[Résolu] WIn32 :FASEC?
Forum Sécurité - Virus : [Résolu] WIn32 :FASEC?
Lire la meilleure réponse, apportée par Angeldark.
completement 
j ai voulu faire un recherche, 4 sec apres couic!
Voici
ComboFix 09-02-25.02 - joyeux 2009-02-26 19:29:57.1 - [color=red]FAT32[/color]x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2943.2491 [GMT 1:00]
Lancé depuis: c:\documents and settings\joyeux\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
.
[color=purple]Les fichiers ci-dessous ont été désactivés pendant l'exécution:[/color]
c:\program files\SuperCopier2\SC2Hook.dll
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
c:\documents and settings\joyeux\ravmonlog
c:\program files\webmediaplayer
c:\program files\webmediaplayer\resources\languages.xml
c:\program files\webmediaplayer\resources\webmedias
c:\program files\webmediaplayer\skins\classic.skn
c:\program files\webmediaplayer\sqlite3.dll
c:\program files\webmediaplayer\WebMediaPlayer.url
c:\windows\IE4 Error Log.txt
c:\windows\pack.epk
c:\windows\system32\drivers\gaopdxltivkjba.sys
c:\windows\system32\gaopdxqgoeypxb.dll
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_gaopdxserv.sys
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-26 au 2009-02-26 ))))))))))))))))))))))))))))))))))))
.
2009-02-23 07:43 . 2009-02-23 07:43 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-23 07:43 . 2009-02-23 07:43 <REP> d-------- c:\documents and settings\joyeux\Application Data\Malwarebytes
2009-02-23 07:43 . 2009-02-23 07:43 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-23 07:43 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-23 07:43 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-22 18:20 . 268,435,456 c:\windows\system32\temppf.sys
2009-02-19 22:34 . 2009-02-19 22:34 <REP> d-------- c:\program files\Avira
2009-02-19 22:34 . 2009-02-19 22:34 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-19 21:21 . 2009-02-19 21:21 <REP> d-------- C:\ToolBar SD
2009-02-18 20:57 . 2009-02-18 20:56 102,664 --a------ c:\windows\system32\drivers\tmcomm.sys
2009-02-18 20:56 . 2009-02-18 20:56 <REP> d-------- c:\documents and settings\joyeux\.housecall6.6
2009-02-16 20:49 . 2009-01-22 14:28 290,816 --a------ c:\windows\system32\decdll.dll
2009-02-16 20:06 . 2009-02-16 20:06 <REP> d-------- c:\documents and settings\joyeux\Application Data\AVS4YOU
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-22 17:01 98,304 ----a-w c:\windows\DUMP2a85.tmp
2009-02-22 15:58 98,304 ----a-w c:\windows\DUMP15b5.tmp
2009-02-20 20:53 98,304 ----a-w c:\windows\DUMPc6bb.tmp
2009-02-20 11:54 98,304 ----a-w c:\windows\DUMPbb80.tmp
2009-02-18 19:02 98,304 ----a-w c:\windows\DUMP91b0.tmp
2009-02-18 18:56 98,304 ----a-w c:\windows\DUMP91d0.tmp
2009-02-18 18:44 98,304 ----a-w c:\windows\DUMP536f.tmp
2009-02-18 18:36 98,304 ----a-w c:\windows\DUMP4ce7.tmp
2009-02-17 20:32 98,304 ----a-w c:\windows\DUMP9b36.tmp
2009-02-16 20:36 98,304 ----a-w c:\windows\DUMP1ecd.tmp
2009-01-23 10:45 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2009-01-20 05:54 --------- d-----w c:\program files\Fichiers communs\AVSMedia
2009-01-19 22:02 --------- d-----w c:\program files\Free Video Converter
2009-01-19 21:31 --------- d-----w c:\program files\Fichiers communs\Adobe AIR
2009-01-19 21:31 --------- d-----w c:\program files\Canal
2009-01-05 22:33 3,751,995 ----a-w c:\windows\system32\GPhotos.scr
2009-01-04 19:00 --------- d-----w c:\program files\Izuba Energies
2009-01-04 19:00 --------- d-----w c:\documents and settings\All Users\Application Data\Pleiades
2008-12-23 09:50 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-22 18:42 3,532 ----a-w C:\drmHeader.bin
2008-12-12 17:02 3,088,896 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-12 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-12-12 10:11 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2007-12-14 13:18 2,995,368 ----a-w c:\documents and settings\joyeux\SVGView.exe
2006-11-18 22:34 251 ----a-w c:\program files\wt3d.ini
2006-11-18 19:38 278,528 ----a-w c:\program files\Fichiers communs\FDEUnInstaller.exe
2006-10-12 16:17 3,072 ----a-w c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2006-02-13 11:07 245,408 ----a-w c:\program files\mozilla firefox\plugins\unicows.dll
2008-08-21 23:33 2 --sha-r c:\windows\winstart.bat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-07-18 438272]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"preload"="c:\windows\RUNXMLPL.exe" [2005-05-19 32768]
"PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2007-07-06 159744]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"CaptureCommander"="c:\windows\Capture.exe" [2007-03-08 98816]
"Boot"="c:\acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 579584]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 53248]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-23 136600]
"Canal Widget"="c:\program files\Canal\Canal Widget\Launcher.exe" [2009-02-04 106040]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 c:\windows\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2006-07-20 c:\windows\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.EXE" [2008-04-14 c:\windows\system32\rundll32.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-10-07 805392]
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-11-17 45056]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 02:42 72208 c:\program files\Fichiers communs\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\C:\0autocheck autochk *
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-09-03 20:12 111936 c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-09-10 17:40 289576 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RichVideo"=2 (0x2)
"iPod Service"=3 (0x3)
"gusvc"=3 (0x3)
"CLSched"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"avast! Antivirus"=c:\program files\Alwil Software\Avast4\ashAvast.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Hamachi\\HAMACHI.EXE"=
"c:\\WINDOWS\\PCHEALTH\\HELPCTR\\BINARIES\\HelpCtr.exe"=
"c:\\WINDOWS\\System32\\CNAC1RPK.EXE"=
"c:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3y.exe"=
"c:\\Program Files\\Graphisoft\\ArchiCAD 11 RC1\\ArchiCAD.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Java\\jre1.6.0_02\\bin\\javaw.exe"=
"c:\\Program Files\\adslTV\\vlc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15984:TCP"= 15984:TCP:NortonAV
"15460:TCP"= 15460:TCP:NortonAV
"14431:TCP"= 14431:TCP:NortonAV
"13217:TCP"= 13217:TCP:NortonAV
"15300:TCP"= 15300:TCP:NortonAV
"18580:TCP"= 18580:TCP:NortonAV
"13869:TCP"= 13869:TCP:NortonAV
"13116:TCP"= 13116:TCP:NortonAV
"13925:TCP"= 13925:TCP:NortonAV
R2 CanalPlus.VOD;CanalPlus.VOD;c:\program files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe [2008-12-10 61440]
R2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;c:\windows\system32\eLock2BurnerLockDriver.sys [2006-11-17 17664]
R2 eLock2FSCTLDriver;eLock2FSCTLDriver;c:\windows\system32\eLock2FSCTLDriver.sys [2006-11-17 90112]
R2 LockServ;LockServ;c:\acer\Empowering Technology\eLock\LockServ.exe -p --> c:\acer\Empowering Technology\eLock\LockServ.exe -p [?]
S3 ausens;ausens;c:\windows\system32\drivers\ausens.sys [2003-08-13 404736]
S3 epindd;epindd;c:\windows\system32\drivers\EPINDD.SYS [2006-11-17 8448]
S3 k600bus;Sony Ericsson 600i driver (WDM);c:\windows\system32\drivers\k600bus.sys [2005-05-11 52384]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;c:\windows\system32\drivers\k600mdfl.sys [2005-05-11 6096]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;c:\windows\system32\drivers\k600mdm.sys [2005-05-11 87456]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;c:\windows\system32\drivers\k600mgmt.sys [2005-05-11 79248]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;c:\windows\system32\drivers\k600obex.sys [2005-05-11 77072]
S3 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys --> c:\windows\system32\drivers\Partizan.sys [?]
S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [2008-08-20 25773]
S3 uafilter;uafilter;c:\windows\system32\drivers\UAFilter.sys [2007-12-30 9886]
S3 USBVCD;Canon USB Video;c:\windows\system32\drivers\USBVCD.sys [2004-10-05 57856]
S3 VCIDRV;Canon USB Video Control;c:\windows\system32\drivers\VCIDRV.sys [2004-10-05 6528]
S3 XE102Mp5;XE102Mp5 NDIS Protocol Driver;c:\windows\system32\drivers\XE102Mp5.sys [2008-06-01 21120]
S3 XE102Sp5;XE102Sp5 NDIS Protocol Driver;c:\windows\system32\drivers\XE102Sp5.sys [2008-06-01 18176]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\autorun.exe
\Shell\setup\command - D:\install.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{06537e56-f679-11dd-a4da-0016d34873f1}]
\Shell\AutoRun\command - E:\EmDesk.exe
\Shell\EmDesk\command - E:\EmDesk.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eb41e9a0-bd8f-11db-a1e5-0016cf5bc188}]
\Shell\AutoRun\command - F:\v.cmd
\Shell\explore\Command - F:\v.cmd
\Shell\open\Command - F:\v.cmd
.
