virus besoin d aide - Sécurité - Virus
TomsGuide.com : 700 000 inscrits répondent à toutes vos questions high-tech et informatique.
Pour obtenir de l'aide, inscrivez-vous gratuitement !
 

Ajouter une réponse



Mot :   Pseudo :  
 
Bas de page
Auteur
 Sujet : virus besoin d aide
 
miniche
Profil : IDNaute
Plus d'informations
n°323419
17-07-2008 à 00:18:50

bonjour

j ai un virus je narrive pas a l enlever

voici le rapport hijackthis aider moi merci

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:17:44, on 17/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\slserv.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\WINDOWS\VM_STI.EXE
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\USS\USS.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\rundll32.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\wspwprtct.exe
D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Windows Live\Messenger\usnsvc.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\miniche\Mes documents\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
O3 - Toolbar: qndsfmao - {264BFEF2-1935-497C-9FD4-6EEF1FAA2764} - D:\WINDOWS\qndsfmao.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [BigDogPath] D:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [USS] "D:\Program Files\USS\USS.exe"
O4 - HKLM\..\Run: [183fbc3c] rundll32.exe "D:\WINDOWS\system32\dgkpnono.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ares] "D:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [AlcoholAutomount] "D:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [s9201] "D:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\wspwprtct.exe" /autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activ [...] stubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wi [...] 1310843281
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O21 - SSODL: evgratsm - {913E59D6-7A83-4DE9-9FBF-4EAD6269EA71} - D:\WINDOWS\evgratsm.dll
O21 - SSODL: kvxqmtre - {93685434-1A2C-40D3-A913-A6CB964631F1} - D:\WINDOWS\kvxqmtre.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - D:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 5492 bytes

que dois je faire merci

Liens sponsorisés


Inscrivez-vous ou connectez-vous pour masquer ceci.

Bruce Lee72
Profil : IDNaute
Plus d'informations
n°323446
17-07-2008 à 10:11:17

Bonjour,

1. Télécharge [color=red]combofix.exe[/color] (par [color=#3366FF]sUBs[/color]) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe

sur ton Bureau.

2. Double clique sur combofix.exe pour lancer le scan.
3. Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

miniche
Profil : IDNaute
Plus d'informations
n°323540
17-07-2008 à 19:42:31

ComboFix 08-07-15.4 - miniche 2008-07-17 16:30:43.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.457 [GMT 2:00]
Endroit: D:\Documents and Settings\miniche\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\WINDOWS\cookies.ini
D:\WINDOWS\eprt.exe
D:\WINDOWS\evgratsm.dll
D:\WINDOWS\system32\atbqimmq.dll
D:\WINDOWS\system32\ddcYpqrp.dll
D:\WINDOWS\system32\dgkpnono.dll
D:\WINDOWS\system32\hbsqsapb.dll
D:\WINDOWS\system32\mcrh.tmp
D:\WINDOWS\system32\ononpkgd.ini
D:\WINDOWS\system32\pmnkHxVl.dll
D:\WINDOWS\system32\ppxidbps.ini
D:\WINDOWS\system32\prqpYcdd.ini
D:\WINDOWS\system32\prqpYcdd.ini2
D:\WINDOWS\system32\qgjyxi.dll
D:\WINDOWS\system32\twjsvi.dll
D:\WINDOWS\system32\vtUlKawT.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-17 to 2008-07-17 ))))))))))))))))))))))))))))))))))))
.

