[Résolu] Win32.Brontok

Bonsoir!

En recherchant une solution à mon problème avec Win32.Brontok, je suis tombée sur ce forum, sur l'article avec Pat 181 : http://www.infos-du-net.com/forum/ [...] 32-brontok

Mon problème est exactement le même que le sien! Depuis hier, je reçois ce message de security center alert disant que mon PC pourrait être infecté par win32.brontok.. j'ai scanné et rien trouvé. Et lorsque j'ouvre une page Internet, il me dit "Insecure Internet activity. Threat of virus attack" et me donne deux options, vu que la page en question ne serait pas protégée...

J'avais essayé Malwarebytes' Anti Madware, mais il ne veut pas démarrer. Je suis également sous configuration Windows XP. Pouvez-vous m'aider, s'il vous plaît? Mon frère me dit que je n'ai qu'à tout formater, mais je suis sûre qu'il y a un autre moyen.

Merci beaucoup en avance.

Tsumi.

Voilà, j'ai fais ce que tu viens de me dire, voici le rapport :

ComboFix 09-07-23.04 - Admin 24/07/2009 21:21.1.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.959.433 [GMT 2:00]
Running from: c:\documents and settings\Admin\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Admin\Application Data\Google\ocprg23017248.exe
c:\documents and settings\Admin\Application Data\Google\Shell32.dll
c:\windows\system32\CONFIG.exe

.
((((((((((((((((((((((((( Files Created from 2009-06-24 to 2009-07-24 )))))))))))))))))))))))))))))))
.

2009-07-24 18:25 . 2009-07-24 18:25 -------- d-----w- c:\documents and settings\Admin\Application Data\Malwarebytes
2009-07-24 14:11 . 2009-07-24 14:11 -------- d-----w- c:\documents and settings\NetworkService\Menu Démarrer
2009-07-24 14:11 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-07-24 14:11 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-24 14:11 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-07-24 14:11 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-07-24 14:11 . 2009-07-24 14:11 -------- d-----w- c:\program files\Avira
2009-07-24 14:11 . 2009-07-24 14:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-07-23 22:44 . 2009-07-24 18:42 4956408 ----a-w- c:\documents and settings\Admin\Application Data\pdinstall.exe
2009-07-23 22:26 . 2009-07-23 22:26 422 ----a-w- c:\documents and settings\Admin\Application Data\Apple Computer\mario.exe
2009-07-23 22:26 . 2009-07-23 22:26 16141 ----a-w- c:\documents and settings\Admin\Application Data\BitTorrent\flamiks32.exe
2009-07-23 22:26 . 2009-07-23 22:26 145131 ----a-w- c:\documents and settings\Admin\Application Data\avidemux\pingo.dll
2009-07-23 22:26 . 2009-07-23 22:26 13221 ----a-w- c:\documents and settings\Admin\Application Data\AdobeUM\xl12.exe
2009-07-23 22:26 . 2009-07-23 22:26 11232 ----a-w- c:\documents and settings\Admin\Application Data\Adobe\norigami.dll
2009-07-23 14:04 . 2009-07-23 14:04 -------- d-----w- c:\program files\iPod
2009-07-23 14:04 . 2009-07-23 14:04 -------- d-----w- c:\program files\iTunes
2009-07-23 13:55 . 2009-07-23 13:55 75040 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-18 12:17 . 2009-07-18 12:17 -------- d-sh--w- c:\documents and settings\Admin\IECompatCache
2009-07-18 12:17 . 2009-07-18 12:17 -------- d-sh--w- c:\documents and settings\Admin\PrivacIE
2009-07-18 12:14 . 2009-07-18 12:14 -------- d-sh--w- c:\documents and settings\Admin\IETldCache
2009-07-17 12:14 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-07-17 12:13 . 2009-07-17 12:14 -------- d-----w- c:\windows\ie8updates
2009-07-17 12:13 . 2009-04-30 21:16 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-07-17 12:13 . 2009-04-30 21:16 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-07-17 12:12 . 2009-07-17 12:13 -------- dc-h--w- c:\windows\ie8

