Bonjour,
Je rencontre le meme probleme que Sherno (sujet HLDRRR.EXE0... J'ai fait plusieurs nettoyages avec divers outils, je croyais m'en etre debarrasse, mais les memes problemes sont revenus. J'ai donc besoin d'aide, s'il-vous-plait.
Merci d'avance !
Ci-dessous les logs successifs d'Helibagle, puis 2 de Hijackthis, 2 de Malwarebyte's, et 2 de AVG antispyware (c'est tout...).
J'ai aussi reinstalle McAfee, qui ne marche toujours pas, et Kerio firewall, qui ne marche pas non plus (message au demarrage du systeme : "Kerio HIPS Driver found an incompatible DLL "entapi.dll". The HIPS Driver has been unloaded" ).
Merci de votre aide !


Mon Sep 22 19:29:55 2008
EliBagle v11.75 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 22 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINNT\SYSTEM32\DRIVERS\SROSA.SYS --> Eliminado Bagle (rootkit)
C:\WINNT\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Renombrado a .VIR

Mon Sep 22 19:41:28 2008
EliBagle v11.75 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 22 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINNT\SYSTEM32\Drivers\HLDRRR.EXE.VIR --> Eliminado
Restaurada Clave: "SafeBoot\Minimal y Network"

Mon Sep 22 19:42:25 2008
EliBagle v11.75 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 22 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\
C:\Program Files\Spybot - Search & Destroy\TEATIMER.EXE --> Eliminado Bagle.dldr

Nº Total de Directorios: 5590
Nº Total de Ficheros: 51718
Nº de Ficheros Analizados: 9352
Nº de Ficheros Infectados: 1
Nº de Ficheros Limpiados: 1

Mon Sep 22 19:55:49 2008
EliBagle v11.75 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 22 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

Mon Sep 22 19:55:53 2008
EliBagle v11.75 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 22 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 5590
Nº Total de Ficheros: 51717
Nº de Ficheros Analizados: 9351
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Mon Sep 22 22:31:06 2008
EliBagle v11.75 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 22 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

Mon Sep 22 22:31:10 2008
EliBagle v11.75 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 22 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 5590
Nº Total de Ficheros: 51726
Nº de Ficheros Analizados: 9353
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Tue Sep 23 11:29:52 2008
EliBagle v11.75 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 22 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

Tue Sep 23 11:29:55 2008
EliBagle v11.75 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 22 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 4870
Nº Total de Ficheros: 46235
Nº de Ficheros Analizados: 9386
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Tue Sep 23 11:43:40 2008
EliBagle v11.75 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 22 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 4870
Nº Total de Ficheros: 46235
Nº de Ficheros Analizados: 9386
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0









Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:46:43, on 22/09/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\asuskbservice.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\tbmon.exe
C:\Program Files\Multimédia\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Multimédia\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Documents and Settings\Hamir\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\Multimédia\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Raccourci vers sunbird.exe.lnk = C:\Program Files\Bureautique\sunbird\sunbird.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Bureautique\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O15 - Trusted Zone: www.archivio.name
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wi [...] 7719401390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mi [...] 7719693640
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ASUSKeyboardService - ASUSTeK COMPUTER INC. - C:\WINNT\asuskbservice.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\Multimédia\CDBurnerXP Pro 3\Tools\NMSAccess.exe (file missing)
O23 - Service: %NVSVC.name% (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--
End of file - 6632 bytes






Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:57:12, on 23/09/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Safe mode

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Documents and Settings\Hamir\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\Multimédia\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Raccourci vers sunbird.exe.lnk = C:\Program Files\Bureautique\sunbird\sunbird.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Bureautique\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O15 - Trusted Zone: www.archivio.name
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wi [...] 7719401390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mi [...] 7719693640
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ASUSKeyboardService - ASUSTeK COMPUTER INC. - C:\WINNT\asuskbservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\Multimédia\CDBurnerXP Pro 3\Tools\NMSAccess.exe (file missing)
O23 - Service: %NVSVC.name% (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe

--
End of file - 6204 bytes







Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1134
Windows 5.0.2195 Service Pack 4

23/09/2008 00:26:05
mbam-log-2008-09-23 (00-26-05).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 86530
Temps écoulé: 53 minute(s), 16 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Interface\{85e06077-c824-43d0-a8dc-5efb17bc348a} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1" ) Good: (regedit.exe "%1" ) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\WINNT\system32\drivers\downld (Trojan.Agent) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)









Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1134
Windows 5.0.2195 Service Pack 4

23/09/2008 13:50:21
mbam-log-2008-09-23 (13-50-21).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 80989
Temps écoulé: 1 hour(s), 4 minute(s), 33 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)






---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 01:24:29 23/09/2008

+ Résultat de l'analyse:



HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Nettoyé.
HKU\S-1-5-21-343818398-583907252-839522115-1000\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Nettoyé.
C:\Program Files\Free.fr\connect.exe -> Dialer.Freefr : Nettoyé.
C:\Documents and Settings\Hamir\Bureau\ELIBAGLA.%D8BA%D8B%D8%D8H.EXE -> Heuristic.Win32.AVKiller : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport





---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 12:38:28 23/09/2008

+ Résultat de l'analyse:



C:\Documents and Settings\Hamir\Bureau\ELIBAGLA.ØBAØBØØH.EXE -> Heuristic.Win32.AVKiller : Nettoyé.


Fin du rapport

Bonjour,
Merci de me consacrer un peu de ton temps.


ComboFix 08-09-22.05 - Hamir 23/09/2008 22:07:52.1 - NTFSx86 MINIMAL
Lancé depuis: C:\Documents and Settings\Hamir\Bureau\ComboFix.exe

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\InfoSat.txt
C:\Program Files\scurit~1
C:\Program Files\scurit~1\Personal Firewall 4\Config\charts.dat
C:\Program Files\scurit~1\Personal Firewall 4\Config\kpf.cfg
C:\Program Files\scurit~1\Personal Firewall 4\crashdump.tar.gz
C:\Program Files\scurit~1\Personal Firewall 4\logs\debug.log
C:\Program Files\scurit~1\Personal Firewall 4\logs\debug.log.idx
C:\Program Files\scurit~1\Personal Firewall 4\logs\error.log
C:\Program Files\scurit~1\Personal Firewall 4\logs\error.log.idx
C:\Program Files\scurit~1\Personal Firewall 4\logs\hips.log
C:\Program Files\scurit~1\Personal Firewall 4\logs\hips.log.idx
C:\Program Files\scurit~1\Personal Firewall 4\logs\ids.log
C:\Program Files\scurit~1\Personal Firewall 4\logs\khips.log
C:\Program Files\scurit~1\Personal Firewall 4\logs\network.log
C:\Program Files\scurit~1\Personal Firewall 4\logs\network.log.idx
C:\Program Files\scurit~1\Personal Firewall 4\logs\system.log
C:\Program Files\scurit~1\Personal Firewall 4\logs\system.log.idx
C:\Program Files\scurit~1\Personal Firewall 4\logs\warning.log
C:\Program Files\scurit~1\Personal Firewall 4\logs\warning.log.idx
C:\Program Files\scurit~1\Personal Firewall 4\logs\web.log
C:\Program Files\scurit~1\Personal Firewall 4\server.dbk
C:\Program Files\scurit~1\Spybot - Search & Destroy\advcheck.dll
C:\Program Files\scurit~1\Spybot - Search & Destroy\aports.dll
C:\Program Files\scurit~1\Spybot - Search & Destroy\blindman.exe
C:\Program Files\scurit~1\Spybot - Search & Destroy\borlndmm.dll
C:\Program Files\scurit~1\Spybot - Search & Destroy\Default configuration.ini
C:\Program Files\scurit~1\Spybot - Search & Destroy\delphimm.dll
C:\Program Files\scurit~1\Spybot - Search & Destroy\Dummies\dummy.cd_clint.dll
C:\Program Files\scurit~1\Spybot - Search & Destroy\Dummies\dummy.dap.gif
C:\Program Files\scurit~1\Spybot - Search & Destroy\Dummies\dummy.data.xml
C:\Program Files\scurit~1\Spybot - Search & Destroy\Dummies\dummy.default.gif
C:\Program Files\scurit~1\Spybot - Search & Destroy\Dummies\dummy.related.htm
C:\Program Files\scurit~1\Spybot - Search & Destroy\Help\Deutsch.license.txt
C:\Program Files\scurit~1\Spybot - Search & Destroy\Help\English.chm
C:\Program Files\scurit~1\Spybot - Search & Destroy\Help\English.license.txt
C:\Program Files\scurit~1\Spybot - Search & Destroy\Help\English.Resident.chm
C:\Program Files\scurit~1\Spybot - Search & Destroy\Help\Francais.chm
C:\Program Files\scurit~1\Spybot - Search & Destroy\Help\Francais.license.txt
C:\Program Files\scurit~1\Spybot - Search & Destroy\Help\Francais.Resident.chm
C:\Program Files\scurit~1\Spybot - Search & Destroy\Help\Italiano.license.txt
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\AdvWhite.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Adware.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\AdwareC.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Browserpages.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\CLSIDs.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Cookies.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Cookies.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Dialer.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Dialer.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\DialerC.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Domains.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\FPFix.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\HeavyDuty.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Hijackers.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\HijackersC.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Keyloggers.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\KeyloggersC.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Logs.uts
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\LSP.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\LSP.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Malware.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\MalwareC.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\OperaPlugins.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\ProcWatch.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\PUPS.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\PUPSC.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\RegDFLinks.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\RegWatch.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Revision.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Revision.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Searchpages.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Security.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\SecurityC.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Services.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Spybots.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\SpybotsC.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Spyware.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\SpywareC.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Startup.tnfo
