alou

ok, ça marche, je fais passer le mot. encore un grand merci à vous.

PROBLEME EXOCLICK RESOLU

Hug Grand Manitou ! Encore merci pour tout, et bravo la communauté ! Je vais prendre le temps de faire du propre pour ne plus avoir de souci. bonne continuation, pour le sauvetage des internautes.. :P :P Alou.

Bonjour, j' ai fais le scann avec ESET, et il n' a pas trouvé d' infection. Je n' ai pas eu de rapport. Donc je pense que tout est clean ! Bonne journée. oup's ! j' ai oublié le rapport Tcleaner : @+ [ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ] --> Recherche: C:\Combofix.txt: trouvé ! C:\Combofix: trouvé ! C:\_OTM: trouvé ! C:\Rsit: trouvé ! C:\Documents and Settings\ALI\Bureau\Gmer.zip: trouvé ! C:\Documents and Settings\ALI\Bureau\OTM.exe: trouvé ! C:\Documents and Settings\ALI\Bureau\HijackThis.exe: trouvé ! C:\Documents and Settings\ALI\Bureau\Rsit.exe: trouvé ! --------------------------------- --> Suppression: C:\Documents and Settings\ALI\Bureau\Gmer.zip: supprimé ! C:\Documents and Settings\ALI\Bureau\OTM.exe: supprimé ! C:\Documents and Settings\ALI\Bureau\HijackThis.exe: supprimé ! C:\Combofix.txt: supprimé ! C:\Documents and Settings\ALI\Bureau\Rsit.exe: supprimé ! C:\Combofix: supprimé ! C:\_OTM: supprimé ! C:\Rsit: supprimé ! Fichiers temporaires nettoyés ! Corbeille vidée! Restauration annulée !

Salut, le scann Kapersky ne fonctionne pas, mise à jour impossible...(??) .Dois-je faire le scann avec un autre anti virus.. Bien à toi.

bonjour; voilà le rapport : All processes killed ========== FILES ========== C:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\update moved successfully. C:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2qfe moved successfully. C:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2gdr moved successfully. C:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96 moved successfully. C:\windows\$hf_mig$\KB941644\update moved successfully. C:\windows\$hf_mig$\KB941644\SP2QFE moved successfully. C:\windows\$hf_mig$\KB941644 moved successfully. C:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\update moved successfully. C:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2qfe moved successfully. C:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2gdr moved successfully. C:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967 moved successfully. C:\windows\$hf_mig$\KB938828\update moved successfully. C:\windows\$hf_mig$\KB938828\SP2QFE moved successfully. C:\windows\$hf_mig$\KB938828 moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrateur ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes User: ALI File delete failed. C:\Documents and Settings\ALI\Local Settings\Temp\MAR1.tmp scheduled to be deleted on reboot. ->Temp folder emptied: 203390 bytes ->Temporary Internet Files folder emptied: 55715648 bytes ->Java cache emptied: 0 bytes User: All Users User: All Users.WINDOWS User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User.WINDOWS ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.AUTORITE NT ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService.AUTORITE NT\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.AUTORITE NT ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\NetworkService.AUTORITE NT\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 32902 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 49152 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 53,44 mb OTM by OldTimer - Version 3.0.0.6 log created on 10052009_075919 Files moved on Reboot... C:\Documents and Settings\ALI\Local Settings\Temp\MAR1.tmp moved successfully. Registry entries deleted on Reboot...

ello ! voilà c fait, je n' ai pas eu la demande de validation par OK lors du Double clique sur fix.bat. Une fenêtre s 'est bien ouverte mais rien de plus.. Ensuite j' ai fais la manip avec Combofix et ça donne ça : ComboFix 09-09-30.05 - ALI 04/10/2009 10:14.9.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.510.171 [GMT 2:00] Lancé depuis: c:\documents and settings\ALI\Bureau\combofix.exe Commutateurs utilisés :: c:\documents and settings\ALI\Bureau\CFScript.txt . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . --------------- FCopy --------------- c:\windows\system32\dllcache\wscntfy.exe --> c:\windows\system32\wscntfy.exe c:\windows\system32\dllcache\tcpip.sys --> c:\windows\system32\drivers\tcpip.sys c:\windows\system32\dllcache\sfcfiles.dll --> c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((( Fichiers créés du 2009-09-04 au 2009-10-04 )))))))))))))))))))))))))))))))))))) . 2009-10-04 08:05 . 2004-08-19 14:10 13824 -c----w- c:\windows\system32\dllcache\wscntfy.exe 2009-10-03 05:46 . 2004-08-19 14:09 1548288 -c----w- c:\windows\system32\dllcache\sfcfiles.dll 2009-10-03 05:46 . 2004-08-19 14:10 57856 -c----w- c:\windows\system32\dllcache\spoolsv.exe 2009-10-03 05:46 . 2004-08-19 14:10 14336 -c----w- c:\windows\system32\dllcache\svchost.exe 2009-10-03 05:46 . 2004-08-19 14:09 1036288 -c----w- c:\windows\system32\dllcache\Explorer.EXE 2009-10-03 05:46 . 2004-08-19 14:10 108544 -c----w- c:\windows\system32\dllcache\services.exe 2009-10-03 05:46 . 2004-08-19 14:09 13312 -c----w- c:\windows\system32\dllcache\lsass.exe 2009-10-02 14:48 . 