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-24 19:27 . 2008-10-18 22:13 -------- d-----w- c:\program files\DNA
2009-07-24 19:27 . 2008-10-18 22:13 -------- d-----w- c:\documents and settings\Admin\Application Data\DNA
2009-07-24 19:19 . 2008-10-28 11:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-24 14:12 . 2001-10-02 18:17 74336 ----a-w- c:\windows\system32\perfc00C.dat
2009-07-24 14:12 . 2001-10-02 18:17 467886 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-24 12:11 . 2008-03-08 20:51 -------- d-----w- c:\documents and settings\Admin\Application Data\BitTorrent
2009-07-24 01:02 . 2008-11-19 12:39 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-23 14:04 . 2008-03-08 20:31 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-07-19 14:53 . 2009-05-30 16:12 -------- d-----w- c:\documents and settings\Admin\Application Data\Desktopicon
2009-07-15 15:46 . 2008-12-30 14:14 -------- d-----w- c:\program files\FinePixViewer
2009-07-15 10:19 . 2008-03-08 18:36 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-16 14:40 . 2004-08-19 16:09 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2001-10-02 18:16 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-06 21:26 . 2008-12-23 13:54 -------- d-----w- c:\documents and settings\Admin\Application Data\gtk-2.0
2009-06-06 21:18 . 2008-03-08 20:32 -------- d-----w- c:\program files\QuickTime
2009-06-06 21:10 . 2008-12-23 13:52 -------- d-----w- c:\program files\Avidemux 2.4
2009-06-03 19:10 . 2005-10-12 10:25 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-05-30 17:24 . 2009-05-30 17:24 38768 ---ha-w- c:\windows\system32\mlfcache.dat
2009-05-30 17:24 . 2008-03-08 20:33 -------- d-----w- c:\documents and settings\Admin\Application Data\Apple Computer
2009-05-30 16:43 . 2009-05-30 16:04 -------- d-----w- c:\documents and settings\Admin\Application Data\MxBoost
2009-05-30 16:37 . 2009-05-30 16:37 0 ----a-w- c:\windows\system32\cid_store.dat
2009-05-30 16:03 . 2009-05-30 15:16 -------- d-----w- c:\documents and settings\Admin\Application Data\Orbit
2009-05-30 15:17 . 2009-05-30 15:16 -------- d-----w- c:\documents and settings\Admin\Application Data\GrabPro
2009-05-29 11:36 . 2009-03-19 23:13 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-05-29 11:36 . 2008-03-08 20:32 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-13 05:04 . 2005-10-12 10:25 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:33 . 2004-08-19 16:09 348672 ----a-w- c:\windows\system32\localspl.dll
2006-11-05 19:35 . 2008-03-08 20:17 689152 ----a-w- c:\program files\Xtremsplit.exe
2009-07-22 22:56 . 2008-09-02 08:52 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2006-05-03 09:06 . 2008-03-19 19:58 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2008-03-19 19:58 31232 --sh--r- c:\windows\system32\msfDX.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-16 342848]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-01-25 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2006-01-25 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-01-25 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-01-25 455168]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-10-19 202032]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" - c:\windows\system32\CHDAudPropShortcut.exe [2006-07-27 61952]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NoIE4StubProcessing"="c:\windows\system32\reg.exe" [2008-04-14 53248]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"Config"="c:\windows\system32\run.cmd" [2005-08-23 341]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Bluestork BS-W-USB Utility.lnk - c:\program files\Bluestork Wifi\BS-W-USB\BS-W-USB.exe [2008-3-8 491520]
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2008-12-30 303104]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=

R1 raddrvv3;raddrvv3;c:\windows\system32\rserver30\raddrvv3.sys [24/04/2008 08:49 45848]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [24/07/2009 16:11 108289]
R3 mirrorv3;mirrorv3;c:\windows\system32\drivers\rminiv3.sys [01/11/2006 06:01 3328]
S2 RServer3;Radmin Server V3;"c:\windows\system32\rserver30\RServer3.exe" /service --> c:\windows\system32\rserver30\RServer3.exe [?]
S3 ZD1211BU(BLUESTORK);Bluestork BS-W-USB Wifi 54g USB Module Driver(BLUESTORK);c:\windows\system32\drivers\ZD1211BU.sys [08/03/2008 18:51 439808]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - SSMDRV

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-01-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 10:34]

