Ralentissement suite a antivir XP

Bonsoir,

Pas d'infection visible.

Dac donc c plus un virus

alors est ce que antivir aurait pu changer la config de mon PC ou modifer des driver, une connerie dans le genre;

En tant normal, j'aurai formater mon PC, mais la je suis en deplacement pour 2 mois donc aucun autre moyen

Euh je ne pense pas )

Tu peux toujours faire ceci :

Désinstalle via Ajout/Suppression de Programmes (si présents) :

Avast!

Télécharge et exécute : http://www.avast.com/eng/avast-uninstall-utility.html

Télécharge Ccleaner sur ton Bureau.

Clique sur download the latest version.

Installe-le en laissant seulement les options suivantes cochées :
- Ajouter un raccourci sur le Bureau.
- Contrôler automatiquement les mises à jour de CCleaner.

Lance le Nettoyage.

Clique sur Chercher des erreurs et sauvegarde si tu le souhaites.

Aide : Comment utiliser CCleaner.

***************

Télécharge AntiVir sur ton Bureau.

Double clique sur l'exécutable téléchargé pour lancer l'installation.

A la fin de l'installation, clique sur Finish.

Ouvre Antivir, assure-toi qu’il soit bien à jour !

Dans l'onglet Local Protection, choisis Scanner.

Active la recherche de rootkits via le + de rootkit search, puis dans manual selection, coche tout (tes partitions de disque dur).

Clique sur la loupe du milieu pour lancer le scan en tant qu'Administrateur.

Poste moi le rapport généré : Pour cela, clique sur l'onglet Overview, puis choisis Reports, tu trouveras son rapport..

Note : Pour une éradication des menaces plus efficace, lance le scan en mode sans échec.

Pourquoi changer ? Avast vs Antivir.

Aide : Comment installer et utiliser AntiVir.

voila le rapport


Avira AntiVir Personal
Report file date: vendredi 11 juillet 2008 10:46

Scanning for 1418048 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: Julien
Computer name: COCO

Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 10:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 09:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 09:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 09:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 11:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 09:43:47
ANTIVIR2.VDF : 7.0.5.86 547840 Bytes 09/07/2008 09:43:50
ANTIVIR3.VDF : 7.0.5.101 223232 Bytes 11/07/2008 09:43:52
Engineversion : 8.1.0.64
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 10:58:21
AESCRIPT.DLL : 8.1.0.46 283002 Bytes 11/07/2008 09:44:07
AESCN.DLL : 8.1.0.22 119157 Bytes 11/07/2008 09:44:06
AERDL.DLL : 8.1.0.20 418165 Bytes 11/07/2008 09:44:05
AEPACK.DLL : 8.1.1.6 364918 Bytes 11/07/2008 09:44:01
AEOFFICE.DLL : 8.1.0.20 192891 Bytes 11/07/2008 09:44:00
AEHEUR.DLL : 8.1.0.35 1298806 Bytes 11/07/2008 09:43:59
AEHELP.DLL : 8.1.0.15 115063 Bytes 11/07/2008 09:43:56
AEGEN.DLL : 8.1.0.29 307573 Bytes 11/07/2008 09:43:55
AEEMU.DLL : 8.1.0.6 430451 Bytes 11/07/2008 09:43:54
AECORE.DLL : 8.1.0.32 168311 Bytes 11/07/2008 09:43:53
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 18:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 11:37:50
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 14:26:47
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 18:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 09:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 09:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 18:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 18:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 13:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 15:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 13:02:11

Configuration settings for the scan:
Jobname..........................: Manual Selection
Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, E:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: vendredi 11 juillet 2008 10:46

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'Dot1XCfg.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned
Scan process 'cvpnd.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'SuperCopier2.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned
Scan process 'WButton.exe' - '1' Module(s) have been scanned
Scan process 'OSDCtrl.exe' - '1' Module(s) have been scanned
Scan process 'HotkeyApp.exe' - '1' Module(s) have been scanned
Scan process 'LaunchAp.exe' - '1' Module(s) have been scanned
Scan process 'EOUWiz.exe' - '1' Module(s) have been scanned
Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned
Scan process 'iFrmewrk.exe' - '1' Module(s) have been scanned
Scan process 'ZCfgSvc.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned
Scan process 'EvtEng.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
46 processes with 46 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '27' files ).


Starting the file scan:

Begin scan in 'C:\' <DISQUE LOCAL>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\axrfgvek.dll
[DETECTION] Is the Trojan horse TR/Drop.Agen.344064
[NOTE] The file was deleted!
C:\WINDOWS\system32\kytpvyxp.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was deleted!
C:\WINDOWS\system32\vnubuydm.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was deleted!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <Stockage>
Begin scan in 'E:\' <TQIT>


End of the scan: vendredi 11 juillet 2008 11:25
Used time: 39:16 min

The scan has been done completely.

4310 Scanning directories
123096 Files were scanned
3 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
3 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
123093 Files not concerned
2043 Archives were scanned
2 Warnings
3 Notes

Ah !

Télécharge ComboFix (de sUBs) sur ton Bureau.

Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)

Double clique sur ComboFix.exe.

Accepte la licence en cliquant sur Oui.

Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

Le rapport se trouve ici : %systemdrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)

Aide : Comment utiliser ComboFix.

voila le rapport :

ComboFix 08-07-10.1 - Julien 2008-07-11 12:44:31.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1414 [GMT 1:00]
Endroit: C:\Documents and Settings\Julien\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\hnlmaeoh.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\SDJQYcfe.ini
C:\WINDOWS\system32\SDJQYcfe.ini2

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CLBDRIVER
-------\Service_clbdriver


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-11 to 2008-07-11 ))))))))))))))))))))))))))))))))))))
.

2008-07-11 10:42 . 2008-07-11 10:42 <REP> d-------- C:\Program Files\Avira
2008-07-10 18:45 . 2008-07-10 18:45 <REP> d-------- C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-07-10 18:43 . 2008-07-10 18:43 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-07-10 18:43 . 2008-07-10 18:43 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-10 18:39 . 2007-01-01 20:03 40,960 -ra------ C:\WINDOWS\system32\psfind.dll
2008-07-10 18:30 . 2008-07-10 18:30 <REP> d-------- C:\WINDOWS\NV34003388.TMP
2008-07-10 18:14 . 2008-07-10 18:14 <REP> d-------- C:\WINDOWS\Drivers
2008-07-09 15:39 . 2008-07-10 12:18 <REP> d-------- C:\Program Files\World of Warcraft Trial
2008-07-09 15:39 . 2008-07-09 15:39 <REP> d-------- C:\Program Files\Fichiers communs\Blizzard Entertainment
2008-07-09 13:33 . 2008-07-09 13:33 <REP> d-------- C:\Program Files\Trend Micro
2008-07-08 00:47 . 2008-07-08 11:04 <REP> d-------- C:\Program Files\Cyanide
2008-07-07 22:38 . 2008-07-07 22:38 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-07 22:38 . 2008-07-11 10:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-07 22:23 . 2008-07-11 10:29 <REP> d-------- C:\Program Files\CCleaner
2008-07-07 11:48 . 2008-07-07 11:48 <REP> d-------- C:\Documents and Settings\Julien\Application Data\Grisoft
2008-07-07 11:47 . 2008-07-07 11:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-07-07 11:47 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-07-07 11:44 . 2008-07-07 11:53 <REP> d-------- C:\Program Files\TuneUp Utilities 2008
2008-07-07 11:44 . 2008-07-07 11:44 <REP> d-------- C:\Documents and Settings\Julien\Application Data\TuneUp Software
2008-07-07 11:44 . 2008-07-07 11:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-07-07 11:44 . 2008-07-07 11:44 355,584 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-07-07 11:44 . 2008-05-29 09:28 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-07-07 11:43 . 2008-07-07 11:43 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-07 11:43 . 2008-07-07 11:43 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-07 11:43 . 2008-07-07 11:43 <REP> d-------- C:\Documents and Settings\Julien\Application Data\Malwarebytes
2008-07-07 11:43 . 2008-07-07 11:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-07 11:43 . 2008-06-28 14:16 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-07 11:43 . 2008-06-28 14:16 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-07 11:19 . 2008-07-07 11:19 <REP> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-07-07 10:04 . 2008-07-07 10:04 <REP> d-------- C:\Program Files\Alcohol Soft
2008-07-07 09:19 . 2008-04-13 19:33 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2008-07-07 09:19 . 2008-04-13 19:33 54,784 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-07-07 09:19 . 2008-04-13 19:34 20,992 --a------ C:\WINDOWS\system32\dshowext.ax
2008-07-07 09:19 . 2008-04-13 19:34 20,992 --a--c--- C:\WINDOWS\system32\dllcache\dshowext.ax
2008-07-07 09:16 . 2006-06-23 10:39 245,824 -ra------ C:\WINDOWS\system32\InstExec.exe
2008-07-07 09:16 . 2006-06-23 10:40 245,824 --a------ C:\WINDOWS\Instexec.exe
2008-07-07 09:16 . 2006-06-23 10:39 719 -ra------ C:\WINDOWS\system32\InstExec.ini
2008-07-07 09:15 . 2008-07-07 09:17 <REP> d-------- C:\Program Files\Fichiers communs\Logitech
2008-07-07 09:15 . 2008-07-07 09:15 <REP> d-------- C:\Program Files\Fichiers communs\Acer
2008-07-07 09:15 . 2006-06-19 12:20 1,097,728 --a------ C:\WINDOWS\system32\drivers\lv321av.sys
2008-07-07 09:15 . 2006-06-19 12:18 380,928 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2008-07-07 09:15 . 2003-02-21 05:42 348,160 --a------ C:\WINDOWS\system\msvcr71.dll
2008-07-07 09:15 . 2006-06-19 12:15 221,184 --a------ C:\WINDOWS\system32\LVUI2.dll
2008-07-07 09:15 . 2006-06-19 12:15 204,800 --a------ C:\WINDOWS\system32\lvcodec2.dll
2008-07-07 09:15 . 2006-06-19 12:11 110,592 --a------ C:\WINDOWS\system32\lvcoinst.dll
2008-07-07 09:15 . 2006-06-19 12:16 39,424 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-07-07 09:15 . 2006-06-19 11:59 13,227 --a------ C:\WINDOWS\system32\lvcoinst.ini
2008-07-07 09:15 . 2006-06-19 11:58 2,760 --a------ C:\WINDOWS\system32\Repository.reg
2008-07-07 09:14 . 1998-11-13 14:16 308,224 --a------ C:\WINDOWS\IsUn040c.exe
2008-07-07 09:13 . 2008-07-07 09:13 264 --a------ C:\WINDOWS\_delis32.ini
2008-07-06 22:00 . 2008-07-06 22:00 <REP> d-------- C:\Program Files\Alwil Software
2008-07-06 22:00 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-07-06 21:47 . 2008-07-06 21:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-06 21:34 . 2008-07-07 11:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-06 21:06 . 2008-07-06 21:13 <REP> d-------- C:\Program Files\VS Revo Group
2008-07-06 17:43 . 2008-07-11 10:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-06 16:28 . 2001-08-28 15:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-07-06 14:32 . 2008-07-06 14:32 <REP> d-------- C:\Program Files\uTorrent
2008-07-06 14:32 . 2008-07-06 14:53 <REP> d-------- C:\Documents and Settings\Julien\Application Data\uTorrent
2008-07-06 14:04 . 2008-07-06 14:04 <REP> d-------- C:\Program Files\Microsoft Games
2008-07-04 15:28 . 2008-04-13 11:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-07-04 15:28 . 2008-04-13 11:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-07-01 08:38 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-07-01 08:38 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-07-01 08:38 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-07-01 00:57 . 2008-07-01 00:57 <REP> d-------- C:\Documents and Settings\Julien\Contacts
2008-07-01 00:56 . 2008-07-01 00:56 268 --ah----- C:\sqmdata00.sqm
2008-07-01 00:56 . 2008-07-01 00:56 244 --ah----- C:\sqmnoopt00.sqm
2008-07-01 00:49 . 2008-07-01 00:55 <REP> d-------- C:\Program Files\Windows Live
2008-07-01 00:49 . 2008-07-01 00:55 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-07-01 00:49 . 2008-07-01 00:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-06-28 19:57 . 2008-06-28 19:57 <REP> d-------- C:\Documents and Settings\Julien\Application Data\dvdcss
2008-06-26 21:10 . 2008-06-26 21:10 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-06-25 17:00 . 2008-06-25 17:00 <REP> d-------- C:\Program Files\MSXML 4.0
2008-06-15 23:46 . 2008-06-15 23:46 <REP> d-------- C:\Program Files\GameTribe
2008-06-14 11:43 . 2008-06-14 11:43 <REP> d-------- C:\Documents and Settings\Julien\Application Data\Ahead
2008-06-12 17:46 . 2008-06-12 17:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-06-11 13:31 . 2008-06-14 18:33 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 13:31 . 2008-06-14 18:33 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-10 17:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-10 17:44 --------- d-----w C:\Program Files\THQ
2008-07-09 17:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-07 12:36 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-07-06 22:59 --------- d-----w C:\Documents and Settings\Julien\Application Data\teamspeak2
2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-04 21:55 --------- d-----w C:\Program Files\Common Files
2008-06-04 21:28 --------- d-----w C:\Program Files\Gpotato.eu
2008-05-30 13:18 --------- d-----w C:\Program Files\Fichiers communs\Deterministic Networks
2008-05-30 13:18 --------- d-----w C:\Program Files\Cisco Systems
2008-05-23 07:47 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-23 07:47 --------- d-----w C:\Documents and Settings\Julien\Application Data\DAEMON Tools
2008-05-19 20:35 --------- d-----w C:\Program Files\QuickTime
2008-05-19 20:35 --------- d-----w C:\Program Files\iTunes
2008-05-19 20:35 --------- d-----w C:\Program Files\iPod
2008-05-19 20:35 --------- d-----w C:\Documents and Settings\Julien\Application Data\Apple Computer
2008-05-19 20:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-19 20:33 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-05-19 20:33 --------- d-----w C:\Program Files\Apple Software Update
2008-05-19 20:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-05-09 10:55 90,112 ----a-w C:\WINDOWS\system32\wshext.dll
2008-05-09 10:55 430,080 ----a-w C:\WINDOWS\system32\vbscript.dll
2008-05-09 10:55 180,224 ----a-w C:\WINDOWS\system32\scrobj.dll
2008-05-09 10:55 172,032 ----a-w C:\WINDOWS\system32\scrrun.dll
2008-05-08 11:24 155,648 ----a-w C:\WINDOWS\system32\wscript.exe
2008-05-07 09:07 135,168 ----a-w C:\WINDOWS\system32\cscript.exe
2008-05-07 05:11 1,294,336 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-13 19:33 76,800 ----a-w C:\WINDOWS\system32\storprop.dll
2008-04-13 18:47 1,246,130 ----a-r C:\WINDOWS\SET3.tmp
2008-04-13 18:38 16,825 ----a-r C:\WINDOWS\SET8.tmp
2008-04-13 18:38 1,088,840 ----a-r C:\WINDOWS\SET4.tmp
2008-04-13 17:50 1,804 ----a-w C:\WINDOWS\system32\Dcache.bin
2008-04-13 17:47 58,880 ----a-w C:\WINDOWS\system32\dmutil.dll
2008-04-13 17:47 52,736 ----a-w C:\WINDOWS\system32\wzcsapi.dll
2008-04-13 17:47 50,688 ----a-w C:\WINDOWS\system32\cnbjmon.dll
2008-04-13 17:47 483,840 ----a-w C:\WINDOWS\system32\wzcsvc.dll
2008-04-13 17:47 47,616 ----a-w C:\WINDOWS\system32\iyuv_32.dll
2008-04-13 17:47 35,328 ----a-w C:\WINDOWS\system32\pid.dll
2008-04-13 17:47 294,912 ----a-w C:\WINDOWS\system32\msh263.drv
2008-04-13 17:47 20,992 ----a-w C:\WINDOWS\system32\hid.dll
2008-04-13 17:47 2,025,984 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 17:47 16,896 ----a-w C:\WINDOWS\system32\msyuv.dll
2008-04-13 17:47 15,360 ----a-w C:\WINDOWS\system32\pjlmon.dll
2008-04-13 17:37 332,800 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-13 17:33 98,816 ----a-w C:\WINDOWS\system32\psbase.dll
2008-04-13 17:32 764,416 ----a-w C:\WINDOWS\system32\winntbbu.dll
2008-04-13 17:32 61,471 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-13 17:32 5,632 ----a-w C:\WINDOWS\system32\wmi.dll
2008-04-13 17:32 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll
2008-04-13 17:07 2,147,328 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 17:06 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:04 93,184 ----a-w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:03 81,920 ----a-w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:02 50,688 ----a-w C:\WINDOWS\system32\inetres.dll
2008-04-13 17:02 2,985,984 ----a-w C:\WINDOWS\system32\wmploc.dll
2008-04-13 17:01 572,416 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:59 200,704 ----a-w C:\WINDOWS\system32\wmerror.dll
2008-04-13 16:59 10,240 ----a-w C:\WINDOWS\system32\gpkrsrc.dll
2008-04-13 16:58 1,845,760 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 16:58 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:57 70,144 ----a-w C:\WINDOWS\system32\browselc.dll
2008-04-13 16:55 8,704 ----a-w C:\WINDOWS\system32\asferror.dll
2008-04-13 16:53 70,688 ----a-w C:\WINDOWS\system32\mmsystem.dll
2008-04-13 09:45 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 09:43 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe
2008-04-13 09:40 445,440 ----a-w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 09:36 2,986,496 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 09:35 197,632 ----a-w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 09:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 09:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 08:38 306,176 ----a-w C:\WINDOWS\system32\slbcsp.dll
2008-04-13 08:38 169,984 ----a-w C:\WINDOWS\system32\sccbase.dll
2008-04-13 08:38 101,888 ----a-w C:\WINDOWS\system32\gpkcsp.dll
2008-04-13 08:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 08:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 08:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 08:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dLL
2008-04-13 08:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 07:54 54,080 ----a-w C:\WINDOWS\system32\dosx.exe
2008-04-13 07:54 5,120 ----a-w C:\WINDOWS\system32\winnls.dll
2008-04-13 07:53 92,608 ----a-w C:\WINDOWS\system32\krnl386.exe
2008-04-13 07:52 3,352 ----a-w C:\WINDOWS\system32\redir.exe
2008-04-13 07:50 42,537 ----a-w C:\WINDOWS\system32\keyboard.sys
2008-04-13 07:49 35,648 ----a-w C:\WINDOWS\system32\ntio411.sys
2008-04-13 07:49 35,424 ----a-w C:\WINDOWS\system32\ntio412.sys
2008-04-13 07:49 34,560 ----a-w C:\WINDOWS\system32\ntio804.sys
2008-04-13 07:49 34,560 ----a-w C:\WINDOWS\system32\ntio404.sys
2008-04-13 07:49 34,000 ----a-w C:\WINDOWS\system32\ntio.sys
2008-04-13 07:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll
2008-04-13 07:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
2008-04-13 06:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 17:45 1052672]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 18:34 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 18:04 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-01-19 07:43 7397376]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-11-28 10:41 667718]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 10:41 602182]
"EOUApp"="C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" [2005-11-28 10:47 569413]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-07-25 12:36 32768]
"LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2006-02-21 08:46 69632]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 13:28 20480]
"LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2005-07-25 09:45 241664]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2006-03-14 13:33 86016]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 14:40 155648]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2006-06-23 10:39 225280]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-01-19 08:43 86016]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 18:34 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-07-10 08:18 270648 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-29 05:24 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Mythology\\aom.exe"=
"C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"=
"C:\\Program Files\\Cyanide\\Chaos-League MS\\ChaosLeagueEx.exe"=

