VIRUS ALERT !

Bonjour à tous,

J'ai un portable ( TOSHIBA - Xp edition tablet Pc SP2 )

je me suis retrouvé, comme beaucoup ces derniers temps, avec ce vilain message d'alert VIRUS ALERT ! à coté de l'horloge de la barre des taches, C: ayant disparu, plus d'accès internet, impossible de faire de regedit, d'accéder à la gestion des tâches, etc...

J'ai donc fouillé les différents forums et j'ai lancé COMBOFIX ( mode opératoire: http://www.bleepingcomputer.com/combofix/fr/comment-uti... )

Apparemment, tout est nikel, mais je vous pose au cas où le log que j'ai récupéré pour savoir s'il y a quelques résidus qui trainent encore...

Merci,



-----------------------------------------------





ComboFix 08-07-22.4 - P.Boero 2008-07-24 11:27:54.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.979 [GMT 2:00]
Endroit: C:\Documents and Settings\P.Boero.HOMEBUSINESS\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\P.Boero.HOMEBUSINESS\Bureau\WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
* Création d'un nouveau point de restauration
* Resident AV is active

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\65360906.exe
C:\Documents and Settings\__sbs_netsetup__\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\AntiSpywareExpert
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\AntiSpywareExpert\AntiSpywareExpert.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\AntiSpywareExpert\Uninstall AntiSpywareExpert.lnk
C:\Documents and Settings\MMV_Admin\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\P.Boero.HOMEBUSINESS\Application Data\rhcrubj0ee51
C:\Documents and Settings\P.Boero.HOMEBUSINESS\err.log
C:\Documents and Settings\P.Boero.HOMEBUSINESS\Favoris\Error Cleaner.url
C:\Documents and Settings\P.Boero.HOMEBUSINESS\Favoris\Privacy Protector.url
C:\Documents and Settings\P.Boero.HOMEBUSINESS\Favoris\Spyware&Malware Protection.url
C:\Documents and Settings\P.Boero.PORT_PB\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\P.Boero\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Program Files\rhcrubj0ee51
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\cgzxzp.dll
C:\WINDOWS\system32\efcyYpMc.dll
C:\WINDOWS\system32\gptafdkg.dll
C:\WINDOWS\system32\hgGATmmM.dll
C:\WINDOWS\system32\jKAPjiIb.dll
C:\WINDOWS\system32\kcsghdfi.dll
C:\WINDOWS\system32\maejib.dll
C:\WINDOWS\system32\MmmTAGgh.ini
C:\WINDOWS\system32\MmmTAGgh.ini2
C:\WINDOWS\system32\nsmxkrwt.ini
C:\WINDOWS\system32\twrkxmsn.dll
C:\WINDOWS\system32\wqtkiebn.ini

----- BITS: Possible sites infect‚s -----

http://sbs:8530
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-24 to 2008-07-24 ))))))))))))))))))))))))))))))))))))
.

2008-07-24 11:07 . 2008-07-24 11:07 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-21 16:20 . 2008-07-23 12:44 <REP> d--h----- C:\$AVG8.VAULT$
2008-07-21 15:58 . 2008-07-21 15:58 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-21 15:58 . 2008-07-21 15:58 12,936 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys
2008-07-21 15:58 . 2008-07-21 15:58 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-07-21 15:57 . 2008-07-22 07:36 <REP> d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-21 15:57 . 2008-07-21 15:57 <REP> d-------- C:\Program Files\AVG
2008-07-21 15:57 . 2008-07-21 19:28 <REP> d-------- C:\Documents and Settings\P.Boero.HOMEBUSINESS\Application Data\AVGTOOLBAR
2008-07-21 15:57 . 2008-07-21 15:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-07-21 15:57 . 2008-07-21 15:57 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-21 13:52 . 2008-07-21 13:53 <REP> d-------- C:\Program Files\SPYWAREfighter
2008-07-21 12:53 . 2008-07-21 12:53 <REP> d-------- C:\Program Files\Fichiers communs\Intruder Trace
2008-07-21 12:50 . 2008-07-22 07:33 <REP> d-------- C:\Program Files\TweakRAM
2008-07-18 11:17 . 2008-07-18 11:17 <REP> d-------- C:\Documents and Settings\P.Boero.HOMEBUSINESS\Mes documents
2008-07-09 02:11 . 2008-06-20 19:41 247,808 -----c--- C:\WINDOWS\system32\dllcache\mswsock.dll
2008-07-09 02:11 . 2008-06-20 12:44 138,368 -----c--- C:\WINDOWS\system32\dllcache\afd.sys
2008-07-08 14:52 . 2008-07-08 15:03 <REP> d-------- C:\Documents and Settings\P.Boero.HOMEBUSINESS\Application Data\ntr