2009-07-24 c:\windows\Tasks\User_Feed_Synchronization-{831B46EC-2F0F-41FD-81D2-9ADD619F7F90}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)
HKLM-Run-realteks - c:\documents and settings\Admin\Application Data\Google\ocprg23017248.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\cerwbw9j.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.awesomestart.com/panicch/
FF - prefs.js: keyword.URL - hxxp://fr.search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-24 21:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-220523388-1935655697-839522115-1003\SOFTWARE\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:31,a2,ed,16,27,41,e3,33,c2,b5,cc,93,43,18,06,0e,e4,53,5a,04,cb,10,37,
1f,3a,66,e9,74,6e,4f,9a,75,2e,a9,52,7d,06,37,93,42,f8,7d,75,65,0a,68,06,41,\
"??"=hex:a6,09,a7,ec,73,c9,36,12,c3,d1,7a,73,59,24,78,cf

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\windows\IME\IMJP8_1\Dicts\IMJPCD.DIC

- - - - - - - > 'explorer.exe'(2008)
c:\windows\IME\IMJP8_1\Dicts\IMJPCD.DIC
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll

- - - - - - - > 'explorer.exe'(3288)
c:\windows\IME\IMJP8_1\Dicts\IMJPCD.DIC
c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
c:\progra~1\SPYBOT~1\SDHelper.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-07-24 21:33 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-24 19:32

Pre-Run: 13 152 309 248 octets libres
Post-Run: 13 266 247 680 octets libres

225 --- E O F --- 2009-07-17 12:15

Déjà, les pages Internet s'ouvrent normalement maintenant. Mon antivirus s'est remit en route, je dois le laisser désactivé pour le scan ou c'est pas grave?

D'accord. Les mises à jour sont terminées, il commence tout juste l'analyse là ^^. Je ne sais pas combien de temps ça prendra.. ^^"

Ca y est, c'est terminé! Voilà le rapport :

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: rapport d'analyse
samedi 25 juillet 2009
Système d'exploitation : Microsoft Windows XP Professional Service Pack 3 (build 2600)
Version de Kaspersky Online Scanner : 7.0.26.13
Dernière mise à jour de la base : Friday, July 24, 2009 20:39:02
Enregistrements dans la base : 2527145
--------------------------------------------------------------------------------

Paramètres d'analyse:
analyser avec la base suivante: étendue
Analyser les archives: oui
Analyser les bases de messagerie: oui

Zone d'analyse - Poste de travail:
C:\
D:\

Statistiques d'analyse:
Objets analysés: 58815
Menaces trouvées: 2
Objets infectés trouvés: 2
Objets suspects trouvés: 0
Durée d'analyse: 02:10:03


Nom de fichier / Menace / Compteur de menaces
C:\Documents and Settings\Admin\Mes documents\Mes fichiers reçus\X Documents X\Mes Logiciels\HACHA\hacha.exe Infecté : Trojan-Dropper.Win32.Agent.aceh 1
C:\WINDOWS\system32\cmdow.exe Infecté : not-a-virus:RiskTool.Win32.HideWindows 1

La zone sélectionnée a été analysée.

Et c'est reparti pour un rapport XD :

ComboFix 09-07-23.04 - Admin 25/07/2009 1:19.2.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.959.687 [GMT 2:00]
Running from: c:\documents and settings\Admin\Bureau\ComboFix.exe
Command switches used :: c:\documents and settings\Admin\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\documents and settings\Admin\Application Data\Adobe\norigami.dll"
"c:\documents and settings\Admin\Application Data\AdobeUM\xl12.exe"
"c:\documents and settings\Admin\Application Data\Apple Computer\mario.exe"
"c:\documents and settings\Admin\Application Data\avidemux\pingo.dll"
"c:\documents and settings\Admin\Application Data\BitTorrent\flamiks32.exe"
"c:\documents and settings\Admin\Application Data\pdinstall.exe"
"c:\documents and settings\Admin\Mes documents\Mes fichiers reçus\X Documents X\Mes Logiciels\HACHA\hacha.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Admin\Application Data\Adobe\norigami.dll
c:\documents and settings\Admin\Application Data\AdobeUM\xl12.exe
c:\documents and settings\Admin\Application Data\Apple Computer\mario.exe
c:\documents and settings\Admin\Application Data\avidemux\pingo.dll
c:\documents and settings\Admin\Application Data\BitTorrent\flamiks32.exe
c:\documents and settings\Admin\Application Data\pdinstall.exe
c:\documents and settings\Admin\Mes documents\Mes fichiers reçus\X Documents X\Mes Logiciels\HACHA\hacha.exe

.
((((((((((((((((((((((((( Files Created from 2009-06-24 to 2009-07-24 )))))))))))))))))))))))))))))))
.