R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 10:27]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2008-04-13 18:34]
R3 lv321av;Logitech USB PC Camera (VC0321);C:\WINDOWS\system32\DRIVERS\lv321av.sys [2006-06-19 12:20]
R3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2006-06-23 10:40]
S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys []
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-07-07 11:44]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - SSMDRV
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-07-11 11:48:46 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-11 12:49:25
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...


**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\C:\DOCUME~1\Julien\LOCALS~1\Temp\mc22.tmp"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-11 13:41:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-11 11:52:06

Pre-Run: 33,701,416,960 octets libres
Post-Run: 33,651,032,064 octets libres

293 --- E O F --- 2008-07-09 18:19:44

Re,

J'aimerais vérifier quelque chose.

Télécharge DiagHelp (de Malekal) sur ton Bureau

Dézippe le, ouvre le nouveau dossier DiagHelp, et double-clic sur go.cmd (le .cmd peut ne pas apparaître! )

Choisis l’option 1 dans la fenêtre qui s’ouvrira.
Ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand cela t’est demandé..
ATTENTION : Pendant l'analyse, après le rapport CatchMe, il te sera demandé d'appuyer sur une touche afin de poursuivre le scan, suis bien les instructions à l'écran !

A la fin de l'analyse, ton ordi devra peut-être être redémarré... Une fois l'ordinateur redémarré, le rapport va apparaître sur le Bloc-note.. Poste le ici.

Ce dernier se trouve ici : C:\resultat.txt

Si tu obtiens un fichier C:\upload_moi.zip, merci de l’envoyer sur http://upload.malekal.com/
Comment Uploader ?

Aide : Comment utiliser DiagHelp.

Et un petit rapport, 1 :


DiagHelp version v1.4 - http://www.malekal.com
excute le 11/07/2008 à 14:06:20,25


Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->11/07/2008 14:06:19
C:\WINDOWS\prefetch\WINRAR.EXE-39C6DAD9.pf -->11/07/2008 14:05:39
C:\WINDOWS\prefetch\VERCLSID.EXE-3667BD89.pf -->11/07/2008 14:04:40
C:\WINDOWS\prefetch\RUNDLL32.EXE-2E5AF1D7.pf -->11/07/2008 14:04:40
C:\WINDOWS\prefetch\RUNDLL32.EXE-2A94BB85.pf -->11/07/2008 14:04:40
C:\WINDOWS\prefetch\CTRLVOL.EXE-3824587E.pf -->11/07/2008 14:02:11
C:\WINDOWS\prefetch\ONECLICKSTARTER.EXE-1492110E.pf -->11/07/2008 14:00:00
C:\WINDOWS\prefetch\WOW.EXE-00FBAB74.pf -->11/07/2008 13:56:04
C:\WINDOWS\prefetch\LAUNCHER.EXE-02C46D8B.pf -->11/07/2008 13:56:02
C:\WINDOWS\prefetch\RASAUTOU.EXE-18B88A68.pf -->11/07/2008 13:55:55

C:\WINDOWS\System32\drivers\mbamcatchme.sys -->28/06/2008 14:16:40
C:\WINDOWS\System32\drivers\mbam.sys -->28/06/2008 14:16:36
C:\WINDOWS\System32\drivers\tcpip.sys -->20/06/2008 12:51:12
C:\WINDOWS\System32\drivers\afd.sys -->20/06/2008 12:40:08
C:\WINDOWS\System32\drivers\tcpip6.sys -->20/06/2008 12:08:27
C:\WINDOWS\System32\drivers\bthport.sys -->14/06/2008 18:33:37
C:\WINDOWS\System32\drivers\sptd.sys -->23/05/2008 08:47:43

C:\WINDOWS\System32\PerfStringBackup.INI -->11/07/2008 12:53:09
C:\WINDOWS\System32\perfh00C.dat -->11/07/2008 12:53:09
C:\WINDOWS\System32\perfh009.dat -->11/07/2008 12:53:09
C:\WINDOWS\System32\perfc00C.dat -->11/07/2008 12:53:09
C:\WINDOWS\System32\perfc009.dat -->11/07/2008 12:53:09
C:\WINDOWS\System32\nvapps.xml -->11/07/2008 12:49:16
C:\WINDOWS\System32\wpa.dbl -->11/07/2008 12:48:44
C:\WINDOWS\System32\CONFIG.NT -->11/07/2008 10:32:46
C:\WINDOWS\System32\TuneUpDefragService.exe -->07/07/2008 11:44:53
C:\WINDOWS\System32\lvcoinst.log -->07/07/2008 09:19:29
C:\WINDOWS\System32\cf87b616-.txt -->07/07/2008 09:01:41
C:\WINDOWS\System32\FNTCACHE.DAT -->06/07/2008 14:55:08
C:\WINDOWS\System32\xfcodec.dll -->26/06/2008 21:10:46
C:\WINDOWS\System32\MRT.exe -->25/06/2008 17:15:46
C:\WINDOWS\System32\mswsock.dll -->20/06/2008 18:47:22
C:\WINDOWS\System32\dnsapi.dll -->20/06/2008 18:47:22
C:\WINDOWS\System32\success -->30/05/2008 14:18:48
C:\WINDOWS\System32\TZLog.log -->29/05/2008 17:00:33
C:\WINDOWS\System32\uxtuneup.dll -->29/05/2008 09:28:54
C:\WINDOWS\System32\wshom.ocx -->10/05/2008 00:25:02
C:\WINDOWS\System32\wshext.dll -->09/05/2008 11:55:00
C:\WINDOWS\System32\vbscript.dll -->09/05/2008 11:55:00
C:\WINDOWS\System32\scrrun.dll -->09/05/2008 11:55:00
C:\WINDOWS\System32\scrobj.dll -->09/05/2008 11:55:00
C:\WINDOWS\System32\jscript.dll -->09/05/2008 11:55:00

C:\WINDOWS\WindowsUpdate.log -->11/07/2008 12:50:52
C:\WINDOWS\system.ini -->11/07/2008 12:49:20
C:\WINDOWS\0.log -->11/07/2008 12:49:10
C:\WINDOWS\wiadebug.log -->11/07/2008 12:48:51
C:\WINDOWS\wiaservc.log -->11/07/2008 12:48:47
C:\WINDOWS\bootstat.dat -->11/07/2008 12:48:36
C:\WINDOWS\SchedLgU.Txt -->11/07/2008 12:47:23
C:\WINDOWS\QTFont.qfn -->10/07/2008 18:43:24
C:\WINDOWS\QTFont.for -->10/07/2008 18:43:24
C:\WINDOWS\NeroDigital.ini -->09/07/2008 23:05:00
C:\WINDOWS\win.ini -->07/07/2008 12:26:54
C:\WINDOWS\_delis32.ini -->07/07/2008 09:13:17
C:\WINDOWS\mozver.dat -->05/05/2008 22:28:35
C:\WINDOWS\Sti_Trace.log -->05/05/2008 21:07:32
C:\WINDOWS\nsreg.dat -->05/05/2008 20:53:00

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed


ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 4348
Command line: C:\WINDOWS\explorer.exe

Base Size Version Path
0x77be0000 0x58000 7.00.2600.5512 C:\WINDOWS\system32\msvcrt.dll
0x779e0000 0x97000 5.131.2600.5512 C:\WINDOWS\system32\CRYPT32.dll
0x76610000 0x84000 5.131.2600.5512 C:\WINDOWS\system32\CRYPTUI.dll
0x44080000 0xd0000 7.00.6000.16674 C:\WINDOWS\system32\WININET.dll
0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x43e00000 0x45000 7.00.6000.16674 C:\WINDOWS\system32\iertutil.dll
0x76be0000 0x2e000 5.131.2600.5512 C:\WINDOWS\system32\WINTRUST.dll
0x58b50000 0x9a000 5.82.2900.5512 C:\WINDOWS\system32\comctl32.dll
0x10000000 0x16000 9.04.0004.1082 C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcInj.dll
0x00c80000 0x19000 2.00.0000.0016 C:\Program Files\SuperCopier2\SC2Hook.dll
0x76f80000 0x7f000 2001.12.4414.0700 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0700 C:\WINDOWS\system32\COMRes.dll
0x76ac0000 0x11000 3.05.2284.0001 C:\WINDOWS\system32\ATL.DLL
0x7d200000 0x2bc000 3.01.4001.5512 C:\WINDOWS\system32\msi.dll
0x44360000 0x5cd000 7.00.6000.16674 C:\WINDOWS\system32\ieframe.dll
0x44160000 0x127000 7.00.6000.16674 C:\WINDOWS\system32\urlmon.dll
0x442b0000 0x3c000 7.00.6000.16674 C:\WINDOWS\system32\webcheck.dll
0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x01680000 0x13000 7.05.0001.0036 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
0x02880000 0x5b000 8.01.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
0x78130000 0x9b000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
0x028e0000 0x4c000 8.00.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
0x019a0000 0x8000 1.00.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
0x02cf0000 0x2e000 C:\Program Files\WinRAR\rarext.dll
0x019c0000 0x9000 2.00.0000.0004 C:\Program Files\TuneUp Utilities 2008\SDShelEx-win32.dll
0x029d0000 0x13000 7.00.0000.0011 C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll
0x7c250000 0x102000 7.10.3077.0000 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MFC71U.DLL
0x03120000 0x56000 7.10.3052.0004 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll
0x7c3a0000 0x7b000 7.10.3077.0000 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCP71.dll
0x032b0000 0x2a000 7.05.0001.0036 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll
0x00fd0000 0x10000 8.00.0000.0456 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
0x6bd10000 0x10000 12.00.4518.1014 C:\Program Files\Microsoft Office\Office12\msohevi.dll
0x60990000 0x7000 3.01.4001.5512 C:\WINDOWS\system32\MSISIP.DLL
0x7e6a0000 0x16000 5.07.0000.18066 C:\WINDOWS\system32\wshext.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 972
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x82000 \??\C:\WINDOWS\system32\winlogon.exe
0x77be0000 0x58000 7.00.2600.5512 C:\WINDOWS\system32\msvcrt.dll
0x779e0000 0x97000 5.131.2600.5512 C:\WINDOWS\system32\CRYPT32.dll
0x76be0000 0x2e000 5.131.2600.5512 C:\WINDOWS\system32\WINTRUST.dll
0x58b50000 0x9a000 5.82.2900.5512 C:\WINDOWS\system32\COMCTL32.dll
0x74730000 0x3d000 3.525.1132.0000 C:\WINDOWS\system32\ODBC32.dll
0x1f840000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x76ac0000 0x11000 3.05.2284.0001 C:\WINDOWS\system32\ATL.DLL
0x77000000 0xd4000 2001.12.4414.0700 C:\WINDOWS\system32\COMRes.dll
0x76f80000 0x7f000 2001.12.4414.0700 C:\WINDOWS\system32\CLBCATQ.DLL


Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le numéro de série du volume est C4A4-72C7

Répertoire de C:\WINDOWS\system32

13/04/2008 18:34 6 144 csrss.exe
1 fichier(s) 6 144 octets
0 Rép(s) 33 701 953 536 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le numéro de série du volume est C4A4-72C7

Répertoire de C:\WINDOWS\Downloaded Program Files

06/07/2008 23:17 <REP> .
06/07/2008 23:17 <REP> ..
05/05/2008 19:20 65 desktop.ini
24/03/2008 19:33 1 527 056 FP_AX_CAB_INSTALLER.exe
24/03/2008 19:18 247 swflash.inf
3 fichier(s) 1 527 368 octets

Total des fichiers listés :
3 fichier(s) 1 527 368 octets
2 Rép(s) 33 701 953 536 octets libres

Recherche de rootkit! (Merci S!Ri)
SVKP présent! Possible infection W32/Maibot-A/W32/Rbot-AJR

Recherche d'infections connues

Export des clefs sensibles..


Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
"C:\\Program Files\\Microsoft Games\\Age of Mythology\\aom.exe"="C:\\Program Files\\Microsoft Games\\Age of Mythology\\aom.exe:*:Enabled:Age of Mythology"
"C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"="C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe:*:Enabled:GameCenter"
"C:\\Program Files\\Cyanide\\Chaos-League MS\\ChaosLeagueEx.exe"="C:\\Program Files\\Cyanide\\Chaos-League MS\\ChaosLeagueEx.exe:*:Enabled:Chaos-League-MS"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"



exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableRegistryTools"=dword:00000000
"HideLegacyLogonScripts"=dword:00000000
"HideLogoffScripts"=dword:00000000
"RunLogonScriptSync"=dword:00000001
"RunStartupScriptSync"=dword:00000000
"HideStartupScripts"=dword:00000000



Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-11 14:06:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:28,90,51,6f,b0,9b,2a,e7,7e,22,d1,7c,4a,d1,63,ac,c1,55,3c,1e,ae,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:f8,c2,a3,3c,59,e4,d9,07,b7,24,c1,a4,e9,9d,94,77,f2,d3,1f,a5,68,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:28,90,51,6f,b0,9b,2a,e7,7e,22,d1,7c,4a,d1,63,ac,c1,55,3c,1e,ae,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:f8,c2,a3,3c,59,e4,d9,07,b7,24,c1,a4,e9,9d,94,77,f2,d3,1f,a5,68,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000003c9

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0


KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
224 - LVPrcSrv.exe
296 - nvsvc32.exe
564 - guard.exe
624 - Dot1XCfg.exe
744 - AppleMobileDevi
756 - avgnt.exe
776 - avguard.exe
948 - csrss.exe
972 - winlogon.exe
1016 - services.exe
1028 - lsass.exe
1096 - cvpnd.exe
1296 - svchost.exe
1420 - svchost.exe
1484 - EvtEng.exe
1512 - S24EvMon.exe
1604 - svchost.exe
2200 - ctfmon.exe
2592 - NMBgMonitor.exe
2692 - msnmsgr.exe
2788 - ZCfgSvc.exe
2844 - iFrmewrk.exe
3016 - HotkeyApp.exe
3564 - NMIndexStoreSvr
4004 - firefox.exe
4348 - explorer.exe
4592 - avgas.exe
5560 - usnsvc.exe
7256 - cmd.exe

Total number of processes = 30
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\ntkrnlpa.exe
806E4000 - \WINDOWS\system32\hal.dll
BADA8000 - \WINDOWS\system32\KDCOM.DLL
BACB8000 - \WINDOWS\system32\BOOTVID.dll
BA6A7000 - spek.sys
BADAA000 - \WINDOWS\System32\Drivers\WMILIB.SYS
BA68F000 - \WINDOWS\System32\Drivers\SCSIPORT.SYS
BA660000 - ACPI.sys
BA64F000 - pci.sys
BA8A8000 - isapnp.sys
BACBC000 - compbatt.sys
BACC0000 - \WINDOWS\system32\DRIVERS\BATTC.SYS
BAE70000 - pciide.sys
BAB28000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
BA631000 - pcmcia.sys
BA8B8000 - MountMgr.sys
BA612000 - ftdisk.sys
BADAC000 - dmload.sys
BA5EC000 - dmio.sys
BACC4000 - ACPIEC.sys
BAE71000 - \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
BAB30000 - PartMgr.sys
BA8C8000 - sfsync02.sys
BA8D8000 - VolSnap.sys
BA5D4000 - atapi.sys
BA8E8000 - disk.sys
BA8F8000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
BA5B4000 - fltMgr.sys
BA5A2000 - sr.sys
BA58B000 - KSecDD.sys
BA4FE000 - Ntfs.sys
BA4D1000 - NDIS.sys
BA908000 - Combo-Fix.sys
BAB38000 - sfhlp02.sys
BADAE000 - sfhlp01.sys
BA4C0000 - sfdrv01.sys
BADB0000 - prosync1.sys
BA4AD000 - prohlp02.sys
BA493000 - Mup.sys
BAA68000 - \SystemRoot\system32\DRIVERS\intelppm.sys
BAD80000 - \SystemRoot\system32\DRIVERS\wmiacpi.sys
B9F70000 - \SystemRoot\system32\DRIVERS\nv4_mini.sys
B9F5C000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
B9F34000 - \SystemRoot\system32\DRIVERS\HDAudBus.sys
B9DD7000 - \SystemRoot\system32\DRIVERS\w39n51.sys
BABD0000 - \SystemRoot\system32\DRIVERS\usbuhci.sys
B9DB3000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
BABD8000 - \SystemRoot\system32\DRIVERS\usbehci.sys
B9D9F000 - \SystemRoot\system32\DRIVERS\sdbus.sys
BAD94000 - \SystemRoot\system32\DRIVERS\CmBatt.sys
BAA78000 - \SystemRoot\system32\DRIVERS\i8042prt.sys
BABE0000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
B9D70000 - \SystemRoot\system32\DRIVERS\SynTP.sys
BADBE000 - \SystemRoot\system32\DRIVERS\USBD.SYS
BABE8000 - \SystemRoot\system32\DRIVERS\mouclass.sys
BAA88000 - \SystemRoot\system32\DRIVERS\imapi.sys
BAA98000 - \SystemRoot\system32\DRIVERS\cdrom.sys
BAAA8000 - \SystemRoot\system32\DRIVERS\redbook.sys
B9D4D000 - \SystemRoot\system32\DRIVERS\ks.sys
BABF0000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys
B9D2F000 - \SystemRoot\system32\DRIVERS\dne2000.sys
BAFB0000 - \SystemRoot\system32\DRIVERS\audstub.sys
BAB08000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
BADA0000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
B9D18000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
BAB18000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
BA928000 - \SystemRoot\system32\DRIVERS\raspptp.sys
BABF8000 - \SystemRoot\system32\DRIVERS\TDI.SYS
B9D07000 - \SystemRoot\system32\DRIVERS\psched.sys
BA938000 - \SystemRoot\system32\DRIVERS\msgpc.sys
BAC00000 - \SystemRoot\system32\DRIVERS\ptilink.sys
BAC08000 - \SystemRoot\system32\DRIVERS\raspti.sys
B9CAF000 - \SystemRoot\system32\DRIVERS\rdpdr.sys
BA948000 - \SystemRoot\system32\DRIVERS\termdd.sys
BADC0000 - \SystemRoot\system32\DRIVERS\swenum.sys
B9C51000 - \SystemRoot\system32\DRIVERS\update.sys
BA45F000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
BA958000 - \SystemRoot\System32\Drivers\NDProxy.SYS
B7819000 - \SystemRoot\system32\drivers\RtkHDAud.sys
B77F5000 - \SystemRoot\system32\drivers\portcls.sys
BA998000 - \SystemRoot\system32\drivers\drmk.sys
BA9A8000 - \SystemRoot\system32\DRIVERS\usbhub.sys
BADE2000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
BAEB3000 - \SystemRoot\System32\Drivers\Null.SYS
BADE4000 - \SystemRoot\System32\Drivers\Beep.SYS
BAEB4000 - \SystemRoot\System32\DRIVERS\AvgAsCln.sys
BAC28000 - \SystemRoot\System32\drivers\vga.sys
BADE6000 - \SystemRoot\System32\Drivers\mnmdd.SYS
BADE8000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
BAC30000 - \SystemRoot\System32\Drivers\Msfs.SYS
BAC38000 - \SystemRoot\System32\Drivers\Npfs.SYS
BAD68000 - \SystemRoot\system32\DRIVERS\rasacd.sys
B7722000 - \SystemRoot\system32\DRIVERS\ipsec.sys
B76C9000 - \SystemRoot\system32\DRIVERS\tcpip.sys
B767B000 - \SystemRoot\system32\DRIVERS\ipnat.sys
B7653000 - \SystemRoot\system32\DRIVERS\netbt.sys
BA9B8000 - \SystemRoot\system32\DRIVERS\wanarp.sys
B7631000 - \SystemRoot\System32\drivers\afd.sys
BA9C8000 - \SystemRoot\system32\DRIVERS\netbios.sys
BAC48000 - \SystemRoot\system32\DRIVERS\ssmdrv.sys
B7606000 - \SystemRoot\system32\DRIVERS\rdbss.sys
B75F2000 - \SystemRoot\System32\drivers\prodrv06.sys
B7582000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
B9D03000 - \SystemRoot\System32\Drivers\Hotkey.SYS
BA9D8000 - \SystemRoot\System32\Drivers\Fips.SYS
B756F000 - \SystemRoot\system32\DRIVERS\avipbb.sys
BADEC000 - \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
BAEA8000 - \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
B72FD000 - \??\C:\WINDOWS\system32\drivers\lvmvdrv.sys
BAA08000 - \SystemRoot\system32\DRIVERS\LVUSBSta.sys
B71F1000 - \SystemRoot\system32\DRIVERS\lv321av.sys
BAA18000 - \SystemRoot\system32\DRIVERS\STREAM.SYS
B9C39000 - \SystemRoot\system32\DRIVERS\hidusb.sys
BAA28000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
BAC78000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
B9C35000 - \SystemRoot\system32\DRIVERS\mouhid.sys
B71E0000 - \SystemRoot\System32\Drivers\Udfs.SYS
B71C8000 - \SystemRoot\System32\Drivers\dump_atapi.sys
BAE16000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
BAD64000 - \SystemRoot\System32\drivers\Dxapi.sys
BAC88000 - \SystemRoot\System32\watchdog.sys
BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
BAFAF000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9D5000 - \SystemRoot\System32\nv4_disp.dll
BAC10000 - \SystemRoot\system32\DRIVERS\AegisP.sys
B6137000 - \SystemRoot\system32\DRIVERS\s24trans.sys
B618B000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
B55F2000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
B4CC5000 - \SystemRoot\system32\drivers\wdmaud.sys
B5E67000 - \SystemRoot\system32\drivers\sysaudio.sys
B4BC4000 - \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
B49F2000 - \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
B48B0000 - \SystemRoot\system32\DRIVERS\srv.sys
BAC80000 - \??\C:\WINDOWS\system32\drivers\LVPrcMon.sys
BAFD8000 - \??\C:\DOCUME~1\Julien\LOCALS~1\Temp\mc22.tmp
BAB90000 - \??\C:\ComboFix\catchme.sys
BAE02000 - \??\C:\WINDOWS\system32\Drivers\PROCEXP90.SYS
B035A000 - \SystemRoot\system32\drivers\kmixer.sys
BAFC2000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 140

Liste des programmes installes

Acer GridVista
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Reader 8.1.2 - Français
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Age of Mythology
Apple Mobile Device Support
Apple Software Update
Archiveur WinRAR
AVG Anti-Spyware 7.5
Avira AntiVir Personal – Free Antivirus
CCleaner (remove only)
Chaos-League MS
Correctif pour Windows Internet Explorer 7 (KB947864)
GameCenter
HijackThis 2.0.2
iTunes
Launch Manager V1.1.0.0
Logiciel Intel(R) PROSet/Wireless
Malwarebytes' Anti-Malware
mCore
mDriver
mDrWiFi
mEoU
mHelp
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)
Mise à jour de sécurité pour Windows XP (KB950760)
Mise à jour de sécurité pour Windows XP (KB950762)
Mise à jour de sécurité pour Windows XP (KB951376-v2)
Mise à jour de sécurité pour Windows XP (KB951376)
Mise à jour de sécurité pour Windows XP (KB951698)
Mise à jour de sécurité pour Windows XP (KB951748)
Mise à jour pour Windows XP (KB898461)
Mise à jour pour Windows XP (KB942763)
Mise à jour pour Windows XP (KB951978)
mIWA
mLogView
mMHouse
Mozilla Firefox (3.0)
mPfMgr
mPfWiz
mProSafe
MSXML 4.0 SP2 (KB936181)
MSXML4 Parser
mWlsSafe
mXML
mZConfig
Nero 7 Ultra Edition
NVIDIA Drivers
Programme de gestion Acer OrbiCam
QuickTime
Realtek High Definition Audio Driver
Revo Uninstaller 1.71
RF Online Episode 2
Security Update for Excel 2007 (KB946974)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB951808)
Security Update for Microsoft Office Word 2007 (KB950113)
Security Update for Office 2007 (KB947801)
Security Update for Outlook 2007 (KB946983)
Spybot - Search & Destroy
SuperCopier2
Synaptics Pointing Device Driver
TeamSpeak 2 RC2
Titan Quest
TuneUp Utilities 2008
Update for Office 2007 (KB934391)
Update for Office 2007 (KB946691)
Update for Outlook 2007 Junk Email Filter (kb953463)
VideoLAN VLC media player 0.8.6a
VPN Client
WebFldrs XP
Windows Internet Explorer 7
Windows Live installer
Windows Live Messenger



Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le numéro de série du volume est C4A4-72C7

Répertoire de C:\Program Files

11/07/2008 10:42 <REP> .
11/07/2008 10:42 <REP> ..
05/05/2008 20:40 <REP> Acer Inc
07/07/2008 12:25 <REP> Adobe
07/07/2008 10:04 <REP> Alcohol Soft
06/07/2008 22:00 <REP> Alwil Software
19/05/2008 21:33 <REP> Apple Software Update
11/07/2008 10:42 <REP> Avira
11/07/2008 10:29 <REP> CCleaner
30/05/2008 14:18 <REP> Cisco Systems
05/05/2008 21:18 <REP> Codemasters
04/06/2008 22:55 <REP> Common Files
05/05/2008 19:17 <REP> ComPlus Applications
08/07/2008 11:04 <REP> Cyanide
05/05/2008 21:19 <REP> EoRezo
09/07/2008 15:39 <REP> Fichiers communs
15/06/2008 23:46 <REP> GameTribe
04/06/2008 22:28 <REP> Gpotato.eu
07/07/2008 11:46 <REP> Grisoft
05/05/2008 20:26 <REP> Intel
11/06/2008 17:01 <REP> Internet Explorer
19/05/2008 21:35 <REP> iPod
19/05/2008 21:35 <REP> iTunes
05/05/2008 22:21 <REP> Launch Manager
07/07/2008 11:43 <REP> Malwarebytes' Anti-Malware
05/05/2008 19:17 <REP> Messenger
05/05/2008 19:40 <REP> microsoft frontpage
06/07/2008 14:04 <REP> Microsoft Games
23/05/2008 09:10 <REP> Microsoft Office
23/05/2008 09:09 <REP> Microsoft Visual Studio
05/05/2008 19:19 <REP> Movie Maker
11/07/2008 13:41 <REP> Mozilla Firefox
05/05/2008 19:16 <REP> MSN
05/05/2008 19:17 <REP> MSN Gaming Zone
25/06/2008 17:00 <REP> MSXML 4.0
05/05/2008 23:03 <REP> Nero
05/05/2008 19:19 <REP> NetMeeting
05/05/2008 19:17 <REP> Online Services
05/05/2008 19:19 <REP> Outlook Express
19/05/2008 21:35 <REP> QuickTime
05/05/2008 20:33 <REP> Realtek
05/05/2008 19:20 <REP> Services en ligne
07/07/2008 22:38 <REP> Spybot - Search & Destroy
05/05/2008 22:22 <REP> SuperCopier2
05/05/2008 20:58 <REP> Synaptics
07/07/2008 13:36 <REP> Teamspeak2_RC2
10/07/2008 18:44 <REP> THQ
09/07/2008 13:33 <REP> Trend Micro
07/07/2008 11:53 <REP> TuneUp Utilities 2008
06/07/2008 14:32 <REP> uTorrent
05/05/2008 21:04 <REP> VideoLAN
06/07/2008 21:13 <REP> VS Revo Group
01/07/2008 00:55 <REP> Windows Live
05/05/2008 19:40 <REP> Windows Media Player
05/05/2008 19:17 <REP> Windows NT
05/05/2008 20:48 <REP> WinRAR
10/07/2008 12:18 <REP> World of Warcraft Trial
06/07/2008 20:02 <REP> xerox
0 fichier(s) 0 octets
58 Rép(s) 33 702 309 888 octets libres
Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le numéro de série du volume est C4A4-72C7

