cassquapointe

je crois que je vais m'en passer plus que quelquejours ^^ merci bien pour votre présence et vos conseils. bonne continuation

apres 2 reboot de suite pas de message d'erreur de MBAM !!!!??? cela viendrait t'il de suprecopier ...

bon, j'ai lancé tfc.exe et viré spybot. tjrs la meme chose au demarrage , si je clique pas sur une action dans l'alerte malwarebyte dans les 2 seconde tt se fige. de tt maniere que je fasse quarantaine ou ignorer ou demarrage suivant meme probleme. ca serait dommage de le supprimer tt ca pour ne plus avoir un message qui me dis qu'il y a un probleme. c'est contourner le probleme pour le laisser ...

depuis ma reinstall recente je n'ai que malaware et avira et depuis hier spybot qui ne m'a rien décelé d'anormal apres le scan. faudrait t'il que j'install un des programme cité ci_dessus ? Dès mon retour sur mon pc je test le prog de pear (TFC) Il me semble l'avoir utiliser au debut du post

bon avec toute bonne nouvelle, la mauvaise qui va avec quoi .. mdr ========== PROCESSES ========== Process explorer.exe killed successfully. ========== FILES ========== File/Folder C:\\DOCUME~1\\VOTREO~1\\LOCALS~1\\Temp\\mc22.tmp not found. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mchInjDrv\\ImagePath deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\mchInjDrv\\ImagePath deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mchInjDrv\\ImagePath not found. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\VOTREO~1\LOCALS~1\Temp\Perflib_Perfdata_978.dat scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\VOTREO~1\LOCALS~1\Temp\Perflib_Perfdata_544.dat scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\VOTREO~1\LOCALS~1\Temp\etilqs_cLZF9ZjcLUyCd1DsWLmJ scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\Votre Ordinateur\Local Settings\Temporary Internet Files\Content.IE5\END3WUBQ\MsgrConfig[1].asmx scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Votre Ordinateur\Local Settings\Temporary Internet Files\Content.IE5\V7OG47Z1\ADSAdClient31[2].txt scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Votre Ordinateur\Local Settings\Temporary Internet Files\Content.IE5\V7OG47Z1\01[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Votre Ordinateur\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. User's Temporary Internet Files folder emptied. Local Service Temp folder emptied. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_770.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. File delete failed. C:\Documents and Settings\Votre Ordinateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Votre Ordinateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Votre Ordinateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Votre Ordinateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Votre Ordinateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\XUL.mfl scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Votre Ordinateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\urlclassifier3.sqlite scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTM by OldTimer - Version 2.1.0.0 log created on 06092009_113134 Files moved on Reboot... File C:\DOCUME~1\VOTREO~1\LOCALS~1\Temp\Perflib_Perfdata_978.dat not found! File C:\DOCUME~1\VOTREO~1\LOCALS~1\Temp\Perflib_Perfdata_544.dat not found! File C:\DOCUME~1\VOTREO~1\LOCALS~1\Temp\etilqs_cLZF9ZjcLUyCd1DsWLmJ not found! C:\Documents and Settings\Votre Ordinateur\Local Settings\Temporary Internet Files\Content.IE5\END3WUBQ\MsgrConfig[1].asmx moved successfully. File C:\Documents and Settings\Votre Ordinateur\Local Settings\Temporary Internet Files\Content.IE5\V7OG47Z1\ADSAdClient31[2].txt not found! File C:\Documents and Settings\Votre Ordinateur\Local Settings\Temporary Internet Files\Content.IE5\V7OG47Z1\01[1].htm not found! File C:\WINDOWS\temp\Perflib_Perfdata_770.dat not found! C:\Documents and Settings\Votre Ordinateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\Votre Ordinateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\Votre Ordinateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\Votre Ordinateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\Votre Ordinateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\XUL.mfl moved successfully. C:\Documents and Settings\Votre Ordinateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\urlclassifier3.sqlite moved successfully. Registry entries deleted on Reboot...

donc MBAM reagit a ce driver positivement... mais le probleme c'est qu'il bloque ensuite le pc. Faudrait t'il le rajouter dans les exceptions pour ne pas qu'il le detecte ??? en somme comment faire pour ne plus qu'il me derange....