2008-07-17 00:57 . 2008-07-17 00:57 <REP> d-------- D:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-17 00:48 . 2008-07-17 06:36 <REP> d-------- D:\WINDOWS\SxsCaPendDel
2008-07-16 23:40 . 2008-07-16 23:40 <REP> d-------- D:\Documents and Settings\All Users\Application Data\SecuriSoft SARL
2008-07-16 19:59 . 2008-07-16 19:59 86 --a------ D:\WINDOWS\wininit.ini
2008-07-16 17:25 . 2008-07-16 17:25 69 --a------ D:\WINDOWS\NeroDigital.ini
2008-07-16 17:00 . 2008-07-16 14:29 102,400 --a------ D:\WINDOWS\agpqlrfm.exe
2008-07-16 17:00 . 2006-11-09 15:48 11,776 --a------ D:\WINDOWS\system32\drivers\wasfsd.sys
2008-07-16 16:59 . 2008-07-16 17:00 <REP> d-------- D:\Program Files\USS
2008-07-16 16:59 . 2008-07-16 16:59 0 --a------ D:\END
2008-06-25 06:16 . 2008-06-25 06:16 268 --ah----- D:\sqmdata19.sqm
2008-06-25 06:16 . 2008-06-25 06:16 244 --ah----- D:\sqmnoopt19.sqm
2008-06-23 22:41 . 2008-06-23 22:41 268 --ah----- D:\sqmdata18.sqm
2008-06-23 22:41 . 2008-06-23 22:41 244 --ah----- D:\sqmnoopt18.sqm
2008-06-23 21:01 . 2008-06-23 21:01 <REP> d-------- D:\Program Files\Alcohol Soft
2008-06-23 20:59 . 2008-06-23 20:59 715,248 --a------ D:\WINDOWS\system32\drivers\sptd.sys
2008-06-23 20:59 . 2008-06-23 20:59 268 --ah----- D:\sqmdata17.sqm
2008-06-23 20:59 . 2008-06-23 20:59 244 --ah----- D:\sqmnoopt17.sqm
2008-06-23 19:17 . 2008-06-23 21:19 1,905 --a------ D:\WINDOWS\diagwrn.xml
2008-06-23 19:17 . 2008-06-23 21:19 1,905 --a------ D:\WINDOWS\diagerr.xml
2008-06-23 00:46 . 2008-06-23 00:46 268 --ah----- D:\sqmdata16.sqm
2008-06-23 00:46 . 2008-06-23 00:46 244 --ah----- D:\sqmnoopt16.sqm
2008-06-20 19:47 . 2008-06-20 19:47 247,808 -----c--- D:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 19:47 . 2008-06-20 19:47 147,968 -----c--- D:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 18:34 . 2008-06-20 18:34 268 --ah----- D:\sqmdata15.sqm
2008-06-20 18:34 . 2008-06-20 18:34 244 --ah----- D:\sqmnoopt15.sqm
2008-06-20 13:51 . 2008-06-20 13:51 361,600 -----c--- D:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 13:40 . 2008-06-20 13:40 138,496 -----c--- D:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 13:08 . 2008-06-20 13:08 225,856 -----c--- D:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-19 20:26 . 1996-08-20 20:37 15,840 --a------ D:\WINDOWS\system32\Machnm1.exe
2008-06-19 20:26 . 2005-09-25 16:37 5,632 --a------ D:\WINDOWS\system32\Machnm64.sys
2008-06-19 20:26 . 2008-06-19 20:26 3,120 --a------ D:\WINDOWS\system32\118290.54
2008-06-19 20:26 . 2008-06-19 20:26 3,120 --a------ D:\WINDOWS\118294.78
2008-06-19 20:26 . 2003-08-13 00:27 2,304 --a------ D:\WINDOWS\system32\Machnm32.sys
2008-06-17 20:06 . 2008-06-17 20:06 268 --ah----- D:\sqmdata14.sqm
2008-06-17 20:06 . 2008-06-17 20:06 244 --ah----- D:\sqmnoopt14.sqm