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Targets.Francais.nfo
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Targets.nfo
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Tracks.uti
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\Trojans.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\TrojansC.sbi
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\URL-Blacklist.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Includes\X509White.sbs
C:\Program Files\scurit~1\Spybot - Search & Destroy\Languages\Deutsch.sbl
C:\Program Files\scurit~1\Spybot - Search & Destroy\Languages\English.sbl
C:\Program Files\scurit~1\Spybot - Search & Destroy\Languages\Espanol.sbl
C:\Program Files\scurit~1\Spybot - Search & Destroy\Languages\Francais.sbl
C:\Program Files\scurit~1\Spybot - Search & Destroy\Languages\Italiano.sbl
C:\Program Files\scurit~1\Spybot - Search & Destroy\messages.zres
C:\Program Files\scurit~1\Spybot - Search & Destroy\OptOut.ini
C:\Program Files\scurit~1\Spybot - Search & Destroy\Plugins\TCPIPAddress.dll
C:\Program Files\scurit~1\Spybot - Search & Destroy\SDHelper.dll
C:\Program Files\scurit~1\Spybot - Search & Destroy\Skins\Colorblind.ini
C:\Program Files\scurit~1\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\scurit~1\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\scurit~1\Spybot - Search & Destroy\Tools.dll
C:\Program Files\scurit~1\Spybot - Search & Destroy\unins000.dat
C:\Program Files\scurit~1\Spybot - Search & Destroy\unins000.exe
C:\Program Files\scurit~1\Spybot - Search & Destroy\UnzDll.dll
C:\Program Files\scurit~1\Spybot - Search & Destroy\Update.exe
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\advcheck.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\advcheck15.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\advcheck151.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\advcheck152.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\advcheck153.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\clsid.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\desc.english.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\desc.francais.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\downloaded.ini
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\help.english.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\help.francais.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\helpres.english.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\helpres.francais.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\includes.dialer.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\includes.hijackers.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\includes.keyloggers.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\includes.malware.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\includes.pups.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\includes.security.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\includes.spybots.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\includes.trojans.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\includes.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\lang.francais.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\mainapp152.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\online.ini
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\plugtcpip.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\quickfix.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\sbsd152upd.exe
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\sbsd152upd.wem
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\skins.main.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\startup.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\tools.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\tools15.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\Updates\tools212.zip
C:\Program Files\scurit~1\Spybot - Search & Destroy\ZipDll.dll
C:\Program Files\scurit~1\SpywareBlaster\ckdatabase.dtb
C:\Program Files\scurit~1\SpywareBlaster\license.txt
C:\Program Files\scurit~1\SpywareBlaster\readme.txt
C:\Program Files\scurit~1\SpywareBlaster\rsdatabase.dtb
C:\Program Files\scurit~1\SpywareBlaster\sbauhelp.chm
C:\Program Files\scurit~1\SpywareBlaster\sbautoupdate.exe
C:\Program Files\scurit~1\SpywareBlaster\sbdatabase.dtb
C:\Program Files\scurit~1\SpywareBlaster\sbdatabase2.dtb
C:\Program Files\scurit~1\SpywareBlaster\sbdatabaseinf.dtb
C:\Program Files\scurit~1\SpywareBlaster\sbdatabaseinf2.dtb
C:\Program Files\scurit~1\SpywareBlaster\sbhelp.chm
C:\Program Files\scurit~1\SpywareBlaster\sbinfo.dtb
C:\Program Files\scurit~1\SpywareBlaster\sbversion2.txt
C:\Program Files\scurit~1\SpywareBlaster\spywareblaster.exe
C:\Program Files\scurit~1\SpywareBlaster\unins000.dat
C:\Program Files\scurit~1\SpywareBlaster\unins000.exe
C:\Program Files\scurit~1\ZebProtect.exe
C:\WINNT\Web\default.htt

.
((((((((((((((((((((((((( Files Created from 2008-08-23 to 2008-09-23 )))))))))))))))))))))))))))))))
.