il se peux que finalement j'ai une bonne nouvelle, comme dis precedemment il se lance au demarrage 9 fois sur 10 . j'ai donc reussi a demarrer sans qu'il se lance (coup de bol !) et fait la recherche que tu me demandais en voici le resultat Windows Registry Editor Version 5.00 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.6.0 ; Results at 09/06/2009 11:06:31 for strings: ; 'mc22.tmp' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mchInjDrv] "ImagePath"="\\??\\C:\\DOCUME~1\\VOTREO~1\\LOCALS~1\\Temp\\mc22.tmp" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\mchInjDrv] "ImagePath"="\\??\\C:\\DOCUME~1\\VOTREO~1\\LOCALS~1\\Temp\\mc22.tmp" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mchInjDrv] "ImagePath"="\\??\\C:\\DOCUME~1\\VOTREO~1\\LOCALS~1\\Temp\\mc22.tmp" ; End Of The Log...

ha ! ce n'est pas que de la bonne nouvelle ca .... et la reinstall complete suffirait. J'aime pas bosser sur un pc tout en sachant qu'il y a un truc au niveau de la sécurité qui déconne.

votre lien ne semble plus fonctionner. voici le rapport avec la recherche mc22.tmp Windows Registry Editor Version 5.00 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.6.0 ; Results at 09/06/2009 10:33:00 for strings: ; 'mc22.tmp' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS ; End Of The Log...

tout d'abord effectivement Bonjour, j'utilise la version payante

je pense que c'est cela que tu m'a demandé. MBAM ne le voit qu'au demarrrage ensuite le scan ne le detecte pas Malwarebytes' Anti-Malware 1.37 Version de la base de données: 2246 Windows 5.1.2600 Service Pack 3 08/06/2009 13:37:11 mbam-log-2009-06-08 (13-37-11).txt Type de recherche: Examen complet (C:\|H:\|) Eléments examinés: 55830 Temps écoulé: 35 minute(s), 21 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 0 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): (Aucun élément nuisible détecté) j'ai 3 élément en quarantaine le02/06/09 et le 07/06/09: trojan.agent c:\documents and settings\votre ordinateur\local settings\TEMP\mc22.tmp le02/06/09: Hijack.ControlPanelStyle : HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\forceclassiccontrolpanel (data:1)

apres essai en mode sans echec qd le pc redemarre malaware redetecte le fichier .tmp et blocage donc pas de log de crée.. il a l'air penible ce virus !!!

toujours meme probleme au demarrage. Essayer en mode sans echec ?