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-24 09:41 --------- d-----w C:\Program Files\SPAMfighter
2008-07-24 09:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-22 09:12 --------- d-----w C:\Program Files\OrangeBs
2008-07-21 00:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-07-17 21:38 --------- d-----w C:\Program Files\Google
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 13:22 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-16 19:07 --------- d-----w C:\Documents and Settings\P.Boero.HOMEBUSINESS\Application Data\U3
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-09 09:43 --------- d-----w C:\Program Files\MSECache
2008-06-05 08:05 --------- d-----w C:\Documents and Settings\P.Boero.HOMEBUSINESS\Application Data\PDFcreator
2008-06-03 05:56 --------- d-----w C:\Documents and Settings\P.Boero.HOMEBUSINESS\Application Data\Nokia
2008-06-03 05:55 --------- d-----w C:\Documents and Settings\P.Boero.HOMEBUSINESS\Application Data\PC Suite
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-15 15:45 724,984 -c--a-w C:\Documents and Settings\P.Boero\gotomypc_437.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 21:00 15360]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2005-04-11 23:08 65536]
"PC Suite Tray"="C:\Program Files\nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
"TweakRAM"="C:\Program Files\TweakRAM\TweakRAM.exe" [2008-05-22 11:28 1520128]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe" [2006-06-26 10:46 497200]
"LVCOMSX"="C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe" [2006-06-26 11:33 243248]
"ITcw"="C:\Program Files\Fichiers communs\Intruder Trace\ITcw.exe" [2008-03-06 11:55 241664]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-21 15:57 1232152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 21:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispSettingPage"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"= 1 (0x1)
"LockTaskbar"= 1 (0x1)
"NoSimpleStartMenu"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
2004-08-04 21:00 47104 C:\Program Files\Fichiers communs\Microsoft Shared\Ink\LoginKey.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2005-12-22 05:42 40448 C:\WINDOWS\system32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
2002-08-29 18:45 11776 C:\WINDOWS\system32\tabbtnwl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TosBtNP]
2006-01-28 20:49 61440 C:\WINDOWS\system32\TosBtNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
2004-08-04 21:00 30208 C:\WINDOWS\system32\tpgwlnot.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TSigNP]
2006-01-30 19:51 53248 C:\WINDOWS\system32\TSigNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage rapide du logiciel HP Image Zone.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage rapide du logiciel HP Image Zone.lnk
backup=C:\WINDOWS\pss\Démarrage rapide du logiciel HP Image Zone.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^EPSON Status Monitor 3 Environment Check(2).lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\EPSON Status Monitor 3 Environment Check(2).lnk
backup=C:\WINDOWS\pss\EPSON Status Monitor 3 Environment Check(2).lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=C:\WINDOWS\pss\Outil de mise à jour Google.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
--a------ 2008-03-09 00:00 36864 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
--a------ 2006-06-26 11:34 614960 C:\Program Files\Logitech\QuickCam10\QuickCam10.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SPAMfighter Agent]
--a------ 2008-04-30 12:36 321160 C:\Program Files\SPAMfighter\SFAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spywarefighterguard]
--a------ 2008-02-21 15:37 115344 C:\Program Files\SPYWAREfighter\spftray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-09-09 16:56 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\000StTHK]
--a------ 2001-06-23 10:28 24576 C:\WINDOWS\system32\000StTHK.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"C:\\Program Files\\OpenVPN\\bin\\openvpn.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\UltraVNC\\winvnc.exe"=
"C:\\Program Files\\nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Fichiers communs\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-07-21 15:58]
R0 Thpdrv;TOSHIBA HDD Protection Driver;C:\WINDOWS\system32\DRIVERS\thpdrv.sys [2004-12-28 07:31]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;C:\WINDOWS\system32\DRIVERS\Thpevm.SYS [2004-11-13 20:24]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-21 15:57]
R1 TMEI3E;TMEI3E;C:\WINDOWS\system32\Drivers\TMEI3E.SYS [2004-06-16 18:08]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-21 15:57]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-21 15:58]
R2 FdRedir;FdRedir;C:\Program Files\Fichiers communs\Protector Suite QL\Drivers\FdRedir.sys [2005-12-22 05:55]
R2 FileDisk2;FileDisk Protector Kernel Driver;C:\Program Files\Fichiers communs\Protector Suite QL\Drivers\filedisk.sys [2005-12-22 05:55]
R2 smihlp;SMI helper driver;C:\Program Files\Protector Suite QL\smihlp.sys [2005-12-22 05:25]
R2 SPAMfighter Update Service;SPAMfighter Update Service;C:\Program Files\SPAMfighter\sfus.exe [2008-04-30 12:37]
R2 vnccom;vnccom;C:\WINDOWS\system32\Drivers\vnccom.SYS [2004-06-26 16:22]
R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2005-06-11 04:26]
R3 tap0801;TAP-Win32 Adapter V8;C:\WINDOWS\system32\DRIVERS\tap0801.sys [2006-10-01 14:37]
R3 TEchoCan;Toshiba Audio Effect;C:\WINDOWS\system32\DRIVERS\TEchoCan.sys [2005-12-27 01:59]
R3 WacomPen;Pilote de tablette Wacom à stylet série;C:\WINDOWS\system32\DRIVERS\wacompen.sys [2004-08-04 07:04]
S2 RGFILERW;RGFILERW;C:\WINDOWS\system32\Drivers\RGFILERW.SYS []
S3 GTF32BUS;GT F32 BUS;C:\WINDOWS\system32\DRIVERS\gtf32bus.sys [2005-09-01 19:54]
S3 GTPTSER;GT PT SER;C:\WINDOWS\system32\DRIVERS\gtptser.sys [2005-09-01 19:54]
S3 GTSCSER;GT SC SER;C:\WINDOWS\system32\DRIVERS\gtscser.sys [2005-08-29 17:45]
S3 HPPLSBULK;HPPLSBULK;C:\WINDOWS\system32\drivers\hpplsbulk.sys [2005-02-03 01:29]
S3 SpyFighter;SpyFighter Guard Device;C:\Program Files\SPYWAREfighter\spyfighter.sys [2008-02-21 15:38]
S3 SPYWAREfighterRP;SPYWAREfighterRP;C:\Program Files\SPYWAREfighter\spfprc.exe [2008-02-21 15:37]
S3 UnlockerDriver4;UnlockerDriver4 Driver;C:\Program Files\Unlocker\UnlockerDriver4.sys []
S4 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;C:\WINDOWS\system32\DRIVERS\TBtnKey.sys [2002-09-13 04:48]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{771ba58f-166c-11dd-839d-001302c2df13}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c93da7c6-4cd3-11dc-ac8b-001302c2df13}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cef3e623-a877-11dc-830c-001302c2df13}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-07-23 16:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
- - - - ORPHANS REMOVED - - - -