2008-09-23 11:49 . 07-05-30 14:10 10,872 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2008-09-23 11:18 . 08-09-23 11:21 536,072,192 --a------ C:\WINNT\MEMORY.DMP
2008-09-23 11:03 . 08-09-23 11:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Network Associates
2008-09-23 11:03 . 05-08-22 20:00 114,624 --a------ C:\WINNT\system32\drivers\naiavf5x.sys
2008-09-23 11:03 . 05-08-22 20:00 58,464 --a------ C:\WINNT\system32\drivers\mvstdi5x.sys
2008-09-23 11:02 . 08-09-23 11:03 <DIR> d-------- C:\Program Files\Network Associates
2008-09-23 10:45 . 04-06-03 04:40 68,224 -ra------ C:\WINNT\system32\drivers\nvraid.sys
2008-09-23 10:45 . 04-06-03 04:40 18,432 -ra------ C:\WINNT\system32\nvraidco.dll
2008-09-23 10:29 . 04-05-17 07:49 198,656 -ra------ C:\WINNT\system32\fdco1.dll
2008-09-23 10:29 . 04-05-17 08:00 191,232 -ra------ C:\WINNT\system32\drivers\nvsnpu.sys
2008-09-23 10:29 . 04-09-07 08:23 156,672 -ra------ C:\WINNT\system32\RTLCPAPI.dll
2008-09-23 10:29 . 04-05-17 08:00 56,960 -ra------ C:\WINNT\system32\drivers\nvnrm.sys
2008-09-23 10:29 . 04-05-17 08:00 33,408 -ra------ C:\WINNT\system32\drivers\NVENETFD.sys
2008-09-23 10:29 . 04-05-10 02:53 32,256 -ra------ C:\WINNT\system32\nvconrm.dll
2008-09-23 10:29 . 04-05-17 08:00 12,928 -ra------ C:\WINNT\system32\drivers\nvnetbus.sys
2008-09-23 10:29 . 04-05-17 07:48 8,192 -ra------ C:\WINNT\system32\bdco1.dll
2008-09-23 10:28 . 05-05-18 09:17 18,726,912 -ra------ C:\WINNT\system32\ALSNDMGR.CPL
2008-09-23 10:28 . 05-05-18 09:15 9,389,568 -ra------ C:\WINNT\system32\RTLCPL.EXE
2008-09-23 10:28 . 05-05-18 11:50 2,319,680 -ra------ C:\WINNT\system32\drivers\ALCXWDM.SYS
2008-09-23 10:28 . 02-02-05 07:54 141,016 -ra------ C:\WINNT\system32\ALSNDMGR.WAV
2008-09-23 10:28 . 05-05-17 12:48 77,824 -ra------ C:\WINNT\SOUNDMAN.EXE
2008-09-23 10:26 . 03-06-19 12:05 148,208 --a------ C:\WINNT\system32\drivers\portcls.sys
2008-09-23 10:26 . 03-06-19 12:05 148,208 --a--c--- C:\WINNT\system32\dllcache\portcls.sys
2008-09-23 10:26 . 03-06-19 12:05 21,264 --a------ C:\WINNT\system32\wdmaud.drv
2008-09-23 10:18 . 04-07-12 12:25 5,218,304 -ra------ C:\WINNT\system32\nvoglnt.lrc
2008-09-23 10:17 . 04-07-01 10:12 1,642,496 -ra------ C:\WINNT\system32\nvwdmcpl.dll
2008-09-23 10:17 . 04-07-01 10:12 1,363,968 -ra------ C:\WINNT\system32\nview.dll
2008-09-23 10:17 . 04-07-01 10:12 1,110,016 -ra------ C:\WINNT\system32\nvdspsch.exe
2008-09-23 10:17 . 04-07-01 10:12 1,019,904 -ra------ C:\WINNT\system32\nvwimg.dll
2008-09-23 10:17 . 04-07-01 10:12 843,776 -ra------ C:\WINNT\system32\nwiz.exe
2008-09-23 10:17 . 04-07-01 10:12 454,656 -ra------ C:\WINNT\system32\nvshell.dll
2008-09-23 10:17 . 04-07-01 10:12 438,272 -ra------ C:\WINNT\system32\nvappbar.exe
2008-09-23 10:17 . 04-07-01 10:12 352,256 -ra------ C:\WINNT\system32\keystone.exe
2008-09-23 10:17 . 04-07-01 10:12 73,728 -ra------ C:\WINNT\system32\nvtuicpl.cpl
2008-09-23 10:17 . 04-07-01 10:12 4,582 -ra------ C:\WINNT\system32\nvapps.xml
2008-09-23 00:47 . 08-09-23 00:47 <DIR> d-------- C:\Documents and Settings\Hamir\Application Data\Grisoft
2008-09-23 00:47 . 08-09-23 00:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-09-23 00:43 . 08-09-23 00:43 <DIR> d-------- C:\Program Files\CCleaner