le voila : ComboFix 09-06-07.05 - Votre Ordinateur 08/06/2009 19:33.4 - FAT32x86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2046.1528 [GMT 2:00] Lancé depuis: c:\documents and settings\Votre Ordinateur\Bureau\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\Votre Ordinateur\Bureau\CFScript.txt AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} FILE :: "C:\FOUND.000" "C:\FOUND.001" "C:\FOUND.002" "C:\FOUND.003" "C:\FOUND.004" "c:\windows\PEV.exe" . Les fichiers ci-dessous ont été désactivés pendant l'exécution: c:\program files\SuperCopier2\SC2Hook.dll (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\PEV.exe . ---- Exécution préalable ------- . c:\windows\PEV.exe . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_MCHINJDRV -------\Legacy_MCHINJDRV ((((((((((((((((((((((((((((( Fichiers créés du 2009-05-08 au 2009-06-08 )))))))))))))))))))))))))))))))))))) . 2009-06-08 12:03 . 2009-06-08 12:03 -------- d-----w- c:\program files\trend micro 2009-06-08 12:03 . 2009-06-08 12:03 -------- d-----w- C:\rsit 2009-06-08 09:55 . 2009-06-08 09:55 -------- d-----w- c:\windows\system32\AGEIA 2009-06-08 09:55 . 2009-06-08 09:55 -------- d-----w- c:\program files\AGEIA Technologies 2009-06-08 09:55 . 2009-06-08 09:55 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-06-08 09:55 . 2009-04-30 20:02 457248 ----a-w- c:\windows\system32\nvudisp.exe 2009-06-08 09:54 . 2009-04-26 22:42 457248 ----a-w- c:\windows\system32\NVUNINST.EXE 2009-06-07 12:20 . 2009-06-07 12:20 -------- d-sh--w- c:\documents and settings\Votre Ordinateur\PrivacIE 2009-06-06 17:41 . 2009-06-06 17:41 -------- d-sh--w- c:\documents and settings\Votre Ordinateur\IETldCache 2009-06-06 16:41 . 2009-06-06 16:41 -------- d-----w- c:\windows\ie8updates 2009-06-06 16:41 . 2009-05-12 05:11 102912 ------w- c:\windows\system32\dllcache\iecompat.dll 2009-06-06 16:40 . 2009-06-06 16:40 -------- d--h--w- c:\windows\ie8 2009-06-04 12:51 . 2009-06-04 12:51 -------- d-----w- c:\program files\CPU Stress MT 2009-06-03 10:57 . 2009-06-03 10:57 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe 2009-06-03 10:57 . 2009-06-03 10:57 -------- d-----w- c:\documents and settings\LocalService\Bureau 2009-06-02 14:09 . 2009-06-02 14:09 -------- d-----w- c:\program files\uTorrent 2009-06-02 14:09 . 2009-06-02 14:09 -------- d-----w- c:\documents and settings\Votre Ordinateur\Application Data\uTorrent 2009-06-02 09:29 . 2009-06-02 09:29 -------- d--h--w- c:\windows\system32\GroupPolicy 2009-06-01 16:52 . 2009-06-01 16:52 86016 ----a-w- c:\windows\system32\OpenAL32.dll 2009-06-01 16:52 . 2009-06-01 16:52 262144 ----a-w- c:\windows\system32\wrap_oal.dll 2009-06-01 16:51 . 2009-06-01 16:51 -------- d-----w- c:\windows\system32\Futuremark 2009-06-01 16:51 . 2007-09-07 12:55 27672 ----a-w- c:\windows\system32\drivers\Entech.sys 2009-06-01 16:51 . 2007-09-07 12:55 12744 ----a-w- c:\windows\system32\drivers\Entech64.sys 2009-06-01 16:51 . 2001-11-19 18:05 3972 ----a-w- c:\windows\system32\drivers\PciBus.sys 2009-06-01 16:50 . 2009-06-01 16:50 -------- d-----w- c:\program files\Futuremark 2009-06-01 08:36 . 2009-06-01 08:36 -------- d-----w- c:\documents and settings\Votre Ordinateur\Application Data\Malwarebytes 2009-06-01 08:36 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-01 08:36 . 2009-06-01 08:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-06-01 08:36 . 2009-06-01 08:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-06-01 08:36 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-05-29 16:55 . 2009-05-29 16:55 -------- d-----w- c:\program files\Axon Data 2009-05-27 17:29 . 2009-05-27 17:29 -------- d-----w- c:\windows\system32\oodag 2009-05-27 17:17 . 2009-05-27 17:17 -------- d-----w- c:\program files\OO Software 2009-05-27 16:50 . 2009-05-27 16:50 -------- d-----w- c:\program files\PowerQuest 2009-05-27 16:35 . 2009-05-27 16:35 -------- d-----w- c:\windows\system32\NtmsData 2009-05-26 19:03 . 2009-05-26 19:04 -------- d-----w- c:\program files\Windows Live Safety Center 2009-05-26 16:02 . 