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-16 22:57 --------- d-----w D:\Program Files\Lavasoft
2008-07-16 22:57 --------- d-----w D:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-20 17:47 247,808 ----a-w D:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51 361,600 ----a-w D:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w D:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w D:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 18:26 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-06-16 04:07 --------- d-----w D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-14 17:33 272,768 ------w D:\WINDOWS\system32\drivers\bthport.sys
2008-06-07 17:10 --------- d-----w D:\Documents and Settings\laurence\Application Data\Media Player Classic
2008-05-31 18:45 --------- d-----w D:\Documents and Settings\laurence\Application Data\vlc
2008-05-28 10:15 --------- d-----w D:\Program Files\Vimicro
2008-05-28 10:15 --------- d-----w D:\Program Files\Fichiers communs\InstallShield
2008-05-26 18:06 --------- d-----w D:\Documents and Settings\laurence\Application Data\InstallShield
2008-05-22 14:25 --------- d-----w D:\Documents and Settings\miniche\Application Data\Media Player Classic
2008-05-21 21:11 --------- d-----w D:\Program Files\ATI Technologies
2008-05-21 20:34 --------- d-----w D:\Program Files\Satsuki Decoder Pack
2008-05-21 20:32 --------- d-----w D:\Documents and Settings\All Users\Application Data\TEMP
2008-05-21 20:31 --------- d-----w D:\Program Files\Fichiers communs\Adobe
2008-05-21 20:13 --------- d-----w D:\Program Files\SLD Codec Pack
2008-05-21 20:03 --------- d-----w D:\Program Files\VideoLAN
2008-05-21 20:02 --------- d-----w D:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-05-21 20:01 --------- d-----w D:\Program Files\Windows Media Connect 2
2008-05-21 19:56 --------- d-----w D:\Documents and Settings\miniche\Application Data\Ahead
2008-05-21 19:54 --------- d-----w D:\Program Files\Nero
2008-05-21 19:54 --------- d-----w D:\Program Files\Fichiers communs\Ahead
2008-05-21 18:17 --------- d-----w D:\Program Files\uTorrent
2008-05-21 18:17 --------- d-----w D:\Documents and Settings\miniche\Application Data\uTorrent
2008-05-21 18:16 --------- d-----w D:\Program Files\CCleaner
2008-05-21 14:28 --------- d-----w D:\Program Files\Spybot - Search & Destroy
2008-05-21 14:24 --------- d-----w D:\Program Files\TrackMania Nations ESWC
2008-05-21 14:19 --------- d-----w D:\Program Files\Windows Live
2008-05-21 14:18 --------- dcsh--w D:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-05-21 14:16 --------- d-----w D:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-20 19:04 --------- d-----w D:\Program Files\Alwil Software
2008-05-20 18:55 --------- d-----w D:\Program Files\microsoft frontpage
2008-05-20 18:53 --------- d-----w D:\Program Files\Services en ligne
2008-05-16 09:58 12,632 ----a-w D:\WINDOWS\system32\lsdelete.exe
2008-05-09 10:55 90,112 ----a-w D:\WINDOWS\system32\wshext.dll
2008-05-09 10:55 430,080 ----a-w D:\WINDOWS\system32\vbscript.dll
2008-05-09 10:55 180,224 ----a-w D:\WINDOWS\system32\scrobj.dll
2008-05-09 10:55 172,032 ----a-w D:\WINDOWS\system32\scrrun.dll
2008-05-08 11:24 155,648 ----a-w D:\WINDOWS\system32\wscript.exe
2008-05-07 09:07 135,168 ----a-w D:\WINDOWS\system32\cscript.exe
2008-05-07 05:11 1,294,336 ----a-w D:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w D:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:33 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="D:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18 94208]
"msnmsgr"="D:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"AlcoholAutomount"="D:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 21:05 344064]
"BigDogPath"="D:\WINDOWS\VM_STI.EXE" [2004-06-09 15:37 40960]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 00:34 57344 D:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 04:33 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 D:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 D:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-05-21 15:46 1271032 d:\Valve\Steam\Steam.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Valve\\Steam\\steamapps\\angelwhoopy\\condition zero\\hl.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;D:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;D:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;D:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-02-26 05:54]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-NWEReboot - (no file)
SSODL-evgratsm-{6266D5CB-61A1-4EA0-8635-509D225EB70A} - D:\WINDOWS\evgratsm.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-17 16:35:16
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...


D:\Documents and Settings\miniche\Local Settings\Application Data\Ahead\Nero Home\indexstore.db-journal 512 bytes


**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
D:\WINDOWS\system32\ati2evxx.exe
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\system32\ati2evxx.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\WINDOWS\system32\logonui.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-17 16:40:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-17 14:38:59

Pre-Run: 114,447,527,936 octets libres
Post-Run: 114,397,192,192 octets libres

181 --- E O F --- 2008-07-10 14:59:49

miniche
Profil : IDNaute
Plus d'informations
n°323541
17-07-2008 à 19:43:06

ComboFix 08-07-15.4 - miniche 2008-07-17 16:30:43.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.457 [GMT 2:00]
Endroit: D:\Documents and Settings\miniche\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\WINDOWS\cookies.ini
D:\WINDOWS\eprt.exe
D:\WINDOWS\evgratsm.dll
D:\WINDOWS\system32\atbqimmq.dll
D:\WINDOWS\system32\ddcYpqrp.dll
D:\WINDOWS\system32\dgkpnono.dll
D:\WINDOWS\system32\hbsqsapb.dll
D:\WINDOWS\system32\mcrh.tmp
D:\WINDOWS\system32\ononpkgd.ini
D:\WINDOWS\system32\pmnkHxVl.dll
D:\WINDOWS\system32\ppxidbps.ini
D:\WINDOWS\system32\prqpYcdd.ini
D:\WINDOWS\system32\prqpYcdd.ini2
D:\WINDOWS\system32\qgjyxi.dll
D:\WINDOWS\system32\twjsvi.dll
D:\WINDOWS\system32\vtUlKawT.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-17 to 2008-07-17 ))))))))))))))))))))))))))))))))))))
.