2008-09-22 22:59 . 08-09-22 22:59 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-22 22:59 . 08-09-22 22:59 <DIR> d-------- C:\Documents and Settings\Hamir\Application Data\Malwarebytes
2008-09-22 22:59 . 08-09-22 22:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-22 22:59 . 08-09-10 00:04 38,528 --a------ C:\WINNT\system32\drivers\mbamswissarmy.sys
2008-09-22 22:59 . 08-09-10 00:03 17,200 --a------ C:\WINNT\system32\drivers\mbam.sys
2008-09-22 18:14 . 08-09-22 18:14 <DIR> d-------- C:\fsaua.data
2008-09-21 22:50 . 08-09-23 10:15 54,156 --ah----- C:\WINNT\QTFont.qfn
2008-09-21 22:50 . 08-09-21 22:50 1,409 --a------ C:\WINNT\QTFont.for
2008-09-19 16:31 . 08-09-19 16:31 <DIR> d-------- C:\WINNT\Lhsp
2008-09-15 18:39 . 08-09-15 18:49 <DIR> d-------- C:\Program Files\Picasa2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-23 15:51 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-09-23 09:18 45,056 -c--a-w C:\WINNT\system32\drivers\fwdrv.err
2008-09-23 09:02 --------- d-----w C:\Program Files\Fichiers communs\Network Associates
2008-09-23 08:49 --------- d-----w C:\Program Files\Sunbelt Software
2008-09-23 08:41 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-23 08:36 --------- d---a-w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-22 23:24 --------- d-----w C:\Program Files\Free.fr
2008-09-19 16:38 --------- d-----w C:\Program Files\adslTV
2008-09-15 16:40 --------- d-----w C:\Program Files\Google
2008-09-15 08:49 --------- d-----w C:\Program Files\Sony
2008-09-14 18:04 --------- d-----w C:\Program Files\Java
2008-08-03 08:06 --------- d-----w C:\Documents and Settings\Hamir\Application Data\dvdcss
2008-07-27 07:32 --------- d-----w C:\Documents and Settings\Hamir\Application Data\Sony Corporation
2008-07-27 07:26 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-26 08:41 --------- d-----w C:\Documents and Settings\Hamir\Application Data\Skype
2006-03-26 18:36 271 ---h--w C:\Program Files\desktop.ini
2006-03-26 18:36 22,115 -c-h--w C:\Program Files\folder.htt
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [06-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINNT\system32\NvCpl.dll" [04-07-09 12:02 4136960]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [03-09-29 17:00 155648]
"QuickTime Task"="C:\Program Files\QuickTime Alternative\qttask.exe" [08-06-15 16:38 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [08-06-10 04:27 144784]
"NvMediaCenter"="C:\WINNT\system32\NvMcTray.dll" [04-07-09 12:02 81920]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" [04-09-22 20:00 94208]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [04-08-06 03:50 139320]
"Network Associates Error Reporting Service"="C:\Program Files\Fichiers communs\Network Associates\TalkBack\tbmon.exe" [03-10-07 09:48 147514]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [07-06-11 11:25 6731312]
"Synchronization Manager"="mobsync.exe" [03-06-19 12:05 111888 C:\WINNT\system32\mobsync.exe]
"nwiz"="nwiz.exe" [04-07-01 10:12 843776 C:\WINNT\system32\nwiz.exe]
"anvshell"="anvshell.exe" [04-06-24 15:28 393216 C:\WINNT\anvshell.exe]
"SoundMan"="SOUNDMAN.EXE" [05-05-17 12:48 77824 C:\WINNT\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [99-12-16 02:00 20752 C:\WINNT\system32\internat.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [03-06-19 12:05 189712]