2009-05-26 16:02 -------- d-----w- c:\program files\Fichiers communs\Adobe 2009-05-26 16:01 . 2009-05-26 16:01 -------- d-----w- c:\documents and settings\Votre Ordinateur\Local Settings\Application Data\Adobe 2009-05-26 16:01 . 2009-05-26 16:01 -------- d-----w- c:\program files\NOS 2009-05-26 16:01 . 2009-05-26 16:01 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS 2009-05-26 15:07 . 2009-05-26 15:07 430080 ----a-w- c:\windows\AsTransBMP.exe 2009-05-20 10:31 . 2009-05-20 10:31 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2 2009-05-20 10:31 . 2009-05-20 10:31 -------- d-----w- c:\program files\MSXML 4.0 2009-05-19 13:31 . 2009-05-19 13:31 -------- d-----w- c:\documents and settings\Votre Ordinateur\Application Data\vlc 2009-05-19 13:28 . 2009-05-19 13:28 10134 ----a-r- c:\documents and settings\Votre Ordinateur\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe 2009-05-19 13:27 . 2009-05-19 13:28 10134 ----a-r- c:\documents and settings\Votre Ordinateur\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe 2009-05-19 13:27 . 2009-05-19 13:27 10134 ----a-r- c:\documents and settings\Votre Ordinateur\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe 2009-05-19 13:27 . 2009-05-19 13:27 -------- d-----w- c:\documents and settings\Votre Ordinateur\Application Data\dvdcss 2009-05-19 13:15 . 1998-11-13 12:16 308224 ----a-w- c:\windows\IsUn040c.exe 2009-05-19 13:13 . 2009-05-19 13:13 -------- d-----w- c:\documents and settings\Votre Ordinateur\Local Settings\Application Data\Logitech-LS 2009-05-19 13:09 . 2009-05-19 13:09 -------- d-----w- c:\program files\Fichiers communs\FotoWire 2009-05-19 13:09 . 2009-05-19 13:09 -------- d-----w- c:\documents and settings\Votre Ordinateur\Application Data\FotoWire 2009-05-19 13:08 . 2004-10-08 10:46 53248 ----a-r- c:\windows\system32\InstMed.exe 2009-05-19 13:08 . 2009-05-19 13:08 -------- d-----w- c:\program files\Fichiers communs\Logitech 2009-05-19 13:07 . 2003-03-18 20:12 1047552 ----a-w- c:\windows\system32\MFC71u.dll 2009-05-19 13:07 . 2003-03-18 19:44 57344 ----a-w- c:\windows\system32\MFC71ENU.DLL 2009-05-19 13:07 . 2003-03-18 19:44 49152 ----a-w- c:\windows\system32\MFC71KOR.DLL 2009-05-19 13:07 . 2003-03-18 19:44 61440 ----a-w- c:\windows\system32\MFC71ITA.DLL 2009-05-19 13:07 . 2003-03-18 19:44 61440 ----a-w- c:\windows\system32\MFC71ESP.DLL 2009-05-19 13:07 . 2003-03-18 19:44 45056 ----a-w- c:\windows\system32\MFC71CHT.DLL 2009-05-19 13:07 . 2003-03-18 19:44 40960 ----a-w- c:\windows\system32\MFC71CHS.DLL 2009-05-19 13:07 . 2003-03-18 19:44 65536 ----a-w- c:\windows\system32\MFC71DEU.DLL 2009-05-19 13:07 . 2003-03-18 19:44 49152 ----a-w- c:\windows\system32\MFC71JPN.DLL 2009-05-19 13:07 . 2003-03-18 18:05 89088 ----a-w- c:\windows\system32\atl71.dll 2009-05-19 12:29 . 2009-05-19 12:29 -------- d-----w- c:\program files\HyCam2 2009-05-18 12:52 . 2009-05-18 12:52 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\NVIDIA Corporation 2009-05-18 12:52 . 2009-05-18 12:52 -------- d-----w- c:\program files\NVIDIA Corporation 2009-05-18 10:37 . 2009-05-18 10:37 -------- d-----w- c:\documents and settings\Votre Ordinateur\Tracing 2009-05-18 10:32 . 2009-05-18 10:32 -------- d-----w- c:\program files\Microsoft Silverlight 2009-05-18 10:32 . 2009-05-18 10:32 -------- d-----w- c:\program files\Microsoft Office Outlook Connector 2009-05-18 10:32 . 2009-05-18 10:32 -------- d-----w- c:\program files\Microsoft Sync Framework 2009-05-18 10:31 . 2009-05-18 10:31 -------- d-----w- c:\program files\Microsoft 2009-05-18 10:31 . 2009-05-18 10:31 -------- d-----w- c:\program files\Windows Live SkyDrive 2009-05-18 10:27 . 2009-05-18 10:27 -------- d-----w- c:\program files\Fichiers communs\Windows Live 2009-05-17 09:41 . 2008-10-16 12:06 268648 ----a-w- c:\windows\system32\mucltui.dll 2009-05-17 09:40 . 2009-05-17 09:40 -------- d-----w- c:\program files\Runtime Software 2009-05-16 17:25 . 2009-05-16 17:25 -------- d-----w- C:\usbboot 2009-05-16 16:54 . 2009-05-16 16:54 -------- d-----w- c:\program files\CPUID 2009-05-16 16:54 . 