Contenu du dossier 'Tâches planifiées'
2008-04-07 c:\windows\Tasks\Uniblue SpeedUpMyPC.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
2009-02-11 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
2009-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHELINS SUPPRIMES - - - -
ShellExecuteHooks-{F552DDE6-2090-4bf4-B924-6141E87789A5} - (no file)
MSConfigStartUp-Regrun2 - c:\progra~1\Greatis\REGRUN~1\WatchDog.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Connection Wizard,ShellNext = hxxp://fr.fr.acer.yahoo.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Télécharger avec NetTransport - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Tout t&élécharger avec NetTransport - c:\program files\Xi\NetTransport 2\NTAddList.html
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - hooseek
FF - prefs.js: browser.startup.homepage - hxxp://fr.mg40.mail.yahoo.com/dc/launch?.rand=b1k78sli1jf70&npfa=1|http://www.radiofrance.fr/franceinter/em/carnetsdecampagne/|http://news.google.fr/nwshp?client=firefox-a&rls=org.mozilla:fr
fficial&ie=UTF-8&oe=UTF-8&hl=fr&client=firefox-a&rls=org.mozilla:frfficial_s&tab=wn&q=&auth=DQAAAGgAAADrSzX40d7Xg7v4_EOApap38xRTtHjn0_36J50pN22Q6PhYAVStdisrBYMlr2xRg-dBaS2FdVR5fMWNJ0Y0Lhqlgir5jy4quxSnqn54FdSrrt5NUneqhFnBRk2tOS6w1vNZfOgo50XhzYBby8gpd-3T
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\{8b7625de-675d-4627-9ebe-bd02b7d0a89a}\components\FFAlert.dll
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\Canal\Canal Widget\VOD\npCpVod.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npcosmop211.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRACtrl.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-26 19:33:30
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
c:\windows\system32\drivers\gaopdxltivkjba.sys 98304 bytes
c:\windows\system32\drivers\gaopdxpcvbrsnk.sys 98304 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\ 6586368 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\Ï vk 1819246592 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\ð vk 875659264 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\40x900(2.).y 32768 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\ 6193152 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\Ï vk 1970241536 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\ lf 32768 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\ 7045120 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\¿ nk 0 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\ . 0 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\ 425984 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\ 6160384 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\ÿ§] 6160384 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\WLZDA2D.tmp\Çc:\docume~1\joyeux\LOCALS~1\Temp\gaopdxserv.sys000 0 bytes
c:\docume~1\joyeux\LOCALS~1\Temp\gaopdx000 0 bytes
c:\windows\system32\gaopdxcounter 32768 bytes
c:\windows\system32\gaopdxqgoeypxb.dll 65536 bytes
Scan terminé avec succès
Fichiers cachés: 21
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\gaopdxserv.sys]
"imagepath"="\systemroot\system32\drivers\gaopdxypxtjfvj.sys"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\ActiveSync]
"Name"="ActiveSync"
"DisplayName"="Microsoft ActiveSync"
"Param1"="ActiveSync"
"Type"="wellknown"
"Order"=dword:00000001
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\IESettings]
"Name"="IESettings"
"Type"="IESettings"
"Order"=dword:00000004
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\MediaFiles]
"Name"="MediaFiles"
"Type"="MediaFiles"
"Order"=dword:00000003
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\NPW]
"Name"="NPW"
"Param1"="NPW"
"Type"="wellknown"
"Order"=dword:00000002
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\Outlook]
"Name"="Outlook"
"DisplayName"="Microsoft Outlook"
"Param1"="Outlook"
"Type"="wellknown"
"Order"=dword:00000000
"State"=dword:0000000b
[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\gaopdxserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\\systemroot\\system32\\drivers\\gaopdxypxtjfvj.sys"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(936)
c:\program files\fichiers communs\logitech\bluetooth\LBTWlgn.dll
c:\program files\fichiers communs\logitech\bluetooth\LBTServ.dll
.
Heure de fin: 2009-02-26 19:34:38
ComboFix-quarantined-files.txt 2009-02-26 18:34:38
Avant-CF: 25,135,808,512 octets libres
Après-CF: 25,130,827,776 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect/PAE
Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5
342 --- E O F --- 2009-02-11 18:03:31
merci
Wouah!!! ca y est ca marche!! coool 
merci beaucoup, j ai lancé kapersky je te renvoi un msg une fois fini!
pourrais tu mr dire a quoi cela était du? un virus?
que me conseils tu comme antivirus?
Un petit reste :
Sélectionne l'intégralité du cadre ci-dessous :
File::
|
- Copie/colle le dans le Bloc Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
- Enregistre le sous sur ton bureau sous le nom de CFScript.txt
- Glisse maintenant le fichier CFScript.txt dans ComboFix.exe comme ci-dessous :
- Cela va relancer Combofix.
- Tu devras accepter la licence.
Poste le contenu du rapport ComboFix.txt après redémarrage s'il y en a un.
Le rapport se trouve ici : %SystemDrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)
Répondre à Angeldark
Bonjour,
le lien proposé ds ton msg ne fonctione pas, mais j ai qd meme reussi à "glissé"
voici le rapport
ComboFix 09-02-26.02 - joyeux 2009-02-27 18:44:07.2 - [color=red]FAT32[/color]x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2943.2089 [GMT 1:00]
Lancé depuis: c:\documents and settings\joyeux\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\joyeux\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
FILE ::
c:\windows\system32\gaopdxqgoeypxb.dl
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\gaopdxltivkjba.sys
c:\windows\system32\drivers\gaopdxpcvbrsnk.sys
c:\windows\system32\gaopdxcounter
c:\windows\system32\gaopdxqgoeypxb.dll
F:\autorun.inf
H:\Autorun.inf
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-27 au 2009-02-27 ))))))))))))))))))))))))))))))))))))
.
