sys­tem32\dllcache\ntfs.sys

                        celui ci est infecte (d après antivir...) Dans le fichier 'C:\WINDOWS\system32\dllcache\ntfs.sys'
                        un virus ou un programme indésirable 'RKIT/Kobcka.Patched.62633.6' [trojan] a été détecté.
                        Antivirus Version Dernière mise à jour Résultat
                        a-squared 4.5.0.24 2009.08.24 Virus.Win32.Protector!IK
                        AhnLab-V3 5.0.0.2 2009.08.24 -
                        AntiVir 7.9.1.3 2009.08.24 RKIT/Kobcka.Patched.62633.6
                        Antiy-AVL 2.0.3.7 2009.08.24 Virus/Win32.Protector
                        Authentium 5.1.2.4 2009.08.23 -
                        Avast 4.8.1335.0 2009.08.24 Win32:Cutwail-Y
                        AVG 8.5.0.406 2009.08.24 -
                        BitDefender 7.2 2009.08.24 Rootkit.Kobcka.Patched.Gen
                        CAT-QuickHeal 10.00 2009.08.24 W32.Protector.C
                        ClamAV 0.94.1 2009.08.24 -
                        Comodo 2083 2009.08.24 UnclassifiedMalware
                        DrWeb 5.0.0.12182 2009.08.24 BackDoor.Bulknet.404
                        eSafe 7.0.17.0 2009.08.24 -
                        eTrust-Vet 31.6.6697 2009.08.24 -
                        F-Prot 4.4.4.56 2009.08.23 -
                        F-Secure 8.0.14470.0 2009.08.24 Virus.Win32.Protector.c
                        Fortinet 3.120.0.0 2009.08.24 -
                        GData 19 2009.08.24 Rootkit.Kobcka.Patched.Gen
                        Ikarus T3.1.1.68.0 2009.08.24 Virus.Win32.Protector
                        Jiangmin 11.0.800 2009.08.23 -
                        K7AntiVirus 7.10.826 2009.08.24 -
                        Kaspersky 7.0.0.125 2009.08.24 Virus.Win32.Protector.c
                        McAfee 5719 2009.08.24 Generic.dx!dxx
                        McAfee+Artemis 5719 2009.08.24 Generic.dx!dxx
                        McAfee-GW-Edition 6.8.5 2009.08.24 Heuristic.LooksLike.Rootkit.HareBot.J
                        Microsoft 1.4903 2009.08.24 Virus:Win32/Cutwail.G
                        NOD32 4364 2009.08.24 a variant of Win32/Kryptik.ABX
                        Norman 2009.08.24 -
                        nProtect 2009.1.8.0 2009.08.24 -
                        Panda 10.0.0.14 2009.08.24 Suspicious file
                        PCTools 4.4.2.0 2009.08.24 -
                        Prevx 3.0 2009.08.24 -
                        Rising 21.43.62.00 2009.08.24 -
                        Sophos 4.44.0 2009.08.24 Troj/NTFSKit-B
                        Sunbelt 3.2.1858.2 2009.08.24 -
                        Symantec 1.4.4.12 2009.08.24 -
                        TheHacker 6.3.4.3.386 2009.08.22 -
                        TrendMicro 8.950.0.1094 2009.08.24 -
                        VBA32 3.12.10.9 2009.08.24 -
                        ViRobot 2009.8.24.1899 2009.08.24 -
                        VirusBuster 4.6.5.0 2009.08.24 -
                        Information additionnelle
                        File size: 626336 bytes
                        MD5...: e86d39da8d7b1f24a79418c6650c0290
                        SHA1..: 161af84c767f84bc7ef9dd84a549b7409ac17ec5
                        SHA256: 4d33b0cee9a1dfd46afae438c6f6d05632ab32ddade198b536827f16977488e6
                        ssdeep: 12288:8uh1xqxz58/mV1OeoHli/Hk08Q3UlyGNdRWJ5K9QZ4eRA89UEPpDSQCX+7
                        COPNTG:LPlivk08Q3UlvNdR2Hy8KEBDSQ7COPNT
                        PEiD..: -
                        RDS...: NSRL Reference Data Set
                        -
                        pdfid.: -
                        trid..: Generic Win/DOS Executable (49.5%)
                        DOS Executable Generic (49.5%)
                        VXD Driver (0.7%)
                        Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)

                        c:\windows\sys­tem32\drivers\ntfs.sys
                        Dans le fichier 'C:\WINDOWS\system32\drivers\ntfs.sys'
                        un virus ou un programme indésirable 'RKIT/Kobcka.Patched.62633.6' [trojan] a été détecté.
                        0
                        1. papyber Contributeur sécurité
                          pas trop grave on va le réparer
                          continue
                          0
                          1. houlalala2001
                            c:\windows\sys­tem32\drivers\ntfs.sys
                            http://www.virustotal.com/fr/analisis/4d33b0cee9a1dfd46afae438c6f6d05632ab32ddade198b536827f16977488e6-1251141599

                            c:\windows\system32\dllcache\user32.dl­l
                            http://www.virustotal.com/fr/analisis/f06da9ccea0f1fb5e9b1bf66b589f97b3b3e2cb557a58ba672c7b2a4ec9cb10e-1251141734

                            c:\windows\system32\xpsshhdr.dll
                            http://www.virustotal.com/fr/analisis/cb78f39219d6b17bc5da4115d83f6c8cfe0ccd7f532ec3febce7aa498e91d0d6-1251142029
                            0
                            1. houlalala2001
                              on continue :
                              c:\windows\system32\xpsshhdr.dlll
                              http://www.virustotal.com/fr/analisis/cb78f39219d6b17bc5da4115d83f6c8cfe0ccd7f532ec3febce7aa498e91d0d6-1251142029

                              c:\windows\system32\dllcache\xpsshhdr.­dll
                              http://www.virustotal.com/fr/analisis/cb78f39219d6b17bc5da4115d83f6c8cfe0ccd7f532ec3febce7aa498e91d0d6-1251142172