2009-07-24 19:51 . 2009-07-24 19:51 -------- d-----w- c:\windows\Sun
2009-07-24 19:50 . 2009-07-24 19:50 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-24 19:50 . 2009-07-24 19:50 -------- d-----w- c:\program files\Java
2009-07-24 19:49 . 2009-07-24 19:49 152576 ----a-w- c:\documents and settings\Admin\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-07-24 19:43 . 2009-07-24 19:41 404225 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.exe
2009-07-24 19:43 . 2009-07-24 19:41 345345 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.dll
2009-07-24 19:43 . 2009-04-17 15:07 87297 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updaterc.dll
2009-07-24 19:43 . 2009-03-03 09:21 9985 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updguirc.dll
2009-07-24 19:43 . 2009-02-24 11:16 117505 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updgui.dll
2009-07-24 19:43 . 2009-02-17 12:49 79105 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updext.dll
2009-07-24 19:43 . 2008-10-20 06:38 126721 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\scewxmlw.dll
2009-07-24 18:25 . 2009-07-24 18:25 -------- d-----w- c:\documents and settings\Admin\Application Data\Malwarebytes
2009-07-24 14:11 . 2009-07-24 14:11 -------- d-----w- c:\documents and settings\NetworkService\Menu Démarrer
2009-07-24 14:11 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-07-24 14:11 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-24 14:11 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-07-24 14:11 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-07-24 14:11 . 2009-07-24 14:11 -------- d-----w- c:\program files\Avira
2009-07-24 14:11 . 2009-07-24 14:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-07-23 14:04 . 2009-07-23 14:04 -------- d-----w- c:\program files\iPod
2009-07-23 14:04 . 2009-07-23 14:04 -------- d-----w- c:\program files\iTunes
2009-07-23 13:55 . 2009-07-23 13:55 75040 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-18 12:17 . 2009-07-18 12:17 -------- d-sh--w- c:\documents and settings\Admin\IECompatCache
2009-07-18 12:17 . 2009-07-18 12:17 -------- d-sh--w- c:\documents and settings\Admin\PrivacIE
2009-07-18 12:14 . 2009-07-18 12:14 -------- d-sh--w- c:\documents and settings\Admin\IETldCache
2009-07-17 12:14 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-07-17 12:13 . 2009-07-17 12:14 -------- d-----w- c:\windows\ie8updates
2009-07-17 12:13 . 2009-04-30 21:16 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-07-17 12:13 . 2009-04-30 21:16 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-07-17 12:12 . 2009-07-17 12:13 -------- dc-h--w- c:\windows\ie8