2009-02-27 13:09 . 2009-02-27 13:09 <REP> dr------- c:\program files\Skype
2009-02-27 13:09 . 2009-02-27 13:09 <REP> d-------- c:\program files\Fichiers communs\Skype
2009-02-27 11:36 . 2009-02-27 11:36 <REP> d-------- c:\program files\Skyline
2009-02-27 11:36 . 2009-02-27 11:36 <REP> d-------- c:\documents and settings\All Users\Application Data\Skyline
2009-02-26 20:17 . 2009-02-26 20:17 <REP> d-------- c:\windows\system32\Kaspersky Lab
2009-02-26 20:17 . 2009-02-26 20:17 <REP> d-------- c:\windows\LastGood
2009-02-26 19:59 . 2009-02-26 19:59 <REP> d--hs---- C:\FOUND.001
2009-02-23 07:43 . 2009-02-23 07:43 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-23 07:43 . 2009-02-23 07:43 <REP> d-------- c:\documents and settings\joyeux\Application Data\Malwarebytes
2009-02-23 07:43 . 2009-02-23 07:43 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-23 07:43 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-23 07:43 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-19 22:34 . 2009-02-19 22:34 <REP> d-------- c:\program files\Avira
2009-02-19 22:34 . 2009-02-19 22:34 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-19 21:21 . 2009-02-19 21:21 <REP> d-------- C:\ToolBar SD
2009-02-18 20:57 . 2009-02-18 20:56 102,664 --a------ c:\windows\system32\drivers\tmcomm.sys
2009-02-18 20:56 . 2009-02-18 20:56 <REP> d-------- c:\documents and settings\joyeux\.housecall6.6
2009-02-16 20:49 . 2009-01-22 14:28 290,816 --a------ c:\windows\system32\decdll.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-22 17:01 98,304 ----a-w c:\windows\DUMP2a85.tmp
2009-02-22 15:58 98,304 ----a-w c:\windows\DUMP15b5.tmp
2009-02-20 11:54 98,304 ----a-w c:\windows\DUMPbb80.tmp
2009-02-18 19:02 98,304 ----a-w c:\windows\DUMP91b0.tmp
2009-02-18 18:56 98,304 ----a-w c:\windows\DUMP91d0.tmp
2009-02-18 18:44 98,304 ----a-w c:\windows\DUMP536f.tmp
2009-02-18 18:36 98,304 ----a-w c:\windows\DUMP4ce7.tmp
2009-02-17 20:32 98,304 ----a-w c:\windows\DUMP9b36.tmp
2009-02-16 20:36 98,304 ----a-w c:\windows\DUMP1ecd.tmp
2009-01-23 10:45 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2009-01-20 05:54 --------- d-----w c:\program files\Fichiers communs\AVSMedia
2009-01-19 22:02 --------- d-----w c:\program files\Free Video Converter
2009-01-19 21:31 --------- d-----w c:\program files\Fichiers communs\Adobe AIR
2009-01-19 21:31 --------- d-----w c:\program files\Canal
2009-01-05 22:33 3,751,995 ----a-w c:\windows\system32\GPhotos.scr
2009-01-04 19:00 --------- d-----w c:\program files\Izuba Energies
2009-01-04 19:00 --------- d-----w c:\documents and settings\All Users\Application Data\Pleiades
2008-12-23 09:50 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-22 18:42 3,532 ----a-w C:\drmHeader.bin
2008-12-12 17:02 3,088,896 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-12 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-12-12 10:11 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2007-12-14 13:18 2,995,368 ----a-w c:\documents and settings\joyeux\SVGView.exe
2006-11-18 22:34 251 ----a-w c:\program files\wt3d.ini
2006-11-18 19:38 278,528 ----a-w c:\program files\Fichiers communs\FDEUnInstaller.exe
2006-10-12 16:17 3,072 ----a-w c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2006-02-13 11:07 245,408 ----a-w c:\program files\mozilla firefox\plugins\unicows.dll
2008-08-21 23:33 2 --sha-r c:\windows\winstart.bat
.
((((((((((((((((((((((((((((( SnapShot@2009-02-26_19.33.47.99 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-27 12:09:26 364,726 ----a-r c:\windows\Installer\{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}\SkypeIcon.exe
+ 2009-02-27 12:08:40 295,606 ----a-r c:\windows\Installer\{AC76BA86-7AD7-1036-7B44-A81300000003}\SC_Reader.exe
+ 2005-05-16 18:34:48 213,048 ----a-w c:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2008-08-13 14:03:26 65,536 ----a-w c:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2008-08-13 14:03:26 798,720 ----a-w c:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2009-02-26 19:01:18 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_930.dat
+ 2009-02-26 19:03:10 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_f4c.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-07-18 438272]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"preload"="c:\windows\RUNXMLPL.exe" [2005-05-19 32768]
"PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2007-07-06 159744]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"CaptureCommander"="c:\windows\Capture.exe" [2007-03-08 98816]
"Boot"="c:\acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 579584]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 53248]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-23 136600]
"Canal Widget"="c:\program files\Canal\Canal Widget\Launcher.exe" [2009-02-04 106040]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 c:\windows\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2006-07-20 c:\windows\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.EXE" [2008-04-14 c:\windows\system32\rundll32.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-10-07 805392]
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-11-17 45056]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 02:42 72208 c:\program files\Fichiers communs\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-09-03 20:12 111936 c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-09-10 17:40 289576 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RichVideo"=2 (0x2)
"iPod Service"=3 (0x3)
"gusvc"=3 (0x3)
"CLSched"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"avast! Antivirus"=c:\program files\Alwil Software\Avast4\ashAvast.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Hamachi\\HAMACHI.EXE"=
"c:\\WINDOWS\\PCHEALTH\\HELPCTR\\BINARIES\\HelpCtr.exe"=
"c:\\WINDOWS\\System32\\CNAC1RPK.EXE"=
"c:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3y.exe"=
"c:\\Program Files\\Graphisoft\\ArchiCAD 11 RC1\\ArchiCAD.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Java\\jre1.6.0_02\\bin\\javaw.exe"=
"c:\\Program Files\\adslTV\\vlc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15984:TCP"= 15984:TCP:NortonAV
"15460:TCP"= 15460:TCP:NortonAV
"14431:TCP"= 14431:TCP:NortonAV
"13217:TCP"= 13217:TCP:NortonAV
"15300:TCP"= 15300:TCP:NortonAV
"18580:TCP"= 18580:TCP:NortonAV
"13869:TCP"= 13869:TCP:NortonAV
"13116:TCP"= 13116:TCP:NortonAV
"13925:TCP"= 13925:TCP:NortonAV
R2 CanalPlus.VOD;CanalPlus.VOD;c:\program files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe [2008-12-10 61440]
R2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;c:\windows\system32\eLock2BurnerLockDriver.sys [2006-11-17 17664]
R2 eLock2FSCTLDriver;eLock2FSCTLDriver;c:\windows\system32\eLock2FSCTLDriver.sys [2006-11-17 90112]
R2 LockServ;LockServ;c:\acer\Empowering Technology\eLock\LockServ.exe -p --> c:\acer\Empowering Technology\eLock\LockServ.exe -p [?]