Répertoire de C:\Program Files\fichiers communs

09/07/2008 15:39 <REP> .
09/07/2008 15:39 <REP> ..
07/07/2008 09:15 <REP> Acer
05/05/2008 21:49 <REP> Adobe
05/05/2008 23:03 <REP> Ahead
19/05/2008 21:33 <REP> Apple
09/07/2008 15:39 <REP> Blizzard Entertainment
23/05/2008 09:09 <REP> DESIGNER
30/05/2008 14:18 <REP> Deterministic Networks
05/05/2008 20:35 <REP> InstallShield
07/07/2008 09:17 <REP> Logitech
23/05/2008 09:10 <REP> Microsoft Shared
05/05/2008 19:19 <REP> MSSoap
05/05/2008 20:55 <REP> ODBC
05/05/2008 19:19 <REP> Services
05/05/2008 20:55 <REP> SpeechEngines
05/05/2008 19:18 <REP> System
07/07/2008 11:43 <REP> Wise Installation Wizard
0 fichier(s) 0 octets
18 Rép(s) 33 702 309 888 octets libres
Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le numéro de série du volume est C4A4-72C7

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

23/05/2008 09:09 <REP> .
23/05/2008 09:09 <REP> ..
23/05/2008 09:07 <REP> 1033
26/10/2006 18:49 970 528 MSONSEXT.DLL
26/10/2006 19:12 40 256 MSOSV.DLL
03/06/1999 11:09 122 937 MSOWS409.DLL
07/03/2001 06:00 127 033 MSOWS40c.DLL
4 fichier(s) 1 260 754 octets
3 Rép(s) 33 702 305 792 octets libres
Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le numéro de série du volume est C4A4-72C7

Répertoire de C:\Program Files\common files

04/06/2008 22:55 <REP> .
04/06/2008 22:55 <REP> ..
04/06/2008 22:55 <REP> INCA Shared
0 fichier(s) 0 octets
3 Rép(s) 33 702 305 792 octets libres




c:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.3.1.3\iTunesSetupAdmin.exe
c:\Documents and Settings\All Users\Documents\AoM.eXe
c:\Documents and Settings\Julien\Bureau\DiagHelp\catchme.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\diff.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\dumphive.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\find2.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\Fport.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\grep.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\gzip.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\KProcCheck.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\LFiles.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\md5sums.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\pslist.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\sigcheck.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\streams.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\swreg.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\tar.exe
c:\Documents and Settings\Julien\Bureau\Jeux\fly_for_fun_client_complet_-_acte_2_l_aube_des_heros_francais_41629.exe
c:\Documents and Settings\Julien\Bureau\Jeux\poweroff.exe
c:\Documents and Settings\Julien\Bureau\Jeux\crack\Titan Quest Reloded crack\Titan Patch 1.01- 1.20.exe
c:\Documents and Settings\Julien\Bureau\Jeux\crack\Titan Quest Reloded crack\Titan Quest.exe
c:\Documents and Settings\Julien\Bureau\Jeux\crack\Titan Quest Reloded crack\Titan Quest1.exe
c:\Documents and Settings\Julien\Bureau\Jeux\crack\Titan Quest Reloded crack\Titan_Quest.exe
c:\Documents and Settings\Julien\Bureau\Utilitaire\Client VPN.exe
c:\Documents and Settings\Julien\Bureau\Utilitaire\daemon-tools_daemon_tools_4.12.3_anglais_10729.exe
c:\Documents and Settings\Julien\Mes documents\Ma musique\iTunes 7.3.1.3 + Quick Time Pro 7.2 + Serial [www.newpct.com]\iTunesSetup.exe
c:\Documents and Settings\Julien\Mes documents\My Games\Titan Quest\TitanQuest1_08.exe
c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

****** Fin du rapport DiagHelp

Re,

Passe à nouveau ComboFix, poste moi son rapport.

Rabbit rapport de retour, vous avez choisi un rapport combofix le voici :

ComboFix 08-07-11.1 - Julien 2008-07-12 8:54:05.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1469 [GMT 1:00]
Endroit: C:\Documents and Settings\Julien\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_poof


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-12 to 2008-07-12 ))))))))))))))))))))))))))))))))))))
.

2008-07-11 10:42 . 2008-07-11 10:42 <REP> d-------- C:\Program Files\Avira
2008-07-10 18:45 . 2008-07-10 18:45 <REP> d-------- C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-07-10 18:39 . 2007-01-01 20:03 40,960 -ra------ C:\WINDOWS\system32\psfind.dll
2008-07-10 18:30 . 2008-07-10 18:30 <REP> d-------- C:\WINDOWS\NV34003388.TMP
2008-07-10 18:14 . 2008-07-10 18:14 <REP> d-------- C:\WINDOWS\Drivers
2008-07-09 15:39 . 2008-07-10 12:18 <REP> d-------- C:\Program Files\World of Warcraft Trial
2008-07-09 15:39 . 2008-07-09 15:39 <REP> d-------- C:\Program Files\Fichiers communs\Blizzard Entertainment
2008-07-09 13:33 . 2008-07-09 13:33 <REP> d-------- C:\Program Files\Trend Micro
2008-07-08 00:47 . 2008-07-08 11:04 <REP> d-------- C:\Program Files\Cyanide
2008-07-07 22:38 . 2008-07-07 22:38 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-07 22:38 . 2008-07-11 10:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-07 22:23 . 2008-07-11 10:29 <REP> d-------- C:\Program Files\CCleaner
2008-07-07 11:48 . 2008-07-07 11:48 <REP> d-------- C:\Documents and Settings\Julien\Application Data\Grisoft
2008-07-07 11:47 . 2008-07-07 11:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-07-07 11:47 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-07-07 11:44 . 2008-07-07 11:53 <REP> d-------- C:\Program Files\TuneUp Utilities 2008
2008-07-07 11:44 . 2008-07-07 11:44 <REP> d-------- C:\Documents and Settings\Julien\Application Data\TuneUp Software
2008-07-07 11:44 . 2008-07-07 11:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-07-07 11:44 . 2008-07-07 11:44 355,584 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-07-07 11:44 . 2008-05-29 09:28 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-07-07 11:43 . 2008-07-07 11:43 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-07 11:43 . 2008-07-07 11:43 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-07 11:43 . 2008-07-07 11:43 <REP> d-------- C:\Documents and Settings\Julien\Application Data\Malwarebytes
2008-07-07 11:43 . 2008-07-07 11:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-07 11:43 . 2008-06-28 14:16 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-07 11:43 . 2008-06-28 14:16 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-07 11:19 . 2008-07-07 11:19 <REP> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-07-07 10:04 . 2008-07-07 10:04 <REP> d-------- C:\Program Files\Alcohol Soft
2008-07-07 09:19 . 2008-04-13 19:33 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2008-07-07 09:19 . 2008-04-13 19:33 54,784 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-07-07 09:19 . 2008-04-13 19:34 20,992 --a------ C:\WINDOWS\system32\dshowext.ax
2008-07-07 09:19 . 2008-04-13 19:34 20,992 --a--c--- C:\WINDOWS\system32\dllcache\dshowext.ax
2008-07-07 09:16 . 2006-06-23 10:39 245,824 -ra------ C:\WINDOWS\system32\InstExec.exe
2008-07-07 09:16 . 2006-06-23 10:40 245,824 --a------ C:\WINDOWS\Instexec.exe
2008-07-07 09:16 . 2006-06-23 10:39 719 -ra------ C:\WINDOWS\system32\InstExec.ini
2008-07-07 09:15 . 2008-07-07 09:17 <REP> d-------- C:\Program Files\Fichiers communs\Logitech
2008-07-07 09:15 . 2008-07-07 09:15 <REP> d-------- C:\Program Files\Fichiers communs\Acer
2008-07-07 09:15 . 2006-06-19 12:20 1,097,728 --a------ C:\WINDOWS\system32\drivers\lv321av.sys
2008-07-07 09:15 . 2006-06-19 12:18 380,928 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2008-07-07 09:15 . 2003-02-21 05:42 348,160 --a------ C:\WINDOWS\system\msvcr71.dll
2008-07-07 09:15 . 2006-06-19 12:15 221,184 --a------ C:\WINDOWS\system32\LVUI2.dll
2008-07-07 09:15 . 2006-06-19 12:15 204,800 --a------ C:\WINDOWS\system32\lvcodec2.dll
2008-07-07 09:15 . 2006-06-19 12:11 110,592 --a------ C:\WINDOWS\system32\lvcoinst.dll
2008-07-07 09:15 . 2006-06-19 12:16 39,424 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-07-07 09:15 . 2006-06-19 11:59 13,227 --a------ C:\WINDOWS\system32\lvcoinst.ini
2008-07-07 09:15 . 2006-06-19 11:58 2,760 --a------ C:\WINDOWS\system32\Repository.reg
2008-07-07 09:14 . 1998-11-13 14:16 308,224 --a------ C:\WINDOWS\IsUn040c.exe
2008-07-07 09:13 . 2008-07-07 09:13 264 --a------ C:\WINDOWS\_delis32.ini
2008-07-06 22:00 . 2008-07-06 22:00 <REP> d-------- C:\Program Files\Alwil Software
2008-07-06 22:00 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-07-06 21:47 . 2008-07-06 21:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-06 21:34 . 2008-07-07 11:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-06 21:06 . 2008-07-06 21:13 <REP> d-------- C:\Program Files\VS Revo Group
2008-07-06 17:43 . 2008-07-11 10:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-06 16:28 . 2001-08-28 15:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-07-06 14:32 . 2008-07-06 14:32 <REP> d-------- C:\Program Files\uTorrent
2008-07-06 14:32 . 2008-07-06 14:53 <REP> d-------- C:\Documents and Settings\Julien\Application Data\uTorrent
2008-07-06 14:04 . 2008-07-06 14:04 <REP> d-------- C:\Program Files\Microsoft Games
2008-07-04 15:28 . 2008-04-13 11:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-07-04 15:28 . 2008-04-13 11:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-07-01 08:38 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-07-01 08:38 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-07-01 08:38 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-07-01 00:57 . 2008-07-01 00:57 <REP> d-------- C:\Documents and Settings\Julien\Contacts
2008-07-01 00:56 . 2008-07-01 00:56 268 --ah----- C:\sqmdata00.sqm
2008-07-01 00:56 . 2008-07-01 00:56 244 --ah----- C:\sqmnoopt00.sqm
2008-07-01 00:49 . 2008-07-01 00:55 <REP> d-------- C:\Program Files\Windows Live
2008-07-01 00:49 . 2008-07-01 00:55 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-07-01 00:49 . 2008-07-01 00:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-06-28 19:57 . 2008-06-28 19:57 <REP> d-------- C:\Documents and Settings\Julien\Application Data\dvdcss
2008-06-26 21:10 . 2008-06-26 21:10 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-06-25 17:00 . 2008-06-25 17:00 <REP> d-------- C:\Program Files\MSXML 4.0
2008-06-15 23:46 . 2008-06-15 23:46 <REP> d-------- C:\Program Files\GameTribe
2008-06-14 11:43 . 2008-06-14 11:43 <REP> d-------- C:\Documents and Settings\Julien\Application Data\Ahead
2008-06-12 17:46 . 2008-06-12 17:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-10 17:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-10 17:44 --------- d-----w C:\Program Files\THQ
2008-07-09 17:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-07 12:36 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-07-06 22:59 --------- d-----w C:\Documents and Settings\Julien\Application Data\teamspeak2
2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 17:33 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-04 21:55 --------- d-----w C:\Program Files\Common Files
2008-06-04 21:28 --------- d-----w C:\Program Files\Gpotato.eu
2008-05-30 13:18 --------- d-----w C:\Program Files\Fichiers communs\Deterministic Networks
2008-05-30 13:18 --------- d-----w C:\Program Files\Cisco Systems
2008-05-23 07:47 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-23 07:47 --------- d-----w C:\Documents and Settings\Julien\Application Data\DAEMON Tools
2008-05-19 20:35 --------- d-----w C:\Program Files\QuickTime
2008-05-19 20:35 --------- d-----w C:\Program Files\iTunes
2008-05-19 20:35 --------- d-----w C:\Program Files\iPod
2008-05-19 20:35 --------- d-----w C:\Documents and Settings\Julien\Application Data\Apple Computer
2008-05-19 20:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-19 20:33 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-05-19 20:33 --------- d-----w C:\Program Files\Apple Software Update
2008-05-19 20:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-05-09 10:55 90,112 ----a-w C:\WINDOWS\system32\wshext.dll
2008-05-09 10:55 430,080 ----a-w C:\WINDOWS\system32\vbscript.dll
2008-05-09 10:55 180,224 ----a-w C:\WINDOWS\system32\scrobj.dll
2008-05-09 10:55 172,032 ----a-w C:\WINDOWS\system32\scrrun.dll
2008-05-08 11:24 155,648 ----a-w C:\WINDOWS\system32\wscript.exe
2008-05-07 09:07 135,168 ----a-w C:\WINDOWS\system32\cscript.exe
2008-05-07 05:11 1,294,336 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-13 19:33 76,800 ----a-w C:\WINDOWS\system32\storprop.dll
2008-04-13 18:47 1,246,130 ----a-r C:\WINDOWS\SET3.tmp
2008-04-13 18:38 16,825 ----a-r C:\WINDOWS\SET8.tmp
2008-04-13 18:38 1,088,840 ----a-r C:\WINDOWS\SET4.tmp
2008-04-13 17:50 1,804 ----a-w C:\WINDOWS\system32\Dcache.bin
2008-04-13 17:47 58,880 ----a-w C:\WINDOWS\system32\dmutil.dll
2008-04-13 17:47 52,736 ----a-w C:\WINDOWS\system32\wzcsapi.dll
2008-04-13 17:47 50,688 ----a-w C:\WINDOWS\system32\cnbjmon.dll
2008-04-13 17:47 483,840 ----a-w C:\WINDOWS\system32\wzcsvc.dll
2008-04-13 17:47 47,616 ----a-w C:\WINDOWS\system32\iyuv_32.dll
2008-04-13 17:47 35,328 ----a-w C:\WINDOWS\system32\pid.dll
2008-04-13 17:47 294,912 ----a-w C:\WINDOWS\system32\msh263.drv
2008-04-13 17:47 20,992 ----a-w C:\WINDOWS\system32\hid.dll
2008-04-13 17:47 2,025,984 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 17:47 16,896 ----a-w C:\WINDOWS\system32\msyuv.dll
2008-04-13 17:47 15,360 ----a-w C:\WINDOWS\system32\pjlmon.dll
2008-04-13 17:37 332,800 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-13 17:33 98,816 ----a-w C:\WINDOWS\system32\psbase.dll
2008-04-13 17:32 764,416 ----a-w C:\WINDOWS\system32\winntbbu.dll
2008-04-13 17:32 61,471 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-13 17:32 5,632 ----a-w C:\WINDOWS\system32\wmi.dll
2008-04-13 17:32 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll
2008-04-13 17:07 2,147,328 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 17:06 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:04 93,184 ----a-w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:03 81,920 ----a-w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:02 50,688 ----a-w C:\WINDOWS\system32\inetres.dll
2008-04-13 17:02 2,985,984 ----a-w C:\WINDOWS\system32\wmploc.dll
2008-04-13 17:01 572,416 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:59 200,704 ----a-w C:\WINDOWS\system32\wmerror.dll
2008-04-13 16:59 10,240 ----a-w C:\WINDOWS\system32\gpkrsrc.dll
2008-04-13 16:58 1,845,760 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 16:58 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:57 70,144 ----a-w C:\WINDOWS\system32\browselc.dll
2008-04-13 16:55 8,704 ----a-w C:\WINDOWS\system32\asferror.dll
2008-04-13 16:53 70,688 ----a-w C:\WINDOWS\system32\mmsystem.dll
2008-04-13 09:45 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 09:43 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe
2008-04-13 09:40 445,440 ----a-w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 09:36 2,986,496 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 09:35 197,632 ----a-w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 09:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 09:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 08:38 306,176 ----a-w C:\WINDOWS\system32\slbcsp.dll
2008-04-13 08:38 169,984 ----a-w C:\WINDOWS\system32\sccbase.dll
2008-04-13 08:38 101,888 ----a-w C:\WINDOWS\system32\gpkcsp.dll
2008-04-13 08:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 08:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 08:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 08:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dLL
2008-04-13 08:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 07:54 54,080 ----a-w C:\WINDOWS\system32\dosx.exe
2008-04-13 07:54 5,120 ----a-w C:\WINDOWS\system32\winnls.dll
2008-04-13 07:53 92,608 ----a-w C:\WINDOWS\system32\krnl386.exe
2008-04-13 07:52 3,352 ----a-w C:\WINDOWS\system32\redir.exe
2008-04-13 07:50 42,537 ----a-w C:\WINDOWS\system32\keyboard.sys
2008-04-13 07:49 35,648 ----a-w C:\WINDOWS\system32\ntio411.sys
2008-04-13 07:49 35,424 ----a-w C:\WINDOWS\system32\ntio412.sys
2008-04-13 07:49 34,560 ----a-w C:\WINDOWS\system32\ntio804.sys
2008-04-13 07:49 34,560 ----a-w C:\WINDOWS\system32\ntio404.sys
2008-04-13 07:49 34,000 ----a-w C:\WINDOWS\system32\ntio.sys
2008-04-13 07:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll
2008-04-13 07:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
2008-04-13 06:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
.