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-24 23:25 . 2008-10-18 22:13 -------- d-----w- c:\program files\DNA
2009-07-24 23:25 . 2008-10-18 22:13 -------- d-----w- c:\documents and settings\Admin\Application Data\DNA
2009-07-24 23:23 . 2008-12-23 13:52 -------- d-----w- c:\documents and settings\Admin\Application Data\avidemux
2009-07-24 23:23 . 2008-03-08 20:51 -------- d-----w- c:\documents and settings\Admin\Application Data\BitTorrent
2009-07-24 23:23 . 2008-09-13 16:34 -------- d-----w- c:\documents and settings\Admin\Application Data\AdobeUM
2009-07-24 23:23 . 2008-03-08 20:33 -------- d-----w- c:\documents and settings\Admin\Application Data\Apple Computer
2009-07-24 19:32 . 2001-10-02 18:17 74336 ----a-w- c:\windows\system32\perfc00C.dat
2009-07-24 19:32 . 2001-10-02 18:17 467886 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-24 19:19 . 2008-10-28 11:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-24 01:02 . 2008-11-19 12:39 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-23 14:04 . 2008-03-08 20:31 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-07-19 14:53 . 2009-05-30 16:12 -------- d-----w- c:\documents and settings\Admin\Application Data\Desktopicon
2009-07-15 15:46 . 2008-12-30 14:14 -------- d-----w- c:\program files\FinePixViewer
2009-07-15 10:19 . 2008-03-08 18:36 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-16 14:40 . 2004-08-19 16:09 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2001-10-02 18:16 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-06 21:26 . 2008-12-23 13:54 -------- d-----w- c:\documents and settings\Admin\Application Data\gtk-2.0
2009-06-06 21:18 . 2008-03-08 20:32 -------- d-----w- c:\program files\QuickTime
2009-06-06 21:10 . 2008-12-23 13:52 -------- d-----w- c:\program files\Avidemux 2.4
2009-06-03 19:10 . 2005-10-12 10:25 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-05-30 17:24 . 2009-05-30 17:24 38768 ---ha-w- c:\windows\system32\mlfcache.dat
2009-05-30 16:43 . 2009-05-30 16:04 -------- d-----w- c:\documents and settings\Admin\Application Data\MxBoost
2009-05-30 16:37 . 2009-05-30 16:37 0 ----a-w- c:\windows\system32\cid_store.dat
2009-05-30 16:03 . 2009-05-30 15:16 -------- d-----w- c:\documents and settings\Admin\Application Data\Orbit
2009-05-30 15:17 . 2009-05-30 15:16 -------- d-----w- c:\documents and settings\Admin\Application Data\GrabPro
2009-05-29 11:36 . 2009-03-19 23:13 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-05-29 11:36 . 2008-03-08 20:32 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-13 05:04 . 2005-10-12 10:25 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:33 . 2004-08-19 16:09 348672 ----a-w- c:\windows\system32\localspl.dll
2006-11-05 19:35 . 2008-03-08 20:17 689152 ----a-w- c:\program files\Xtremsplit.exe
2009-07-22 22:56 . 2008-09-02 08:52 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2006-05-03 09:06 . 2008-03-19 19:58 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2008-03-19 19:58 31232 --sh--r- c:\windows\system32\msfDX.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-24_19.28.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-24 23:25 . 2009-07-24 23:25 16384 c:\windows\temp\Perflib_Perfdata_514.dat
+ 2001-10-02 18:17 . 2009-07-24 19:32 60958 c:\windows\system32\perfc009.dat
- 2001-10-02 18:17 . 2009-07-24 14:12 60958 c:\windows\system32\perfc009.dat
+ 2009-07-24 14:11 . 2009-07-24 19:43 28520 c:\windows\system32\drivers\ssmdrv.sys
+ 2001-10-02 18:17 . 2009-07-24 19:32 400798 c:\windows\system32\perfh009.dat
- 2001-10-02 18:17 . 2009-07-24 14:12 400798 c:\windows\system32\perfh009.dat
+ 2009-07-24 19:50 . 2009-07-24 19:50 148888 c:\windows\system32\javaws.exe
+ 2009-07-24 19:50 . 2009-07-24 19:50 144792 c:\windows\system32\javaw.exe
+ 2009-07-24 19:50 . 2009-07-24 19:50 144792 c:\windows\system32\java.exe
+ 2009-07-24 19:50 . 2009-07-24 19:50 536576 c:\windows\Installer\1557c2.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-16 342848]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-01-25 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2006-01-25 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-01-25 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-01-25 455168]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-10-19 202032]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-24 148888]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" - c:\windows\system32\CHDAudPropShortcut.exe [2006-07-27 61952]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NoIE4StubProcessing"="c:\windows\system32\reg.exe" [2008-04-14 53248]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"Config"="c:\windows\system32\run.cmd" [2005-08-23 341]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Bluestork BS-W-USB Utility.lnk - c:\program files\Bluestork Wifi\BS-W-USB\BS-W-USB.exe [2008-3-8 491520]
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2008-12-30 303104]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 raddrvv3;raddrvv3;c:\windows\system32\rserver30\raddrvv3.sys [24/04/2008 08:49 45848]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [24/07/2009 16:11 108289]
R3 mirrorv3;mirrorv3;c:\windows\system32\drivers\rminiv3.sys [01/11/2006 06:01 3328]
S2 RServer3;Radmin Server V3;"c:\windows\system32\rserver30\RServer3.exe" /service --> c:\windows\system32\rserver30\RServer3.exe [?]
S3 ZD1211BU(BLUESTORK);Bluestork BS-W-USB Wifi 54g USB Module Driver(BLUESTORK);c:\windows\system32\drivers\ZD1211BU.sys [08/03/2008 18:51 439808]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-01-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 10:34]