S3 ausens;ausens;c:\windows\system32\drivers\ausens.sys [2003-08-13 404736]
S3 epindd;epindd;c:\windows\system32\drivers\EPINDD.SYS [2006-11-17 8448]
S3 k600bus;Sony Ericsson 600i driver (WDM);c:\windows\system32\drivers\k600bus.sys [2005-05-11 52384]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;c:\windows\system32\drivers\k600mdfl.sys [2005-05-11 6096]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;c:\windows\system32\drivers\k600mdm.sys [2005-05-11 87456]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;c:\windows\system32\drivers\k600mgmt.sys [2005-05-11 79248]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;c:\windows\system32\drivers\k600obex.sys [2005-05-11 77072]
S3 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys --> c:\windows\system32\drivers\Partizan.sys [?]
S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [2008-08-20 25773]
S3 uafilter;uafilter;c:\windows\system32\drivers\UAFilter.sys [2007-12-30 9886]
S3 USBVCD;Canon USB Video;c:\windows\system32\drivers\USBVCD.sys [2004-10-05 57856]
S3 VCIDRV;Canon USB Video Control;c:\windows\system32\drivers\VCIDRV.sys [2004-10-05 6528]
S3 XE102Mp5;XE102Mp5 NDIS Protocol Driver;c:\windows\system32\drivers\XE102Mp5.sys [2008-06-01 21120]
S3 XE102Sp5;XE102Sp5 NDIS Protocol Driver;c:\windows\system32\drivers\XE102Sp5.sys [2008-06-01 18176]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - mchInjDrv
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\autorun.exe
\Shell\setup\command - D:\install.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{06537e56-f679-11dd-a4da-0016d34873f1}]
\Shell\AutoRun\command - E:\EmDesk.exe
\Shell\EmDesk\command - E:\EmDesk.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eb41e9a0-bd8f-11db-a1e5-0016cf5bc188}]
\Shell\AutoRun\command - F:\v.cmd
\Shell\explore\Command - F:\v.cmd
\Shell\open\Command - F:\v.cmd
.
Contenu du dossier 'Tâches planifiées'
2008-04-07 c:\windows\Tasks\Uniblue SpeedUpMyPC.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
2009-02-11 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
2009-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Connection Wizard,ShellNext = hxxp://fr.fr.acer.yahoo.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Télécharger avec NetTransport - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Tout t&élécharger avec NetTransport - c:\program files\Xi\NetTransport 2\NTAddList.html
Handler: skyline - {3a4f9195-65a8-11d5-85c1-0001023952c1} - c:\program files\Skyline\TerraExplorer\TerraExplorerX.dll
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - hooseek
FF - prefs.js: browser.startup.homepage - hxxp://fr.mg40.mail.yahoo.com/dc/launch?.rand=b1k78sli1jf70&npfa=1|http://www.radiofrance.fr/franceinter/em/carnetsdecampagne/|http://news.google.fr/nwshp?client=firefox-a&rls=org.mozilla:frfficial&ie=UTF-8&oe=UTF-8&hl=fr&client=firefox-a&rls=org.mozilla:frfficial_s&tab=wn&q=&auth=DQAAAGgAAADrSzX40d7Xg7v4_EOApap38xRTtHjn0_36J50pN22Q6PhYAVStdisrBYMlr2xRg-dBaS2FdVR5fMWNJ0Y0Lhqlgir5jy4quxSnqn54FdSrrt5NUneqhFnBRk2tOS6w1vNZfOgo50XhzYBby8gpd-3T
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\{8b7625de-675d-4627-9ebe-bd02b7d0a89a}\components\FFAlert.dll
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\Canal\Canal Widget\VOD\npCpVod.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npcosmop211.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRACtrl.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-27 18:45:56
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\mchInjDrv]
"ImagePath"="\??\c:\docume~1\joyeux\LOCALS~1\Temp\mc21.tmp"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\ActiveSync]
"Name"="ActiveSync"
"DisplayName"="Microsoft ActiveSync"
"Param1"="ActiveSync"
"Type"="wellknown"
"Order"=dword:00000001
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\IESettings]
"Name"="IESettings"
"Type"="IESettings"
"Order"=dword:00000004
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\MediaFiles]
"Name"="MediaFiles"
"Type"="MediaFiles"
"Order"=dword:00000003
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\NPW]
"Name"="NPW"
"Param1"="NPW"
"Type"="wellknown"
"Order"=dword:00000002
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\Outlook]
"Name"="Outlook"
"DisplayName"="Microsoft Outlook"
"Param1"="Outlook"
"Type"="wellknown"
"Order"=dword:00000000
"State"=dword:0000000b
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(936)
c:\program files\fichiers communs\logitech\bluetooth\LBTWlgn.dll
c:\program files\fichiers communs\logitech\bluetooth\LBTServ.dll
.
Heure de fin: 2009-02-27 18:47:21
ComboFix-quarantined-files.txt 2009-02-27 17:47:20
ComboFix2.txt 2009-02-26 18:34:40
Avant-CF: 18 299 748 352 octets libres
Après-CF: 18,316,034,048 octets libres
Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5
316 --- E O F --- 2009-02-11 18:03:31
que me conseils tu comme antivirus?