2009-03-26 23:16 12672 ----a-w- c:\windows\system32\drivers\cpuz132_x32.sys 2009-05-16 15:59 . 2009-05-16 15:59 -------- d-----w- c:\program files\7-Zip 2009-05-16 15:58 . 2008-10-24 11:21 455296 ------w- c:\windows\system32\dllcache\mrxsmb.sys 2009-05-16 15:42 . 2009-05-16 15:42 -------- d-----w- c:\program files\Microsoft Works 2009-05-16 15:41 . 2009-05-16 15:41 -------- d-----w- c:\program files\MSBuild 2009-05-16 15:41 . 2009-05-16 15:41 -------- d-----w- c:\program files\Microsoft.NET 2009-05-16 15:39 . 2009-05-16 15:39 -------- d-----w- c:\program files\Microsoft Visual Studio 8 2009-05-16 15:38 . 2009-05-16 15:38 -------- d-----w- c:\windows\SHELLNEW 2009-05-16 15:38 . 2009-05-16 15:38 -------- d-----w- c:\documents and settings\Votre Ordinateur\Local Settings\Application Data\Microsoft Help 2009-05-16 15:38 . 2009-05-16 15:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-05-16 15:38 . 2009-05-16 15:38 -------- d--h--r- C:\MSOCache 2009-05-16 15:31 . 2009-05-16 15:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus! 2009-05-16 15:30 . 2009-05-16 15:30 -------- d-s---w- c:\documents and settings\Votre Ordinateur\UserData 2009-05-16 15:29 . 2009-05-16 15:29 -------- d-----w- c:\documents and settings\Votre Ordinateur\Application Data\FileZilla 2009-05-16 15:29 . 2009-05-16 15:29 -------- d-----w- c:\program files\FileZilla FTP Client 2009-05-16 15:27 . 2009-05-16 15:27 -------- d-----w- c:\documents and settings\Votre Ordinateur\Application Data\teamspeak2 2009-05-16 15:26 . 2009-05-16 15:27 -------- d-----w- c:\program files\Teamspeak2_RC2 2009-05-16 15:18 . 2009-05-16 15:18 -------- d-----w- c:\documents and settings\Votre Ordinateur\Local Settings\Application Data\Logitech 2009-05-16 15:18 . 2009-05-16 15:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech 2009-05-16 15:17 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys 2009-05-16 15:17 . 2009-03-24 14:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-05-16 15:17 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys 2009-05-16 15:17 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys 2009-05-16 15:17 . 2009-05-16 15:17 -------- d-----w- c:\program files\Avira 2009-05-16 15:17 . 2009-05-16 15:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira 2009-05-16 15:14 . 2009-05-16 15:14 -------- d-----w- c:\program files\Messenger Plus! Live 2009-05-16 15:14 . 2009-05-16 15:50 69240 ----a-w- c:\documents and settings\Votre Ordinateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-05-16 15:11 . 2009-05-16 15:11 -------- d-----w- c:\program files\CCleaner 2009-05-16 15:08 . 2009-05-16 15:08 -------- d-----w- c:\program files\DIFX 2009-05-16 15:08 . 2007-09-27 12:46 48896 ----a-w- c:\windows\system32\drivers\JmtFltr.sys 2009-05-16 15:08 . 2005-12-22 01:23 14592 ----a-w- c:\windows\system32\drivers\USBICP.sys 2009-05-16 15:08 . 2009-05-16 15:08 -------- d-----w- c:\documents and settings\Votre Ordinateur\Application Data\n52te 2009-05-16 15:08 . 2009-05-16 15:08 -------- d-----w- c:\program files\n52te 2009-05-16 15:08 . 2007-09-19 15:01 12672 ----a-w- c:\windows\system32\drivers\vhidmini.sys 2009-05-16 15:05 . 2009-05-16 15:05 -------- d-----w- c:\documents and settings\Votre Ordinateur\Local Settings\Application Data\LogiShrd 2009-05-16 15:04 . 2009-05-16 15:04 53248 ----a-r- c:\documents and settings\Votre Ordinateur\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe 2009-05-16 15:04 . 2009-05-16 15:04 -------- d-----w- c:\program files\Common Files 2009-05-16 15:04 . 2009-05-16 15:04 -------- d-----w- c:\documents and settings\Votre Ordinateur\Application Data\Leadertech 2009-05-16 15:03 . 2009-05-16 15:03 -------- d-----w- C:\NVIDIA 2009-05-16 15:02 . 2009-05-16 15:02 -------- d-----w- c:\program files\Logitech 2009-05-16 15:02 . 2009-05-16 15:02 -------- d-----w- c:\program files\Fichiers communs\Logishrd 2009-05-16 15:02 . 2009-05-16 15:02 -------- d-----w- c:\documents and settings\Votre Ordinateur\Local Settings\Application Data\Downloaded Installations 2009-05-16 15:02 . 