2009-07-24 c:\windows\Tasks\User_Feed_Synchronization-{831B46EC-2F0F-41FD-81D2-9ADD619F7F90}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\cerwbw9j.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.awesomestart.com/panicch/
FF - prefs.js: keyword.URL - hxxp://fr.search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-25 01:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-220523388-1935655697-839522115-1003\SOFTWARE\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:31,a2,ed,16,27,41,e3,33,c2,b5,cc,93,43,18,06,0e,e4,53,5a,04,cb,10,37,
1f,3a,66,e9,74,6e,4f,9a,75,2e,a9,52,7d,06,37,93,42,f8,7d,75,65,0a,68,06,41,\
"??"=hex:a6,09,a7,ec,73,c9,36,12,c3,d1,7a,73,59,24,78,cf

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\windows\IME\IMJP8_1\Dicts\IMJPCD.DIC

- - - - - - - > 'explorer.exe'(3852)
c:\windows\IME\IMJP8_1\Dicts\IMJPCD.DIC
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-07-24 1:31 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-24 23:31

Pre-Run: 13 007 376 384 octets libres
Post-Run: 13 050 339 328 octets libres

248 --- E O F --- 2009-07-17 12:15

Alors, le log.txt :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Admin at 2009-07-25 01:49:11
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 13 GB (17%) free of 76 GB
Total RAM: 959 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:57:43, on 25/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Admin\Bureau\RSIT.exe
C:\Program Files\trend micro\Admin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluestork BS-W-USB Utility.lnk = C:\Program Files\Bluestork Wifi\BS-W-USB\BS-W-USB.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b56907.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Radmin Server V3 (RServer3) - Unknown owner - C:\WINDOWS\system32\rserver30\RServer3.exe (file missing)

--
End of file - 7931 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{831B46EC-2F0F-41FD-81D2-9ADD619F7F90}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-24 41368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-24 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\CHDAudPropShortcut.exe [2006-07-27 61952]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-10-07 13574144]
"nwiz"=nwiz.exe /install []
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-01-12 827392]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2006-01-25 208952]
"MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2006-01-25 59392]
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2006-01-25 455168]
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2006-01-25 455168]
"QlbCtrl.exe"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-10-19 202032]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-10-07 86016]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-07-13 292128]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-24 148888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2008-12-16 342848]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2007-10-18 5724184]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Bluestork BS-W-USB Utility.lnk - C:\Program Files\Bluestork Wifi\BS-W-USB\BS-W-USB.exe
ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoSMHelp"=1
"MemCheckBoxInRunDlg"=1
"NoSMBalloonTip"=1
"NoDesktopCleanupWizard"=1
"NoWelcomeScreen"=1
"NoAutoUpdate"=1
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:EnabledNA"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"%windir%\system32\drivers\svchost.exe"="%windir%\system32\drivers\svchost.exe:*:Enabled:svchost"

======List of files/folders created in the last 1 months======

2009-07-25 01:49:11 ----D---- C:\rsit
2009-07-25 01:49:11 ----D---- C:\Program Files\trend micro
2009-07-25 01:47:42 ----SHD---- C:\RECYCLER
2009-07-25 01:31:14 ----A---- C:\ComboFix.txt
2009-07-25 01:23:25 ----D---- C:\WINDOWS\temp
2009-07-24 21:51:09 ----D---- C:\WINDOWS\Sun
2009-07-24 21:50:19 ----A---- C:\WINDOWS\system32\javaws.exe
2009-07-24 21:50:19 ----A---- C:\WINDOWS\system32\javaw.exe
2009-07-24 21:50:19 ----A---- C:\WINDOWS\system32\java.exe
2009-07-24 21:50:19 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-07-24 21:50:00 ----D---- C:\Program Files\Java
2009-07-24 21:47:44 ----D---- C:\Documents and Settings\Admin\Application Data\Sun
2009-07-24 21:19:57 ----D---- C:\WINDOWS\ERDNT
2009-07-24 20:25:05 ----D---- C:\Documents and Settings\Admin\Application Data\Malwarebytes
2009-07-24 16:11:06 ----D---- C:\Program Files\Avira
2009-07-24 16:11:06 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2009-07-24 00:25:51 ----D---- C:\Documents and Settings\Admin\Application Data\Google
2009-07-23 16:04:18 ----D---- C:\Program Files\iPod
2009-07-23 16:04:14 ----D---- C:\Program Files\iTunes
2009-07-17 14:14:23 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
2009-07-17 14:14:18 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-07-17 14:14:13 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-07-17 14:13:49 ----D---- C:\WINDOWS\ie8updates
2009-07-17 14:12:33 ----HDC---- C:\WINDOWS\ie8
2009-07-17 14:05:15 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-07-17 14:02:01 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-07-17 14:01:17 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$

