advitameternam

Bonjour, Après formatage et reformatage je vous envoi deux fichier un hijackthis et un combofix apres formatage et install de windows avec nlite tout va bien. Je recopie les données tout va bien et au bout de quelques heures l'ordi rame beaucoup trop Merci de votre aide chris rapport hijackthis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:28:48, on 05/09/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service - Unknown owner - F:\utilitaires\Ad-Aware2007Portable\aawservice.exe (file missing) O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 4767 bytes rapport combofix ComboFix 09-09-04.02 - jean-pierre 05/09/2009 19:13.1.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.1007.709 [GMT 2:00] Running from: c:\documents and settings\jean-pierre\Bureau\ComboFix.exe AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2009-08-05 to 2009-09-05 ))))))))))))))))))))))))))))))) . 2009-09-05 09:19 . 2007-12-24 15:37 138384 ----a-w- c:\windows\system32\drivers\tmcomm.sys 2009-09-05 09:16 . 2009-09-05 12:38 -------- d-----w- c:\windows\system32\HouseCall 6.6 2009-09-03 22:51 . 2009-09-03 22:51 -------- d-sh--w- c:\documents and settings\jean-pierre\IECompatCache 2009-09-03 21:10 . 2009-09-03 21:10 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes 2009-09-03 07:27 . 2009-09-03 07:27 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2009-09-03 07:27 . 2009-09-05 12:44 -------- d-----w- c:\documents and settings\jean-pierre\Application Data\skypePM 2009-09-03 07:25 . 2009-09-05 17:21 -------- d-----w- c:\documents and settings\jean-pierre\Application Data\Skype 2009-09-03 07:25 . 2009-09-03 07:25 -------- d-----w- c:\program files\Fichiers communs\Skype 2009-09-03 07:24 . 2009-09-03 22:48 -------- d-----r- c:\program files\Skype 2009-09-03 07:24 . 2009-09-03 07:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2009-09-02 15:26 . 2009-09-02 15:26 -------- d-----w- c:\documents and settings\jean-pierre\Local Settings\Application Data\Adobe 2009-09-02 15:24 . 2009-09-02 15:25 -------- d-----w- c:\program files\Fichiers communs\Adobe 2009-09-02 15:15 . 2009-09-02 15:16 -------- d-----w- c:\program files\PhotoFiltre 2009-09-02 15:11 . 2009-09-02 15:11 -------- d-sh--w- c:\documents and settings\jean-pierre\PrivacIE 2009-09-02 15:07 . 2009-09-02 15:07 -------- d-sh--w- c:\documents and settings\jean-pierre\IETldCache 2009-09-02 15:05 . 2009-08-07 08:48 100352 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-09-02 15:05 . 2009-09-02 15:06 -------- d-----w- c:\windows\ie8updates 2009-09-02 15:05 . 2009-07-19 16:45 11067392 -c----w- c:\windows\system32\dllcache\ieframe.dll 2009-09-02 15:05 . 2009-07-03 16:57 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-09-02 15:05 . 2009-07-03 16:57 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll 2009-09-02 15:05 . 2009-07-03 16:57 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll 2009-09-02 15:05 . 2009-07-03 16:57 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll 2009-09-02 15:05 . 2009-07-03 16:57 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-09-02 15:02 . 2009-09-02 15:05 -------- dc-h--w- c:\windows\ie8 2009-09-02 14:58 . 2009-09-02 14:58 -------- d-----w- c:\program files\Microsoft Works 2009-09-02 14:52 . 2009-09-02 15:00 -------- d-----w- c:\windows\system32\CatRoot_bak 2009-09-02 14:51 . 2009-09-02 14:52 -------- d-----w- c:\windows\SHELLNEW 2009-09-02 14:51 . 2009-09-02 14:51 -------- d-----w- c:\documents and settings\jean-pierre\Local Settings\Application Data\Microsoft Help 2009-09-02 14:50 . 