                              c:\windows\system32\xpssvcs.dll
                              http://www.virustotal.com/fr/analisis/2f0f402c9073fd4faa888750bbbbc889ba74f457cc73f743faeba192f9058b02-1251142412

                              c:\windows\system32\dllcache\xpssvcs.­dll
                              http://www.virustotal.com/fr/analisis/2f0f402c9073fd4faa888750bbbbc889ba74f457cc73f743faeba192f9058b02-1251142469

                              c:\windows\system32\drivers\beep.sys
                              http://www.virustotal.com/fr/analisis/5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d-1251142536

                              c:\windows\system32\dllcache\beep.sys
                              http://www.virustotal.com/fr/analisis/5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d-1251142685

                              et voila ... ca n a pas l'air fameux !
                              0
                              1. papyber Contributeur sécurité
                                suis ce tuto
                                https://forum.malekal.com/viewtopic.php?t=19657&start=
                                et utilise WinFilsReplace pour remplacer les fichiers patchés par l'infection comme indiqué sur le tuto

                                C:\windows\system32\drivers\ntfs.sys
                                C:\windows\system32\dllcache\ntfs.sys
                                poste moi le rapport de WinFileReplace
                                0
                                1. houlalala2001
                                  bonjour

                                  hier soir WinFilsReplace n 'as pas remplacer les fichiers en indiquant qu'il n existait pas sur sp3... et n a pas non plus réaliser de rapport...
                                  aujourdhui je viens d'allummer le pc et spybot antivir trouvent braviax, fraudo... et tout leurs copains...
                                  que dois je faire svp
                                  je suis dispo encore une demi heure puis ce soir a partir de 18 h

                                  merci
                                  0
                                  1. papyber Contributeur sécurité
                                    l'infection s'est relancée...les fichiers patchés n'ayant pas été remplacés...
                                    quelle est ta version de xp? tu as le SP3?
                                    on va essayer autrement
                                    supprime ta version de combofix renommé
                                    retélécharge le en renommant comme je te l'avais indiqué
                                    lance le et scanne ton pc puis poste le rapport obtenu.
                                    0
                                    1. houlalala2001
                                      ComboFix 09-08-24.06 - julie 25/08/2009 18:24.2.1 - NTFSx86
                                      Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.502.269 [GMT 2:00]
                                      Running from: c:\documents and settings\julie\Bureau\bebette.exe
                                      AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
                                      AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
                                      FW: *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

                                      WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
                                      .

                                      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
                                      .

                                      c:\documents and settings\All Users\Application Data\birasiru.sys
                                      c:\documents and settings\All Users\Application Data\omar.dl
                                      c:\documents and settings\All Users\Application Data\wyhiso.bat
                                      c:\documents and settings\All Users\Documents\anyj.exe
                                      c:\documents and settings\All Users\Documents\nogixi.reg
                                      c:\documents and settings\LocalService\Local Settings\Application Data\azypyzyfini.bat
                                      c:\documents and settings\LocalService\Local Settings\Application Data\danexy.vbs
                                      c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
                                      c:\program files\Fichiers communs\lizaquwelu.com
                                      c:\program files\Fichiers communs\okotemesor.exe
                                      c:\program files\Fichiers communs\opoqowenox._dl
                                      c:\program files\Fichiers communs\xarimolugy.pif
                                      c:\windows\cuvire.bin
                                      c:\windows\idekilo.inf
                                      c:\windows\muxaryju.reg
                                      c:\windows\pican.inf
                                      c:\windows\system32\braviax.exe
                                      c:\windows\system32\codewe.dll
                                      c:\windows\system32\fehucyw.inf
                                      c:\windows\system32\ilunarek.inf
                                      c:\windows\system32\itasef.sys
                                      c:\windows\veso.inf

                                      .
                                      ((((((((((((((((((((((((( Files Created from 2009-07-25 to 2009-08-25 )))))))))))))))))))))))))))))))
                                      .