((((((((((((((((((((((((((((( snapshot@2008-07-11_12.51.47.70 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-11 11:48:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-12 07:57:47 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-07-11 08:31:54 40,640 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-07-12 07:49:03 40,640 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-07-11 08:31:54 49,400 ----a-w C:\WINDOWS\system32\perfc00C.dat
+ 2008-07-12 07:49:03 49,400 ----a-w C:\WINDOWS\system32\perfc00C.dat
- 2008-07-11 08:31:54 312,444 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-07-12 07:49:03 312,444 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-07-11 08:31:54 368,930 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2008-07-12 07:49:03 368,930 ----a-w C:\WINDOWS\system32\perfh00C.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 17:45 1052672]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 18:34 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 18:04 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-01-19 07:43 7397376]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-11-28 10:41 667718]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 10:41 602182]
"EOUApp"="C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" [2005-11-28 10:47 569413]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-07-25 12:36 32768]
"LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2006-02-21 08:46 69632]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 13:28 20480]
"LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2005-07-25 09:45 241664]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2006-03-14 13:33 86016]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 14:40 155648]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2006-06-23 10:39 225280]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-01-19 08:43 86016]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 18:34 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-07-10 08:18 270648 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-29 05:24 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Mythology\\aom.exe"=
"C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"=
"C:\\Program Files\\Cyanide\\Chaos-League MS\\ChaosLeagueEx.exe"=

R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 10:27]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2008-04-13 18:34]
R3 lv321av;Logitech USB PC Camera (VC0321);C:\WINDOWS\system32\DRIVERS\lv321av.sys [2006-06-19 12:20]
R3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2006-06-23 10:40]
S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys []
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-07-07 11:44]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-07-12 08:00:00 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-12 08:58:18
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\C:\DOCUME~1\Julien\LOCALS~1\Temp\mc22.tmp"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-12 9:01:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-12 08:00:31
ComboFix2.txt 2008-07-11 12:41:05

Pre-Run: 33,718,718,464 octets libres
Post-Run: 33,711,206,400 octets libres

300 --- E O F --- 2008-07-09 18:19:44


en tt cas merci de ton aide !!!!

Re,

- Poste de travail/outils/option des dossiers/affichage/cocher afficher les fichiers et dossiers cachés/Appliquer - - > OK
- Poste de travail/outils/option des dossiers/affichage/décocher masquer les fichiers protégés du système d’exploitation./Appliquer - - > OK
- Poste de travail/outils/option des dossiers/affichage/décocher masquer les extensions dont le type est connu/Appliquer - - > OK

N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

Fais analyser ce(s) fichier(s) sur ce site >> Virustotal <<

Clique sur Parcourir en haut, choisis Poste de travail et cherche ce fichier : C:\WINDOWS\_delis32.ini

Clique maintenant sur Envoyer le fichier.

Poste le rapport (De Fichier *** reçu le *** jusqu’à SHA1 : ***)

Fais la même chose avec ces fichiers : C:\WINDOWS\system32\beep.sys

Fichier beep.sys reçu le 2008.07.12 16:10:58 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 0/33 (0%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 1.
L'heure estimée de démarrage est entre 37 et 53 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.11.0 2008.07.11 -
AntiVir 7.8.0.64 2008.07.11 -
Authentium 5.1.0.4 2008.07.11 -
Avast 4.8.1195.0 2008.07.12 -
AVG 7.5.0.516 2008.07.12 -
BitDefender 7.2 2008.07.12 -
CAT-QuickHeal 9.50 2008.07.11 -
ClamAV 0.93.1 2008.07.11 -
DrWeb 4.44.0.09170 2008.07.12 -
eSafe 7.0.17.0 2008.07.10 -
eTrust-Vet 31.6.5949 2008.07.12 -
Ewido 4.0 2008.07.12 -
F-Prot 4.4.4.56 2008.07.11 -
F-Secure 7.60.13501.0 2008.07.12 -
Fortinet 3.14.0.0 2008.07.12 -
GData 2.0.7306.1023 2008.07.12 -
Ikarus T3.1.1.26.0 2008.07.12 -
Kaspersky 7.0.0.125 2008.07.12 -
McAfee 5337 2008.07.11 -
Microsoft 1.3704 2008.07.12 -
NOD32v2 3263 2008.07.11 -
Norman 5.80.02 2008.07.11 -
Panda 9.0.0.4 2008.07.12 -
Prevx1 V2 2008.07.12 -
Rising 20.52.52.00 2008.07.12 -
Sophos 4.31.0 2008.07.12 -
Sunbelt 3.1.1536.1 2008.07.12 -
Symantec 10 2008.07.12 -
TheHacker 6.2.96.376 2008.07.10 -
TrendMicro 8.700.0.1004 2008.07.11 -
VBA32 3.12.6.9 2008.07.12 -
VirusBuster 4.5.11.0 2008.07.12 -
Webwasher-Gateway 6.6.2 2008.07.11 -
Information additionnelle
File size: 4224 bytes
MD5...: da1f27d85e0d1525f6621372e7b685e9
SHA1..: e3d2dc5eb273fa701de8af13b60d6baac7629260



Fichier _delis32.ini reçu le 2008.07.12 16:12:39 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 0/33 (0%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: ___.
L'heure estimée de démarrage est entre ___ et ___ .
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.11.0 2008.07.11 -
AntiVir 7.8.0.64 2008.07.11 -
Authentium 5.1.0.4 2008.07.11 -
Avast 4.8.1195.0 2008.07.12 -
AVG 7.5.0.516 2008.07.12 -
BitDefender 7.2 2008.07.12 -
CAT-QuickHeal 9.50 2008.07.11 -
ClamAV 0.93.1 2008.07.11 -
DrWeb 4.44.0.09170 2008.07.12 -
eSafe 7.0.17.0 2008.07.10 -
eTrust-Vet 31.6.5949 2008.07.12 -
Ewido 4.0 2008.07.12 -
F-Prot 4.4.4.56 2008.07.11 -
F-Secure 7.60.13501.0 2008.07.12 -
Fortinet 3.14.0.0 2008.07.12 -
GData 2.0.7306.1023 2008.07.12 -
Ikarus T3.1.1.26.0 2008.07.12 -
Kaspersky 7.0.0.125 2008.07.12 -
McAfee 5337 2008.07.11 -
Microsoft 1.3704 2008.07.12 -
NOD32v2 3263 2008.07.11 -
Norman 5.80.02 2008.07.11 -
Panda 9.0.0.4 2008.07.12 -
Prevx1 V2 2008.07.12 -
Rising 20.52.52.00 2008.07.12 -
Sophos 4.31.0 2008.07.12 -
Sunbelt 3.1.1536.1 2008.07.12 -
Symantec 10 2008.07.12 -
TheHacker 6.2.96.376 2008.07.10 -
TrendMicro 8.700.0.1004 2008.07.11 -
VBA32 3.12.6.9 2008.07.12 -
VirusBuster 4.5.11.0 2008.07.12 -
Webwasher-Gateway 6.6.2 2008.07.11 -
Information additionnelle
File size: 264 bytes
MD5...: e219a734b2ce72d747e4910aa50c6580
SHA1..: 8144b80bf9fe3bf66c504d12d2288dd2f039208e

il me semble qu'il ya un probleme car sur le rapport il est inscrit que c'est en court alors que la recherche a bien été terminé !!!!

Re,

Sélectionne l’intégralité du cadre ci-dessous :

Copie/colle le dans le Bloc-notes (Démarrer\Tous les programmes\Accessoires\Bloc-notes.)
Enregistre le sous sur ton Bureau sous le nom de Correction.bat
Double-clique dessus. Poste le rapport généré (si présent).

Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le num‚ro de s‚rie du volume est C4A4-72C7

R‚pertoire de C:\WINDOWS\Drivers

10/07/2008 18:14 <REP> .
10/07/2008 18:14 <REP> ..
10/07/2008 18:14 <REP> Intel
0 fichier(s) 0 octets
3 R‚p(s) 33ÿ630ÿ765ÿ056 octets libres

voila mon chti rapport !!!

Oki, poste un nouveua rapport HIjackTHis  

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:49:58, on 12/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Julien\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr/
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 7561 bytes

Re,

Télécharge MalwareByte's Anti-Malware sur ton Bureau.

Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.

Une fois l'installation et la mise à jour effectuées :
Redémarre en mode sans échec
/!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\

Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".

Afin de lancer la recherche, clic sur"Rechercher".

Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :
-- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
-- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.

REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.[/#f]

[#FF0000]Aide : Comment utiliser MBAM.

Malwarebytes' Anti-Malware 1.19
Version de la base de données: 929
Windows 5.1.2600 Service Pack 3

12:22:14 07/07/2008
mbam-log-7-7-2008 (12-22-14).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 79173
Temps écoulé: 28 minute(s), 5 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 5
Clé(s) du Registre infectée(s): 22
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 14
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 32

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\efcYQJDS.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\kytpvyxp.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\vnubuydm.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\xxyabBtt.dll (Backdoor.Agent) -> Unloaded module successfully.
C:\WINDOWS\axrfgvek.dll (Trojan.FakeAlert) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{80e7acc6-2337-4f50-a597-32742e273607} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{80e7acc6-2337-4f50-a597-32742e273607} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\Interface\{101900f3-7aeb-4e3b-b4cc-dcb483b3b92f} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{9c7e91a9-0001-4c4e-bcc2-a56bc8329049} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{a59c4135-df7a-4666-8129-478376867b3c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f70c9bf7-63da-40cc-a57c-b874b07259e0} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{7f62b052-bbd3-476f-a8d5-aea51d86367a} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{80123684-a222-4009-8220-a867294d6de8} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3ba3028f-fd37-46bf-ad27-733734684f06} (Backdoor.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ba3028f-fd37-46bf-ad27-733734684f06} (Backdoor.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxyabbtt (Backdoor.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{942bfd20-ab47-4c4c-aa32-20677c215db1} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\nqgpedlr.bxod (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\nqgpedlr.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo (Trojan.Fakealert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c4a47268 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{80123684-a222-4009-8220-a867294d6de8} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{3ba3028f-fd37-46bf-ad27-733734684f06} (Backdoor.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\axrfgvek (Trojan.FakeAlert) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcccqj0e9a3 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SMrhc9cqj0e9a3 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\efcyqjds -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\efcyqjds -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6...) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (55274-025-2980826-22289) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Documents and Settings\Julien\Application Data\rhc9cqj0e9a3 (Rogue.Multiple) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\efcYQJDS.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\SDJQYcfe.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\SDJQYcfe.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kytpvyxp.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\pxyvptyk.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vnubuydm.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\mdyubunv.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\nqgpedlr.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D904E349-358D-4816-B715-EA1053916ADF}\RP59\A0009459.sys (Rootkit.Clbd) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D904E349-358D-4816-B715-EA1053916ADF}\RP59\A0009481.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D904E349-358D-4816-B715-EA1053916ADF}\RP61\A0010661.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D904E349-358D-4816-B715-EA1053916ADF}\RP61\A0010662.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D904E349-358D-4816-B715-EA1053916ADF}\RP61\A0013824.dll (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D904E349-358D-4816-B715-EA1053916ADF}\RP65\A0014885.dll (Rootkit.Clbd) -> Quarantined and deleted successfully.
C:\WINDOWS\esrp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Julien\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\clbdriver.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xxyabBtt.dll (Backdoor.Agent) -> Delete on reboot.
C:\WINDOWS\system32\clbinit.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\mrvtdpqe.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\axrfgvek.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\blphcccqj0e9a3.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phcccqj0e9a3.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Julien\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Julien\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Julien\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Julien\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Julien\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Julien\Favoris\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Julien\Favoris\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Julien\Favoris\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.

Re,

C'est mieux ? Si non, repasse ComboFix et poste moi son rapport.

Malheureusement non !!! jaitjs c ralentissement
jai esssayede reinstaller titan quest et ca na rien donner donc voici le rapport combofix :

ComboFix 08-07-11.1 - Julien 2008-07-13 14:01:37.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1514 [GMT 1:00]
Endroit: C:\Documents and Settings\Julien\Bureau\ComboFix.exe

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

((((((((((((((((((((((((((((( Fichiers créés 2008-06-13 to 2008-07-13 ))))))))))))))))))))))))))))))))))))
.