2009-10-04 08:10 -------- d-----w- C:\FR-files 2009-10-02 14:41 . 2009-10-02 15:03 -------- d-----w- C:\WinFileReplace 2009-09-30 14:15 . 2009-09-30 14:28 -------- d-----w- C:\bibitte 2009-09-30 14:05 . 2004-08-19 14:10 13824 ----a-w- c:\windows\system32\wscntfy.exe 2009-09-25 07:38 . 2009-09-25 07:38 -------- d-----w- C:\rsit 2009-09-25 07:34 . 2009-09-25 07:34 -------- d-----w- C:\_OTM 2009-09-24 15:35 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys 2009-09-24 15:35 . 2009-09-24 15:35 -------- d-----w- c:\program files\Panda Security 2009-09-22 16:35 . 2009-09-22 16:35 -------- d-----w- c:\documents and settings\ALI\Tracing 2009-09-22 16:33 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2009-09-21 12:18 . 2009-09-21 12:18 -------- d-----w- c:\documents and settings\NetworkService.AUTORITE NT\Local Settings\Application Data\Apple 2009-09-16 17:11 . 2009-09-16 17:11 -------- d-----w- c:\program files\Fichiers communs\Windows Live 2009-09-15 04:45 . 2009-09-15 04:44 502208 ----a-w- c:\windows\system32\drivers\amon.sys 2009-09-15 04:45 . 2009-09-15 04:44 270336 ----a-w- c:\windows\system32\imon.dll 2009-09-11 06:07 . 2009-10-03 07:49 -------- d-----w- c:\program files\IKEA HomePlanner 2009-09-11 06:06 . 2009-09-11 06:06 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-09-09 05:51 . 2009-09-09 05:51 -------- d-----w- c:\documents and settings\ALI\Local Settings\Application Data\WMTools Downloaded Files . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-28 16:11 . 2008-02-22 17:28 -------- d-----w- c:\program files\Eset 2009-09-27 07:17 . 2008-02-17 07:20 -------- d-----w- c:\program files\CCleaner 2009-09-27 06:56 . 2009-08-25 11:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-22 16:34 . 2008-05-11 15:33 60240 ----a-w- c:\documents and settings\ALI\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-10 12:54 . 2009-08-25 13:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 12:53 . 2009-08-25 13:27 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-04 12:39 . 2008-12-21 18:00 -------- d-----w- c:\documents and settings\ALI\Application Data\Apple Computer 2009-09-01 16:24 . 2008-05-28 09:52 -------- d-----w- c:\documents and settings\ALI\Application Data\Canon 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iTunes 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iPod 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Apple Software Update 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Fichiers communs\Apple 2009-08-25 11:25 . 2008-12-02 19:16 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP 2009-08-25 08:37 . 2009-08-25 08:37 0 ----a-w- c:\windows\nsreg.dat 2009-08-24 16:56 . 2009-08-24 16:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\STOPzilla! 2009-08-19 05:21 . 2009-08-19 05:21 -------- d-----w- c:\program files\MSSOAP 2009-08-19 05:20 . 2009-08-19 05:20 -------- d-----w- c:\program files\Webroot 2009-07-09 10:16 . 2009-08-25 14:30 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-07-09 10:16 . 2009-08-25 14:30 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll 2006-03-27 17:49 . 2008-04-30 07:32 3809280 ----a-w- c:\program files\Guitools.exe 2004-08-19 17:09 . 2008-05-03 14:40 1028096 --sha-w- c:\windows\system32\mfc42.dll 2002-09-06 20:59 . 2008-05-03 14:40 57344 --sha-w- c:\windows\system32\mfc42loc.dll 1995-09-20 14:16 . 2008-07-05 14:43 35088 --sha-w- c:\windows\system32\msjint32.dll 1995-09-20 14:13 . 2008-07-05 14:43 977680 --sha-w- c:\windows\system32\msjt3032.dll 1995-09-20 14:16 . 2008-07-05 14:43 23824 --sha-w- c:\windows\system32\msjter32.dll 2004-08-19 17:09 . 2008-05-03 14:40 413696 --sha-w- c:\windows\system32\msvcp60.dll 2002-09-06 20:59 . 2008-05-03 14:40 253952 --sha-w- c:\windows\system32\msvcrt20.dll 2004-08-19 17:09 . 2008-05-03 14:41 553472 --sha-w- c:\windows\system32\oleaut32.dll 2004-08-19 17:09 . 2008-05-03 14:41 83456 --sha-w- c:\windows\system32\olepro32.dll 2004-08-19 17:09 . 2008-05-03 14:43 30749 --sha-w- c:\windows\system32\vbajet32.dll 1995-09-24 09:02 . 2008-07-05 14:43 243472 --sha-w- c:\windows\system32\vbar2232.dll 1998-05-18 01:06 . 2008-07-05 14:43 368912 --sha-w- c:\windows\system32\vbar332.dll . ((((((((((((((((((((((((((((( SnapShot@2009-09-29_16.58.14 ))))))))))))))))))))))))))))))))))))))))) . + 2009-10-04 07:48 . 2009-10-04 07:48 16384 c:\windows\Temp\Perflib_Perfdata_300.dat + 2008-05-03 14:42 . 2004-08-19 14:10 14336 c:\windows\system32\svchost.exe + 2008-05-03 14:42 . 2004-08-19 14:10 57856 c:\windows\system32\spoolsv.exe + 2008-05-03 14:40 . 2004-08-19 14:09 13312 c:\windows\system32\lsass.exe + 2008-05-03 14:43 . 2004-08-19 14:10 506368 c:\windows\system32\winlogon.exe + 2008-05-03 14:41 . 2004-08-19 14:10 108544 c:\windows\system32\services.exe + 2009-04-13 15:54 . 2009-10-04 07:48 214880 c:\windows\system32\inetsrv\MetaBase.bin + 2008-05-03 14:43 . 2004-08-19 14:10 506368 c:\windows\system32\dllcache\winlogon.exe + 2008-05-03 14:43 . 2004-08-03 21:14 359040 c:\windows\system32\dllcache\tcpip.sys + 2008-05-03 14:39 . 2004-08-19 14:09 1036288 c:\windows\explorer.exe . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-10 397312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "Cloneur Expert Monitor"="c:\program files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [2009-02-04 437675] "Acronis Scheduler2 Service"="c:\program files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [2009-02-04 61440] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "UVS11 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 341488] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-09-15 917504] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-06-23 1519616] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544] c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\ALI\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624] Pinnacle Scheduler.lnk - c:\program files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe [2008-4-30 237568] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoSimpleStartMenu"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 0 (0x0) "NoResolveTrack"= 0 (0x0) "NoSMMyPictures"= 0 (0x0) "MaxRecentDocs"= 15 (0xf) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\GT2002\\gpstrack.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "19793:TCP"= 19793:TCP:BitComet 19793 TCP "19793:UDP"= 19793:UDP:BitComet 19793 UDP R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [24/09/2009 17:35 28544] R3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [30/04/2008 10:12 6400] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [02/03/2009 12:14 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [02/03/2009 12:14 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [02/03/2009 12:14 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [02/03/2009 12:14 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [02/03/2009 12:14 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [02/03/2009 12:14 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [02/03/2009 12:14 115752] . Contenu du dossier 'Tâches planifiées' 2009-09-21 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2009-10-03 c:\windows\Tasks\HPpromotions journeysoftware.job - c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 15:36] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uSearchURL,(Default) = hxxp://www.google.fr/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 LSP: imon.dll DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-04 10:26 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:c0,d7,08,f9,31,8e,b0,1c,9a,2e,00,5c,4c,75,7e,de,43,a2,85,b5,f3,b9,51, f0,6f,a7,97,36,c9,e4,1f,81,fe,af,18,db,6d,92,73,80,eb,f6,70,64,14,33,75,52,\ "??"=hex:9c,d9,e4,f4,dd,c3,5d,1d,ea,4c,fa,e2,06,f7,3d,8c [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:87,9b,67,be,f7,4d,c0,6b,40,27,b8,b2,cf,b5,5e,04,c4,ad,d2,a8,bf, e5,5c,47,a8,1c,d9,62,87,f1,23,08,66,e6,50,e5,3e,13,01,80,22,12,4a,0c,b0,43,\ "rkeysecu"=hex:c8,9d,f3,27,d6,13,ee,5b,0c,3f,42,18,e6,bb,ee,f4 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'lsass.exe'(892) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll - - - - - - - > 'explorer.exe'(748) c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\windows\system32\msi.dll . Heure de fin: 2009-10-04 10:29 ComboFix-quarantined-files.txt 2009-10-04 08:29 ComboFix2.txt 2009-10-03 10:18 ComboFix3.txt 2009-10-03 06:09 ComboFix4.txt 2009-09-30 05:26 ComboFix5.txt 2009-10-04 08:11 Avant-CF: 53 094 268 928 octets libres Après-CF: 53 094 744 064 octets libres Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=,1,2,3,4 227 --- E O F --- 2008-05-04 06:01

je crois ce coup-ci tout va bien, je n' ai plus d 'alerte virus. Un grand MERCI !! à toi je te joints les rapports, et enfin, peux-tu me dire quels outils je dois à l' avenir utiliser pour me protéger, changer ma version IE 7 en 8 ?, et nettoyer mon PC. à bientôt. Rapport Combofix: : ComboFix 09-09-30.05 - ALI 03/10/2009 12:03.8.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.510.176 [GMT 2:00] Lancé depuis: c:\documents and settings\ALI\Bureau\combofix.exe Commutateurs utilisés :: c:\documents and settings\ALI\Bureau\CFScript.txt FILE :: "c:\windows\Temp\Perflib_Perfdata_3a4.dat" "c:\windows\Temp\Perflib_Perfdata_5b4.dat" "c:\windows\Temp\Perflib_Perfdata_5f8.dat" . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\Temp\Perflib_Perfdata_3a4.dat c:\windows\Temp\Perflib_Perfdata_5f8.dat . --------------- FCopy --------------- c:\windows\system32\dllcache\winlogon.exe --> c:\windows\system32\winlogon.exe . ((((((((((((((((((((((((((((( Fichiers créés du 2009-09-03 au 2009-10-03 )))))))))))))))))))))))))))))))))))) . 2009-10-03 05:46 . 2004-08-19 14:09 1548288 -c--a-w- c:\windows\system32\dllcache\sfcfiles.dll 2009-10-03 05:46 . 2004-08-03 21:14 359040 -c--a-w- c:\windows\system32\dllcache\tcpip.sys 2009-10-03 05:46 . 2004-08-19 14:10 57856 -c----w- c:\windows\system32\dllcache\spoolsv.exe 2009-10-03 05:46 . 2004-08-19 14:10 14336 -c----w- c:\windows\system32\dllcache\svchost.exe 2009-10-03 05:46 . 2004-08-19 14:09 1036288 -c----w- c:\windows\system32\dllcache\Explorer.EXE 2009-10-03 05:46 . 2004-08-19 14:10 108544 -c----w- c:\windows\system32\dllcache\services.exe 2009-10-03 05:46 . 2004-08-19 14:09 13312 -c----w- c:\windows\system32\dllcache\lsass.exe 2009-10-02 14:48 . 2009-10-02 15:07 -------- d-----w- C:\FR-files 2009-10-02 14:41 . 2009-10-02 15:03 -------- d-----w- C:\WinFileReplace 2009-09-30 14:15 . 