                                      2009-08-25 11:41 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
                                      2009-08-24 21:13 . 2009-08-24 21:13 -------- d-----w- C:\FR-files
                                      2009-08-24 20:17 . 2009-08-24 20:17 1924440 ----a-w- c:\documents and settings\julie\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
                                      2009-08-24 20:06 . 2009-08-24 21:15 -------- d-----w- C:\WinFileReplace
                                      2009-08-24 17:48 . 2009-08-24 17:48 14600 ----a-w- c:\windows\ovewuhoz.dat
                                      2009-08-24 17:48 . 2009-08-24 17:48 12074 ----a-w- c:\windows\system32\ubemogosi.com
                                      2009-08-24 17:05 . 2009-08-24 17:05 579584 ----a-w- c:\windows\system32\dllcache\user32.dll
                                      2009-08-24 17:03 . 2009-08-24 17:03 -------- d-----w- c:\windows\ERUNT
                                      2009-08-22 18:33 . 2009-08-22 18:33 -------- d-----w- c:\windows\system32\XPSViewer
                                      2009-08-22 18:33 . 2009-08-22 18:33 -------- d-----w- c:\program files\MSBuild
                                      2009-08-22 18:32 . 2009-08-22 18:32 -------- d-----w- c:\program files\Reference Assemblies
                                      2009-08-22 18:31 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
                                      2009-08-22 18:31 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
                                      2009-08-22 18:31 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
                                      2009-08-22 18:31 . 2009-08-22 18:32 -------- d-----w- C:\f24615ca3c2e5b69549c0e
                                      2009-08-22 18:31 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
                                      2009-08-22 18:31 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
                                      2009-08-22 18:31 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
                                      2009-08-22 18:31 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
                                      2009-08-22 18:31 . 2009-08-23 08:44 -------- d-----w- c:\windows\SxsCaPendDel
                                      2009-08-22 17:19 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\julie\Application Data\Simply Super Software\Trojan Remover\bsi18.exe
                                      2009-08-22 15:50 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\julie\Application Data\Simply Super Software\Trojan Remover\jug16.exe
                                      2009-08-22 14:21 . 2009-08-22 14:21 -------- d-----w- c:\documents and settings\LocalService\Menu Démarrer
                                      2009-08-22 14:18 . 2009-08-22 14:49 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
                                      2009-08-22 14:18 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
                                      2009-08-22 14:18 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
                                      2009-08-22 14:18 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
                                      2009-08-22 14:16 . 2009-08-22 14:16 -------- d-----w- c:\program files\Avira
                                      2009-08-22 14:16 . 2009-08-22 14:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
                                      2009-08-22 14:16 . 2008-08-07 13:27 4224 ----a-w- c:\windows\system32\drivers\beep.sys
                                      2009-08-22 14:16 . 2008-08-07 13:27 4224 ----a-w- c:\windows\system32\dllcache\beep.sys
                                      2009-08-22 13:50 . 2009-08-22 13:50 -------- d-----w- c:\windows\system32\wbem\Repository
                                      2009-08-22 13:49 . 2009-08-22 13:49 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
                                      2009-08-22 13:49 . 2009-08-22 13:49 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
                                      2009-08-22 13:49 . 2009-08-22 13:49 -------- d-----w- c:\documents and settings\julie\Application Data\Simply Super Software
                                      2009-08-22 10:19 . 2009-08-25 16:12 117760 ----a-w- c:\documents and settings\julie\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
                                      2009-08-22 10:12 . 2009-08-22 13:49 -------- d-----w- c:\program files\SUPERAntiSpyware
                                      2009-08-22 10:12 . 2009-08-22 10:12 -------- d-----w- c:\documents and settings\julie\Application Data\SUPERAntiSpyware.com
                                      2009-08-22 10:06 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\julie\Application Data\Simply Super Software\Trojan Remover\bqk2C.exe
                                      2009-08-22 09:58 . 2005-08-25 23:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
                                      2009-08-22 09:58 . 2006-05-25 13:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
                                      2009-08-22 09:58 . 2006-06-19 11:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
                                      2009-08-22 09:58 . 2002-03-05 23:00 75264 ----a-w- c:\windows\system32\unacev2.dll
                                      2009-08-22 09:58 . 2003-02-02 18:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
                                      2009-08-22 09:57 . 2009-08-22 09:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
                                      2009-08-22 09:57 . 2009-08-22 13:49 -------- d-----w- c:\program files\Trojan Remover
                                      2009-08-22 09:57 . 2009-08-22 09:57 -------- d-----w- c:\program files\Trend Micro
                                      2009-08-22 07:12 . 2008-12-11 06:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
                                      2009-08-22 07:12 . 2009-04-03 08:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
                                      2009-08-22 07:12 . 2008-12-18 09:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
                                      2009-08-22 07:12 . 2009-08-24 17:44 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
                                      2009-08-22 07:12 . 2009-08-22 07:12 -------- d-----w- c:\program files\Fichiers communs\PC Tools
                                      2009-08-22 07:12 . 2008-12-10 09:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
                                      2009-08-22 07:11 . 2009-08-24 17:14 -------- d-----w- c:\program files\Spyware Doctor
                                      2009-08-22 07:11 . 2009-08-22 07:11 -------- d-----w- c:\documents and settings\julie\Application Data\PC Tools
                                      2009-08-22 07:11 . 2009-08-22 07:11 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
                                      2009-08-05 09:00 . 2009-08-05 09:00 205312 ------w- c:\windows\system32\dllcache\mswebdvd.dll
                                      2009-08-03 21:33 . 2009-08-03 21:33 -------- d-----w- c:\documents and settings\julie\Application Data\Malwarebytes
                                      2009-08-03 21:33 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
                                      2009-08-03 21:33 . 2009-08-03 21:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
                                      2009-08-03 21:33 . 2009-08-03 21:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
                                      2009-08-03 21:33 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