2008-07-17 00:57 . 2008-07-17 00:57 <REP> d-------- D:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-17 00:48 . 2008-07-17 06:36 <REP> d-------- D:\WINDOWS\SxsCaPendDel
2008-07-16 23:40 . 2008-07-16 23:40 <REP> d-------- D:\Documents and Settings\All Users\Application Data\SecuriSoft SARL
2008-07-16 19:59 . 2008-07-16 19:59 86 --a------ D:\WINDOWS\wininit.ini
2008-07-16 17:25 . 2008-07-16 17:25 69 --a------ D:\WINDOWS\NeroDigital.ini
2008-07-16 17:00 . 2008-07-16 14:29 102,400 --a------ D:\WINDOWS\agpqlrfm.exe
2008-07-16 17:00 . 2006-11-09 15:48 11,776 --a------ D:\WINDOWS\system32\drivers\wasfsd.sys
2008-07-16 16:59 . 2008-07-16 17:00 <REP> d-------- D:\Program Files\USS
2008-07-16 16:59 . 2008-07-16 16:59 0 --a------ D:\END
2008-06-25 06:16 . 2008-06-25 06:16 268 --ah----- D:\sqmdata19.sqm
2008-06-25 06:16 . 2008-06-25 06:16 244 --ah----- D:\sqmnoopt19.sqm
2008-06-23 22:41 . 2008-06-23 22:41 268 --ah----- D:\sqmdata18.sqm
2008-06-23 22:41 . 2008-06-23 22:41 244 --ah----- D:\sqmnoopt18.sqm
2008-06-23 21:01 . 2008-06-23 21:01 <REP> d-------- D:\Program Files\Alcohol Soft
2008-06-23 20:59 . 2008-06-23 20:59 715,248 --a------ D:\WINDOWS\system32\drivers\sptd.sys
2008-06-23 20:59 . 2008-06-23 20:59 268 --ah----- D:\sqmdata17.sqm
2008-06-23 20:59 . 2008-06-23 20:59 244 --ah----- D:\sqmnoopt17.sqm
2008-06-23 19:17 . 2008-06-23 21:19 1,905 --a------ D:\WINDOWS\diagwrn.xml
2008-06-23 19:17 . 2008-06-23 21:19 1,905 --a------ D:\WINDOWS\diagerr.xml
2008-06-23 00:46 . 2008-06-23 00:46 268 --ah----- D:\sqmdata16.sqm
2008-06-23 00:46 . 2008-06-23 00:46 244 --ah----- D:\sqmnoopt16.sqm
2008-06-20 19:47 . 2008-06-20 19:47 247,808 -----c--- D:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 19:47 . 2008-06-20 19:47 147,968 -----c--- D:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 18:34 . 2008-06-20 18:34 268 --ah----- D:\sqmdata15.sqm
2008-06-20 18:34 . 2008-06-20 18:34 244 --ah----- D:\sqmnoopt15.sqm
2008-06-20 13:51 . 2008-06-20 13:51 361,600 -----c--- D:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 13:40 . 2008-06-20 13:40 138,496 -----c--- D:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 13:08 . 2008-06-20 13:08 225,856 -----c--- D:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-19 20:26 . 1996-08-20 20:37 15,840 --a------ D:\WINDOWS\system32\Machnm1.exe
2008-06-19 20:26 . 2005-09-25 16:37 5,632 --a------ D:\WINDOWS\system32\Machnm64.sys
2008-06-19 20:26 . 2008-06-19 20:26 3,120 --a------ D:\WINDOWS\system32\118290.54
2008-06-19 20:26 . 2008-06-19 20:26 3,120 --a------ D:\WINDOWS\118294.78
2008-06-19 20:26 . 2003-08-13 00:27 2,304 --a------ D:\WINDOWS\system32\Machnm32.sys
2008-06-17 20:06 . 2008-06-17 20:06 268 --ah----- D:\sqmdata14.sqm
2008-06-17 20:06 . 2008-06-17 20:06 244 --ah----- D:\sqmnoopt14.sqm