2009-09-30 14:28 -------- d-----w- C:\bibitte 2009-09-30 14:05 . 2009-09-30 14:02 13824 ----a-w- c:\windows\system32\wscntfy.exe 2009-09-25 07:38 . 2009-09-25 07:38 -------- d-----w- C:\rsit 2009-09-25 07:34 . 2009-09-25 07:34 -------- d-----w- C:\_OTM 2009-09-24 15:35 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys 2009-09-24 15:35 . 2009-09-24 15:35 -------- d-----w- c:\program files\Panda Security 2009-09-22 16:35 . 2009-09-22 16:35 -------- d-----w- c:\documents and settings\ALI\Tracing 2009-09-22 16:33 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2009-09-21 12:18 . 2009-09-21 12:18 -------- d-----w- c:\documents and settings\NetworkService.AUTORITE NT\Local Settings\Application Data\Apple 2009-09-16 17:11 . 2009-09-16 17:11 -------- d-----w- c:\program files\Fichiers communs\Windows Live 2009-09-15 04:45 . 2009-09-15 04:44 502208 ----a-w- c:\windows\system32\drivers\amon.sys 2009-09-15 04:45 . 2009-09-15 04:44 270336 ----a-w- c:\windows\system32\imon.dll 2009-09-11 06:07 . 2009-10-03 07:49 -------- d-----w- c:\program files\IKEA HomePlanner 2009-09-11 06:06 . 2009-09-11 06:06 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-09-09 05:51 . 2009-09-09 05:51 -------- d-----w- c:\documents and settings\ALI\Local Settings\Application Data\WMTools Downloaded Files . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-28 16:11 . 2008-02-22 17:28 -------- d-----w- c:\program files\Eset 2009-09-27 07:17 . 2008-02-17 07:20 -------- d-----w- c:\program files\CCleaner 2009-09-27 06:56 . 2009-08-25 11:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-22 16:34 . 2008-05-11 15:33 60240 ----a-w- c:\documents and settings\ALI\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-10 12:54 . 2009-08-25 13:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 12:53 . 2009-08-25 13:27 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-04 12:39 . 2008-12-21 18:00 -------- d-----w- c:\documents and settings\ALI\Application Data\Apple Computer 2009-09-01 16:24 . 2008-05-28 09:52 -------- d-----w- c:\documents and settings\ALI\Application Data\Canon 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iTunes 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iPod 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Apple Software Update 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Fichiers communs\Apple 2009-08-25 11:25 . 2008-12-02 19:16 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP 2009-08-25 08:37 . 2009-08-25 08:37 0 ----a-w- c:\windows\nsreg.dat 2009-08-24 16:56 . 2009-08-24 16:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\STOPzilla! 2009-08-19 05:21 . 2009-08-19 05:21 -------- d-----w- c:\program files\MSSOAP 2009-08-19 05:20 . 2009-08-19 05:20 -------- d-----w- c:\program files\Webroot 2009-07-09 10:16 . 2009-08-25 14:30 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-07-09 10:16 . 2009-08-25 14:30 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll 2006-03-27 17:49 . 2008-04-30 07:32 3809280 ----a-w- c:\program files\Guitools.exe 2004-08-19 17:09 . 2008-05-03 14:40 1028096 --sha-w- c:\windows\system32\mfc42.dll 2002-09-06 20:59 . 2008-05-03 14:40 57344 --sha-w- c:\windows\system32\mfc42loc.dll 1995-09-20 14:16 . 2008-07-05 14:43 35088 --sha-w- c:\windows\system32\msjint32.dll 1995-09-20 14:13 . 2008-07-05 14:43 977680 --sha-w- c:\windows\system32\msjt3032.dll 1995-09-20 14:16 . 2008-07-05 14:43 23824 --sha-w- c:\windows\system32\msjter32.dll 2004-08-19 17:09 . 2008-05-03 14:40 413696 --sha-w- c:\windows\system32\msvcp60.dll 2002-09-06 20:59 . 2008-05-03 14:40 253952 --sha-w- c:\windows\system32\msvcrt20.dll 2004-08-19 17:09 . 2008-05-03 14:41 553472 --sha-w- c:\windows\system32\oleaut32.dll 2004-08-19 17:09 . 2008-05-03 14:41 83456 --sha-w- c:\windows\system32\olepro32.dll 2004-08-19 17:09 . 2008-05-03 14:43 30749 --sha-w- c:\windows\system32\vbajet32.dll 1995-09-24 09:02 . 2008-07-05 14:43 243472 --sha-w- c:\windows\system32\vbar2232.dll 1998-05-18 01:06 . 2008-07-05 14:43 368912 --sha-w- c:\windows\system32\vbar332.dll . ------- Sigcheck ------- [-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2gdr\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2qfe\tcpip.sys [-] 2006-11-11 . 8D8949936913B041C6A0E184FBF1030B . 359808 . . [5.1.2600.2892] . . c:\windows\system32\drivers\tcpip.sys [7] 2004-08-03 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\tcpip.sys [-] 2009-09-30 . 54CDDAD404557ED98433D6ECBFC92691 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe [-] 2006-12-13 . 0CEF991C04073F5EC8BFD65B961705F1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll [7] 2004-08-19 . 6D8F3AC555E3F8A569AA9B2A817698C1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2009-09-29_16.58.14 ))))))))))))))))))))))))))))))))))))))))) . + 2009-10-03 09:57 . 2009-10-03 09:57 16384 c:\windows\Temp\Perflib_Perfdata_11c.dat + 2008-05-03 14:42 . 2004-08-19 14:10 14336 c:\windows\system32\svchost.exe + 2008-05-03 14:42 . 2004-08-19 14:10 57856 c:\windows\system32\spoolsv.exe + 2008-05-03 14:40 . 2004-08-19 14:09 13312 c:\windows\system32\lsass.exe + 2008-05-03 14:41 . 2004-08-19 14:10 108544 c:\windows\system32\services.exe + 2009-04-13 15:54 . 2009-10-03 09:57 214881 c:\windows\system32\inetsrv\MetaBase.bin + 2008-05-03 14:43 . 