                                      .
                                      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
                                      .
                                      2009-08-24 18:04 . 2009-06-10 20:38 -------- d-----w- c:\program files\pdfforge Toolbar
                                      2009-08-24 17:48 . 2009-08-24 17:48 12563 ----a-w- c:\documents and settings\LocalService\Application Data\ifum.dat
                                      2009-08-24 17:42 . 2006-10-07 10:53 48648 ----a-w- c:\documents and settings\julie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
                                      2009-08-22 18:40 . 2004-08-20 09:24 564702 ----a-w- c:\windows\system32\perfh00C.dat
                                      2009-08-22 18:40 . 2004-08-20 09:24 108842 ----a-w- c:\windows\system32\perfc00C.dat
                                      2009-08-22 07:26 . 2008-09-13 08:56 -------- d-----w- c:\program files\Bonjour
                                      2009-08-05 09:00 . 2004-08-20 09:23 205312 ----a-w- c:\windows\system32\mswebdvd.dll
                                      2009-07-20 21:13 . 2007-12-26 22:12 -------- d-----w- c:\program files\TrackMania Nations ESWC
                                      2009-07-17 19:03 . 2004-08-20 09:23 58880 ----a-w- c:\windows\system32\atl.dll
                                      2009-07-13 21:43 . 2004-08-20 09:24 286208 ----a-w- c:\windows\system32\wmpdxm.dll
                                      2009-07-10 11:54 . 2009-01-17 15:46 -------- d-----w- c:\program files\Windows Desktop Search
                                      2009-06-29 15:57 . 2004-08-20 09:24 827392 ----a-w- c:\windows\system32\wininet.dll
                                      2009-06-29 15:57 . 2004-08-20 09:23 78336 ----a-w- c:\windows\system32\ieencode.dll
                                      2009-06-29 15:57 . 2004-08-20 09:23 17408 ------w- c:\windows\system32\corpol.dll
                                      2009-06-16 14:40 . 2004-08-20 09:24 119808 ----a-w- c:\windows\system32\t2embed.dll
                                      2009-06-16 14:40 . 2004-08-20 09:23 81920 ----a-w- c:\windows\system32\fontsub.dll
                                      2009-06-15 10:44 . 2004-08-20 09:24 78848 ----a-w- c:\windows\system32\telnet.exe
                                      2009-06-10 20:07 . 2009-06-10 20:07 73216 ----a-w- c:\windows\cadkasdeinst01f.exe
                                      2009-06-10 14:14 . 2004-08-20 09:23 85504 ----a-w- c:\windows\system32\avifil32.dll
                                      2009-06-10 07:21 . 2004-08-20 09:34 2066432 ----a-w- c:\windows\system32\mstscax.dll
                                      2009-06-10 06:15 . 2004-08-20 09:24 132096 ----a-w- c:\windows\system32\wkssvc.dll
                                      2009-06-03 19:10 . 2004-08-20 09:24 1297408 ----a-w- c:\windows\system32\quartz.dll
                                      1999-04-06 12:27 . 1999-04-06 12:27 99840 ----a-w- c:\program files\Fichiers communs\IRAABOUT.DLL
                                      1998-12-09 02:53 . 1998-12-09 02:53 70144 ----a-w- c:\program files\Fichiers communs\IRAMDMTR.DLL
                                      1998-12-09 02:53 . 1998-12-09 02:53 48640 ----a-w- c:\program files\Fichiers communs\IRALPTTR.DLL
                                      1998-12-09 02:53 . 1998-12-09 02:53 31744 ----a-w- c:\program files\Fichiers communs\IRAWEBTR.DLL
                                      1998-12-09 02:53 . 1998-12-09 02:53 186368 ----a-w- c:\program files\Fichiers communs\IRAREG.DLL
                                      1998-12-09 02:53 . 1998-12-09 02:53 17920 ----a-w- c:\program files\Fichiers communs\IRASRIAL.DLL
                                      2006-10-08 12:27 . 2006-10-08 12:27 1682 --sha-w- c:\windows\system32\KGyGaAvL.sys
                                      .