2008-07-11 10:42 . 2008-07-11 10:42 <REP> d-------- C:\Program Files\Avira
2008-07-10 18:45 . 2008-07-10 18:45 <REP> d-------- C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-07-10 18:39 . 2007-01-01 20:03 40,960 -ra------ C:\WINDOWS\system32\psfind.dll
2008-07-10 18:30 . 2008-07-10 18:30 <REP> d-------- C:\WINDOWS\NV34003388.TMP
2008-07-10 18:14 . 2008-07-10 18:14 <REP> d-------- C:\WINDOWS\Drivers
2008-07-09 15:39 . 2008-07-10 12:18 <REP> d-------- C:\Program Files\World of Warcraft Trial
2008-07-09 15:39 . 2008-07-09 15:39 <REP> d-------- C:\Program Files\Fichiers communs\Blizzard Entertainment
2008-07-09 13:33 . 2008-07-09 13:33 <REP> d-------- C:\Program Files\Trend Micro
2008-07-08 00:47 . 2008-07-08 11:04 <REP> d-------- C:\Program Files\Cyanide
2008-07-07 22:38 . 2008-07-07 22:38 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-07 22:38 . 2008-07-11 10:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-07 22:23 . 2008-07-11 10:29 <REP> d-------- C:\Program Files\CCleaner
2008-07-07 11:48 . 2008-07-07 11:48 <REP> d-------- C:\Documents and Settings\Julien\Application Data\Grisoft
2008-07-07 11:47 . 2008-07-07 11:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-07-07 11:47 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-07-07 11:44 . 2008-07-07 11:53 <REP> d-------- C:\Program Files\TuneUp Utilities 2008
2008-07-07 11:44 . 2008-07-07 11:44 <REP> d-------- C:\Documents and Settings\Julien\Application Data\TuneUp Software
2008-07-07 11:44 . 2008-07-07 11:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-07-07 11:44 . 2008-07-07 11:44 355,584 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-07-07 11:44 . 2008-05-29 09:28 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-07-07 11:43 . 2008-07-13 00:41 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-07 11:43 . 2008-07-07 11:43 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-07 11:43 . 2008-07-07 11:43 <REP> d-------- C:\Documents and Settings\Julien\Application Data\Malwarebytes
2008-07-07 11:43 . 2008-07-07 11:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-07 11:43 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-07 11:43 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-07 11:19 . 2008-07-07 11:19 <REP> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-07-07 10:04 . 2008-07-07 10:04 <REP> d-------- C:\Program Files\Alcohol Soft
2008-07-07 09:19 . 2008-04-13 19:33 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2008-07-07 09:19 . 2008-04-13 19:33 54,784 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-07-07 09:19 . 2008-04-13 19:34 20,992 --a------ C:\WINDOWS\system32\dshowext.ax
2008-07-07 09:19 . 2008-04-13 19:34 20,992 --a--c--- C:\WINDOWS\system32\dllcache\dshowext.ax
2008-07-07 09:16 . 2006-06-23 10:39 245,824 -ra------ C:\WINDOWS\system32\InstExec.exe
2008-07-07 09:16 . 2006-06-23 10:40 245,824 --a------ C:\WINDOWS\Instexec.exe
2008-07-07 09:16 . 2006-06-23 10:39 719 -ra------ C:\WINDOWS\system32\InstExec.ini
2008-07-07 09:15 . 2008-07-07 09:17 <REP> d-------- C:\Program Files\Fichiers communs\Logitech
2008-07-07 09:15 . 2008-07-07 09:15 <REP> d-------- C:\Program Files\Fichiers communs\Acer
2008-07-07 09:15 . 2006-06-19 12:20 1,097,728 --a------ C:\WINDOWS\system32\drivers\lv321av.sys
2008-07-07 09:15 . 2006-06-19 12:18 380,928 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2008-07-07 09:15 . 2003-02-21 05:42 348,160 --a------ C:\WINDOWS\system\msvcr71.dll
2008-07-07 09:15 . 2006-06-19 12:15 221,184 --a------ C:\WINDOWS\system32\LVUI2.dll
2008-07-07 09:15 . 2006-06-19 12:15 204,800 --a------ C:\WINDOWS\system32\lvcodec2.dll
2008-07-07 09:15 . 2006-06-19 12:11 110,592 --a------ C:\WINDOWS\system32\lvcoinst.dll
2008-07-07 09:15 . 2006-06-19 12:16 39,424 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-07-07 09:15 . 2006-06-19 11:59 13,227 --a------ C:\WINDOWS\system32\lvcoinst.ini
2008-07-07 09:15 . 2006-06-19 11:58 2,760 --a------ C:\WINDOWS\system32\Repository.reg
2008-07-07 09:14 . 1998-11-13 14:16 308,224 --a------ C:\WINDOWS\IsUn040c.exe
2008-07-07 09:13 . 2008-07-07 09:13 264 --a------ C:\WINDOWS\_delis32.ini
2008-07-06 22:00 . 2008-07-06 22:00 <REP> d-------- C:\Program Files\Alwil Software
2008-07-06 22:00 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-07-06 21:47 . 2008-07-06 21:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-06 21:34 . 2008-07-07 11:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-06 21:06 . 2008-07-06 21:13 <REP> d-------- C:\Program Files\VS Revo Group
2008-07-06 17:43 . 2008-07-11 10:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-06 16:28 . 2001-08-28 15:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-07-06 14:32 . 2008-07-06 14:32 <REP> d-------- C:\Program Files\uTorrent
2008-07-06 14:32 . 2008-07-06 14:53 <REP> d-------- C:\Documents and Settings\Julien\Application Data\uTorrent
2008-07-06 14:04 . 2008-07-06 14:04 <REP> d-------- C:\Program Files\Microsoft Games
2008-07-04 15:28 . 2008-04-13 11:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-07-04 15:28 . 2008-04-13 11:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-07-01 08:38 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-07-01 08:38 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-07-01 08:38 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-07-01 00:57 . 2008-07-01 00:57 <REP> d-------- C:\Documents and Settings\Julien\Contacts
2008-07-01 00:56 . 2008-07-01 00:56 268 --ah----- C:\sqmdata00.sqm
2008-07-01 00:56 . 2008-07-01 00:56 244 --ah----- C:\sqmnoopt00.sqm
2008-07-01 00:49 . 2008-07-01 00:55 <REP> d-------- C:\Program Files\Windows Live
2008-07-01 00:49 . 2008-07-01 00:55 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-07-01 00:49 . 2008-07-01 00:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-06-28 19:57 . 2008-06-28 19:57 <REP> d-------- C:\Documents and Settings\Julien\Application Data\dvdcss
2008-06-26 21:10 . 2008-06-26 21:10 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-06-25 17:00 . 2008-06-25 17:00 <REP> d-------- C:\Program Files\MSXML 4.0
2008-06-15 23:46 . 2008-06-15 23:46 <REP> d-------- C:\Program Files\GameTribe
2008-06-14 11:43 . 2008-06-14 11:43 <REP> d-------- C:\Documents and Settings\Julien\Application Data\Ahead

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-10 17:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-10 17:44 --------- d-----w C:\Program Files\THQ
2008-07-09 17:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-07 12:36 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-07-06 22:59 --------- d-----w C:\Documents and Settings\Julien\Application Data\teamspeak2
2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 17:33 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 16:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-06-04 21:55 --------- d-----w C:\Program Files\Common Files
2008-06-04 21:28 --------- d-----w C:\Program Files\Gpotato.eu
2008-05-30 13:18 --------- d-----w C:\Program Files\Fichiers communs\Deterministic Networks
2008-05-30 13:18 --------- d-----w C:\Program Files\Cisco Systems
2008-05-23 07:47 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-23 07:47 --------- d-----w C:\Documents and Settings\Julien\Application Data\DAEMON Tools
2008-05-19 20:35 --------- d-----w C:\Program Files\QuickTime
2008-05-19 20:35 --------- d-----w C:\Program Files\iTunes
2008-05-19 20:35 --------- d-----w C:\Program Files\iPod
2008-05-19 20:35 --------- d-----w C:\Documents and Settings\Julien\Application Data\Apple Computer
2008-05-19 20:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-19 20:33 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-05-19 20:33 --------- d-----w C:\Program Files\Apple Software Update
2008-05-19 20:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-05-09 10:55 90,112 ----a-w C:\WINDOWS\system32\wshext.dll
2008-05-09 10:55 430,080 ----a-w C:\WINDOWS\system32\vbscript.dll
2008-05-09 10:55 180,224 ----a-w C:\WINDOWS\system32\scrobj.dll
2008-05-09 10:55 172,032 ----a-w C:\WINDOWS\system32\scrrun.dll
2008-05-08 11:24 155,648 ----a-w C:\WINDOWS\system32\wscript.exe
2008-05-07 09:07 135,168 ----a-w C:\WINDOWS\system32\cscript.exe
2008-05-07 05:11 1,294,336 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-13 19:33 76,800 ----a-w C:\WINDOWS\system32\storprop.dll
2008-04-13 18:47 1,246,130 ----a-r C:\WINDOWS\SET3.tmp
2008-04-13 18:38 16,825 ----a-r C:\WINDOWS\SET8.tmp
2008-04-13 18:38 1,088,840 ----a-r C:\WINDOWS\SET4.tmp
2008-04-13 17:50 1,804 ----a-w C:\WINDOWS\system32\Dcache.bin
2008-04-13 17:47 58,880 ----a-w C:\WINDOWS\system32\dmutil.dll
2008-04-13 17:47 52,736 ----a-w C:\WINDOWS\system32\wzcsapi.dll
2008-04-13 17:47 50,688 ----a-w C:\WINDOWS\system32\cnbjmon.dll
2008-04-13 17:47 483,840 ----a-w C:\WINDOWS\system32\wzcsvc.dll
2008-04-13 17:47 47,616 ----a-w C:\WINDOWS\system32\iyuv_32.dll
2008-04-13 17:47 35,328 ----a-w C:\WINDOWS\system32\pid.dll
2008-04-13 17:47 294,912 ----a-w C:\WINDOWS\system32\msh263.drv
2008-04-13 17:47 20,992 ----a-w C:\WINDOWS\system32\hid.dll
2008-04-13 17:47 2,025,984 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 17:47 16,896 ----a-w C:\WINDOWS\system32\msyuv.dll
2008-04-13 17:47 15,360 ----a-w C:\WINDOWS\system32\pjlmon.dll
2008-04-13 17:37 332,800 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-13 17:33 98,816 ----a-w C:\WINDOWS\system32\psbase.dll
2008-04-13 17:32 764,416 ----a-w C:\WINDOWS\system32\winntbbu.dll
2008-04-13 17:32 61,471 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-13 17:32 5,632 ----a-w C:\WINDOWS\system32\wmi.dll
2008-04-13 17:32 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll
2008-04-13 17:07 2,147,328 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 17:06 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:04 93,184 ----a-w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:03 81,920 ----a-w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:02 50,688 ----a-w C:\WINDOWS\system32\inetres.dll
2008-04-13 17:02 2,985,984 ----a-w C:\WINDOWS\system32\wmploc.dll
2008-04-13 17:01 572,416 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:59 200,704 ----a-w C:\WINDOWS\system32\wmerror.dll
2008-04-13 16:59 10,240 ----a-w C:\WINDOWS\system32\gpkrsrc.dll
2008-04-13 16:58 1,845,760 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 16:58 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:57 70,144 ----a-w C:\WINDOWS\system32\browselc.dll
2008-04-13 16:55 8,704 ----a-w C:\WINDOWS\system32\asferror.dll
2008-04-13 16:53 70,688 ----a-w C:\WINDOWS\system32\mmsystem.dll
2008-04-13 09:45 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 09:43 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe
2008-04-13 09:40 445,440 ----a-w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 09:36 2,986,496 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 09:35 197,632 ----a-w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 09:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 09:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 08:38 306,176 ----a-w C:\WINDOWS\system32\slbcsp.dll
2008-04-13 08:38 169,984 ----a-w C:\WINDOWS\system32\sccbase.dll
2008-04-13 08:38 101,888 ----a-w C:\WINDOWS\system32\gpkcsp.dll
2008-04-13 08:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 08:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 08:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 08:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dLL
2008-04-13 08:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 07:54 54,080 ----a-w C:\WINDOWS\system32\dosx.exe
2008-04-13 07:54 5,120 ----a-w C:\WINDOWS\system32\winnls.dll
2008-04-13 07:53 92,608 ----a-w C:\WINDOWS\system32\krnl386.exe
2008-04-13 07:52 3,352 ----a-w C:\WINDOWS\system32\redir.exe
2008-04-13 07:50 42,537 ----a-w C:\WINDOWS\system32\keyboard.sys
2008-04-13 07:49 35,648 ----a-w C:\WINDOWS\system32\ntio411.sys
2008-04-13 07:49 35,424 ----a-w C:\WINDOWS\system32\ntio412.sys
2008-04-13 07:49 34,560 ----a-w C:\WINDOWS\system32\ntio804.sys
2008-04-13 07:49 34,560 ----a-w C:\WINDOWS\system32\ntio404.sys
2008-04-13 07:49 34,000 ----a-w C:\WINDOWS\system32\ntio.sys
2008-04-13 07:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll
2008-04-13 07:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
2008-04-13 06:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
.

((((((((((((((((((((((((((((( snapshot@2008-07-11_12.51.47.70 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-11 11:48:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-13 08:20:46 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2007-02-22 22:41:12 304,544 ----a-w C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll
+ 2007-02-28 13:21:04 131,472 ----a-w C:\WINDOWS\Downloaded Program Files\msgrchkr.dll
- 2008-07-11 08:31:54 40,640 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-07-13 08:25:23 40,640 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-07-11 08:31:54 49,400 ----a-w C:\WINDOWS\system32\perfc00C.dat
+ 2008-07-13 08:25:23 49,400 ----a-w C:\WINDOWS\system32\perfc00C.dat
- 2008-07-11 08:31:54 312,444 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-07-13 08:25:23 312,444 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-07-11 08:31:54 368,930 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2008-07-13 08:25:23 368,930 ----a-w C:\WINDOWS\system32\perfh00C.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 17:45 1052672]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 18:34 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 18:04 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-01-19 07:43 7397376]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-11-28 10:41 667718]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 10:41 602182]
"EOUApp"="C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" [2005-11-28 10:47 569413]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-07-25 12:36 32768]
"LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2006-02-21 08:46 69632]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 13:28 20480]
"LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2005-07-25 09:45 241664]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2006-03-14 13:33 86016]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 14:40 155648]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2006-06-23 10:39 225280]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-01-19 08:43 86016]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 18:34 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-07-10 08:18 270648 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-29 05:24 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Mythology\\aom.exe"=
"C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"=
"C:\\Program Files\\Cyanide\\Chaos-League MS\\ChaosLeagueEx.exe"=

R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 10:27]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2008-04-13 18:34]
R3 lv321av;Logitech USB PC Camera (VC0321);C:\WINDOWS\system32\DRIVERS\lv321av.sys [2006-06-19 12:20]
R3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2006-06-23 10:40]
S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys []
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-07-07 11:44]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-07-13 13:00:00 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-13 14:04:02
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\C:\DOCUME~1\Julien\LOCALS~1\Temp\mc21.tmp"
.
Temps d'accomplissement: 2008-07-13 14:05:14
ComboFix-quarantined-files.txt 2008-07-13 13:05:07
ComboFix2.txt 2008-07-12 08:01:24
ComboFix3.txt 2008-07-11 12:41:05

Pre-Run: 33,987,796,992 octets libres
Post-Run: 33,988,956,160 octets libres

278 --- E O F --- 2008-07-09 18:19:44

Ton infection semble vieille..

Télécharge DiagHelp (de Malekal) sur ton Bureau

Dézippe le, ouvre le nouveau dossier DiagHelp, et double-clic sur go.cmd (le .cmd peut ne pas apparaître! )

Choisis l’option 1 dans la fenêtre qui s’ouvrira.
Ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand cela t’est demandé..
ATTENTION : Pendant l'analyse, après le rapport CatchMe, il te sera demandé d'appuyer sur une touche afin de poursuivre le scan, suis bien les instructions à l'écran !

A la fin de l'analyse, ton ordi devra peut-être être redémarré... Une fois l'ordinateur redémarré, le rapport va apparaître sur le Bloc-note.. Poste le ici.

Ce dernier se trouve ici : C:\resultat.txt

Si tu obtiens un fichier C:\upload_moi.zip, merci de l’envoyer sur http://upload.malekal.com/
Comment Uploader ?

Aide : Comment utiliser DiagHelp.