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-16 22:57 --------- d-----w D:\Program Files\Lavasoft
2008-07-16 22:57 --------- d-----w D:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-20 17:47 247,808 ----a-w D:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51 361,600 ----a-w D:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w D:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w D:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 18:26 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-06-16 04:07 --------- d-----w D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-14 17:33 272,768 ------w D:\WINDOWS\system32\drivers\bthport.sys
2008-06-07 17:10 --------- d-----w D:\Documents and Settings\laurence\Application Data\Media Player Classic
2008-05-31 18:45 --------- d-----w D:\Documents and Settings\laurence\Application Data\vlc
2008-05-28 10:15 --------- d-----w D:\Program Files\Vimicro
2008-05-28 10:15 --------- d-----w D:\Program Files\Fichiers communs\InstallShield
2008-05-26 18:06 --------- d-----w D:\Documents and Settings\laurence\Application Data\InstallShield
2008-05-22 14:25 --------- d-----w D:\Documents and Settings\miniche\Application Data\Media Player Classic
2008-05-21 21:11 --------- d-----w D:\Program Files\ATI Technologies
2008-05-21 20:34 --------- d-----w D:\Program Files\Satsuki Decoder Pack
2008-05-21 20:32 --------- d-----w D:\Documents and Settings\All Users\Application Data\TEMP
2008-05-21 20:31 --------- d-----w D:\Program Files\Fichiers communs\Adobe
2008-05-21 20:13 --------- d-----w D:\Program Files\SLD Codec Pack
2008-05-21 20:03 --------- d-----w D:\Program Files\VideoLAN
2008-05-21 20:02 --------- d-----w D:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-05-21 20:01 --------- d-----w D:\Program Files\Windows Media Connect 2
2008-05-21 19:56 --------- d-----w D:\Documents and Settings\miniche\Application Data\Ahead
2008-05-21 19:54 --------- d-----w D:\Program Files\Nero
2008-05-21 19:54 --------- d-----w D:\Program Files\Fichiers communs\Ahead
2008-05-21 18:17 --------- d-----w D:\Program Files\uTorrent
2008-05-21 18:17 --------- d-----w D:\Documents and Settings\miniche\Application Data\uTorrent
2008-05-21 18:16 --------- d-----w D:\Program Files\CCleaner
2008-05-21 14:28 --------- d-----w D:\Program Files\Spybot - Search & Destroy
2008-05-21 14:24 --------- d-----w D:\Program Files\TrackMania Nations ESWC
2008-05-21 14:19 --------- d-----w D:\Program Files\Windows Live
2008-05-21 14:18 --------- dcsh--w D:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-05-21 14:16 --------- d-----w D:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-20 19:04 --------- d-----w D:\Program Files\Alwil Software
2008-05-20 18:55 --------- d-----w D:\Program Files\microsoft frontpage
2008-05-20 18:53 --------- d-----w D:\Program Files\Services en ligne
2008-05-16 09:58 12,632 ----a-w D:\WINDOWS\system32\lsdelete.exe
2008-05-09 10:55 90,112 ----a-w D:\WINDOWS\system32\wshext.dll
2008-05-09 10:55 430,080 ----a-w D:\WINDOWS\system32\vbscript.dll
2008-05-09 10:55 180,224 ----a-w D:\WINDOWS\system32\scrobj.dll
2008-05-09 10:55 172,032 ----a-w D:\WINDOWS\system32\scrrun.dll
2008-05-08 11:24 155,648 ----a-w D:\WINDOWS\system32\wscript.exe
2008-05-07 09:07 135,168 ----a-w D:\WINDOWS\system32\cscript.exe
2008-05-07 05:11 1,294,336 ----a-w D:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w D:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:33 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="D:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18 94208]
"msnmsgr"="D:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"AlcoholAutomount"="D:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 21:05 344064]
"BigDogPath"="D:\WINDOWS\VM_STI.EXE" [2004-06-09 15:37 40960]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 00:34 57344 D:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 04:33 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 D:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 D:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-05-21 15:46 1271032 d:\Valve\Steam\Steam.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Valve\\Steam\\steamapps\\angelwhoopy\\condition zero\\hl.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;D:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;D:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;D:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-02-26 05:54]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-NWEReboot - (no file)
SSODL-evgratsm-{6266D5CB-61A1-4EA0-8635-509D225EB70A} - D:\WINDOWS\evgratsm.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-17 16:35:16
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...


D:\Documents and Settings\miniche\Local Settings\Application Data\Ahead\Nero Home\indexstore.db-journal 512 bytes


**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
D:\WINDOWS\system32\ati2evxx.exe
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\system32\ati2evxx.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\WINDOWS\system32\logonui.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-17 16:40:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-17 14:38:59

Pre-Run: 114,447,527,936 octets libres
Post-Run: 114,397,192,192 octets libres

181 --- E O F --- 2008-07-10 14:59:49

Bruce Lee72
Profil : IDNaute
Plus d'informations
n°323551
17-07-2008 à 19:58:56

Bonjour,

1/ Ouvre le Bloc-notes ( Menu Démarrer\Tous les programmes\Accessoires\Bloc-notes)

2/ Copie ce qui est en citation ci-dessous (sans le mot citation) par sélection puis Ctrl-C :

Citation :

File::
D:\WINDOWS\agpqlrfm.exe
D:\WINDOWS\system32\drivers\wasfsd.sys
D:\sqmdata19.sqm
D:\sqmnoopt19.sqm
D:\sqmdata18.sqm
D:\sqmnoopt18.sqm
D:\sqmdata17.sqm
D:\sqmnoopt17.sqm
D:\sqmdata16.sqm
D:\sqmnoopt16.sqm
D:\sqmdata15.sqm
D:\sqmnoopt15.sqm
D:\sqmdata14.sqm
D:\sqmnoopt14.sqm

Dirlook::
D:\WINDOWS\system32\118290.54
D:\WINDOWS\118294.78




-Enregistre ce fichier dans: Bureau
-Nom du fichier : CFScript
-Type du fichier : tous les fichiers
-clique sur Enregistrer
-quitte le Bloc Notes


  • Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture


http://img.photobucket.com/albums/v666/sUBs/CFScript.gif[list]

  • Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort), tape 1 puis valide.
  • Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

  • Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
  • Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

[/list]

miniche
Profil : IDNaute
Plus d'informations
n°323596
17-07-2008 à 22:37:00

merci de tout ton aide

ComboFix 08-07-15.4 - miniche 2008-07-17 22:18:50.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.425 [GMT 2:00]
Endroit: D:\Documents and Settings\miniche\Bureau\ComboFix.exe
Command switches used :: D:\Documents and Settings\miniche\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]

FILE ::
D:\sqmdata14.sqm
D:\sqmdata15.sqm
D:\sqmdata16.sqm
D:\sqmdata17.sqm
D:\sqmdata18.sqm
D:\sqmdata19.sqm
D:\sqmnoopt14.sqm
D:\sqmnoopt15.sqm
D:\sqmnoopt16.sqm
D:\sqmnoopt17.sqm
D:\sqmnoopt18.sqm
D:\sqmnoopt19.sqm
D:\WINDOWS\agpqlrfm.exe
D:\WINDOWS\system32\drivers\wasfsd.sys
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\sqmdata14.sqm
D:\sqmdata15.sqm
D:\sqmdata16.sqm
D:\sqmdata17.sqm
D:\sqmdata18.sqm
D:\sqmdata19.sqm
D:\sqmnoopt14.sqm
D:\sqmnoopt15.sqm
D:\sqmnoopt16.sqm
D:\sqmnoopt17.sqm
D:\sqmnoopt18.sqm
D:\sqmnoopt19.sqm
D:\WINDOWS\agpqlrfm.exe
D:\WINDOWS\system32\drivers\wasfsd.sys

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-17 to 2008-07-17 ))))))))))))))))))))))))))))))))))))
.

2008-07-17 00:57 . 2008-07-17 00:57 <REP> d-------- D:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-17 00:48 . 2008-07-17 06:36 <REP> d-------- D:\WINDOWS\SxsCaPendDel
2008-07-16 23:40 . 2008-07-16 23:40 <REP> d-------- D:\Documents and Settings\All Users\Application Data\SecuriSoft SARL
2008-07-16 19:59 . 2008-07-16 19:59 86 --a------ D:\WINDOWS\wininit.ini
2008-07-16 17:25 . 2008-07-16 17:25 69 --a------ D:\WINDOWS\NeroDigital.ini
2008-07-16 16:59 . 2008-07-16 17:00 <REP> d-------- D:\Program Files\USS
2008-07-16 16:59 . 2008-07-16 16:59 0 --a------ D:\END
2008-06-23 21:01 . 2008-06-23 21:01 <REP> d-------- D:\Program Files\Alcohol Soft
2008-06-23 20:59 . 2008-06-23 20:59 715,248 --a------ D:\WINDOWS\system32\drivers\sptd.sys
2008-06-23 19:17 . 2008-06-23 21:19 1,905 --a------ D:\WINDOWS\diagwrn.xml
2008-06-23 19:17 . 2008-06-23 21:19 1,905 --a------ D:\WINDOWS\diagerr.xml
2008-06-20 19:47 . 2008-06-20 19:47 247,808 -----c--- D:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 19:47 . 2008-06-20 19:47 147,968 -----c--- D:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 13:51 . 2008-06-20 13:51 361,600 -----c--- D:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 13:40 . 2008-06-20 13:40 138,496 -----c--- D:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 13:08 . 2008-06-20 13:08 225,856 -----c--- D:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-19 20:26 . 1996-08-20 20:37 15,840 --a------ D:\WINDOWS\system32\Machnm1.exe
2008-06-19 20:26 . 2005-09-25 16:37 5,632 --a------ D:\WINDOWS\system32\Machnm64.sys
2008-06-19 20:26 . 2008-06-19 20:26 3,120 --a------ D:\WINDOWS\system32\118290.54
2008-06-19 20:26 . 2008-06-19 20:26 3,120 --a------ D:\WINDOWS\118294.78
2008-06-19 20:26 . 2003-08-13 00:27 2,304 --a------ D:\WINDOWS\system32\Machnm32.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-17 19:59 --------- d-----w D:\Program Files\TrackMania Nations ESWC
2008-07-16 22:57 --------- d-----w D:\Program Files\Lavasoft
2008-07-16 22:57 --------- d-----w D:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-20 11:51 361,600 ----a-w D:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w D:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w D:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 18:26 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-06-16 04:07 --------- d-----w D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-14 17:33 272,768 ------w D:\WINDOWS\system32\drivers\bthport.sys
2008-06-07 17:10 --------- d-----w D:\Documents and Settings\laurence\Application Data\Media Player Classic
2008-05-31 18:45 --------- d-----w D:\Documents and Settings\laurence\Application Data\vlc
2008-05-28 10:15 --------- d-----w D:\Program Files\Vimicro
2008-05-28 10:15 --------- d-----w D:\Program Files\Fichiers communs\InstallShield
2008-05-26 18:06 --------- d-----w D:\Documents and Settings\laurence\Application Data\InstallShield
2008-05-22 14:25 --------- d-----w D:\Documents and Settings\miniche\Application Data\Media Player Classic
2008-05-21 21:11 --------- d-----w D:\Program Files\ATI Technologies
2008-05-21 20:34 --------- d-----w D:\Program Files\Satsuki Decoder Pack
2008-05-21 20:32 --------- d-----w D:\Documents and Settings\All Users\Application Data\TEMP
2008-05-21 20:31 --------- d-----w D:\Program Files\Fichiers communs\Adobe
2008-05-21 20:13 --------- d-----w D:\Program Files\SLD Codec Pack
2008-05-21 20:03 --------- d-----w D:\Program Files\VideoLAN
2008-05-21 20:02 --------- d-----w D:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-05-21 20:01 --------- d-----w D:\Program Files\Windows Media Connect 2
2008-05-21 19:56 --------- d-----w D:\Documents and Settings\miniche\Application Data\Ahead
2008-05-21 19:54 --------- d-----w D:\Program Files\Nero
2008-05-21 19:54 --------- d-----w D:\Program Files\Fichiers communs\Ahead
2008-05-21 18:17 --------- d-----w D:\Program Files\uTorrent
2008-05-21 18:17 --------- d-----w D:\Documents and Settings\miniche\Application Data\uTorrent
2008-05-21 18:16 --------- d-----w D:\Program Files\CCleaner
2008-05-21 14:28 --------- d-----w D:\Program Files\Spybot - Search & Destroy
2008-05-21 14:19 --------- d-----w D:\Program Files\Windows Live
2008-05-21 14:18 --------- dcsh--w D:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-05-21 14:16 --------- d-----w D:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-20 19:04 --------- d-----w D:\Program Files\Alwil Software
2008-05-20 18:55 --------- d-----w D:\Program Files\microsoft frontpage
2008-05-20 18:53 --------- d-----w D:\Program Files\Services en ligne
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of D:\WINDOWS\118294.78 ----