Encore mille merci, quel plaisir de pouvoir retrouvé son PC comme avant 
Re,
J'ai raté mon script pour une lettre, mais Combofix a apparemment viré le fichier.
Téléchargez Flash_Disinfector.exe de sUBs et sauvegardez-le sur ton bureau.
- Double-cliquez sur Flash_Disinfector.exe pour le lancer et suivez toutes les indications qui apparaissent.
- Cet utilitaire pourra éventuellement vous demander d'insérer vos disques amovibles ( clés usb, disque dur externe, téléphone portable etc. ). Merci de le faire et d'autoriser Flash_Disinfector à les nettoyer, car ils sont susceptibles d'être infectés.
- Patientez jusqu'à ce que le scan soit fini et quittez ensuite le programme.
- Redémarrez votre ordinateur une fois la chose faite.
Note : Flash_Disinfector va créer un dossier caché nommé "autorun.inf" sur chacun des disques amovibles branchés sur votre ordinateur au moment du scan. Ne détruisez pas ces fichiers... car ces derniers vous protègeront d'une éventuelle future infection par disques amovibles.
Information : Pour en savoir plus sur les infections par disques amovibles, clique **ICI**
Une fois que cela aura été fait, nous pourrons ensuite procéder à la désinfection de vos disques amovibles, donc laissez-les brancher le temps de la désinfection et éviter de les utiliser.
&
Sélectionne l'intégralité du cadre ci-dessous :
Driver::
|
- Copie/colle le dans le Bloc Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
- Enregistre le sous sur ton bureau sous le nom de CFScript.txt
- Glisse maintenant le fichier CFScript.txt dans ComboFix.exe comme ci-dessous :
- Cela va relancer Combofix.
- Tu devras accepter la licence.
Poste le contenu du rapport ComboFix.txt après redémarrage s'il y en a un.
Le rapport se trouve ici : %SystemDrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)
Répondre à Angeldark
Salut
Voici le log
ComboFix 09-02-27.02 - joyeux 2009-02-28 11:54:37.3 - [color=red]FAT32[/color]x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2943.2240 [GMT 1:00]
Lancé depuis: c:\documents and settings\joyeux\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\joyeux\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
FILE ::
c:\docume~1\joyeux\LOCALS~1\Temp\mc21.tmp
.
[color=purple]Les fichiers ci-dessous ont été désactivés pendant l'exécution:[/color]
c:\program files\SuperCopier2\SC2Hook.dll
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MCHINJDRV
-------\Service_mchInjDrv
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-28 au 2009-02-28 ))))))))))))))))))))))))))))))))))))
.
2009-02-27 19:18 . 2009-02-27 19:18 <REP> d-------- c:\program files\Skyline
2009-02-27 13:09 . 2009-02-27 13:09 <REP> dr------- c:\program files\Skype
2009-02-27 13:09 . 2009-02-27 13:09 <REP> d-------- c:\program files\Fichiers communs\Skype
2009-02-27 11:36 . 2009-02-27 11:36 <REP> d-------- c:\documents and settings\All Users\Application Data\Skyline
2009-02-26 20:17 . 2009-02-26 20:17 <REP> d-------- c:\windows\system32\Kaspersky Lab
2009-02-26 19:59 . 2009-02-26 19:59 <REP> d--hs---- C:\FOUND.001
2009-02-23 07:43 . 2009-02-23 07:43 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-23 07:43 . 2009-02-23 07:43 <REP> d-------- c:\documents and settings\joyeux\Application Data\Malwarebytes
2009-02-23 07:43 . 2009-02-23 07:43 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-23 07:43 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-23 07:43 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-19 22:34 . 2009-02-19 22:34 <REP> d-------- c:\program files\Avira
2009-02-19 22:34 . 2009-02-19 22:34 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-19 21:21 . 2009-02-19 21:21 <REP> d-------- C:\ToolBar SD
2009-02-18 20:57 . 2009-02-18 20:56 102,664 --a------ c:\windows\system32\drivers\tmcomm.sys
2009-02-18 20:56 . 2009-02-18 20:56 <REP> d-------- c:\documents and settings\joyeux\.housecall6.6
2009-02-16 20:49 . 2009-01-22 14:28 290,816 --a------ c:\windows\system32\decdll.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-22 17:01 98,304 ----a-w c:\windows\DUMP2a85.tmp
2009-02-22 15:58 98,304 ----a-w c:\windows\DUMP15b5.tmp
2009-02-20 11:54 98,304 ----a-w c:\windows\DUMPbb80.tmp
2009-02-18 19:02 98,304 ----a-w c:\windows\DUMP91b0.tmp
2009-02-18 18:56 98,304 ----a-w c:\windows\DUMP91d0.tmp
2009-02-18 18:44 98,304 ----a-w c:\windows\DUMP536f.tmp
2009-02-18 18:36 98,304 ----a-w c:\windows\DUMP4ce7.tmp
2009-02-17 20:32 98,304 ----a-w c:\windows\DUMP9b36.tmp
2009-02-16 20:36 98,304 ----a-w c:\windows\DUMP1ecd.tmp
2009-01-23 10:45 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2009-01-20 05:54 --------- d-----w c:\program files\Fichiers communs\AVSMedia
2009-01-19 22:02 --------- d-----w c:\program files\Free Video Converter
2009-01-19 21:31 --------- d-----w c:\program files\Fichiers communs\Adobe AIR
2009-01-19 21:31 --------- d-----w c:\program files\Canal
2009-01-05 22:33 3,751,995 ----a-w c:\windows\system32\GPhotos.scr
2009-01-04 19:00 --------- d-----w c:\program files\Izuba Energies
2009-01-04 19:00 --------- d-----w c:\documents and settings\All Users\Application Data\Pleiades
2008-12-23 09:50 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-22 18:42 3,532 ----a-w C:\drmHeader.bin
2008-12-12 17:02 3,088,896 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-12 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-12-12 10:11 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2007-12-14 13:18 2,995,368 ----a-w c:\documents and settings\joyeux\SVGView.exe
2006-11-18 22:34 251 ----a-w c:\program files\wt3d.ini
2006-11-18 19:38 278,528 ----a-w c:\program files\Fichiers communs\FDEUnInstaller.exe
2006-10-12 16:17 3,072 ----a-w c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2006-02-13 11:07 245,408 ----a-w c:\program files\mozilla firefox\plugins\unicows.dll
2008-08-21 23:33 2 --sha-r c:\windows\winstart.bat
.