2004-08-19 14:10 506368 c:\windows\system32\dllcache\winlogon.exe + 2008-05-03 14:39 . 2004-08-19 14:09 1036288 c:\windows\explorer.exe . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-10 397312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "Cloneur Expert Monitor"="c:\program files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [2009-02-04 437675] "Acronis Scheduler2 Service"="c:\program files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [2009-02-04 61440] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "UVS11 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 341488] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-09-15 917504] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-06-23 1519616] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544] c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\ALI\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624] Pinnacle Scheduler.lnk - c:\program files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe [2008-4-30 237568] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoSimpleStartMenu"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 0 (0x0) "NoResolveTrack"= 0 (0x0) "NoSMMyPictures"= 0 (0x0) "MaxRecentDocs"= 15 (0xf) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\GT2002\\gpstrack.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "19793:TCP"= 19793:TCP:BitComet 19793 TCP "19793:UDP"= 19793:UDP:BitComet 19793 UDP R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [24/09/2009 17:35 28544] R3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [30/04/2008 10:12 6400] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [02/03/2009 12:14 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [02/03/2009 12:14 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [02/03/2009 12:14 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [02/03/2009 12:14 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [02/03/2009 12:14 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [02/03/2009 12:14 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [02/03/2009 12:14 115752] . Contenu du dossier 'Tâches planifiées' 2009-09-21 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2009-10-03 c:\windows\Tasks\HPpromotions journeysoftware.job - c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 15:36] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uSearchURL,(Default) = hxxp://www.google.fr/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 LSP: imon.dll DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-03 12:15 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:c0,d7,08,f9,31,8e,b0,1c,9a,2e,00,5c,4c,75,7e,de,43,a2,85,b5,f3,b9,51, f0,6f,a7,97,36,c9,e4,1f,81,fe,af,18,db,6d,92,73,80,eb,f6,70,64,14,33,75,52,\ "??"=hex:9c,d9,e4,f4,dd,c3,5d,1d,ea,4c,fa,e2,06,f7,3d,8c [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:87,9b,67,be,f7,4d,c0,6b,40,27,b8,b2,cf,b5,5e,04,c4,ad,d2,a8,bf, e5,5c,47,a8,1c,d9,62,87,f1,23,08,66,e6,50,e5,3e,13,01,80,22,12,4a,0c,b0,43,\ "rkeysecu"=hex:c8,9d,f3,27,d6,13,ee,5b,0c,3f,42,18,e6,bb,ee,f4 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'lsass.exe'(892) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll . Heure de fin: 2009-10-03 12:18 ComboFix-quarantined-files.txt 2009-10-03 10:18 ComboFix2.txt 2009-10-03 06:09 ComboFix3.txt 2009-09-30 05:26 ComboFix4.txt 2009-09-30 04:55 ComboFix5.txt 2009-10-03 10:02 Avant-CF: 53 082 910 720 octets libres Après-CF: 53 086 789 632 octets libres Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=,1,2,3,4 234 --- E O F --- 2008-05-04 06:01 rapport Hijackthis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:19:40, on 03/10/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe C:\WINDOWS\system32\IcoSauve.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\ALI\Bureau\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [uVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [soundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Pinnacle Scheduler.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/51.28/uploader2.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-2.0.cab O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 7309 bytes

bonjour, j' ai effectué les tâches demandées et je crois que Combofix a fait un peu de ménage , il y a du changement : en effet, NoD 32 a apparemment supprimé quelques fichiers infectés, sauf Winlogon .exe qui revient en alerte. @+ Voici les rapports: ComboFix 09-09-30.05 - ALI 03/10/2009 7:46.7.