D:\WINDOWS\118294.78\

---- Directory of D:\WINDOWS\system32\118290.54 ----

D:\WINDOWS\system32\118290.54\


((((((((((((((((((((((((((((( snapshot@2008-07-17_16.38.46.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-08-10 12:44:04 50,688 ----a-w D:\WINDOWS\system32\drivers\sfdrv01.sys
+ 2005-05-16 13:20:39 6,656 ----a-w D:\WINDOWS\system32\drivers\sfhlp02.sys
+ 2005-11-03 14:40:07 63,488 ----a-w D:\WINDOWS\system32\drivers\sfvfs02.sys
+ 2008-07-17 18:16:40 16,384 ----atw D:\WINDOWS\Temp\Perflib_Perfdata_5e0.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:33 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="D:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18 94208]
"msnmsgr"="D:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 21:05 344064]
"BigDogPath"="D:\WINDOWS\VM_STI.EXE" [2004-06-09 15:37 40960]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 00:34 57344 D:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 04:33 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli

[HKLM\~\startupfolder\^NTUSER.DAT]
path=\NTUSER.DAT
backup=D:\WINDOWS\pss\NTUSER.DATCommon Startup

[HKLM\~\startupfolder\^NTUSER.DAT.LOG]
path=\NTUSER.DAT.LOG
backup=D:\WINDOWS\pss\NTUSER.DAT.LOGCommon Startup

[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
backup=D:\WINDOWS\pss\ntuser.iniCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 09:20 222080 D:\Program Files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 D:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 D:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-05-21 15:46 1271032 d:\Valve\Steam\Steam.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Valve\\Steam\\steamapps\\angelwhoopy\\condition zero\\hl.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"D:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=

R1 aswSP;avast! Self Protection;D:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;D:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;D:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-02-26 05:54]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-17 22:22:23
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...