((((((((((((((((((((((((((((( SnapShot@2009-02-26_19.33.47.99 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
+ 2009-02-27 12:09:26 364,726 ----a-r c:\windows\Installer\{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}\SkypeIcon.exe
+ 2009-02-27 12:08:40 295,606 ----a-r c:\windows\Installer\{AC76BA86-7AD7-1036-7B44-A81300000003}\SC_Reader.exe
+ 2008-06-17 19:02:16 8,517,632 ------w c:\windows\system32\dllcache\shell32.dll
+ 2005-05-16 18:34:48 213,048 ----a-w c:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2008-08-13 14:03:26 65,536 ----a-w c:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2008-08-13 14:03:26 798,720 ----a-w c:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
- 2008-04-14 03:33:42 8,517,632 ----a-w c:\windows\system32\shell32.dll
+ 2008-06-17 19:02:16 8,517,632 ----a-w c:\windows\system32\shell32.dll
+ 2009-02-28 11:02:06 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_268.dat
+ 2009-02-28 11:00:12 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_944.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-07-18 438272]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"preload"="c:\windows\RUNXMLPL.exe" [2005-05-19 32768]
"PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2007-07-06 159744]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"CaptureCommander"="c:\windows\Capture.exe" [2007-03-08 98816]
"Boot"="c:\acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 579584]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 53248]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-23 136600]
"Canal Widget"="c:\program files\Canal\Canal Widget\Launcher.exe" [2009-02-04 106040]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 c:\windows\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2006-07-20 c:\windows\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.EXE" [2008-04-14 c:\windows\system32\rundll32.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-10-07 805392]
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-11-17 45056]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 02:42 72208 c:\program files\Fichiers communs\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-09-03 20:12 111936 c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-09-10 17:40 289576 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RichVideo"=2 (0x2)
"iPod Service"=3 (0x3)
"gusvc"=3 (0x3)
"CLSched"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"avast! Antivirus"=c:\program files\Alwil Software\Avast4\ashAvast.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Hamachi\\HAMACHI.EXE"=
"c:\\WINDOWS\\PCHEALTH\\HELPCTR\\BINARIES\\HelpCtr.exe"=
"c:\\WINDOWS\\System32\\CNAC1RPK.EXE"=
"c:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3y.exe"=
"c:\\Program Files\\Graphisoft\\ArchiCAD 11 RC1\\ArchiCAD.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Java\\jre1.6.0_02\\bin\\javaw.exe"=
"c:\\Program Files\\adslTV\\vlc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15984:TCP"= 15984:TCP:NortonAV
"15460:TCP"= 15460:TCP:NortonAV
"14431:TCP"= 14431:TCP:NortonAV
"13217:TCP"= 13217:TCP:NortonAV
"15300:TCP"= 15300:TCP:NortonAV
"18580:TCP"= 18580:TCP:NortonAV
"13869:TCP"= 13869:TCP:NortonAV
"13116:TCP"= 13116:TCP:NortonAV
"13925:TCP"= 13925:TCP:NortonAV
R2 CanalPlus.VOD;CanalPlus.VOD;c:\program files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe [2008-12-10 61440]
R2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;c:\windows\system32\eLock2BurnerLockDriver.sys [2006-11-17 17664]
R2 eLock2FSCTLDriver;eLock2FSCTLDriver;c:\windows\system32\eLock2FSCTLDriver.sys [2006-11-17 90112]
R2 LockServ;LockServ;c:\acer\Empowering Technology\eLock\LockServ.exe -p --> c:\acer\Empowering Technology\eLock\LockServ.exe -p [?]
S3 ausens;ausens;c:\windows\system32\drivers\ausens.sys [2003-08-13 404736]
S3 epindd;epindd;c:\windows\system32\drivers\EPINDD.SYS [2006-11-17 8448]
S3 k600bus;Sony Ericsson 600i driver (WDM);c:\windows\system32\drivers\k600bus.sys [2005-05-11 52384]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;c:\windows\system32\drivers\k600mdfl.sys [2005-05-11 6096]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;c:\windows\system32\drivers\k600mdm.sys [2005-05-11 87456]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;c:\windows\system32\drivers\k600mgmt.sys [2005-05-11 79248]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;c:\windows\system32\drivers\k600obex.sys [2005-05-11 77072]
S3 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys --> c:\windows\system32\drivers\Partizan.sys [?]
