bonjour tout le monde !
voila suite a un virus constaté j'ai utilisé combofix (j'ai été averti aprés qu'il ne fallait pas l'utiliser sans l'avis de quelqu'un) donc j'ai un rapport combofix que je suis dans l'impossibilité de déchiffré.
je vous expose mon probleme:
avant que je n'utilise combofix un message d'alerte en anglais s'afficher a peut prés toute les 10 minutes (s'intitulant "Security center alert") en me disant que j'avais des risques que mon ordinateur sois infecter par un virus (win32.brontok il me semble mais je n'en suis pas sur ) et tenté de me faire installé un antivirus (... défender un truc comme sa) et quand je me connecter a firefox une page s'afficher toujours en anglais en me disant que aucun de mes parefeux n'étaient activé et que me ordinateur couraient un risque .il me donnait deux choix :
-continuer malgré la menace de circulé sur internet
ou
-installé un antivirus sur ce pc (toujours le même)
donc voila le truc bien prise de tète
je présise que depuis l'utilisation de combofix ces symptomes s'emble avoir disparus mais j'ai lus sur un forum qu'il fallait quand même faire analyser le rapport donc me voici ici !!
si quelqu'un voudrai bien m'aider j'en serré ravi
je risque de partir quelque jour donc si je ne répond pas dessuite c'est normal.
merci d'avance
ComboFix 09-08-03.04 - tom 04/08/2009 11:07.1.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.511.93 [GMT 2:00]
Running from: c:\documents and settings\tom\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090804-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\burnlib.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\dsp_sps.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\enc_aacplus.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\enc_flac.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\enc_lame.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\enc_vorbis.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\enc_wav.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\enc_wma.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\gen_crasher.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\gen_ff.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\gen_hotkeys.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\gen_ml.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\gen_tray.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\in_cdda.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\in_dshow.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\in_flac.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\in_linein.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\in_midi.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\in_mod.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\in_mp3.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\in_mp4.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\in_nsv.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\in_vorbis.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\in_wave.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\in_wm.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_bookmarks.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_dash.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_disc.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_history.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_local.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_nowplaying.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_online.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_orb.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_playlists.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_plg.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_pmp.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_rg.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_transcode.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\ml_wire.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\out_disk.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\out_ds.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\out_wave.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\pmp_activesync.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\pmp_ipod.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\pmp_njb.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\pmp_p4s.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\pmp_usb.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\tagz.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\vis_avs.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\vis_milk.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\vis_nsfs.lng
c:\docume~1\tom\LOCALS~1\Temp\WLZE5D4.tmp\winamp.lng
c:\documents and settings\tom\Application Data\Dossier de téléchargement Share-to-Web