2009-09-02 15:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-09-02 14:49 . 2009-09-02 14:49 -------- d--h--r- C:\MSOCache 2009-09-02 14:44 . 2009-09-02 14:44 -------- d-----w- c:\program files\Elaborate Bytes 2009-09-02 10:51 . 2009-09-02 10:51 -------- d-----w- c:\windows\srchasst 2009-09-02 10:20 . 2009-09-02 15:04 -------- d-----w- c:\windows\system32\fr-fr 2009-09-02 10:20 . 2009-09-02 14:31 -------- d-----w- c:\windows\system32\fr 2009-09-02 10:20 . 2009-09-02 14:29 -------- d-----w- c:\windows\l2schemas 2009-09-02 10:20 . 2009-09-02 14:31 -------- d-----w- c:\windows\system32\bits 2009-09-02 10:08 . 2004-08-19 14:10 60416 ----a-w- c:\windows\system32\dllcache\msimn.exe 2009-09-02 10:07 . 2009-07-03 16:57 206848 -c----w- c:\windows\system32\dllcache\occache.dll 2009-09-02 09:38 . 2004-08-19 14:09 21504 ----a-w- c:\windows\system32\hidserv.dll 2009-09-02 09:37 . 2004-08-19 14:09 4096 ----a-w- c:\windows\system32\ksuser.dll 2009-09-01 20:20 . 2009-09-01 20:20 -------- d-----w- c:\documents and settings\jean-pierre\Thunderbird 2009-09-01 20:18 . 2009-09-01 20:18 0 ----a-w- c:\windows\nsreg.dat 2009-09-01 20:17 . 2009-09-01 20:18 -------- d-----w- c:\documents and settings\jean-pierre\Local Settings\Application Data\Thunderbird 2009-09-01 20:17 . 2009-09-01 20:17 -------- d-----w- c:\documents and settings\jean-pierre\Application Data\Thunderbird 2009-09-01 20:16 . 2009-09-05 17:02 -------- d-----w- c:\program files\Mozilla Thunderbird 2009-09-01 19:22 . 2009-09-02 14:40 -------- d-----w- c:\windows\ServicePackFiles 2009-09-01 19:12 . 2009-09-01 19:12 -------- d-sh--w- c:\documents and settings\jean-pierre\UserData 2009-09-01 18:19 . 2009-01-07 16:21 26144 ----a-w- c:\windows\system32\spupdsvc.exe 2009-09-01 18:19 . 2009-09-03 22:42 -------- d--h--w- c:\windows\$hf_mig$ 2009-09-01 17:35 . 2009-09-05 17:20 4532256 --sha-w- c:\windows\system32\drivers\fidbox.dat 2009-09-01 17:32 . 2009-09-01 17:32 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier 2009-09-01 17:32 . 2009-09-01 17:34 4212 ---h--w- c:\windows\system32\zllictbl.dat 2009-09-01 17:31 . 2009-09-01 17:31 -------- d-----w- c:\program files\Zone Labs 2009-09-01 17:31 . 2008-07-09 07:05 1086952 ----a-w- c:\windows\system32\zpeng24.dll 2009-09-01 17:29 . 2009-09-05 17:20 -------- d-----w- c:\windows\Internet Logs 2009-09-01 17:22 . 2009-09-04 12:47 44848 ----a-w- c:\documents and settings\jean-pierre\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-01 17:18 . 2009-09-01 17:23 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-09-01 17:18 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys 2009-09-01 17:18 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys 2009-09-01 17:18 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys 2009-09-01 17:18 . 2009-09-01 17:18 -------- d-----w- c:\program files\Avira 2009-09-01 17:18 . 2009-09-01 17:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira 2009-09-01 17:16 . 2009-09-01 17:16 -------- d-----w- c:\documents and settings\jean-pierre\Application Data\Malwarebytes 2009-09-01 17:16 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-01 17:16 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-01 17:16 . 2009-09-01 17:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-01 17:16 . 2009-09-01 17:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-09-01 17:09 . 2009-09-01 17:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-09-01 16:58 . 2004-06-23 19:36 3147776 ----a-r- c:\windows\system32\drivers\w22n51.sys 2009-09-01 16:58 . 2004-06-01 20:50 1003520 ----a-r- c:\windows\system32\W22MLRes.dll 2009-09-01 16:58 . 