                                      ((((((((((((((((((((((((((((( SnapShot@2009-08-24_18.05.47 )))))))))))))))))))))))))))))))))))))))))
                                      .
                                      + 2009-08-25 16:11 . 2009-08-25 16:11 16384 c:\windows\Temp\Perflib_Perfdata_124.dat
                                      - 2004-08-20 09:24 . 2009-04-29 04:45 44544 c:\windows\system32\pngfilt.dll
                                      + 2004-08-20 09:24 . 2009-06-29 15:57 44544 c:\windows\system32\pngfilt.dll
                                      + 2007-08-13 17:54 . 2009-06-29 15:57 52224 c:\windows\system32\msfeedsbs.dll
                                      - 2007-08-13 17:54 . 2009-04-29 04:45 52224 c:\windows\system32\msfeedsbs.dll
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 27648 c:\windows\system32\jsproxy.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 27648 c:\windows\system32\jsproxy.dll
                                      - 2007-08-13 17:39 . 2009-04-28 09:06 13824 c:\windows\system32\ieudinit.exe
                                      + 2007-08-13 17:39 . 2009-06-29 11:07 13824 c:\windows\system32\ieudinit.exe
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 44544 c:\windows\system32\iernonce.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 44544 c:\windows\system32\iernonce.dll
                                      - 2004-08-20 09:23 . 2009-04-28 09:06 70656 c:\windows\system32\ie4uinit.exe
                                      + 2004-08-20 09:23 . 2009-06-29 11:07 70656 c:\windows\system32\ie4uinit.exe
                                      + 2007-08-13 17:36 . 2009-06-29 15:57 63488 c:\windows\system32\icardie.dll
                                      - 2007-08-13 17:36 . 2009-04-29 04:45 63488 c:\windows\system32\icardie.dll
                                      + 2009-06-15 10:44 . 2009-06-15 10:44 78848 c:\windows\system32\dllcache\telnet.exe
                                      + 2006-09-28 14:23 . 2009-06-29 15:57 44544 c:\windows\system32\dllcache\pngfilt.dll
                                      - 2006-09-28 14:23 . 2009-04-29 04:45 44544 c:\windows\system32\dllcache\pngfilt.dll
                                      + 2007-12-23 17:55 . 2009-06-29 15:57 52224 c:\windows\system32\dllcache\msfeedsbs.dll
                                      - 2007-12-23 17:55 . 2009-04-29 04:45 52224 c:\windows\system32\dllcache\msfeedsbs.dll
                                      + 2006-09-28 14:23 . 2009-06-29 15:57 27648 c:\windows\system32\dllcache\jsproxy.dll
                                      - 2006-09-28 14:23 . 2009-04-29 04:45 27648 c:\windows\system32\dllcache\jsproxy.dll
                                      + 2007-12-23 17:55 . 2009-06-29 11:07 13824 c:\windows\system32\dllcache\ieudinit.exe
                                      - 2007-12-23 17:55 . 2009-04-28 09:06 13824 c:\windows\system32\dllcache\ieudinit.exe
                                      - 2007-08-13 17:39 . 2009-04-29 04:45 44544 c:\windows\system32\dllcache\iernonce.dll
                                      + 2007-08-13 17:39 . 2009-06-29 15:57 44544 c:\windows\system32\dllcache\iernonce.dll
                                      + 2009-02-20 17:10 . 2009-06-29 15:57 78336 c:\windows\system32\dllcache\ieencode.dll
                                      - 2009-02-20 17:10 . 2009-04-29 04:45 78336 c:\windows\system32\dllcache\ieencode.dll
                                      + 2007-08-13 17:39 . 2009-06-29 11:07 70656 c:\windows\system32\dllcache\ie4uinit.exe
                                      - 2007-08-13 17:39 . 2009-04-28 09:06 70656 c:\windows\system32\dllcache\ie4uinit.exe
                                      + 2007-12-23 17:55 . 2009-06-29 15:57 63488 c:\windows\system32\dllcache\icardie.dll
                                      - 2007-12-23 17:55 . 2009-04-29 04:45 63488 c:\windows\system32\dllcache\icardie.dll
                                      + 2009-06-29 15:57 . 2009-06-29 15:57 17408 c:\windows\system32\dllcache\corpol.dll
                                      + 2009-06-10 14:14 . 2009-06-10 14:14 85504 c:\windows\system32\dllcache\avifil32.dll
                                      + 2009-07-17 19:03 . 2009-07-17 19:03 58880 c:\windows\system32\dllcache\atl.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 44544 c:\windows\ie7updates\KB972260-IE7\pngfilt.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 52224 c:\windows\ie7updates\KB972260-IE7\msfeedsbs.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 27648 c:\windows\ie7updates\KB972260-IE7\jsproxy.dll
                                      + 2009-08-25 11:57 . 2009-04-28 09:06 13824 c:\windows\ie7updates\KB972260-IE7\ieudinit.exe
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 44544 c:\windows\ie7updates\KB972260-IE7\iernonce.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 78336 c:\windows\ie7updates\KB972260-IE7\ieencode.dll
                                      + 2009-08-25 11:57 . 2009-04-28 09:06 70656 c:\windows\ie7updates\KB972260-IE7\ie4uinit.exe
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 63488 c:\windows\ie7updates\KB972260-IE7\icardie.dll
                                      + 2009-08-25 11:57 . 2008-04-14 02:33 35328 c:\windows\ie7updates\KB972260-IE7\corpol.dll
                                      + 2004-08-20 09:24 . 2009-06-29 15:57 233472 c:\windows\system32\webcheck.dll
                                      - 2004-08-20 09:24 . 2009-04-29 04:45 233472 c:\windows\system32\webcheck.dll
                                      - 2004-08-20 09:24 . 2009-04-29 04:45 105984 c:\windows\system32\url.dll
                                      + 2004-08-20 09:24 . 2009-06-29 15:57 105984 c:\windows\system32\url.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 102912 c:\windows\system32\occache.dll
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 102912 c:\windows\system32\occache.dll
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 671232 c:\windows\system32\mstime.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 671232 c:\windows\system32\mstime.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 193024 c:\windows\system32\msrating.dll
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 193024 c:\windows\system32\msrating.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 477696 c:\windows\system32\mshtmled.dll
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 477696 c:\windows\system32\mshtmled.dll
                                      - 2007-08-13 17:54 . 2009-04-29 04:45 459264 c:\windows\system32\msfeeds.dll
                                      + 2007-08-13 17:54 . 2009-06-29 15:57 459264 c:\windows\system32\msfeeds.dll
                                      - 2007-08-13 17:34 . 2009-04-29 04:45 268288 c:\windows\system32\iertutil.dll
                                      + 2007-08-13 17:34 . 2009-06-29 15:57 268288 c:\windows\system32\iertutil.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 385024 c:\windows\system32\iedkcs32.dll
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 385024 c:\windows\system32\iedkcs32.dll
                                      + 2007-07-11 11:27 . 2009-06-29 15:57 380928 c:\windows\system32\ieapfltr.dll
                                      - 2004-08-20 09:23 . 2009-04-25 05:26 161792 c:\windows\system32\ieakui.dll
                                      + 2004-08-20 09:23 . 2009-06-29 08:33 161792 c:\windows\system32\ieakui.dll
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 230400 c:\windows\system32\ieaksie.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 230400 c:\windows\system32\ieaksie.dll
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 153088 c:\windows\system32\ieakeng.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 153088 c:\windows\system32\ieakeng.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 133120 c:\windows\system32\extmgr.dll
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 133120 c:\windows\system32\extmgr.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 214528 c:\windows\system32\dxtrans.dll
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 214528 c:\windows\system32\dxtrans.dll
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 347136 c:\windows\system32\dxtmsft.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 347136 c:\windows\system32\dxtmsft.dll
                                      + 2004-08-20 09:23 . 2008-04-13 19:15 574976 c:\windows\system32\drivers\ntfs.sys
                                      + 2009-07-13 21:43 . 2009-07-13 21:43 286208 c:\windows\system32\dllcache\wmpdxm.dll
                                      + 2009-06-10 06:15 . 2009-06-10 06:15 132096 c:\windows\system32\dllcache\wkssvc.dll
                                      + 2006-09-28 14:23 . 2009-06-29 15:57 827392 c:\windows\system32\dllcache\wininet.dll
                                      - 2006-09-28 14:23 . 2009-04-29 04:45 827392 c:\windows\system32\dllcache\wininet.dll
                                      + 2007-08-13 17:54 . 2009-06-29 15:57 233472 c:\windows\system32\dllcache\webcheck.dll
                                      - 2007-08-13 17:54 . 2009-04-29 04:45 233472 c:\windows\system32\dllcache\webcheck.dll