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\burnlib.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\dsp_sps.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\enc_aacplus.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\enc_flac.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\enc_lame.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\enc_vorbis.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\enc_wav.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\enc_wma.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\gen_crasher.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\gen_ff.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\gen_hotkeys.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\gen_ml.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\gen_tray.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\in_cdda.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\in_dshow.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\in_flac.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\in_linein.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\in_midi.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\in_mod.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\in_mp3.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\in_mp4.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\in_nsv.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\in_vorbis.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\in_wave.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\in_wm.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_bookmarks.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_dash.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_disc.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_history.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_local.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_nowplaying.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_online.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_orb.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_playlists.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_plg.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_pmp.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_rg.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_transcode.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\ml_wire.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\out_disk.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\out_ds.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\out_wave.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\pmp_activesync.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\pmp_ipod.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\pmp_njb.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\pmp_p4s.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\pmp_usb.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\tagz.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\vis_avs.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\vis_milk.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\vis_nsfs.lng
c:\documents and settings\tom\Local Settings\Temp\WLZE5D4.tmp\winamp.lng
c:\progra~1\FICHIE~1\{3CE7D~1
c:\progra~1\FICHIE~1\{CCE7D~1
c:\progra~1\FICHIE~1\{CCE7D~2
c:\progra~1\FICHIE~1\{CCE7D~3
c:\program files\Fichiers communs\Yazzle1396OinUninstaller.exe
c:\program files\ipwindows
c:\program files\ipwindows\popEF.tmp
c:\program files\ipwindows\Uninst.exe
c:\program files\newdotnet
c:\program files\newdotnet\readme.html
c:\program files\outlook
c:\windows\Installer\6978f.msi
c:\windows\Installer\69795.msi
c:\windows\Installer\6979d.msi
c:\windows\Installer\bbbab.msp
c:\windows\pack.epk
c:\windows\system32\aqscccy.dat
c:\windows\system32\aqscccy.exe
c:\windows\system32\aqscccy_nav.dat
c:\windows\system32\aqscccy_navps.dat
c:\windows\system32\bszip.dll
c:\windows\system32\cmd.com
c:\windows\system32\drivers\svchost.exe
c:\windows\system32\fo-remove.exe
c:\windows\system32\iqeiu_navfx.dat
c:\windows\system32\izhrtnr_navfx.dat
c:\windows\system32\jzorwmvsih_navtmp.dat
c:\windows\system32\kappzyr_navtmp.dat
c:\windows\system32\ldpackage.dll
c:\windows\system32\model.dat
c:\windows\system32\netstat.com
c:\windows\system32\nvs2.inf
c:\windows\system32\ping.com
c:\windows\system32\regedit.com
c:\windows\system32\rlxf.dll
c:\windows\system32\rnaph.dll
c:\windows\system32\taskkill.com
c:\windows\system32\tasklist.com
c:\windows\system32\tracert.com
c:\windows\system32\UpMedia
c:\windows\system32\UpMedia\uninstallSE.exe
c:\windows\Sysvxd.exe
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_CLIENT_IP-IPX
-------\Service_Client IP-IPX
((((((((((((((((((((((((( Files Created from 2009-07-04 to 2009-08-04 )))))))))))))))))))))))))))))))
.
2009-08-04 09:31 . 2009-08-04 09:31 -------- d-----w- c:\documents and settings\tom\Application Data\Dossier de téléchargement Share-to-Web
2009-08-03 10:47 . 2009-08-03 10:47 4956408 ----a-w- c:\documents and settings\tom\Application Data\pdinstall.exe
2009-08-02 18:29 . 2009-02-05 20:06 23152 -c--a-w- c:\windows\system32\drivers\aswRdr.sys
2009-08-02 18:29 . 2009-02-05 20:06 51376 -c--a-w- c:\windows\system32\drivers\aswTdi.sys
2009-08-02 18:29 . 2009-02-05 20:05 26944 -c--a-w- c:\windows\system32\drivers\aavmker4.sys
2009-08-02 18:29 . 2009-02-05 20:08 93296 -c--a-w- c:\windows\system32\drivers\aswmon.sys
2009-08-02 18:29 . 2009-02-05 20:08 94032 -c--a-w- c:\windows\system32\drivers\aswmon2.sys
2009-08-02 18:29 . 2009-02-05 20:07 114768 -c--a-w- c:\windows\system32\drivers\aswSP.sys
2009-08-02 18:29 . 2009-02-05 20:07 20560 -c--a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-08-02 18:29 . 2009-02-05 20:04 97480 -c--a-w- c:\windows\system32\AvastSS.scr
2009-08-02 18:28 . 2009-02-05 20:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-08-01 14:00 . 2009-08-01 14:00 422 ----a-w- c:\documents and settings\tom\Application Data\Apple Computer\mario.exe
2009-08-01 14:00 . 2009-08-01 14:00 16141 ----a-w- c:\documents and settings\tom\Application Data\CD-LabelPrint\flamiks32.exe
2009-08-01 14:00 . 2009-08-01 14:00 145131 ----a-w- c:\documents and settings\tom\Application Data\BitTorrent\pingo.dll