BHO-{3AA6678D-1CE0-499E-B9F6-8444DEE39D88} - (no file)
BHO-{77B17486-C867-4031-A38B-7AB293C50A5F} - (no file)
BHO-{c6aae82b-1bb0-4cbd-b983-744a5b0ff75c} - (no file)
Toolbar-{3FCAEB7D-F8AE-4A67-AE6C-57EE1416BB6D} - C:\WINDOWS\qndsfmao.dll
HKCU-Run-Antispyware-2008.exe - C:\Program Files\Antispyware 2008\Antispyware-2008.exe
HKLM-Run-AntiSpywareExpert - C:\Program Files\AntiSpywareExpert\ase_fr.exe
HKLM-Run-Intruder Trace - C:\Program Files\Intruder Trace\ITrace.exe
HKLM-Run-80475771 - C:\WINDOWS\system32\twrkxmsn.dll
ShellExecuteHooks-{ED0ACB58-556F-21DA-DDFE-6D20F3F611BB} - C:\WINDOWS\system32\kb1ss1p.dll
SSODL-kvxqmtre-{A778C94B-B3C5-44C5-A4C5-AFFEA36D733F} - C:\WINDOWS\kvxqmtre.dll
SSODL-evgratsm-{AD5DAA99-7AA2-41DD-B942-A2AE5289CE6F} - C:\WINDOWS\evgratsm.dll
Notify-jKAPjiIb - (no file)


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fr/
R0 -: HKLM-Main,Start Page = hxxp://www.google.com
O18 -: Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O16 -: {7584C670-2274-4EFB-B00B-D6AABA6D3850} - hxxps://siege.homebusiness.fr/Remote/msrdp.cab
C:\WINDOWS\Downloaded Program Files\msrdp.inf
C:\WINDOWS\Downloaded Program Files\msrdp.ocx

O16 -: {7D5DD829-6C90-42C5-B54C-2AFA82F988BA} - hxxp://www.antivirusxp2008.com/tools/virusremover.dll
C:\WINDOWS\Downloaded Program Files\virusremover.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-24 11:48:27
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...


C:\WINDOWS\TEMP\70033644-d5e4-430b-94a6-9bab618186bc.tmp

Scan termin‚ avec succŠs
Les fichiers cach‚s: 1

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\eEBAPI\eEBSvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Ink\KeyboardSurrogate.exe
C:\WINDOWS\system32\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Toshiba\TOSHIBA RAID\Service\kraidsvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Toshiba\TOSHIBA RAID\Service\krdevctl.exe
C:\WINDOWS\system32\ThpSrv.exe
C:\Program Files\Toshiba\TME3\TMESRV31.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\wisptis.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\tabbtnu.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Ink\tcserver.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-24 11:52:47 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-24 09:52:36

Pre-Run: 32,181,522,432 octets libres
Post-Run: 35,855,478,784 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect /forceresetreg
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

280 --- E O F --- 2008-07-09 11:03:11