                                      - 2007-08-13 17:44 . 2009-04-29 04:45 105984 c:\windows\system32\dllcache\url.dll
                                      + 2007-08-13 17:44 . 2009-06-29 15:57 105984 c:\windows\system32\dllcache\url.dll
                                      + 2007-08-13 17:44 . 2009-06-29 15:57 102912 c:\windows\system32\dllcache\occache.dll
                                      - 2007-08-13 17:44 . 2009-04-29 04:45 102912 c:\windows\system32\dllcache\occache.dll
                                      + 2004-08-20 09:23 . 2008-04-13 19:15 574976 c:\windows\system32\dllcache\ntfs.sys
                                      + 2006-09-28 14:23 . 2009-06-29 15:57 671232 c:\windows\system32\dllcache\mstime.dll
                                      - 2006-09-28 14:23 . 2009-04-29 04:45 671232 c:\windows\system32\dllcache\mstime.dll
                                      - 2006-09-28 14:23 . 2009-04-29 04:45 193024 c:\windows\system32\dllcache\msrating.dll
                                      + 2006-09-28 14:23 . 2009-06-29 15:57 193024 c:\windows\system32\dllcache\msrating.dll
                                      + 2006-09-28 14:23 . 2009-06-29 15:57 477696 c:\windows\system32\dllcache\mshtmled.dll
                                      - 2006-09-28 14:23 . 2009-04-29 04:45 477696 c:\windows\system32\dllcache\mshtmled.dll
                                      + 2007-12-23 17:55 . 2009-06-29 15:57 459264 c:\windows\system32\dllcache\msfeeds.dll
                                      - 2007-12-23 17:55 . 2009-04-29 04:45 459264 c:\windows\system32\dllcache\msfeeds.dll
                                      + 2007-08-13 17:43 . 2009-06-29 08:35 634632 c:\windows\system32\dllcache\iexplore.exe
                                      - 2007-12-23 17:55 . 2009-04-29 04:45 268288 c:\windows\system32\dllcache\iertutil.dll
                                      + 2007-12-23 17:55 . 2009-06-29 15:57 268288 c:\windows\system32\dllcache\iertutil.dll
                                      + 2007-08-13 17:39 . 2009-06-29 15:57 385024 c:\windows\system32\dllcache\iedkcs32.dll
                                      - 2007-08-13 17:39 . 2009-04-29 04:45 385024 c:\windows\system32\dllcache\iedkcs32.dll
                                      + 2007-12-23 17:55 . 2009-06-29 15:57 380928 c:\windows\system32\dllcache\ieapfltr.dll
                                      - 2007-08-13 16:56 . 2009-04-25 05:26 161792 c:\windows\system32\dllcache\ieakui.dll
                                      + 2007-08-13 16:56 . 2009-06-29 08:33 161792 c:\windows\system32\dllcache\ieakui.dll
                                      + 2007-08-13 17:39 . 2009-06-29 15:57 230400 c:\windows\system32\dllcache\ieaksie.dll
                                      - 2007-08-13 17:39 . 2009-04-29 04:45 230400 c:\windows\system32\dllcache\ieaksie.dll
                                      + 2007-08-13 17:39 . 2009-06-29 15:57 153088 c:\windows\system32\dllcache\ieakeng.dll
                                      - 2007-08-13 17:39 . 2009-04-29 04:45 153088 c:\windows\system32\dllcache\ieakeng.dll
                                      - 2006-09-28 14:23 . 2009-04-29 04:45 133120 c:\windows\system32\dllcache\extmgr.dll
                                      + 2006-09-28 14:23 . 2009-06-29 15:57 133120 c:\windows\system32\dllcache\extmgr.dll
                                      + 2006-09-28 14:23 . 2009-06-29 15:57 214528 c:\windows\system32\dllcache\dxtrans.dll
                                      - 2006-09-28 14:23 . 2009-04-29 04:45 214528 c:\windows\system32\dllcache\dxtrans.dll
                                      - 2006-09-28 14:23 . 2009-04-29 04:45 347136 c:\windows\system32\dllcache\dxtmsft.dll
                                      + 2006-09-28 14:23 . 2009-06-29 15:57 347136 c:\windows\system32\dllcache\dxtmsft.dll
                                      + 2007-08-13 17:39 . 2009-06-29 15:57 124928 c:\windows\system32\dllcache\advpack.dll
                                      - 2007-08-13 17:39 . 2009-04-29 04:45 124928 c:\windows\system32\dllcache\advpack.dll
                                      + 2004-08-20 09:23 . 2009-06-29 15:57 124928 c:\windows\system32\advpack.dll
                                      - 2004-08-20 09:23 . 2009-04-29 04:45 124928 c:\windows\system32\advpack.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 827392 c:\windows\ie7updates\KB972260-IE7\wininet.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 233472 c:\windows\ie7updates\KB972260-IE7\webcheck.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 105984 c:\windows\ie7updates\KB972260-IE7\url.dll
                                      + 2009-08-25 11:57 . 2009-05-26 11:40 406392 c:\windows\ie7updates\KB972260-IE7\spuninst\updspapi.dll
                                      + 2009-08-25 11:57 . 2008-07-08 13:03 234872 c:\windows\ie7updates\KB972260-IE7\spuninst\spuninst.exe
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 102912 c:\windows\ie7updates\KB972260-IE7\occache.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 671232 c:\windows\ie7updates\KB972260-IE7\mstime.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 193024 c:\windows\ie7updates\KB972260-IE7\msrating.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 477696 c:\windows\ie7updates\KB972260-IE7\mshtmled.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 459264 c:\windows\ie7updates\KB972260-IE7\msfeeds.dll
                                      + 2009-08-25 11:57 . 2009-04-25 05:27 636088 c:\windows\ie7updates\KB972260-IE7\iexplore.exe
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 268288 c:\windows\ie7updates\KB972260-IE7\iertutil.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 385024 c:\windows\ie7updates\KB972260-IE7\iedkcs32.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 383488 c:\windows\ie7updates\KB972260-IE7\ieapfltr.dll
                                      + 2009-08-25 11:57 . 2009-04-25 05:26 161792 c:\windows\ie7updates\KB972260-IE7\ieakui.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 230400 c:\windows\ie7updates\KB972260-IE7\ieaksie.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 153088 c:\windows\ie7updates\KB972260-IE7\ieakeng.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 133120 c:\windows\ie7updates\KB972260-IE7\extmgr.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 214528 c:\windows\ie7updates\KB972260-IE7\dxtrans.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 347136 c:\windows\ie7updates\KB972260-IE7\dxtmsft.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 124928 c:\windows\ie7updates\KB972260-IE7\advpack.dll
                                      - 2004-08-20 09:24 . 2009-04-29 04:45 1159680 c:\windows\system32\urlmon.dll
                                      + 2004-08-20 09:24 . 2009-06-29 15:57 1159680 c:\windows\system32\urlmon.dll
                                      + 2004-08-20 09:23 . 2009-07-19 13:29 3597824 c:\windows\system32\mshtml.dll
                                      + 2007-08-13 17:54 . 2009-07-19 13:29 6067200 c:\windows\system32\ieframe.dll
                                      + 2007-02-12 15:10 . 2009-06-29 08:33 2452872 c:\windows\system32\ieapfltr.dat
                                      + 2006-09-28 14:23 . 2009-06-29 15:57 1159680 c:\windows\system32\dllcache\urlmon.dll
                                      - 2006-09-28 14:23 . 2009-04-29 04:45 1159680 c:\windows\system32\dllcache\urlmon.dll
                                      + 2009-06-10 07:21 . 2009-06-10 07:21 2066432 c:\windows\system32\dllcache\mstscax.dll
                                      + 2006-05-19 07:09 . 2009-07-19 13:29 3597824 c:\windows\system32\dllcache\mshtml.dll
                                      + 2007-12-23 17:55 . 2009-07-19 13:29 6067200 c:\windows\system32\dllcache\ieframe.dll
                                      + 2007-12-23 17:55 . 2009-06-29 08:33 2452872 c:\windows\system32\dllcache\ieapfltr.dat
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 1159680 c:\windows\ie7updates\KB972260-IE7\urlmon.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 3596288 c:\windows\ie7updates\KB972260-IE7\mshtml.dll
                                      + 2009-08-25 11:57 . 2009-04-29 04:45 6066176 c:\windows\ie7updates\KB972260-IE7\ieframe.dll
                                      + 2009-08-25 11:57 . 2008-07-09 14:25 2455488 c:\windows\ie7updates\KB972260-IE7\ieapfltr.dat
                                      + 2004-08-20 09:24 . 2009-07-13 21:43 10841088 c:\windows\system32\wmp.dll
                                      + 2007-12-23 17:39 . 2009-07-30 00:49 24281536 c:\windows\system32\MRT.exe
                                      + 2009-07-13 21:43 . 2009-07-13 21:43 10841088 c:\windows\system32\dllcache\wmp.dll
                                      .
                                      -- Snapshot reset to current date --
                                      .
                                      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
                                      .
                                      .
                                      *Note* empty entries & legit default entries are not shown
                                      REGEDIT4