2009-08-01 14:00 . 2009-08-01 14:00 13221 ----a-w- c:\documents and settings\tom\Application Data\AdobeUM\xl12.exe
2009-08-01 14:00 . 2009-08-01 14:00 11232 ----a-w- c:\documents and settings\tom\Application Data\Adobe\norigami.dll
2009-07-19 12:32 . 2009-07-19 12:33 -------- dc----w- c:\program files\QuickTime
2009-07-19 12:27 . 2009-07-19 12:27 -------- dc----w- c:\program files\Apple Software Update
2009-07-19 12:27 . 2009-07-19 12:27 -------- dc----w- c:\documents and settings\All Users\Application Data\Apple
2009-07-09 14:39 . 2009-07-09 14:39 -------- dc----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-04 09:39 . 2006-10-22 10:37 -------- dc----w- c:\program files\Wanadoo
2009-08-02 15:44 . 2007-05-30 17:45 -------- d-----w- c:\documents and settings\tom\Application Data\uTorrent
2009-08-01 15:15 . 2004-01-01 21:43 -------- dc-h--w- c:\program files\InstallShield Installation Information
2009-07-21 17:46 . 2007-02-20 16:37 -------- dc----w- c:\program files\Messenger Plus! Live
2009-07-21 17:46 . 2007-02-20 16:35 -------- dc----w- c:\program files\MSN Messenger
2009-06-29 15:57 . 2006-06-23 12:28 827392 -c--a-w- c:\windows\system32\wininet.dll
2009-06-29 15:57 . 2004-08-19 23:09 78336 -c--a-w- c:\windows\system32\ieencode.dll
2009-06-29 15:57 . 2004-01-02 14:46 17408 -c----w- c:\windows\system32\corpol.dll
2009-06-28 15:21 . 2005-08-31 07:00 1244 ----a-w- c:\documents and settings\tom\Application Data\wklnhst.dat
2009-06-16 14:40 . 2004-01-02 14:49 119808 -c--a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2004-01-02 14:47 81920 -c--a-w- c:\windows\system32\fontsub.dll
2009-06-07 11:09 . 2009-06-07 11:09 2560 -c--a-w- c:\windows\_MSRSTRT.EXE
2009-06-07 09:20 . 2004-12-01 16:17 -------- dc----w- c:\program files\Microsoft Games
2009-06-05 18:30 . 2009-06-05 18:30 -------- d-----w- c:\documents and settings\tom\Application Data\yang
2009-06-05 18:28 . 2009-06-05 18:28 -------- dc----w- c:\program files\YANG
2009-06-03 19:10 . 2005-08-30 08:26 1297408 -c--a-w- c:\windows\system32\quartz.dll
2009-05-07 15:33 . 2004-01-02 14:47 348672 -c--a-w- c:\windows\system32\localspl.dll
2008-12-26 07:31 . 2008-12-26 07:31 3165824 -c--a-w- c:\program files\ccsetup215.exe
2008-06-08 19:21 . 2004-07-29 17:30 4015 -c--a-w- c:\program files\config.cfg
2007-08-24 11:46 . 2007-08-24 11:46 2293712 -c--a-w- c:\program files\FLV PlayerFCSetup.exe
2007-08-24 11:43 . 2007-08-24 11:43 3655608 -c--a-w- c:\program files\FLV PlayerRCATSetup.exe
2009-07-23 08:56 . 2009-04-06 08:53 134648 -c--a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="c:\program files\HP\Digital Imaging\bin\backupnotify.exe" [2004-01-09 32768]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 204800]
"WOOKIT"="c:\program files\Wanadoo\GestMaj.exe" [2004-10-14 32768]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" [2007-12-13 1688872]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-04-13 4608]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"HPHUPD05"="c:\program files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-08-21 49152]
"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-08-21 483328]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2003-08-19 72536]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2004-02-23 3026944]
"UpdateManager"="c:\program files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2003-08-18 110592]
"Share-to-Web Namespace Daemon"="c:\program files\HP\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 69632]
"Microsoft Works Update Detection"="c:\program files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 50688]
"MessagerStarter Wanadoo"="c:\progra~1\MESSAG~1\StartMessager.exe" [2003-04-04 32768]
"WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="c:\progra~1\Wanadoo\GestMaj.exe" [2004-10-14 32768]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2007-05-16 95960]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-07-10 270648]
"WinampAgent"="c:\program files\WINAMP\winampa.exe" [2007-10-10 36352]
"NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-04-17 98616]
"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-05-07 591696]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-06-29 88363]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2004-02-23 753664]
"AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2003-04-03 50176]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Kodak software updater.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Kodak software updater.lnk
backup=c:\windows\pss\Kodak software updater.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logiciel Kodak EasyShare.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logiciel Kodak EasyShare.lnk
backup=c:\windows\pss\Logiciel Kodak EasyShare.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^Pense-bête.lnk]
path=c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\Pense-bête.lnk
backup=c:\windows\pss\Pense-bête.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Wanadoo\\WOOBrowser\\WOOBrowser.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Valve Lan\\hl.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [02/08/2009 20:29 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [02/08/2009 20:29 20560]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\drivers\e4ldr.sys [28/10/2006 10:01 63555]
S2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Nero8\InCD\NBHRegInCDSrv.exe --> c:\program files\Nero\Nero8\InCD\NBHRegInCDSrv.exe [?]