2009-05-16 15:02 -------- d-----w- c:\documents and settings\All Users\Application Data\LogiShrd . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-05 12:07 . 2004-08-05 10:00 75266 ----a-w- c:\windows\system32\perfc00C.dat 2009-06-05 12:07 . 2004-08-05 10:00 468072 ----a-w- c:\windows\system32\perfh00C.dat 2009-05-27 16:25 . 2009-05-27 16:25 -------- d-----w- c:\program files\Winamp 2009-05-27 16:25 . 2009-05-27 16:25 -------- d-----w- c:\documents and settings\Votre Ordinateur\Application Data\Winamp 2009-05-18 15:03 . 2009-05-16 14:25 86331 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-05-16 15:03 . 2009-05-16 15:03 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2009-05-16 15:03 . 2009-05-16 15:03 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2009-05-16 14:58 . 2009-05-16 14:53 664 ----a-w- c:\windows\system32\d3d9caps.dat 2009-05-16 14:53 . 2009-05-16 14:53 -------- d-----w- c:\program files\SystemRequirementsLab 2009-05-16 14:53 . 2009-05-16 14:53 290816 ----a-w- c:\documents and settings\Votre Ordinateur\Application Data\SystemRequirementsLab\SRLProxy_nvd_4.dll 2009-05-16 14:53 . 2009-05-16 14:53 290816 ----a-w- c:\documents and settings\Votre Ordinateur\Application Data\SystemRequirementsLab\SRLProxy_nvd_3.dll 2009-05-16 14:53 . 2009-05-16 14:53 290816 ----a-w- c:\documents and settings\Votre Ordinateur\Application Data\SystemRequirementsLab\SRLProxy_nvd_2.dll 2009-05-16 14:53 . 2009-05-16 14:53 290816 ----a-w- c:\documents and settings\Votre Ordinateur\Application Data\SystemRequirementsLab\SRLProxy_nvd_1.dll 2009-05-16 14:53 . 2009-05-16 14:53 -------- d-----w- c:\documents and settings\Votre Ordinateur\Application Data\SystemRequirementsLab 2009-05-16 14:52 . 2009-05-16 14:52 -------- d-sh--w- c:\program files\Fichiers communs\WindowsLiveInstaller 2009-05-16 14:52 . 2009-05-16 14:52 0 ----a-w- c:\windows\nsreg.dat 2009-05-16 14:52 . 2009-05-16 14:52 -------- d-----w- c:\program files\Windows Live 2009-05-16 14:52 . 2009-05-16 14:51 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller 2009-05-16 14:51 . 2009-05-16 14:51 -------- d-----w- c:\program files\Steam 2009-05-16 14:51 . 2009-05-16 14:51 -------- d-----w- c:\program files\VideoLAN 2009-05-16 14:51 . 2009-05-16 14:51 -------- d-----w- c:\program files\SuperCopier2 2009-05-16 14:50 . 2009-05-16 14:50 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-05-16 14:50 . 2009-05-16 14:50 152576 ----a-w- c:\documents and settings\Votre Ordinateur\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-05-16 14:48 . 2009-05-16 14:48 -------- d-----w- c:\program files\DriveXpert 2009-05-16 14:47 . 2009-05-16 14:47 -------- d-----w- c:\program files\ASUS 2009-05-16 14:40 . 2009-05-16 14:40 -------- d-----w- c:\program files\Fichiers communs\InstallShield 2009-05-16 14:36 . 2009-05-16 14:36 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-05-16 14:36 . 2009-05-16 14:36 -------- d-----w- c:\program files\Realtek 2009-05-16 14:36 . 2009-05-16 14:36 -------- d-----w- c:\documents and settings\Votre Ordinateur\Application Data\InstallShield 2009-05-16 14:32 . 2009-05-16 14:32 -------- d-----w- c:\program files\Intel 2009-05-16 14:31 . 2009-05-16 14:31 -------- d-----w- c:\program files\Windows Media Connect 2 2009-05-16 14:28 . 2009-05-16 14:28 -------- d-----w- c:\program files\Java 2009-05-16 14:28 . 2009-05-16 14:28 -------- d-----w- c:\program files\Fichiers communs\Java 2009-05-16 14:28 . 2009-05-16 14:28 -------- d-----w- c:\program files\Informatik Soluce 2009-05-16 14:28 . 2009-05-16 14:28 -------- d-----w- c:\program files\Contig 2009-05-16 14:28 . 2009-05-16 14:28 -------- d-----w- c:\program files\Mpc 2009-05-16 14:25 . 2009-05-16 14:25 -------- d-----w- c:\program files\microsoft frontpage 2009-05-16 14:24 . 2009-05-16 14:24 -------- d-----w- c:\program files\Services en ligne 2009-05-16 14:23 . 2009-05-16 14:23 21892 ----a-w- c:\windows\system32\emptyregdb.dat 2009-04-30 22:30 . 2009-04-30 22:30 1194528 ----a-w- c:\windows\system32\nvcplui.exe 2009-04-30 20:02 . 