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.510.169 [GMT 2:00] Lancé depuis: c:\documents and settings\ALI\Bureau\combofix.exe Commutateurs utilisés :: c:\documents and settings\ALI\Bureau\CFScript.txt * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . Une copie infectée de c:\windows\system32\lsass.exe a été trouvée et désinfectée Copie restaurée à partir de - c:\windows\system32\dllcache\lsass.exe Une copie infectée de c:\windows\system32\services.exe a été trouvée et désinfectée Copie restaurée à partir de - c:\windows\system32\dllcache\services.exe Une copie infectée de c:\windows\system32\svchost.exe a été trouvée et désinfectée Copie restaurée à partir de - c:\windows\system32\dllcache\svchost.exe Une copie infectée de c:\windows\system32\spoolsv.exe a été trouvée et désinfectée Copie restaurée à partir de - c:\windows\system32\dllcache\spoolsv.exe Une copie infectée de c:\windows\explorer.exe a été trouvée et désinfectée Copie restaurée à partir de - c:\windows\system32\dllcache\Explorer.EXE . --------------- FCopy --------------- c:\fr-files\lsass.exe --> c:\windows\system32\dllcache\lsass.exe c:\fr-files\services.exe --> c:\windows\system32\dllcache\services.exe c:\fr-files\winlogon.exe --> c:\windows\system32\dllcache\winlogon.exe c:\fr-files\svchost.exe --> c:\windows\system32\dllcache\svchost.exe c:\fr-files\spoolsv.exe --> c:\windows\system32\dllcache\spoolsv.exe c:\fr-files\Explorer.EXE --> c:\windows\system32\dllcache\Explorer.EXE c:\fr-files\tcpip.sys --> c:\windows\system32\dllcache\tcpip.sys c:\fr-files\sfcfiles.dll --> c:\windows\system32\dllcache\sfcfiles.dll . ((((((((((((((((((((((((((((( Fichiers créés du 2009-09-03 au 2009-10-03 )))))))))))))))))))))))))))))))))))) . 2009-10-03 05:46 . 2004-08-19 14:09 1548288 -c--a-w- c:\windows\system32\dllcache\sfcfiles.dll 2009-10-03 05:46 . 2004-08-03 21:14 359040 -c--a-w- c:\windows\system32\dllcache\tcpip.sys 2009-10-03 05:46 . 2004-08-19 14:10 57856 -c----w- c:\windows\system32\dllcache\spoolsv.exe 2009-10-03 05:46 . 2004-08-19 14:10 14336 -c----w- c:\windows\system32\dllcache\svchost.exe 2009-10-03 05:46 . 2004-08-19 14:09 1036288 -c----w- c:\windows\system32\dllcache\Explorer.EXE 2009-10-03 05:46 . 2004-08-19 14:10 506368 -c--a-w- c:\windows\system32\dllcache\winlogon.exe 2009-10-03 05:46 . 2004-08-19 14:10 108544 -c----w- c:\windows\system32\dllcache\services.exe 2009-10-03 05:46 . 2004-08-19 14:09 13312 -c----w- c:\windows\system32\dllcache\lsass.exe 2009-10-02 14:48 . 2009-10-02 15:07 -------- d-----w- C:\FR-files 2009-10-02 14:41 . 2009-10-02 15:03 -------- d-----w- C:\WinFileReplace 2009-09-30 14:15 . 2009-09-30 14:28 -------- d-----w- C:\bibitte 2009-09-30 14:05 . 2009-09-30 14:02 13824 ----a-w- c:\windows\system32\wscntfy.exe 2009-09-25 07:38 . 2009-09-25 07:38 -------- d-----w- C:\rsit 2009-09-25 07:34 . 2009-09-25 07:34 -------- d-----w- C:\_OTM 2009-09-24 15:35 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys 2009-09-24 15:35 . 2009-09-24 15:35 -------- d-----w- c:\program files\Panda Security 2009-09-22 16:35 . 2009-09-22 16:35 -------- d-----w- c:\documents and settings\ALI\Tracing 2009-09-22 16:33 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2009-09-21 12:18 . 2009-09-21 12:18 -------- d-----w- c:\documents and settings\NetworkService.AUTORITE NT\Local Settings\Application Data\Apple 2009-09-16 17:11 . 2009-09-16 17:11 -------- d-----w- c:\program files\Fichiers communs\Windows Live 2009-09-15 04:45 . 2009-09-15 04:44 502208 ----a-w- c:\windows\system32\drivers\amon.sys 2009-09-15 04:45 . 2009-09-15 04:44 270336 ----a-w- c:\windows\system32\imon.dll 2009-09-11 06:07 . 2009-09-21 14:14 -------- d-----w- c:\program files\IKEA HomePlanner 2009-09-11 06:06 . 2009-09-11 06:06 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-09-09 05:51 . 2009-09-09 05:51 -------- d-----w- c:\documents and settings\ALI\Local Settings\Application Data\WMTools Downloaded Files . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-28 16:11 . 2008-02-22 17:28 -------- d-----w- c:\program files\Eset 2009-09-27 07:17 . 2008-02-17 07:20 -------- d-----w- c:\program files\CCleaner 2009-09-27 06:56 . 2009-08-25 11:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-22 16:34 . 2008-05-11 15:33 60240 ----a-w- c:\documents and settings\ALI\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-10 12:54 . 2009-08-25 13:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 12:53 . 2009-08-25 13:27 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-04 12:39 . 2008-12-21 18:00 -------- d-----w- c:\documents and settings\ALI\Application Data\Apple Computer 2009-09-01 16:24 . 2008-05-28 09:52 -------- d-----w- c:\documents and settings\ALI\Application Data\Canon 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iTunes 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iPod 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Apple Software Update 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Fichiers communs\Apple 2009-08-25 11:25 . 2008-12-02 19:16 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP 2009-08-25 08:37 . 2009-08-25 08:37 0 ----a-w- c:\windows\nsreg.dat 2009-08-24 16:56 . 2009-08-24 16:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\STOPzilla! 2009-08-19 05:21 . 2009-08-19 05:21 -------- d-----w- c:\program files\MSSOAP 2009-08-19 05:20 . 2009-08-19 05:20 -------- d-----w- c:\program files\Webroot 2009-07-09 10:16 . 2009-08-25 14:30 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-07-09 10:16 . 2009-08-25 14:30 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll 2006-03-27 17:49 . 2008-04-30 07:32 3809280 ----a-w- c:\program files\Guitools.exe 2004-08-19 17:09 . 2008-05-03 14:40 1028096 --sha-w- c:\windows\system32\mfc42.dll 2002-09-06 20:59 . 2008-05-03 14:40 57344 --sha-w- c:\windows\system32\mfc42loc.dll 1995-09-20 14:16 . 2008-07-05 14:43 35088 --sha-w- c:\windows\system32\msjint32.dll 1995-09-20 14:13 . 