DiagHelp version v1.4 - http://www.malekal.com
excute le 14/07/2008 à 9:09:02,43


Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->14/07/2008 09:09:00
C:\WINDOWS\prefetch\CHCP.COM-18156052.pf -->14/07/2008 09:08:59
C:\WINDOWS\prefetch\FIREFOX.EXE-28641590.pf -->14/07/2008 09:07:43
C:\WINDOWS\prefetch\WUAUCLT.EXE-399A8E72.pf -->14/07/2008 09:07:17
C:\WINDOWS\prefetch\NTOSBOOT-B00DFAAD.pf -->14/07/2008 09:07:17
C:\WINDOWS\prefetch\DOT1XCFG.EXE-32C52055.pf -->14/07/2008 09:07:17
C:\WINDOWS\prefetch\LOGONUI.EXE-0AF22957.pf -->14/07/2008 02:01:29
C:\WINDOWS\prefetch\AU_.EXE-38C05C41.pf -->14/07/2008 02:01:11
C:\WINDOWS\prefetch\UNINST.EXE-07470D68.pf -->14/07/2008 02:01:08
C:\WINDOWS\prefetch\VERCLSID.EXE-3667BD89.pf -->14/07/2008 02:00:36

C:\WINDOWS\System32\drivers\mbamcatchme.sys -->07/07/2008 17:35:36
C:\WINDOWS\System32\drivers\mbam.sys -->07/07/2008 17:35:30
C:\WINDOWS\System32\drivers\tcpip.sys -->20/06/2008 12:51:12
C:\WINDOWS\System32\drivers\afd.sys -->20/06/2008 12:40:08
C:\WINDOWS\System32\drivers\tcpip6.sys -->20/06/2008 12:08:27
C:\WINDOWS\System32\drivers\bthport.sys -->14/06/2008 18:33:37
C:\WINDOWS\System32\drivers\sptd.sys -->23/05/2008 08:47:43

C:\WINDOWS\System32\nvapps.xml -->14/07/2008 09:06:25
C:\WINDOWS\System32\wpa.dbl -->14/07/2008 09:06:16
C:\WINDOWS\System32\perfh00C.dat -->13/07/2008 14:27:02
C:\WINDOWS\System32\perfh009.dat -->13/07/2008 14:27:02
C:\WINDOWS\System32\perfc00C.dat -->13/07/2008 14:27:02
C:\WINDOWS\System32\perfc009.dat -->13/07/2008 14:27:02
C:\WINDOWS\System32\PerfStringBackup.INI -->13/07/2008 14:27:01
C:\WINDOWS\System32\CONFIG.NT -->11/07/2008 10:32:46
C:\WINDOWS\System32\TuneUpDefragService.exe -->07/07/2008 11:44:53
C:\WINDOWS\System32\lvcoinst.log -->07/07/2008 09:19:29
C:\WINDOWS\System32\cf87b616-.txt -->07/07/2008 09:01:41
C:\WINDOWS\System32\FNTCACHE.DAT -->06/07/2008 14:55:08
C:\WINDOWS\System32\xfcodec.dll -->26/06/2008 21:10:46
C:\WINDOWS\System32\MRT.exe -->25/06/2008 17:15:46
C:\WINDOWS\System32\mswsock.dll -->20/06/2008 18:47:22
C:\WINDOWS\System32\dnsapi.dll -->20/06/2008 18:47:22
C:\WINDOWS\System32\success -->30/05/2008 14:18:48
C:\WINDOWS\System32\TZLog.log -->29/05/2008 17:00:33
C:\WINDOWS\System32\uxtuneup.dll -->29/05/2008 09:28:54
C:\WINDOWS\System32\wshom.ocx -->10/05/2008 00:25:02
C:\WINDOWS\System32\wshext.dll -->09/05/2008 11:55:00
C:\WINDOWS\System32\vbscript.dll -->09/05/2008 11:55:00
C:\WINDOWS\System32\scrrun.dll -->09/05/2008 11:55:00
C:\WINDOWS\System32\scrobj.dll -->09/05/2008 11:55:00
C:\WINDOWS\System32\jscript.dll -->09/05/2008 11:55:00

C:\WINDOWS\WindowsUpdate.log -->14/07/2008 09:08:56
C:\WINDOWS\0.log -->14/07/2008 09:06:26
C:\WINDOWS\wiadebug.log -->14/07/2008 09:06:24
C:\WINDOWS\wiaservc.log -->14/07/2008 09:06:18
C:\WINDOWS\bootstat.dat -->14/07/2008 09:06:13
C:\WINDOWS\SchedLgU.Txt -->14/07/2008 02:01:30
C:\WINDOWS\system.ini -->13/07/2008 14:04:00
C:\WINDOWS\setupapi.log -->13/07/2008 00:49:23
C:\WINDOWS\NeroDigital.ini -->12/07/2008 20:09:56
C:\WINDOWS\win.ini -->07/07/2008 12:26:54
C:\WINDOWS\_delis32.ini -->07/07/2008 09:13:17
C:\WINDOWS\mozver.dat -->05/05/2008 22:28:35
C:\WINDOWS\Sti_Trace.log -->05/05/2008 21:07:32
C:\WINDOWS\nsreg.dat -->05/05/2008 20:53:00
C:\WINDOWS\GridV.UNI -->05/05/2008 20:40:01

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed


ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 364
Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path
0x77be0000 0x58000 7.00.2600.5512 C:\WINDOWS\system32\msvcrt.dll
0x779e0000 0x97000 5.131.2600.5512 C:\WINDOWS\system32\CRYPT32.dll
0x76610000 0x84000 5.131.2600.5512 C:\WINDOWS\system32\CRYPTUI.dll
0x44080000 0xd0000 7.00.6000.16674 C:\WINDOWS\system32\WININET.dll
0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x43e00000 0x45000 7.00.6000.16674 C:\WINDOWS\system32\iertutil.dll
0x76be0000 0x2e000 5.131.2600.5512 C:\WINDOWS\system32\WINTRUST.dll
0x58b50000 0x9a000 5.82.2900.5512 C:\WINDOWS\system32\comctl32.dll
0x76f80000 0x7f000 2001.12.4414.0700 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0700 C:\WINDOWS\system32\COMRes.dll
0x76ac0000 0x11000 3.05.2284.0001 C:\WINDOWS\system32\ATL.DLL
0x7d200000 0x2bc000 3.01.4001.5512 C:\WINDOWS\system32\msi.dll
0x44360000 0x5cd000 7.00.6000.16674 C:\WINDOWS\system32\ieframe.dll
0x44160000 0x127000 7.00.6000.16674 C:\WINDOWS\system32\urlmon.dll
0x442b0000 0x3c000 7.00.6000.16674 C:\WINDOWS\system32\webcheck.dll
0x018e0000 0x16000 9.04.0004.1082 C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcInj.dll
0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x02200000 0x19000 2.00.0000.0016 C:\Program Files\SuperCopier2\SC2Hook.dll
0x01790000 0x2e000 C:\Program Files\WinRAR\rarext.dll
0x10000000 0x13000 7.00.0000.0011 C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll
0x7c250000 0x102000 7.10.3077.0000 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MFC71U.DLL
0x02ee0000 0x56000 7.10.3052.0004 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll
0x7c3a0000 0x7b000 7.10.3077.0000 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCP71.dll
0x00d40000 0x8000 1.00.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
0x017c0000 0x9000 2.00.0000.0004 C:\Program Files\TuneUp Utilities 2008\SDShelEx-win32.dll
0x00d10000 0x10000 8.00.0000.0456 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
0x78130000 0x9b000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
0x6bd10000 0x10000 12.00.4518.1014 C:\Program Files\Microsoft Office\Office12\msohevi.dll
0x03640000 0x5b000 8.01.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
0x036a0000 0x4c000 8.00.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
0x037a0000 0x13000 7.05.0001.0036 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
0x60990000 0x7000 3.01.4001.5512 C:\WINDOWS\system32\MSISIP.DLL
0x7e6a0000 0x16000 5.07.0000.18066 C:\WINDOWS\system32\wshext.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 948
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x82000 \??\C:\WINDOWS\system32\winlogon.exe
0x77be0000 0x58000 7.00.2600.5512 C:\WINDOWS\system32\msvcrt.dll
0x779e0000 0x97000 5.131.2600.5512 C:\WINDOWS\system32\CRYPT32.dll
0x76be0000 0x2e000 5.131.2600.5512 C:\WINDOWS\system32\WINTRUST.dll
0x58b50000 0x9a000 5.82.2900.5512 C:\WINDOWS\system32\COMCTL32.dll
0x74730000 0x3d000 3.525.1132.0000 C:\WINDOWS\system32\ODBC32.dll
0x1f840000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x76ac0000 0x11000 3.05.2284.0001 C:\WINDOWS\system32\ATL.DLL
0x77000000 0xd4000 2001.12.4414.0700 C:\WINDOWS\system32\COMRes.dll
0x76f80000 0x7f000 2001.12.4414.0700 C:\WINDOWS\system32\CLBCATQ.DLL


Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le numéro de série du volume est C4A4-72C7

Répertoire de C:\WINDOWS\system32

13/04/2008 18:34 6 144 csrss.exe
1 fichier(s) 6 144 octets
0 Rép(s) 33 770 663 936 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le numéro de série du volume est C4A4-72C7

Répertoire de C:\WINDOWS\Downloaded Program Files

13/07/2008 00:49 <REP> .
13/07/2008 00:49 <REP> ..
05/05/2008 19:20 65 desktop.ini
24/03/2008 19:33 1 527 056 FP_AX_CAB_INSTALLER.exe
22/02/2007 23:41 304 544 MessengerStatsPAClient.dll
28/02/2007 14:21 131 472 msgrchkr.dll
24/03/2008 19:18 247 swflash.inf
5 fichier(s) 1 963 384 octets

Total des fichiers listés :
5 fichier(s) 1 963 384 octets
2 Rép(s) 33 770 659 840 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..


Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
"C:\\Program Files\\Microsoft Games\\Age of Mythology\\aom.exe"="C:\\Program Files\\Microsoft Games\\Age of Mythology\\aom.exe:*:Enabled:Age of Mythology"
"C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"="C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe:*:Enabled:GameCenter"
"C:\\Program Files\\Cyanide\\Chaos-League MS\\ChaosLeagueEx.exe"="C:\\Program Files\\Cyanide\\Chaos-League MS\\ChaosLeagueEx.exe:*:Enabled:Chaos-League-MS"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"



exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableRegistryTools"=dword:00000000
"HideLegacyLogonScripts"=dword:00000000
"HideLogoffScripts"=dword:00000000
"RunLogonScriptSync"=dword:00000001
"RunStartupScriptSync"=dword:00000000
"HideStartupScripts"=dword:00000000



Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-14 09:09:39
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:28,90,51,6f,b0,9b,2a,e7,7e,22,d1,7c,4a,d1,63,ac,c1,55,3c,1e,ae,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:f8,c2,a3,3c,59,e4,d9,07,b7,24,c1,a4,e9,9d,94,77,f2,d3,1f,a5,68,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:28,90,51,6f,b0,9b,2a,e7,7e,22,d1,7c,4a,d1,63,ac,c1,55,3c,1e,ae,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:f8,c2,a3,3c,59,e4,d9,07,b7,24,c1,a4,e9,9d,94,77,f2,d3,1f,a5,68,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0


KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
124 - LaunchAp.exe
364 - explorer.exe
472 - avguard.exe
484 - AppleMobileDevi
512 - guard.exe
532 - cvpnd.exe
632 - nvsvc32.exe
660 - ZCfgSvc.exe
696 - iFrmewrk.exe
740 - svchost.exe
764 - EOUWiz.exe
924 - csrss.exe
948 - winlogon.exe
968 - HotkeyApp.exe
992 - services.exe
1004 - lsass.exe
1008 - OSDCtrl.exe
1168 - svchost.exe
1184 - WButton.exe
1240 - LVCOMSX.EXE
1256 - svchost.exe
1296 - svchost.exe
1360 - EvtEng.exe
1396 - S24EvMon.exe
1436 - svchost.exe
1504 - msnmsgr.exe
1548 - svchost.exe
1588 - avgas.exe
1824 - spoolsv.exe
1868 - LVPrcSrv.exe
1908 - sched.exe
2128 - rundll32.exe
2152 - avgnt.exe
2208 - SuperCopier2.ex
2240 - wmiprvse.exe
2272 - ctfmon.exe
2304 - NMBgMonitor.exe
2364 - alg.exe
2392 - wmiprvse.exe
2548 - cmd.exe
2696 - NMIndexStoreSvr
3968 - firefox.exe
4056 - wuauclt.exe
4060 - Dot1XCfg.exe

Total number of processes = 45
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\ntkrnlpa.exe
806E4000 - \WINDOWS\system32\hal.dll
BADA8000 - \WINDOWS\system32\KDCOM.DLL
BACB8000 - \WINDOWS\system32\BOOTVID.dll
BA6A7000 - spum.sys
BADAA000 - \WINDOWS\System32\Drivers\WMILIB.SYS
BA68F000 - \WINDOWS\System32\Drivers\SCSIPORT.SYS
BA660000 - ACPI.sys
BA64F000 - pci.sys
BA8A8000 - isapnp.sys
BACBC000 - compbatt.sys
BACC0000 - \WINDOWS\system32\DRIVERS\BATTC.SYS
BAE70000 - pciide.sys
BAB28000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
BA631000 - pcmcia.sys
BA8B8000 - MountMgr.sys
BA612000 - ftdisk.sys
BADAC000 - dmload.sys
BA5EC000 - dmio.sys
BACC4000 - ACPIEC.sys
BAE71000 - \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
BAB30000 - PartMgr.sys
BA8C8000 - sfsync02.sys
BA8D8000 - VolSnap.sys
BA5D4000 - atapi.sys
BA8E8000 - disk.sys
BA8F8000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
BA5B4000 - fltMgr.sys
BA5A2000 - sr.sys
BA58B000 - KSecDD.sys
BA4FE000 - Ntfs.sys
BA4D1000 - NDIS.sys
BAB38000 - sfhlp02.sys
BADAE000 - sfhlp01.sys
BA4C0000 - sfdrv01.sys
BADB0000 - prosync1.sys
BA4AD000 - prohlp02.sys
BA493000 - Mup.sys
BAA58000 - \SystemRoot\system32\DRIVERS\intelppm.sys
BAD8C000 - \SystemRoot\system32\DRIVERS\wmiacpi.sys
B9D28000 - \SystemRoot\system32\DRIVERS\nv4_mini.sys
B9D14000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
B9CEC000 - \SystemRoot\system32\DRIVERS\HDAudBus.sys
B9B8F000 - \SystemRoot\system32\DRIVERS\w39n51.sys
BABB8000 - \SystemRoot\system32\DRIVERS\usbuhci.sys
B9B6B000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
BABC0000 - \SystemRoot\system32\DRIVERS\usbehci.sys
B9B57000 - \SystemRoot\system32\DRIVERS\sdbus.sys
BADA0000 - \SystemRoot\system32\DRIVERS\CmBatt.sys
BAA68000 - \SystemRoot\system32\DRIVERS\i8042prt.sys
BABC8000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
B9B28000 - \SystemRoot\system32\DRIVERS\SynTP.sys
BADBE000 - \SystemRoot\system32\DRIVERS\USBD.SYS
BABD0000 - \SystemRoot\system32\DRIVERS\mouclass.sys
BAA78000 - \SystemRoot\system32\DRIVERS\imapi.sys
BAA88000 - \SystemRoot\system32\DRIVERS\cdrom.sys
BAA98000 - \SystemRoot\system32\DRIVERS\redbook.sys
B9B05000 - \SystemRoot\system32\DRIVERS\ks.sys
BABD8000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys
B9AE7000 - \SystemRoot\system32\DRIVERS\dne2000.sys
BAEEA000 - \SystemRoot\system32\DRIVERS\audstub.sys
BAAF8000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
BA46B000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
B9AAF000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
BAB08000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
BAB18000 - \SystemRoot\system32\DRIVERS\raspptp.sys
BABE0000 - \SystemRoot\system32\DRIVERS\TDI.SYS
B9A9E000 - \SystemRoot\system32\DRIVERS\psched.sys
BA918000 - \SystemRoot\system32\DRIVERS\msgpc.sys
BABF0000 - \SystemRoot\system32\DRIVERS\ptilink.sys
BABF8000 - \SystemRoot\system32\DRIVERS\raspti.sys
B9A46000 - \SystemRoot\system32\DRIVERS\rdpdr.sys
BA928000 - \SystemRoot\system32\DRIVERS\termdd.sys
BADC6000 - \SystemRoot\system32\DRIVERS\swenum.sys
B99E8000 - \SystemRoot\system32\DRIVERS\update.sys
BA44B000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
BA938000 - \SystemRoot\System32\Drivers\NDProxy.SYS
B75B0000 - \SystemRoot\system32\drivers\RtkHDAud.sys
B758C000 - \SystemRoot\system32\drivers\portcls.sys
BA958000 - \SystemRoot\system32\drivers\drmk.sys
BA968000 - \SystemRoot\system32\DRIVERS\usbhub.sys
BADD0000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
BAEB5000 - \SystemRoot\System32\Drivers\Null.SYS
BADD2000 - \SystemRoot\System32\Drivers\Beep.SYS
BAEE1000 - \SystemRoot\System32\DRIVERS\AvgAsCln.sys
BAC18000 - \SystemRoot\System32\drivers\vga.sys
BADD4000 - \SystemRoot\System32\Drivers\mnmdd.SYS
BADD6000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
BAC20000 - \SystemRoot\System32\Drivers\Msfs.SYS
BAC28000 - \SystemRoot\System32\Drivers\Npfs.SYS
BAD64000 - \SystemRoot\system32\DRIVERS\rasacd.sys
B7559000 - \SystemRoot\system32\DRIVERS\ipsec.sys
B7500000 - \SystemRoot\system32\DRIVERS\tcpip.sys
B74B2000 - \SystemRoot\system32\DRIVERS\ipnat.sys
B748A000 - \SystemRoot\system32\DRIVERS\netbt.sys
BA978000 - \SystemRoot\system32\DRIVERS\wanarp.sys
B73C8000 - \SystemRoot\System32\drivers\afd.sys
BA988000 - \SystemRoot\system32\DRIVERS\netbios.sys
BAC30000 - \SystemRoot\system32\DRIVERS\ssmdrv.sys
B739D000 - \SystemRoot\system32\DRIVERS\rdbss.sys
B7389000 - \SystemRoot\System32\drivers\prodrv06.sys
B7319000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
BAD7C000 - \SystemRoot\System32\Drivers\Hotkey.SYS
BA998000 - \SystemRoot\System32\Drivers\Fips.SYS
B7306000 - \SystemRoot\system32\DRIVERS\avipbb.sys
BADDA000 - \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
BAEEC000 - \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
B9A8A000 - \SystemRoot\system32\DRIVERS\hidusb.sys
BA9F8000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
BAC38000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
B7094000 - \??\C:\WINDOWS\system32\drivers\lvmvdrv.sys
BAA08000 - \SystemRoot\system32\DRIVERS\LVUSBSta.sys
B6F88000 - \SystemRoot\system32\DRIVERS\lv321av.sys
BAA18000 - \SystemRoot\system32\DRIVERS\STREAM.SYS
B9A76000 - \SystemRoot\system32\DRIVERS\mouhid.sys
B6F77000 - \SystemRoot\System32\Drivers\Udfs.SYS
B6F5F000 - \SystemRoot\System32\Drivers\dump_atapi.sys
BAE30000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
B74D8000 - \SystemRoot\System32\drivers\Dxapi.sys
BAC90000 - \SystemRoot\System32\watchdog.sys
BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
BAEAF000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9D5000 - \SystemRoot\System32\nv4_disp.dll
BAB80000 - \SystemRoot\system32\DRIVERS\AegisP.sys
B5EE6000 - \SystemRoot\system32\DRIVERS\s24trans.sys
B5EC6000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
B5389000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
B4B4C000 - \SystemRoot\system32\drivers\wdmaud.sys
B5CCE000 - \SystemRoot\system32\drivers\sysaudio.sys
B47C4000 - \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
B474A000 - \SystemRoot\system32\DRIVERS\srv.sys
B4736000 - \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
BAB48000 - \??\C:\WINDOWS\system32\drivers\LVPrcMon.sys
BAF1D000 - \??\C:\DOCUME~1\Julien\LOCALS~1\Temp\mc21.tmp
BAFF7000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 136