C:\Documents and Settings\Hamir\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-03-26 110592]
Raccourci vers sunbird.exe.lnk - C:\Program Files\Bureautique\sunbird\sunbird.exe [2006-03-27 5238784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nwprovau]
06-09-01 07:49 143632 C:\WINNT\system32\NWPROVAU.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SRService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wd.sys]
@="Driver"

R0 SONYPVM1;Sony Memory Stick Driver(SONYPVM1);C:\WINNT\system32\DRIVERS\SONYPVM1.SYS [00-05-27 04:37 28224]
R1 ANVIOCTL;ANVIOCTL;C:\WINNT\system32\DRIVERS\anvioctl.sys [04-07-08 15:44 233816]
R1 fwdrv;Firewall Driver;C:\WINNT\system32\drivers\fwdrv.sys [05-12-15 18:13 274432]
R1 khips;Kerio HIPS Driver;C:\WINNT\system32\drivers\khips.sys [05-12-15 18:01 81920]
R1 oreans32;oreans32;C:\WINNT\system32\drivers\oreans32.sys [06-11-13 18:37 33824]
R3 EntDrv50;EntDrv50;C:\WINNT\system32\drivers\EntDrv50.sys [05-08-22 20:00 8576]
R3 openhci;Pilote de contrôleur hôte ouvert USB Microsoft;C:\WINNT\system32\DRIVERS\openhci.sys [03-06-19 12:05 24784]
R3 usbhub20;Prise en charge du concentrateur racine USB 2.0;C:\WINNT\system32\DRIVERS\usbhub20.sys [03-06-19 12:05 49776]
S3 fbxusb;Carte réseau virtuelle FreeBox USB;C:\WINNT\system32\DRIVERS\fbxusb32.sys [04-10-20 14:23 21344]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-iTunesHelper - C:\Program Files\Multimédia\iTunesHelper.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Hamir\Application Data\Mozilla\Firefox\Profiles\qdscdlmi.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - about:blank
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\adslTV\npvlc.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPStreamPlug.dll
FF -: plugin - C:\Program Files\Multimédia\Netscape6\nppl3260.dll
FF -: plugin - C:\Program Files\Multimédia\Netscape6\nprjplug.dll
FF -: plugin - C:\Program Files\Multimédia\Netscape6\nprpjplug.dll
FF -: plugin - C:\Program Files\Picasa2\npPicasa2.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-23 22:15:25
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-09-23 22:20:28 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-23 20:20:23

Avant-CF: 1ÿ409ÿ646ÿ592 octets libres
Post-Run: 1,450,037,248 octets libres

316 --- E O F --- 2008-09-23 09:13:43

Re,

Tu avais créé un dossier C:\Program Files\scurit~1 ?

Au fait, j'ai aussi désinstallé Spybot (au profit d'AVG antispyware), ainsi que Kerio (au profit de ZoneAlarm)

Re,
(désolé, je ne peux pas être sur mon ordi tout le temps)

Voici le rapport Malwarebyte, semble-t-il clean.



Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1203
Windows 5.0.2195 Service Pack 4

25/09/2008 11:48:52
mbam-log-2008-09-25 (11-48-52).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 80624
Temps écoulé: 1 hour(s), 3 minute(s), 15 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Non, tout est ok. Merci !
Juste un détail apparu au fil des manips : les pages de Word, Firefox ou Sunbird débordent de mon écran, pourtant 19'' (obligé d'utiliser les barres de déplacement horizontal et vertical pour visualiser tous les coins des fichiers), et impossible d'ajuster via l'affichage ou les options d'affichage (celles des applis comme celles de windows). Comme si tout avait grandi, ajusté à un écran plus grand. Sais-tu qu'est-ce qui pourrait avoir causé ça (probablement un fichier supprimé par CCleaner, par ex ?), et comment retrouver un affichage normal ?
En tout cas, merci beaucoup de ton aide précieuse
http://img.infos-du-net.com/forum/ [...] /wahoo.gif

Je finirai bien par trouver, et c'est vraiment mineur.
Merci encore - et bonne continuation