2008-07-05 14:43 977680 --sha-w- c:\windows\system32\msjt3032.dll 1995-09-20 14:16 . 2008-07-05 14:43 23824 --sha-w- c:\windows\system32\msjter32.dll 2004-08-19 17:09 . 2008-05-03 14:40 413696 --sha-w- c:\windows\system32\msvcp60.dll 2002-09-06 20:59 . 2008-05-03 14:40 253952 --sha-w- c:\windows\system32\msvcrt20.dll 2004-08-19 17:09 . 2008-05-03 14:41 553472 --sha-w- c:\windows\system32\oleaut32.dll 2004-08-19 17:09 . 2008-05-03 14:41 83456 --sha-w- c:\windows\system32\olepro32.dll 2004-08-19 17:09 . 2008-05-03 14:43 30749 --sha-w- c:\windows\system32\vbajet32.dll 1995-09-24 09:02 . 2008-07-05 14:43 243472 --sha-w- c:\windows\system32\vbar2232.dll 1998-05-18 01:06 . 2008-07-05 14:43 368912 --sha-w- c:\windows\system32\vbar332.dll . ------- Sigcheck ------- [-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2gdr\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2qfe\tcpip.sys [-] 2006-11-11 . 8D8949936913B041C6A0E184FBF1030B . 359808 . . [5.1.2600.2892] . . c:\windows\system32\drivers\tcpip.sys [7] 2004-08-03 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\tcpip.sys [-] 2004-08-19 17:10 . !HASH: COULD NOT OPEN FILE !!!!! . 510464 . . [------] . . c:\windows\system32\winlogon.exe [7] 2004-08-19 . 123EEA158F74D0F67A51DCDF065D1091 . 506368 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe [-] 2009-09-30 . 54CDDAD404557ED98433D6ECBFC92691 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe [-] 2006-12-13 . 0CEF991C04073F5EC8BFD65B961705F1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll [7] 2004-08-19 . 6D8F3AC555E3F8A569AA9B2A817698C1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2009-09-29_16.58.14 ))))))))))))))))))))))))))))))))))))))))) . + 2009-10-03 06:01 . 2009-10-03 06:01 16384 c:\windows\Temp\Perflib_Perfdata_5f8.dat + 2009-10-03 05:26 . 2009-10-03 05:26 16384 c:\windows\Temp\Perflib_Perfdata_5b4.dat + 2009-10-03 06:00 . 2009-10-03 06:00 16384 c:\windows\Temp\Perflib_Perfdata_3a4.dat + 2008-05-03 14:42 . 2004-08-19 14:10 14336 c:\windows\system32\svchost.exe + 2008-05-03 14:42 . 2004-08-19 14:10 57856 c:\windows\system32\spoolsv.exe + 2008-05-03 14:40 . 2004-08-19 14:09 13312 c:\windows\system32\lsass.exe + 2008-05-03 14:41 . 2004-08-19 14:10 108544 c:\windows\system32\services.exe + 2009-04-13 15:54 . 2009-10-03 06:01 214880 c:\windows\system32\inetsrv\MetaBase.bin + 2008-05-03 14:39 . 2004-08-19 14:09 1036288 c:\windows\explorer.exe . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-10 397312] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "Cloneur Expert Monitor"="c:\program files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [2009-02-04 437675] "Acronis Scheduler2 Service"="c:\program files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [2009-02-04 61440] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "UVS11 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 341488] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-09-15 917504] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-06-23 1519616] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544] c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\ALI\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624] Pinnacle Scheduler.lnk - c:\program files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe [2008-4-30 237568] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoSimpleStartMenu"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 0 (0x0) "NoResolveTrack"= 0 (0x0) "NoSMMyPictures"= 0 (0x0) "MaxRecentDocs"= 15 (0xf) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\GT2002\\gpstrack.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "19793:TCP"= 19793:TCP:BitComet 19793 TCP "19793:UDP"= 19793:UDP:BitComet 19793 UDP R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [24/09/2009 17:35 28544] R3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [30/04/2008 10:12 6400] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [02/03/2009 12:14 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [02/03/2009 12:14 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [02/03/2009 12:14 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [02/03/2009 12:14 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [02/03/2009 12:14 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [02/03/2009 12:14 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [02/03/2009 12:14 115752] . Contenu du dossier 'Tâches planifiées' 2009-09-21 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2009-09-30 c:\windows\Tasks\HPpromotions journeysoftware.job - c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 15:36] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uSearchURL,(Default) = hxxp://www.google.fr/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 LSP: imon.dll DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-03 08:00 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:c0,d7,08,f9,31,8e,b0,1c,9a,2e,00,5c,4c,75,7e,de,43,a2,85,b5,f3,b9,51, f0,6f,a7,97,36,c9,e4,1f,81,fe,af,18,db,6d,92,73,80,eb,f6,70,64,14,33,75,52,\ "??"