======List of files/folders modified in the last 1 months======

2009-07-25 01:55:33 ----D---- C:\Documents and Settings\Admin\Application Data\DNA
2009-07-25 01:49:11 ----D---- C:\Program Files
2009-07-25 01:47:26 ----D---- C:\WINDOWS
2009-07-25 01:47:19 ----D---- C:\WINDOWS\system32
2009-07-25 01:47:13 ----SHD---- C:\System Volume Information
2009-07-25 01:31:17 ----D---- C:\WINDOWS\system32\drivers
2009-07-25 01:30:13 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-07-25 01:26:40 ----A---- C:\WINDOWS\system.ini
2009-07-25 01:25:57 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-25 01:25:28 ----D---- C:\Program Files\DNA
2009-07-25 01:23:20 ----D---- C:\Documents and Settings\Admin\Application Data\BitTorrent
2009-07-25 01:23:20 ----D---- C:\Documents and Settings\Admin\Application Data\avidemux
2009-07-25 01:23:19 ----D---- C:\Documents and Settings\Admin\Application Data\Apple Computer
2009-07-25 01:23:19 ----D---- C:\Documents and Settings\Admin\Application Data\AdobeUM
2009-07-25 01:23:19 ----D---- C:\Documents and Settings\Admin\Application Data\Adobe
2009-07-25 01:22:39 ----D---- C:\WINDOWS\AppPatch
2009-07-25 01:22:36 ----D---- C:\Program Files\Fichiers communs
2009-07-25 01:18:18 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-07-25 01:17:21 ----D---- C:\downloads
2009-07-25 01:04:08 ----D---- C:\Program Files\Mozilla Firefox
2009-07-24 22:38:09 ----D---- C:\WINDOWS\Prefetch
2009-07-24 21:50:29 ----SHD---- C:\WINDOWS\Installer
2009-07-24 21:32:03 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-07-24 21:20:02 ----D---- C:\WINDOWS\system32\Restore
2009-07-24 21:19:00 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-24 16:13:15 ----D---- C:\WINDOWS\system32\rserver30
2009-07-24 16:11:19 ----HD---- C:\WINDOWS\inf
2009-07-24 16:02:52 ----D---- C:\WINDOWS\WinSxS
2009-07-24 15:58:52 ----A---- C:\WINDOWS\NeroDigital.ini
2009-07-24 03:04:48 ----D---- C:\WINDOWS\Debug
2009-07-24 03:02:46 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-07-23 16:04:17 ----D---- C:\Program Files\Fichiers communs\Apple
2009-07-19 18:08:27 ----D---- C:\WINDOWS\system32\wbem
2009-07-19 16:53:51 ----D---- C:\Documents and Settings\Admin\Application Data\Desktopicon
2009-07-18 14:17:24 ----SD---- C:\WINDOWS\Tasks
2009-07-18 14:14:19 ----D---- C:\WINDOWS\system32\fr-fr
2009-07-18 14:14:19 ----D---- C:\WINDOWS\Media
2009-07-18 14:14:19 ----D---- C:\Program Files\Internet Explorer
2009-07-18 14:14:18 ----D---- C:\WINDOWS\Help
2009-07-17 14:15:28 ----A---- C:\WINDOWS\win.ini
2009-07-17 14:14:23 ----HD---- C:\WINDOWS\$hf_mig$
2009-07-17 14:04:19 ----D---- C:\WINDOWS\ie7updates
2009-07-15 17:46:03 ----D---- C:\Program Files\FinePixViewer
2009-07-15 12:19:26 ----D---- C:\Program Files\Messenger Plus! Live
2009-07-07 08:10:58 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;Pilote de processeur AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43520]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 raddrvv3;raddrvv3; \??\C:\WINDOWS\system32\rserver30\raddrvv3.sys []
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-07-24 28520]
R1 WmiAcpi;Interface de gestion Microsoft Windows pour ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 BCM43XX;Pilote pour carte réseau Broadcom 802.11; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2008-10-27 822272]
R3 catchme;catchme; \??\C:\DOCUME~1\Admin\LOCALS~1\Temp\catchme.sys []
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2009-03-19 23400]
R3 HBtnKey;HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDAud.sys [2006-07-27 581632]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HpqKbFiltr;HpqKbFilter Driver; C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys [2007-06-18 16768]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2006-08-29 990592]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2006-08-29 208384]
R3 mirrorv3;mirrorv3; C:\WINDOWS\system32\DRIVERS\rminiv3.sys [2006-11-01 3328]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2005-07-26 12288]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-10-07 6133856]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-03-03 13056]
R3 nvsmu;nvsmu; C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2006-03-06 11136]
R3 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2005-11-16 28928]
R3 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2005-11-01 51584]
R3 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2005-11-01 308992]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2007-01-12 201856]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2006-08-29 728576]
R3 ZDPSp50;ZDPSp50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\ZDPSp50.sys [2004-10-25 17664]
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-03-03 34176]
S3 QCDonner;Logitech QuickCam Express; C:\WINDOWS\system32\DRIVERS\OVCD.sys [2005-07-26 28032]
S3 sffdisk;Pilote de classe de stockage SFF; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904]
S3 sffp_sd;Pilote de protocole de stockage SFF pour SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 UIUSys;Conexant Setup API; C:\WINDOWS\system32\DRIVERS\UIUSYS.SYS []
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-05-29 39424]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 ZD1211BU(BLUESTORK);Bluestork BS-W-USB Wifi 54g USB Module Driver(BLUESTORK); C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-04-19 439808]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-10 611664]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-07-24 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-24 185089]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-24 152984]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-10-07 163908]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496]
R3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S2 RServer3;Radmin Server V3; C:\WINDOWS\system32\rserver30\RServer3.exe /service []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]