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
                                      "{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files\pdfforge Toolbar\WidgiToolbarIE.dll" [2009-05-04 650752]

                                      [HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]

                                      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                      "TomTomHOME.exe"="c:\program files\TomTom HOME 2\HOMERunner.exe" [2008-12-09 234856]
                                      "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-08-05 1830128]
                                      "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
                                      "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                      "WireLessMouse"="c:\program files\Multimedia Keyboard & Mouse Driver\StartAutorun.exe" [2005-11-30 94208]
                                      "WireLessKeyboard"="c:\program files\Multimedia Keyboard & Mouse Driver\StartAutorun.exe" [2005-11-30 94208]
                                      "TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2009-08-04 1068424]
                                      "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
                                      "SearchSettings"="c:\program files\pdfforge Toolbar\SearchSettings.exe" [2009-03-30 970240]
                                      "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
                                      "PMCRemote"="c:\program files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe" [2005-07-06 61440]
                                      "PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]
                                      "MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 1117184]
                                      "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
                                      "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
                                      "ISUSPM Startup"="c:\program files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
                                      "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
                                      "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
                                      "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
                                      "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
                                      "DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2003-10-02 81920]
                                      "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

                                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                                      "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

                                      c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                                      Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-10-21 110592]
                                      Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
                                      Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
                                      Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308]
                                      Symantec Fax Starter Edition Port.lnk - c:\program files\Microsoft Office\Office\1036\OLFSNT40.EXE [1999-4-6 46080]
                                      Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

                                      [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
                                      "ForceClassicControlPanel"= 1 (0x1)

                                      [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
                                      "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
                                      "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

                                      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
                                      2008-12-22 10:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

                                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
                                      @=""

                                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
                                      @=""

                                      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                                      "UpdatesDisableNotify"=dword:00000001

                                      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
                                      "DisableMonitoring"=dword:00000001

                                      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
                                      "DisableMonitoring"=dword:00000001

                                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                                      "EnableFirewall"= 0 (0x0)

                                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                                      "%windir%\\system32\\sessmgr.exe"=
                                      "c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
                                      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                                      "c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
                                      "c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=
                                      "c:\\Program Files\\Empire Interactive\\FlatOut\\flatout.exe"=
                                      "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
                                      "c:\\Program Files\\iTunes\\iTunes.exe"=

                                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                                      "10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
                                      "10426:UDP"= 10426:UDP:SingleClick ICC

                                      R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [22/08/2009 09:12 130936]
                                      R0 pnpshark;pnpshark;c:\windows\system32\drivers\pnpshark.sys [02/10/2003 04:16 119552]
                                      R0 st3shark;st3shark;c:\windows\system32\drivers\st3shark.sys [27/09/2003 15:37 5504]
                                      R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [05/08/2009 16:06 9968]
                                      R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [05/08/2009 16:06 74480]
                                      R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [22/08/2009 16:18 108289]
                                      R2 hnmwrlspkt;HomeNet Manager Wireless Protocol;c:\windows\system32\drivers\hnm_wrls_pkt.sys [12/01/2006 23:27 13696]
                                      R2 wsppkt;Wireless Security Protocol;c:\windows\system32\drivers\wsp_pkt.sys [12/01/2006 23:29 13568]
                                      R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [05/08/2009 16:06 7408]
                                      S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [20/04/2009 21:46 18176]
                                      S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [20/04/2009 21:46 7680]
                                      S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [22/08/2009 09:11 348752]
                                      .
                                      Contents of the 'Scheduled Tasks' folder