2004-06-01 20:50 344064 ----a-r- c:\windows\system32\w22NCPA.dll 2009-09-01 16:57 . 2003-10-29 18:14 34329 ------w- c:\windows\O2Remove.EXE 2009-09-01 16:57 . 2004-02-12 02:18 191092 ----a-r- c:\windows\system32\drivers\o2mmb.sys 2009-09-01 16:57 . 2004-01-28 15:15 6100 ----a-r- c:\windows\system32\drivers\MbxStby.sys 2009-09-01 16:56 . 2004-05-07 02:49 66048 ----a-w- c:\windows\system32\SynTPFcs.dll 2009-09-01 16:56 . 2004-05-07 02:51 77824 ----a-w- c:\windows\system32\SynTPCoI.dll 2009-09-01 16:56 . 2004-05-07 02:46 90112 ----a-w- c:\windows\system32\SynTPAPI.dll 2009-09-01 16:56 . 2004-05-07 02:44 182688 ----a-w- c:\windows\system32\drivers\SynTP.sys 2009-09-01 16:56 . 2004-05-07 02:46 114688 ----a-w- c:\windows\system32\SynCtrl.dll 2009-09-01 16:56 . 2004-05-07 02:46 77824 ----a-w- c:\windows\system32\SynCOM.dll 2009-09-01 16:56 . 2009-09-01 16:56 -------- d-----w- c:\program files\Synaptics 2009-09-01 16:56 . 2009-09-01 16:56 -------- d-----w- c:\windows\OPTIONS 2009-09-01 16:56 . 2004-04-13 12:14 70144 ----a-w- c:\windows\system32\drivers\Rtlnicxp.sys 2009-09-01 16:55 . 2004-10-08 00:32 167936 ----a-r- c:\windows\system32\igfxres.dll 2009-09-01 16:51 . 2009-09-01 16:58 -------- d-----w- c:\program files\Intel 2009-09-01 16:50 . 2009-09-01 16:56 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-09-01 16:50 . 2009-09-01 16:57 -------- d-----w- c:\program files\Fichiers communs\InstallShield 2009-09-01 16:06 . 2001-08-17 21:59 3072 ----a-w- c:\windows\system32\drivers\audstub.sys 2009-09-01 16:04 . 2004-08-03 22:31 20992 ----a-w- c:\windows\system32\drivers\RTL8139.sys 2009-09-01 16:04 . 2001-08-17 21:46 6400 ----a-w- c:\windows\system32\drivers\enum1394.sys 2009-09-01 16:04 . 2004-08-19 14:09 77312 ----a-w- c:\windows\system32\usbui.dll 2009-09-01 16:03 . 2009-09-04 14:52 -------- d-sh--w- c:\windows\Installer 2009-09-01 16:03 . 2002-08-30 12:00 77824 -c--a-w- c:\windows\system32\dllcache\spcommon.dll 2009-09-01 16:03 . 2002-08-30 12:00 774144 -c--a-w- c:\windows\system32\dllcache\spttseng.dll 2009-09-01 16:03 . 2002-08-30 12:00 65536 -c--a-w- c:\windows\system32\dllcache\spcplui.dll 2009-09-01 16:03 . 2002-08-30 12:00 36864 -c--a-w- c:\windows\system32\dllcache\sapisvr.exe 2009-09-01 16:03 . 2009-09-04 10:20 -------- d-----r- C:\Program Files 2009-09-01 16:01 . 2009-09-03 21:09 -------- d-----w- C:\Documents and Settings 2009-09-01 16:01 . 2009-09-01 14:13 -------- d--h--w- c:\documents and settings\Default User 2009-09-01 16:01 . 2009-09-01 14:11 -------- d-----w- c:\documents and settings\All Users . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-05 17:17 . 2009-09-01 17:35 57224 --sha-w- c:\windows\system32\drivers\fidbox.idx 2009-09-05 06:10 . 2009-09-04 10:20 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-09-04 14:52 . 2009-09-04 08:53 -------- d-----w- c:\program files\Java 2009-09-04 10:20 . 2009-09-04 10:20 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-09-04 10:20 . 2009-09-04 10:20 -------- d-----w- c:\documents and settings\jean-pierre\Application Data\SUPERAntiSpyware.com 2009-09-04 10:19 . 2009-09-04 10:19 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-09-04 09:48 . 2009-09-04 09:48 -------- d-----w- c:\program files\Trend Micro 2009-09-04 09:01 . 2009-09-04 09:01 -------- d-----w- c:\documents and settings\jean-pierre\Application Data\OpenOffice.org 2009-09-04 08:54 . 2009-09-04 08:54 -------- d-----w- c:\program files\JRE 2009-09-04 08:54 . 2009-09-04 08:53 -------- d-----w- c:\program files\OpenOffice.org 3 2009-09-02 14:47 . 