-----------------EOF--------------

• Mets à jour Adobe Reader.

• Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
• Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
• Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
• Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
• Sélectionne Exécuter un examen rapide.
• Clique sur Rechercher. L'analyse démarre.
• A la fin de l'analyse, un message s'affiche :

• Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
• Ferme tes navigateurs.
• Si des malwares ont été détectés, clique sur Afficher les résultats.
• Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
• MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.

Plus de souci ?

• Télécharge UsbFix (de Chiquitine29 & C_XX) sur ton Bureau.
• Lance l'installation avec les paramètres par défaut.
• Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.
• Double-clique sur le raccourci UsbFix sur ton Bureau.
• Choisis l'option 1 (Recherche).
• Laisse travailler l'outil.
• Poste le rapport UsbFix.txt.

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

"Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.

• Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.
• Double-clique sur le raccourci UsbFix présent sur ton Bureau pour le lancer.
• Choisis l'option 2 (Suppression).
• Ton Bureau disparaîtra et le PC redémarrera.
• Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil.
• Ensuite, poste le rapport UsbFix.txt qui apparaîtra avec le Bureau.

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

Bonne nuit

Le disque G, c'est ton iPod ?

• Désinstalle UsbFix.

Plus de souci avec l'iPod ?

Tu ne sais pas les remettre ?

Je ne sais pas non plus.

Ça masque les noms seulement dans ton iPod ?

1/

• Désinstalle HijackThis.

• Télécharge ToolsCleaner2 sur ton Bureau.
• Double-clique sur ToolsCleaner2.exe pour le lancer.
• Clique sur Recherche et laisse le scan agir.
• Clique sur Suppression pour finaliser.
• Tu peux, si tu le souhaites, te servir des Options Facultatives.
• Clique sur Quitter pour obtenir le rapport.
• Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

2/

• Télécharge et installe CCleaner Slim.
• Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
• Va dans Nettoyeur, choisis Analyser. Une fois terminé, lance le nettoyage.

3/

• Il est nécessaire de désactiver puis réactiver la restauration système pour la purger.

==Prévention==

Supprimer les popups d'AntiVir : Lien

Conserve MBAM. Il te servira à scanner les fichiers douteux en complément de l'antivirus et scanne le disque dur régulièrement.

Vérifie que les mises à jour automatiques sont bien activées (Menu Démarrer, clique droit sur Poste de travail, onglet Mises à jour automatiques).

Par rapport au P2P : Lien

Voici un dossier complet (A lire avec Adobe Reader ou Foxit Reader) : Lien


==Problème résolu ?==

--> Si tu estimes que ton problème est résolu, ajoute [Résolu] au titre. Pour cela :

• Clique, dans ton premier message, sur le bouton Editer .
• Ajoute la mention [Résolu] devant le titre.
• Clique ensuite sur Valider votre message.

Sois plus vigilant(e) sur Internet

C:\UsbFix: ERREUR DE SUPPRESSION !!

--> Ce fichier est bien supprimé ?

Tu peux supprimer ToolsCleaner