                                      2009-08-03 c:\windows\Tasks\AppleSoftwareUpdate.job
                                      - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]

                                      2009-01-20 c:\windows\Tasks\PMCS_Wakeup633680891563033113.job
                                      - c:\program files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe [2007-12-23 21:48]
                                      .
                                      .
                                      ------- Supplementary Scan -------
                                      .
                                      uStart Page = hxxp://www.google.com
                                      mStart Page = hxxp://www.google.com
                                      uInternet Connection Wizard,ShellNext = hxxp://www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=0060928
                                      uInternet Settings,ProxyOverride = *.local
                                      IE: SYSTRAN: &Effacer le cache de traduction - c:\program files\Systran\Premium\menuClearCache.html
                                      IE: SYSTRAN: &Options - c:\program files\Systran\Premium\menuConfigure.html
                                      IE: SYSTRAN: &Traduire - c:\program files\Systran\Premium\menuTranslate.html
                                      IE: SYSTRAN: En&registrement - c:\program files\Systran\Premium\menuRegister.html
                                      IE: SYSTRAN: Rechercher les &mises à jour - c:\program files\Systran\Premium\menuUpdate.html
                                      IE: SYSTRAN: Traduire les &cadres - c:\program files\Systran\Premium\menuTranslateAll.html
                                      IE: {{703436F1-3E1F-11d3-8F6B-00105A2A1D59} - c:\program files\Systran\Premium\MenuTranslate.html
                                      IE: {{703436F2-3E1F-11d3-8F6B-00105A2A1D59} - c:\program files\Systran\Premium\MenuTranslateAll.html
                                      IE: {{703436F3-3E1F-11d3-8F6B-00105A2A1D59} - c:\program files\Systran\Premium\MenuConfigure.html
                                      IE: {{703436F4-3E1F-11d3-8F6B-00105A2A1D59} - c:\program files\Systran\Premium\MenuClearCache.html
                                      IE: {{703436F5-3E1F-11d3-8F6B-00105A2A1D59} - c:\program files\Systran\Premium\MenuRegister.html
                                      IE: {{703436F6-3E1F-11d3-8F6B-00105A2A1D59} - c:\program files\Systran\Premium\MenuUpdates.html
                                      FF - ProfilePath - c:\documents and settings\julie\Application Data\Mozilla\Firefox\Profiles\ejhu05ya.default\
                                      FF - component: c:\program files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}\components\pdfforgeToolbarFF.dll
                                      FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll

                                      ---- FIREFOX POLICIES ----
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
                                      c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
                                      c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
                                      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
                                      .

                                      **************************************************************************

                                      catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                      Rootkit scan 2009-08-25 18:32
                                      Windows 5.1.2600 Service Pack 3 NTFS

                                      scanning hidden processes ...

                                      scanning hidden autostart entries ...

                                      scanning hidden files ...

                                      scan completed successfully
                                      hidden files: 0

                                      **************************************************************************
                                      .
                                      --------------------- DLLs Loaded Under Running Processes ---------------------

                                      - - - - - - - > 'winlogon.exe'(644)
                                      c:\program files\SUPERAntiSpyware\SASWINLO.dll
                                      .
                                      Completion time: 2009-08-25 18:36
                                      ComboFix-quarantined-files.txt 2009-08-25 16:36
                                      ComboFix2.txt 2009-08-24 18:11

                                      Pre-Run: 16 855 916 544 octets libres
                                      Post-Run: 16 824 737 792 octets libres

                                      472 --- E O F --- 2009-08-25 11:58
                                      0
                                      1. houlalala2001
                                        et voila ... et oui j ai bien le sp3
                                        0
                                        1. papyber Contributeur sécurité
                                          Avis aux autres lecteurs, ce code a été rédigé spécialement pour cet utilisateur, il serait dangereux de le réutiliser sur votre ordinateur !
                                          /!\ Désactive ton antivirus / antispyware résident / TeaTimer de Spybot (si présent)
                                          Désactiver les protections résidentes - Tutoriel
                                          https://forum.pcastuces.com/default.asp
                                          Sélectionne et copie (Ctrl+C) le texte (en bleu) ci-dessous : 
                                          KillAll::
File::
c:\windows\ovewuhoz.dat
c:\windows\system32\ubemogosi.com
FCopy::
c:\windows\Ser­vicePackFiles\i386\ntfs.sys | C:\windows\system32\drivers\ntfs.sys
c:\windows\$Nt­ServicePackUninstall$\ntfs.sys | C:\windows\system32\dllcache\ntfs.sys 
Collect::
C:\Qoobox\Quarantine


                                          Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précédemment copié. (Bloc-Notes: démarrer > Tous les programmes > Accessoires > Bloc-Notes...)
                                          Sauvegarde ce fichier sous le nom de: CFScript.txt
                                          Comme l'image le montre, fais glisser CFScript.txt sur ComboFix.exe
                                          http://apu.mabul.org/up/apu/2008/08/12/img-210914jjufm.gif
                                          Une fenêtre bleue va apparaître; au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
                                          Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises, c'est normal!
                                          Ne touche à rien tant que le scan n'est pas terminé.
                                          Une fois le scan achevé, un rapport va s'afficher: poste son contenu dans ton prochain message.
                                          Si le fichier ne s'ouvre pas, tu le trouveras dans -> C:\ComboFix.txt

                                          1
                                          • 1
                                          • 2

                                          Discussions similaires

                                          Connexion impossible à Copains d'Avant
                                          bealain

                                          1 réponse
                                          recupération compte copain
                                          steph

                                          2 réponses
                                          je voudrais accéder à mon compte copains d'avant
                                          alice.allio

                                          1 réponse
                                          Perte de mes anciens accès pour Copain D'Avant
                                          Cslingue

                                          4 réponses
                                          Comment savoir qui a visité notre profil copain d'avant et facebook ?
                                          anonyme

                                          3 réponses