Liste des programmes installes

Acer GridVista
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Reader 8.1.2 - Français
Age of Mythology
Apple Mobile Device Support
Apple Software Update
Archiveur WinRAR
AVG Anti-Spyware 7.5
Avira AntiVir Personal – Free Antivirus
CCleaner (remove only)
Chaos-League MS
Correctif pour Windows Internet Explorer 7 (KB947864)
GameCenter
HijackThis 2.0.2
iTunes
Launch Manager V1.1.0.0
Logiciel Intel(R) PROSet/Wireless
Malwarebytes' Anti-Malware
mCore
mDriver
mDrWiFi
mEoU
mHelp
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)
Mise à jour de sécurité pour Windows XP (KB950760)
Mise à jour de sécurité pour Windows XP (KB950762)
Mise à jour de sécurité pour Windows XP (KB951376-v2)
Mise à jour de sécurité pour Windows XP (KB951376)
Mise à jour de sécurité pour Windows XP (KB951698)
Mise à jour de sécurité pour Windows XP (KB951748)
Mise à jour pour Windows XP (KB898461)
Mise à jour pour Windows XP (KB942763)
Mise à jour pour Windows XP (KB951978)
mIWA
mLogView
mMHouse
Mozilla Firefox (3.0)
mPfMgr
mPfWiz
mProSafe
MSXML 4.0 SP2 (KB936181)
MSXML4 Parser
mWlsSafe
mXML
mZConfig
Nero 7 Ultra Edition
NVIDIA Drivers
Programme de gestion Acer OrbiCam
QuickTime
Realtek High Definition Audio Driver
Revo Uninstaller 1.71
RF Online Episode 2
Security Update for Excel 2007 (KB946974)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB951808)
Security Update for Microsoft Office Word 2007 (KB950113)
Security Update for Office 2007 (KB947801)
Security Update for Outlook 2007 (KB946983)
Spybot - Search & Destroy
SuperCopier2
Synaptics Pointing Device Driver
TeamSpeak 2 RC2
Titan Quest
Titan Quest Immortal Throne
TuneUp Utilities 2008
Update for Office 2007 (KB934391)
Update for Office 2007 (KB946691)
Update for Outlook 2007 Junk Email Filter (kb953463)
VideoLAN VLC media player 0.8.6a
VPN Client
WebFldrs XP
Windows Internet Explorer 7
Windows Live installer
Windows Live Messenger



Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le numéro de série du volume est C4A4-72C7

Répertoire de C:\Program Files

14/07/2008 02:01 <REP> .
14/07/2008 02:01 <REP> ..
05/05/2008 20:40 <REP> Acer Inc
07/07/2008 12:25 <REP> Adobe
07/07/2008 10:04 <REP> Alcohol Soft
06/07/2008 22:00 <REP> Alwil Software
19/05/2008 21:33 <REP> Apple Software Update
11/07/2008 10:42 <REP> Avira
11/07/2008 10:29 <REP> CCleaner
30/05/2008 14:18 <REP> Cisco Systems
05/05/2008 21:18 <REP> Codemasters
04/06/2008 22:55 <REP> Common Files
05/05/2008 19:17 <REP> ComPlus Applications
08/07/2008 11:04 <REP> Cyanide
05/05/2008 21:19 <REP> EoRezo
09/07/2008 15:39 <REP> Fichiers communs
15/06/2008 23:46 <REP> GameTribe
04/06/2008 22:28 <REP> Gpotato.eu
07/07/2008 11:46 <REP> Grisoft
05/05/2008 20:26 <REP> Intel
11/06/2008 17:01 <REP> Internet Explorer
19/05/2008 21:35 <REP> iPod
19/05/2008 21:35 <REP> iTunes
05/05/2008 22:21 <REP> Launch Manager
13/07/2008 00:41 <REP> Malwarebytes' Anti-Malware
05/05/2008 19:17 <REP> Messenger
05/05/2008 19:40 <REP> microsoft frontpage
06/07/2008 14:04 <REP> Microsoft Games
23/05/2008 09:10 <REP> Microsoft Office
23/05/2008 09:09 <REP> Microsoft Visual Studio
05/05/2008 19:19 <REP> Movie Maker
14/07/2008 09:07 <REP> Mozilla Firefox
05/05/2008 19:16 <REP> MSN
05/05/2008 19:17 <REP> MSN Gaming Zone
25/06/2008 17:00 <REP> MSXML 4.0
05/05/2008 23:03 <REP> Nero
05/05/2008 19:19 <REP> NetMeeting
05/05/2008 19:17 <REP> Online Services
05/05/2008 19:19 <REP> Outlook Express
19/05/2008 21:35 <REP> QuickTime
05/05/2008 20:33 <REP> Realtek
05/05/2008 19:20 <REP> Services en ligne
07/07/2008 22:38 <REP> Spybot - Search & Destroy
05/05/2008 22:22 <REP> SuperCopier2
05/05/2008 20:58 <REP> Synaptics
07/07/2008 13:36 <REP> Teamspeak2_RC2
10/07/2008 18:44 <REP> THQ
09/07/2008 13:33 <REP> Trend Micro
07/07/2008 11:53 <REP> TuneUp Utilities 2008
06/07/2008 14:32 <REP> uTorrent
05/05/2008 21:04 <REP> VideoLAN
06/07/2008 21:13 <REP> VS Revo Group
01/07/2008 00:55 <REP> Windows Live
05/05/2008 19:40 <REP> Windows Media Player
05/05/2008 19:17 <REP> Windows NT
05/05/2008 20:48 <REP> WinRAR
10/07/2008 12:18 <REP> World of Warcraft Trial
06/07/2008 20:02 <REP> xerox
0 fichier(s) 0 octets
58 Rép(s) 33 770 086 400 octets libres
Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le numéro de série du volume est C4A4-72C7

Répertoire de C:\Program Files\fichiers communs

09/07/2008 15:39 <REP> .
09/07/2008 15:39 <REP> ..
07/07/2008 09:15 <REP> Acer
05/05/2008 21:49 <REP> Adobe
05/05/2008 23:03 <REP> Ahead
19/05/2008 21:33 <REP> Apple
09/07/2008 15:39 <REP> Blizzard Entertainment
23/05/2008 09:09 <REP> DESIGNER
30/05/2008 14:18 <REP> Deterministic Networks
05/05/2008 20:35 <REP> InstallShield
07/07/2008 09:17 <REP> Logitech
23/05/2008 09:10 <REP> Microsoft Shared
05/05/2008 19:19 <REP> MSSoap
05/05/2008 20:55 <REP> ODBC
05/05/2008 19:19 <REP> Services
05/05/2008 20:55 <REP> SpeechEngines
05/05/2008 19:18 <REP> System
07/07/2008 11:43 <REP> Wise Installation Wizard
0 fichier(s) 0 octets
18 Rép(s) 33 770 086 400 octets libres
Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le numéro de série du volume est C4A4-72C7

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

23/05/2008 09:09 <REP> .
23/05/2008 09:09 <REP> ..
23/05/2008 09:07 <REP> 1033
26/10/2006 18:49 970 528 MSONSEXT.DLL
26/10/2006 19:12 40 256 MSOSV.DLL
03/06/1999 11:09 122 937 MSOWS409.DLL
07/03/2001 06:00 127 033 MSOWS40c.DLL
4 fichier(s) 1 260 754 octets
3 Rép(s) 33 770 082 304 octets libres
Le volume dans le lecteur C s'appelle DISQUE LOCAL
Le numéro de série du volume est C4A4-72C7

Répertoire de C:\Program Files\common files

04/06/2008 22:55 <REP> .
04/06/2008 22:55 <REP> ..
04/06/2008 22:55 <REP> INCA Shared
0 fichier(s) 0 octets
3 Rép(s) 33 770 082 304 octets libres




c:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.3.1.3\iTunesSetupAdmin.exe
c:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
c:\Documents and Settings\All Users\Documents\AoM.eXe
c:\Documents and Settings\Julien\Bureau\ComboFix.exe
c:\Documents and Settings\Julien\Bureau\HiJackThis.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\catchme.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\diff.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\dumphive.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\find2.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\Fport.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\grep.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\gzip.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\KProcCheck.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\LFiles.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\md5sums.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\pslist.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\sigcheck.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\streams.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\swreg.exe
c:\Documents and Settings\Julien\Bureau\DiagHelp\tar.exe
c:\Documents and Settings\Julien\Bureau\Jeux\fly_for_fun_client_complet_-_acte_2_l_aube_des_heros_francais_41629.exe
c:\Documents and Settings\Julien\Bureau\Jeux\poweroff.exe
c:\Documents and Settings\Julien\Bureau\Jeux\crack\Titan Quest Reloded crack\Titan Patch 1.01- 1.20.exe
c:\Documents and Settings\Julien\Bureau\Jeux\crack\Titan Quest Reloded crack\Titan Quest.exe
c:\Documents and Settings\Julien\Bureau\Jeux\crack\Titan Quest Reloded crack\Titan Quest1.exe
c:\Documents and Settings\Julien\Bureau\Jeux\crack\Titan Quest Reloded crack\Titan_Quest.exe
c:\Documents and Settings\Julien\Bureau\Utilitaire\Client VPN.exe
c:\Documents and Settings\Julien\Bureau\Utilitaire\daemon-tools_daemon_tools_4.12.3_anglais_10729.exe
c:\Documents and Settings\Julien\Mes documents\Ma musique\iTunes 7.3.1.3 + Quick Time Pro 7.2 + Serial [www.newpct.com]\iTunesSetup.exe
c:\Documents and Settings\Julien\Mes documents\My Games\Titan Quest\TitanQuest1_08.exe
c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

****** Fin du rapport DiagHelp

tous mes probleme sont arrive avec l'antivirus XP et ces spam !!

Ça continue ?

Fais une analyse antivirus en ligne sur Kaspersky avec Internet Explorer.

Autorise les Active x.

Clique sur Démarrer Online Scanner.

Sélectionne le poste de travail comme analyse. Enregistres sous le rapport en format .txt.

Colle son rapport ici.

Poste un nouveau rapport Hijackthis.

Aide : Comment faire un scan en ligne avec Kaspersky .

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, July 14, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, July 14, 2008 17:49:16
Records in database: 952881
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 51536
Threat name: 1
Infected objects: 1
Suspicious objects: 0
Duration of the scan: 00:46:49


File name / Threat name / Threats count
D:\Emule\Patch FR\Learn.To.Speak.English.v9.0-CD1.[sharethefiles.com].iso Infected: not-a-virus:AdWare.Win32.Background 1

The selected area was scanned.

Re,

Supprime D:\Emule\Patch FR\Learn.To.Speak.English.v9.0-CD1.[sharethefiles.com].iso

Poste un nouveau rapport HijackThis.
TOujours des problèmes ?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:58:55, on 15/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Julien\Bureau\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr/
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986....
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 8310 bytes


jai tjs mes problemes

a mon avis, le virus a du attaquer quelque chose dans mes fichers windows ou un mes driver m'empechant de jouer a ces jeux !!!!!4

Sinon laisse tomber, jarrive a jouer a WOW meme si je ne sais pas reellement pk. peut etre parce que c la version d'essai.

jattendrai de rentrer chez moi pour formater!!

Ah ce sont "que" des jeux ..

Relance Hijackthis (clique droit -> lancer en tant qu'adminstrateur sous Vista), do a system scan only, coche ces lignes (si toujours présentes) :

Ferme toutes les applications en cours (particulièrement ton navigateur Internet).
Puis Fix Checked !


Télécharge ToolsCleaner2 (de A.Rothstein)

Installe le sur ton Bureau.

Clique sur Recherche pour lancer le scan.

Clique sur Supprimer pour nettoyer les outils utilisés.

Clique sur Quitter.

Poste ce rapport ~>C:\TCleaner.txt<~

Garde Ccleaner, MBAM et AntiVir si nous les avons installés..

Désactive-réactive la restauration système.

Rapporte ton infection sur Malware Complaints >Tuto<

Ton(tes) infection(s) : Vundo.

Si tu ne la trouves pas dans la liste, poste dans Autres infections,

Mets ton ordi correctement à jour >ici<

Si ce n'est pas fait, assure-toi que les Mises à jour Automatiques Windows soient activées !

Puis regarde ces dossiers :

- Sécurité/Prévention
- Conséquences de la multi-protection
- Toolbars : Inutilité et ralentissements

Bonne journée/soirée  

-->- Recherche:

C:\Qoobox: trouvé !
C:\Documents and Settings\Julien\Bureau\DiagHelp.zip: trouvé !
C:\Documents and Settings\Julien\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Julien\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\Julien\Bureau\DiagHelp: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\Julien\Bureau\DiagHelp.zip: supprimé !
C:\Documents and Settings\Julien\Bureau\ComboFix.exe: supprimé !
C:\Documents and Settings\Julien\Bureau\HijackThis.exe: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\Julien\Bureau\DiagHelp: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Sauvegarde du registre crée !
Point de restauration crée !


Ca sert a koi ce que jai fias sous hijackthis?

voila jai réactiver et désactiver la restauration.

jai pas le tps de lire le reste mais je men occuperais plus tard