**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
D:\WINDOWS\system32\ati2evxx.exe
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
D:\WINDOWS\system32\ati2evxx.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-17 22:27:02 - machine was rebooted [miniche]
ComboFix-quarantined-files.txt 2008-07-17 20:25:58
ComboFix2.txt 2008-07-17 14:40:06

Pre-Run: 114,076,979,200 octets libres
Post-Run: 114,095,226,880 octets libres

191 --- E O F --- 2008-07-10 14:59:49

miniche
Profil : IDNaute
Plus d'informations
n°323597
17-07-2008 à 22:38:10

ComboFix 08-07-15.4 - miniche 2008-07-17 22:18:50.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.425 [GMT 2:00]
Endroit: D:\Documents and Settings\miniche\Bureau\ComboFix.exe
Command switches used :: D:\Documents and Settings\miniche\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]

FILE ::
D:\sqmdata14.sqm
D:\sqmdata15.sqm
D:\sqmdata16.sqm
D:\sqmdata17.sqm
D:\sqmdata18.sqm
D:\sqmdata19.sqm
D:\sqmnoopt14.sqm
D:\sqmnoopt15.sqm
D:\sqmnoopt16.sqm
D:\sqmnoopt17.sqm
D:\sqmnoopt18.sqm
D:\sqmnoopt19.sqm
D:\WINDOWS\agpqlrfm.exe
D:\WINDOWS\system32\drivers\wasfsd.sys
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\sqmdata14.sqm
D:\sqmdata15.sqm
D:\sqmdata16.sqm
D:\sqmdata17.sqm
D:\sqmdata18.sqm
D:\sqmdata19.sqm
D:\sqmnoopt14.sqm
D:\sqmnoopt15.sqm
D:\sqmnoopt16.sqm
D:\sqmnoopt17.sqm
D:\sqmnoopt18.sqm
D:\sqmnoopt19.sqm
D:\WINDOWS\agpqlrfm.exe
D:\WINDOWS\system32\drivers\wasfsd.sys

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-17 to 2008-07-17 ))))))))))))))))))))))))))))))))))))
.

2008-07-17 00:57 . 2008-07-17 00:57 <REP> d-------- D:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-17 00:48 . 2008-07-17 06:36 <REP> d-------- D:\WINDOWS\SxsCaPendDel
2008-07-16 23:40 . 2008-07-16 23:40 <REP> d-------- D:\Documents and Settings\All Users\Application Data\SecuriSoft SARL
2008-07-16 19:59 . 2008-07-16 19:59 86 --a------ D:\WINDOWS\wininit.ini
2008-07-16 17:25 . 2008-07-16 17:25 69 --a------ D:\WINDOWS\NeroDigital.ini
2008-07-16 16:59 . 2008-07-16 17:00 <REP> d-------- D:\Program Files\USS
2008-07-16 16:59 . 2008-07-16 16:59 0 --a------ D:\END
2008-06-23 21:01 . 2008-06-23 21:01 <REP> d-------- D:\Program Files\Alcohol Soft
2008-06-23 20:59 . 2008-06-23 20:59 715,248 --a------ D:\WINDOWS\system32\drivers\sptd.sys
2008-06-23 19:17 . 2008-06-23 21:19 1,905 --a------ D:\WINDOWS\diagwrn.xml
2008-06-23 19:17 . 2008-06-23 21:19 1,905 --a------ D:\WINDOWS\diagerr.xml
2008-06-20 19:47 . 2008-06-20 19:47 247,808 -----c--- D:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 19:47 . 2008-06-20 19:47 147,968 -----c--- D:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 13:51 . 2008-06-20 13:51 361,600 -----c--- D:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 13:40 . 2008-06-20 13:40 138,496 -----c--- D:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 13:08 . 2008-06-20 13:08 225,856 -----c--- D:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-19 20:26 . 1996-08-20 20:37 15,840 --a------ D:\WINDOWS\system32\Machnm1.exe
2008-06-19 20:26 . 2005-09-25 16:37 5,632 --a------ D:\WINDOWS\system32\Machnm64.sys
2008-06-19 20:26 . 2008-06-19 20:26 3,120 --a------ D:\WINDOWS\system32\118290.54
2008-06-19 20:26 . 2008-06-19 20:26 3,120 --a------ D:\WINDOWS\118294.78
2008-06-19 20:26 . 2003-08-13 00:27 2,304 --a------ D:\WINDOWS\system32\Machnm32.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-17 19:59 --------- d-----w D:\Program Files\TrackMania Nations ESWC
2008-07-16 22:57 --------- d-----w D:\Program Files\Lavasoft
2008-07-16 22:57 --------- d-----w D:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-20 11:51 361,600 ----a-w D:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w D:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w D:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 18:26 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-06-16 04:07 --------- d-----w D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-14 17:33 272,768 ------w D:\WINDOWS\system32\drivers\bthport.sys
2008-06-07 17:10 --------- d-----w D:\Documents and Settings\laurence\Application Data\Media Player Classic
2008-05-31 18:45 --------- d-----w D:\Documents and Settings\laurence\Application Data\vlc
2008-05-28 10:15 --------- d-----w D:\Program Files\Vimicro
2008-05-28 10:15 --------- d-----w D:\Program Files\Fichiers communs\InstallShield
2008-05-26 18:06 --------- d-----w D:\Documents and Settings\laurence\Application Data\InstallShield
2008-05-22 14:25 --------- d-----w D:\Documents and Settings\minic