2002-08-30 12:00 49054 ----a-w- c:\windows\system32\perfc00C.dat 2009-09-02 14:47 . 2002-08-30 12:00 368314 ----a-w- c:\windows\system32\perfh00C.dat 2009-09-01 14:13 . 2009-09-01 14:13 -------- d-----w- c:\program files\microsoft frontpage 2009-09-01 14:11 . 2009-09-01 14:11 -------- d-----w- c:\program files\Services en ligne 2009-09-01 14:09 . 2009-09-01 14:09 21892 ----a-w- c:\windows\system32\emptyregdb.dat 2009-08-05 09:06 . 2004-08-19 14:09 205312 ----a-w- c:\windows\system32\mswebdvd.dll 2009-07-29 04:53 . 2004-08-19 14:09 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-07-29 04:53 . 2002-08-30 12:00 82432 ----a-w- c:\windows\system32\fontsub.dll 2009-07-25 03:23 . 2009-09-04 08:53 411368 ----a-w- c:\windows\system32\deploytk.dll 2009-07-17 18:56 . 2004-08-19 14:09 58880 ----a-w- c:\windows\system32\atl.dll 2009-07-13 00:18 . 2004-08-19 14:09 233472 ----a-w- c:\windows\system32\wmpdxm.dll 2009-07-03 16:57 . 2004-08-19 14:09 915456 ----a-w- c:\windows\system32\wininet.dll 2009-06-15 11:33 . 2004-08-19 14:10 78848 ----a-w- c:\windows\system32\telnet.exe 2009-06-10 14:23 . 2004-08-19 14:09 85504 ----a-w- c:\windows\system32\avifil32.dll 2009-06-10 06:30 . 2009-09-02 10:07 132096 ----a-w- c:\windows\system32\wkssvc.dll . ------- Sigcheck ------- [-] 2008-04-14 02:33 1571840 E17C85D5B5CF477638433B851A98499E c:\windows\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\sfcfiles.dll [-] 2008-04-26 12:28 1548288 ED5C110C351EC3429F6959923E9517CF c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-07-16 25604904] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-09-05 1994480] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-10-08 155648] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-10-08 126976] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-07 98304] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-07 536576] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016] "VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2008-06-29 52168] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512] c:\documents and settings\jean-pierre\Menu D‚marrer\Programmes\D‚marrage\ OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "StartMenuLogoff"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [03/09/2009 15:22 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [03/09/2009 15:22 74480] R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [01/09/2009 19:18 108289] R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [01/09/2009 18:57 191092] R3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [01/09/2009 18:57 6100] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [03/09/2009 15:22 7408] S3 Ad-Aware 2007 Service;Ad-Aware 2007 Service;f:\utilitaires\Ad-Aware2007Portable\aawservice.exe --> f:\utilitaires\Ad-Aware2007Portable\aawservice.exe [?] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . - - - - ORPHANS REMOVED - - - - Notify-dimsntfy - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-09-05 19:20 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(508) c:\program files\SUPERAntiSpyware\SASWINLO.dll - - - - - - - > 'explorer.exe'(2780) c:\windows\system32\msi.dll c:\windows\system32\webcheck.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\wbem\wmiapsrv.exe . ************************************************************************** . Completion time: 2009-09-05 19:25 - machine was rebooted ComboFix-quarantined-files.txt 2009-09-05 17:25 Pre-Run: 19 572 428 800 octets libres Post-Run: 19 572 703 232 octets libres 250 --- E O F --- 2009-09-02 16:22