2009-04-30 20:02 9994240 ----a-w- c:\windows\system32\nvoglnt.dll 2009-04-30 20:02 . 2009-04-30 20:02 806912 ----a-w- c:\windows\system32\nvapi.dll 2009-04-30 20:02 . 2009-04-30 20:02 8055584 ----a-w- c:\windows\system32\drivers\nv4_mini.sys 2009-04-30 20:02 . 2009-04-30 20:02 663552 ----a-w- c:\windows\system32\nvcuvid.dll 2009-04-30 20:02 . 2009-04-30 20:02 5896320 ----a-w- c:\windows\system32\nv4_disp.dll 2009-04-30 20:02 . 2009-04-30 20:02 1720320 ----a-w- c:\windows\system32\nvcuda.dll 2009-04-30 20:02 . 2009-04-30 20:02 1579630 ----a-w- c:\windows\system32\nvdata.bin 2009-04-30 20:02 . 2009-04-30 20:02 143360 ----a-w- c:\windows\system32\nvcodins.dll 2009-04-30 20:02 . 2009-04-30 20:02 143360 ----a-w- c:\windows\system32\nvcod.dll 2009-04-30 20:02 . 2009-04-30 20:02 1314816 ----a-w- c:\windows\system32\nvcuvenc.dll 2009-04-03 10:39 . 2009-04-03 10:39 70936 ----a-w- c:\windows\system32\PhysXLoader.dll . ((((((((((((((((((((((((((((( SnapShot@2009-06-08_11.41.10 ))))))))))))))))))))))))))))))))))))))))) . + 2009-06-08 17:35 . 2009-06-08 17:35 16384 c:\windows\temp\Perflib_Perfdata_528.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672] "Steam"="c:\program files\steam\steam.exe" [2009-06-04 1217784] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-16 148888] "JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864] "Launch PC Probe II"="c:\program files\ASUS\PC Probe II\Probe2.exe" [2008-12-11 2143232] "Jomantha"="c:\program files\n52te\n52teHid.exe" [2008-06-13 159744] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-07-17 1687824] "Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-07-18 2094352] "LogitechCommunicationsManager"="c:\program files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe" [2006-10-30 284184] "LVCOMSX"="c:\program files\Fichiers communs\Logitech\LComMgr\LVComSX.exe" [2006-11-15 244512] "ASUS Update Checker"="c:\program files\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe" [2008-12-11 114688] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-05-26 414480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-04-30 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-30 13750272] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-11-17 17676288] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-07-17 55824] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-04-30 1657376] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ SetPointII.lnk - c:\program files\Logitech\SetPoint II\SetpointII.exe [2007-8-30 319488] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^Votre Ordinateur^Menu Démarrer^Programmes^Démarrage^Logitech . Enregistrement du produit.lnk] path=c:\documents and settings\Votre Ordinateur\Menu Démarrer\Programmes\Démarrage\Logitech . Enregistrement du produit.lnk backup=c:\windows\pss\Logitech . Enregistrement du produit.lnkStartup [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Steam\\steamapps\\casquapointes\\counter-strike source\\hl2.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "h:\\Divers\\Left4Dead (PC) (ENG)(NON-STEAM) (ALREADY CRACKED) (DIRECT PLAY) [blaze69]\\Left4Dead\\Left4Dead\\hl2.exe"= R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [16/05/2009 17:17 108289] R3 JmtFltr;n52te;c:\windows\system32\drivers\JmtFltr.sys [16/05/2009 17:08 48896] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [01/06/2009 10:36 19096] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [01/06/2009 10:36 194832] S3 cpuz131;cpuz131;\??\c:\docume~1\VOTREO~1\LOCALS~1\Temp\cpuz131\cpuz_x32.sys --> c:\docume~1\VOTREO~1\LOCALS~1\Temp\cpuz131\cpuz_x32.sys [?] S3 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [16/05/2009 18:54 12672] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contenu du dossier 'Tâches planifiées' 2009-06-08 c:\windows\Tasks\Malwarebytes' Scheduled Update for Votre Ordinateur.job - c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-06-01 11:20] 2009-06-08 c:\windows\Tasks\Malwarebytes' Scheduled Scan for Votre Ordinateur.job - c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-06-01 11:20] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Votre Ordinateur\Application Data\Mozilla\Firefox\Profiles\ux7btt7q.default\ FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll ---- PARAMETRES FIREFOX ---- FF - user.js: yahoo.homepage.dontask - true. ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-08 19:35 Windows 5.1.2600 Service Pack 3 FAT NTAPI Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG10.00.00.01WORKSTATION"="AB60671F8D522BDC363BB3C49CCC59C2D66B42AFCBE057B20B23875921AE3DFEEFC0C565F1F 09B2BE567C37ECE42B72E46640F82812D5881206DD77D0E8B251290A551FB5735166821F231A0C405 F234BB30AA137BA6DD9FAE1A8F3F2DB5F5EFBB20ED5DEE3102813EF94FD1243CB383590EF8587CA87 19341AD42FEF860B81F849C00F78A0F8817F768752E3B246477231060B86827DE98C3000A948DD13B 5561D670AF200718006F80FD47F68D3424819DCD1547A5B51F083B02C9AE640E01AB5EAD5BFEBC9E1 27BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E12 7BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407FEBC9E127BECC74CA6A0AC4980AC7933928453206 D0DEC528714108C835EB7C57D579A294DA0161A13C2A8981846ADE4EAC94216B7379778BA411FDADD D541B6DD8D19CEF7DF642A0AA22510A58D91700055684638913F7BDEFE51C7C6DC771BF6E6480DD0B 70A583A89EEF3ED2D5428B2266DD91741975D8E1F4FF8EF79E0003BAAF42331B47CE3905413411657 7E94074C3CAAE13DDA9487088447700A076A42342C8959BAB57A1CF1DE2B25921B3326EC074889D14 20C2BB3A33FC13F7652C5F13FE86EFDB5C191E7E69887B93AF45E4140F7639E12207F31A221C29C41 2025E7C41DF4887DCFC7CD02A3107DEE3E9E17212E2A960DA4AE23B7E0367DFE3464AD17B9DAB8953 33B50CA1A6F5DD1E97CCF2519FA837B5E86BEE328C10C46E0286E5504ED4007690CAF2180C133FEC2 32600D9856FEAC87F9CE6551EF4A37EEBD69DFF362A3E1E8FE3FA78B0127140B9B525D3EA1F96DCD1 D3142EFAF0D711613F15EB8CFBE38977969C4A58DBA35F738C15C52A6371654AA58C3C653FC9C0A3A ED3BB2AFBD20520A28A5EE2DBE8CB1AF6198CF92CFFB3001CA77CE91166169EA5AA2F8642334E95E0 D3839085AC15549F560E7F7AEFE6B22232D34832BECCD80C507532F4414214C3B2F0AA98888F37259 C87CCA157D05320EFA5728DE714179D3A040B8CA6230CAEC821C03979114BBF729A565155CEDFC50B ACD63AA25C3F7BBE7710BB5C444F46CEDDF68AA95ACD9D39EAF0495050CEF3E095FF9DAC047C3489B CA1755E67B0C1BEEF5123A50ACA5818919C955643A9BC2C508951203B2C7D8BDE7AECF77ECF3ECC83 69C0E81F31D2A8C15BAE1E946385C187847C2AB61126114168B9F281DB3EA052A89C56C57DF0C910D BFA08B729E1D68967F3882A35668A9564691AF0A77AFEB90BAD5589F33F7439A28C7C0F44CAAE27A1 40D50BA6C8ACC5DDFC8C9238F6D0F5B7A83130B8152128D246307F66340F8EE41B162DECC740E153C B934CD6FE6BFB2F4EAE84AD496B3E9C953DE96AAAB6176A4EC0AB918ECC39CA02E325F2FF4156FB9F 8B081DF4F9E6791CCCCE58ACF14C4" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'explorer.exe'(8040) c:\program files\Fichiers communs\Logitech\LVMVFM\LVPrcInj.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\windows\system32\eappprxy.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\SYSTEM32\NVSVC32.EXE c:\program files\FICHIERS COMMUNS\LOGITECH\LVMVFM\LVPRCSRV.EXE c:\program files\AVIRA\ANTIVIR DESKTOP\AVGUARD.EXE c:\program files\JAVA\JRE6\BIN\JQS.EXE c:\windows\SYSTEM32\OODAG.EXE c:\program files\MICROSOFT\SEARCH ENHANCEMENT PACK\SEAPORT\SEAPORT.EXE c:\program files\LOGITECH\GAMEPANEL SOFTWARE\LCD MANAGER\APPLETS\LCDCLOCK.EXE c:\windows\SYSTEM32\RUNDLL32.EXE c:\program files\ASUS\AASP\1.00.81\AACENTER.EXE c:\program files\n52te\n52teTra.exe c:\program files\FICHIERS COMMUNS\LOGISHRD\KHAL2\KHALMNPR.EXE . ************************************************************************** . Heure de fin: 2009-06-08 19:36 - La machine a redémarré ComboFix-quarantined-files.txt 2009-06-08 17:36 ComboFix2.txt 2009-06-08 11:41 ComboFix3.txt 2009-06-08 10:50 Avant-CF: 11 751 997 440 octets libres Après-CF: 11 746 656 256 octets libres 329 --- E O F --- 2009-06-06 16:41

bon... mauvaise nouvelle... apres le lancement de combofix comme decrit ds ton post , le pc redemarre et malawarebyte me signale le meme probleme et freeze du pc. dc reboot forcé et pas de fichier log de crée ! je vais retester en esperant que au prochain demarrage le log soit crée