S3 CAM1210;USB Video Camera;c:\windows\system32\drivers\cam1210.sys [09/01/2007 12:35 91776]
S3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\drivers\e4usbaw.sys [28/10/2006 10:02 114616]
S3 o1394bul;o1394bul;\??\c:\docume~1\tom\LOCALS~1\Temp\o1394bul.sys --> c:\docume~1\tom\LOCALS~1\Temp\o1394bul.sys [?]
.
Contents of the 'Scheduled Tasks' folder
2009-07-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-64Comp - c:\docume~1\tom\APPLIC~1\WIPESH~1\1 platform.exe
HKCU-Run-IncrediMail - c:\program files\IncrediMail\bin\IncMail.exe
HKCU-Run-BitTorrent - c:\program files\BitTorrent\bittorrent.exe
HKCU-Run-Steam - (no file)
HKCU-Run-RecordNow! - (no file)
HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
HKLM-Run-SecurDisc - c:\program files\Nero\Nero8\InCD\NBHGui.exe
HKLM-Run-InCD - c:\program files\Nero\Nero8\InCD\InCD.exe
HKLM-Run-aqscccy - c:\windows\system32\aqscccy.exe
HKLM-Run-realteks - c:\documents and settings\tom\Application Data\Google\cqvgl19623160.exe
HKLM-Run-VTTimer - VTTimer.exe
HKU-Default-Explorer_Run-{CCE7DED5-07D9-1036-0702-041023030021} - c:\program files\Fichiers communs\{CCE7DED5-07D9-1036-0702-041023030021}\Update.exe
HKU-Default-Explorer_Run-{CCE7DED5-07DA-1036-0702-041023030021} - c:\program files\Fichiers communs\{CCE7DED5-07DA-1036-0702-041023030021}\Update.exe
HKU-Default-Explorer_Run-{CCE7DED5-07D8-1036-0702-041023030021} - c:\program files\Fichiers communs\{CCE7DED5-07D8-1036-0702-041023030021}\Update.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.orange.fr
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q304&bd=pavilion&pf=desktop
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
FF - ProfilePath - c:\documents and settings\tom\Application Data\Mozilla\Firefox\Profiles\9hz66437.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Orange
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/firefox?client=firefox-a&rls=org.mozilla:fr:official
FF - prefs.js: keyword.URL - hxxp://r.orange.fr/r?ref=O_toolbar32_hook_syntaxError&url=http%3A//rws.search.ke.voila.fr/RW/A/O_toolbar31?errorigin=noturl&kw=
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-04 11:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1038202898-888617985-3542573666-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2620)
c:\windows\system32\nView.dll
c:\windows\system32\NVWRSFR.DLL
c:\windows\system32\nvwddi.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Fichiers communs\Symantec Shared\ccSetMgr.exe
c:\windows\system32\FTRTSVC.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\snmp.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
c:\windows\system32\rundll32.exe
c:\program files\HP\HP Share-to-Web\hpgs2wnf.exe
c:\progra~1\Wanadoo\TaskBarIcon.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Wanadoo\ComComp.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\progra~1\Wanadoo\Toaster.exe
c:\progra~1\Wanadoo\Inactivity.exe
c:\progra~1\Wanadoo\PollingModule.exe
c:\program files\Fichiers communs\Nero\Lib\NMIndexingService.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-08-04 11:43 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-04 09:42
Pre-Run: 60 077 830 144 octets libres
Post-Run: 61 538 992 128 octets libres
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=,1,2,3,4
381 --- E O F --- 2009-07-30 15:17
voila c'est mon rapport combofix
bonne chance