S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [2008-08-20 25773]
S3 uafilter;uafilter;c:\windows\system32\drivers\UAFilter.sys [2007-12-30 9886]
S3 USBVCD;Canon USB Video;c:\windows\system32\drivers\USBVCD.sys [2004-10-05 57856]
S3 VCIDRV;Canon USB Video Control;c:\windows\system32\drivers\VCIDRV.sys [2004-10-05 6528]
S3 XE102Mp5;XE102Mp5 NDIS Protocol Driver;c:\windows\system32\drivers\XE102Mp5.sys [2008-06-01 21120]
S3 XE102Sp5;XE102Sp5 NDIS Protocol Driver;c:\windows\system32\drivers\XE102Sp5.sys [2008-06-01 18176]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\autorun.exe
\Shell\setup\command - D:\install.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{06537e56-f679-11dd-a4da-0016d34873f1}]
\Shell\AutoRun\command - E:\EmDesk.exe
\Shell\EmDesk\command - E:\EmDesk.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eb41e9a0-bd8f-11db-a1e5-0016cf5bc188}]
\Shell\AutoRun\command - F:\v.cmd
\Shell\explore\Command - F:\v.cmd
\Shell\open\Command - F:\v.cmd
.
Contenu du dossier 'Tâches planifiées'
2008-04-07 c:\windows\Tasks\Uniblue SpeedUpMyPC.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
2009-02-11 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
2009-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Connection Wizard,ShellNext = hxxp://fr.fr.acer.yahoo.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Télécharger avec NetTransport - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Tout t&élécharger avec NetTransport - c:\program files\Xi\NetTransport 2\NTAddList.html
Handler: skyline - {3a4f9195-65a8-11d5-85c1-0001023952c1} - c:\program files\Skyline\TerraExplorer\TerraExplorerX.dll
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - hooseek
FF - prefs.js: browser.startup.homepage - hxxp://fr.mg40.mail.yahoo.com/dc/launch?.rand=b1k78sli1jf70&npfa=1|http://www.radiofrance.fr/franceinter/em/carnetsdecampagne/|http://news.google.fr/nwshp?client=firefox-a&rls=org.mozilla:frfficial&ie=UTF-8&oe=UTF-8&hl=fr&client=firefox-a&rls=org.mozilla:frfficial_s&tab=wn&q=&auth=DQAAAGgAAADrSzX40d7Xg7v4_EOApap38xRTtHjn0_36J50pN22Q6PhYAVStdisrBYMlr2xRg-dBaS2FdVR5fMWNJ0Y0Lhqlgir5jy4quxSnqn54FdSrrt5NUneqhFnBRk2tOS6w1vNZfOgo50XhzYBby8gpd-3T
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\{8b7625de-675d-4627-9ebe-bd02b7d0a89a}\components\FFAlert.dll
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\documents and settings\joyeux\Application Data\Mozilla\Firefox\Profiles\uggqtvll.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\Canal\Canal Widget\VOD\npCpVod.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npcosmop211.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRACtrl.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-28 12:02:00
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\ActiveSync]
"Name"="ActiveSync"
"DisplayName"="Microsoft ActiveSync"
"Param1"="ActiveSync"
"Type"="wellknown"
"Order"=dword:00000001
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\IESettings]
"Name"="IESettings"
"Type"="IESettings"
"Order"=dword:00000004
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\MediaFiles]
"Name"="MediaFiles"
"Type"="MediaFiles"
"Order"=dword:00000003
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\NPW]
"Name"="NPW"
"Param1"="NPW"
"Type"="wellknown"
"Order"=dword:00000002
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-1357383852-95658456-3350552947-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\Outlook]
"Name"="Outlook"
"DisplayName"="Microsoft Outlook"
"Param1"="Outlook"
"Type"="wellknown"
"Order"=dword:00000000
"State"=dword:0000000b
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(928)
c:\program files\fichiers communs\logitech\bluetooth\LBTWlgn.dll
c:\program files\fichiers communs\logitech\bluetooth\LBTServ.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\SCHED.EXE
c:\program files\FICHIERS COMMUNS\LOGISHRD\KHAL2\KHALMNPR.EXE
c:\acer\EMPOWERING TECHNOLOGY\EPERFORMANCE\MEMCHECK.EXE
c:\program files\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\AVGUARD.EXE
c:\program files\BONJOUR\MDNSRESPONDER.EXE
c:\program files\CYBERLINK\POWERCINEMA\KERNEL\TV\CLCAPSVC.EXE
c:\program files\JAVA\JRE6\BIN\JQS.EXE
c:\program files\FICHIERS COMMUNS\LIGHTSCRIBE\LSSRVC.EXE
c:\windows\SYSTEM32\CNAC1RPK.EXE
c:\acer\EMPOWERING TECHNOLOGY\ELOCK\LOCKSERV.EXE
c:\program files\FICHIERS COMMUNS\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
c:\program files\NERO\NERO8\NERO BACKITUP\NBSERVICE.EXE
c:\windows\SYSTEM32\NVSVC32.EXE
c:\docume~1\joyeux\LOCALS~1\Temp\RtkBtMnt.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Heure de fin: 2009-02-28 12:05:20 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-02-28 11:05:18
ComboFix3.txt 2009-02-26 18:34:40
ComboFix2.txt 2009-02-27 17:47:24
Avant-CF: 18 242 666 496 octets libres
Après-CF: 18,119,917,568 octets libres
Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5
337 --- E O F --- 2009-02-27 18:00:34
je vais un peu abuser de toi encore, je trouve que mon pc met un peu de tps au demarage que me conseils tu
Tejyx
non c est nickel, je te remercie encore et encore
je te souhaite tout plein de bonnes choses et pas a bientot
Bon surf
Répondre à Angeldark