=hex:9c,d9,e4,f4,dd,c3,5d,1d,ea,4c,fa,e2,06,f7,3d,8c [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:87,9b,67,be,f7,4d,c0,6b,40,27,b8,b2,cf,b5,5e,04,c4,ad,d2,a8,bf, e5,5c,47,a8,1c,d9,62,87,f1,23,08,66,e6,50,e5,3e,13,01,80,22,12,4a,0c,b0,43,\ "rkeysecu"=hex:c8,9d,f3,27,d6,13,ee,5b,0c,3f,42,18,e6,bb,ee,f4 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'lsass.exe'(912) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll - - - - - - - > 'explorer.exe'(3716) c:\windows\system32\msi.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Autres processus actifs ------------------------ . c:\program files\Fichiers communs\Acronis\Schedule2\schedul2.exe c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\system32\rundll32.exe c:\program files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe c:\windows\system32\inetsrv\inetinfo.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Eset\nod32krn.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\snmp.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe c:\program files\HP\Digital Imaging\bin\hpqste08.exe c:\program files\iPod\bin\iPodService.exe c:\windows\system32\wbem\wmiapsrv.exe . ************************************************************************** . Heure de fin: 2009-10-03 8:09 - La machine a redémarré ComboFix-quarantined-files.txt 2009-10-03 06:09 ComboFix2.txt 2009-09-30 05:26 ComboFix3.txt 2009-09-30 04:55 ComboFix4.txt 2009-09-29 17:06 Avant-CF: 53 118 214 144 octets libres Après-CF: 53 114 363 904 octets libres Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=,1,2,3,4 274 --- E O F --- 2008-05-04 06:01 Rapport Hijackthis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:13:55, on 03/10/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe C:\WINDOWS\system32\IcoSauve.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\ALI\Bureau\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [uVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [soundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Pinnacle Scheduler.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/51.28/uploader2.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-2.0.cab O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 7655 bytes

salut le sioux, bon apparemment ça n' a pas marché je te laisse juger par toi-même : rapport Winfile replace : WinFileReplace - ver : 1.1.0 - by Loup blanc --------------------------- Microsoft Windows XP Service Pack 2 Fran‡ais --------------------------- Contrôle du fichier téléchargé : MD5 recherchée : 3d69b05e454ff7fce91670d4e3e9f473 sp2.000 MD5 : 3d69b05e454ff7fce91670d4e3e9f473 --------------------------- ============ Comparaison des fichiers avant remplacement ============ --------- Les fichiers "C:\WINDOWS\system32\lsass.exe" MD5 : Unable to open "C:\WINDOWS\system32\lsass.exe" MD5 : Unable to open et "C:\FR-files\lsass.exe" MD5 : 259af82a0932eea4f316f92db94707b6 "C:\FR-files\lsass.exe" MD5 : 259af82a0932eea4f316f92db94707b6 sont différents... ----------- Les fichiers "C:\WINDOWS\system32\services.exe" MD5 : Unable to open "C:\WINDOWS\system32\services.exe" MD5 : Unable to open et "C:\FR-files\services.exe" MD5 : 63dcde1a0d86eeb8924d6738ff616ead "C:\FR-files\services.exe" MD5 : 63dcde1a0d86eeb8924d6738ff616ead sont différents... ----------- Les fichiers "C:\WINDOWS\system32\winlogon.exe" MD5 : Unable to open "C:\WINDOWS\system32\winlogon.exe" MD5 : Unable to open et "C:\FR-files\winlogon.exe" MD5 : 123eea158f74d0f67a51dcdf065d1091 "C:\FR-files\winlogon.exe" MD5 : 123eea158f74d0f67a51dcdf065d1091 sont différents... ----------- Les fichiers "C:\WINDOWS\system32\svchost.exe" MD5 : Unable to open "C:\WINDOWS\system32\svchost.exe" MD5 : Unable to open et "C:\FR-files\svchost.exe" MD5 : 2979b03d5382a602623c0535b16ab9c0 "C:\FR-files\svchost.exe" MD5 : 2979b03d5382a602623c0535b16ab9c0 sont différents... ----------- Les fichiers "C:\WINDOWS\system32\spoolsv.exe" MD5 : abcde04f13cd6dd777684ec34815ed5f "C:\WINDOWS\system32\spoolsv.exe" MD5 : abcde04f13cd6dd777684ec34815ed5f et "C:\FR-files\spoolsv.exe" MD5 : df9fc62ad51cb082b0ae371919a232cb "C:\FR-files\spoolsv.exe" MD5 : df9fc62ad51cb082b0ae371919a232cb sont différents... ----------- Les fichiers "C:\WINDOWS\Explorer.EXE" MD5 : 321456be8df9da4acd2306a09549541f "C:\WINDOWS\Explorer.EXE" MD5 : 321456be8df9da4acd2306a09549541f et "C:\FR-files\Explorer.EXE" MD5 : 2a7bd330924252a2fd80344fc949bb72 "C:\FR-files\Explorer.EXE" MD5 : 2a7bd330924252a2fd80344fc949bb72 sont différents... ----------- Les fichiers "C:\WINDOWS\system32\drivers\tcpip.sys" MD5 : 8d8949936913b041c6a0e184fbf1030b "C:\WINDOWS\system32\drivers\tcpip.sys" MD5 : 8d8949936913b041c6a0e184fbf1030b et "C:\FR-files\tcpip.sys" MD5 : 9f4b36614a0fc234525ba224957de55c "C:\FR-files\tcpip.sys" MD5 : 9f4b36614a0fc234525ba224957de55c sont différents... ----------- Les fichiers "C:\WINDOWS\system32\sfcfiles.dll" MD5 : 0cef991c04073f5ec8bfd65b961705f1 "C:\WINDOWS\system32\sfcfiles.dll" MD5 : 0cef991c04073f5ec8bfd65b961705f1 et "C:\FR-files\sfcfiles.dll" MD5 : 6d8f3ac555e3f8a569aa9b2a817698c1 "C:\FR-files\sfcfiles.dll" MD5 : 6d8f3ac555e3f8a569aa9b2a817698c1 sont différents... ----------- Les fichiers "C:\WINDOWS\system32\ctfmon.exe" MD5 : 64e41e8fee655b03e3f19ded21ba5118 et "C:\FR-files\ctfmon.exe" MD5 : 64e41e8fee655b03e3f19ded21ba5118 sont identiques... ----------- ============ Comparaison des fichiers après remplacement ============ ----------- Les fichiers "C:\WINDOWS\system32\lsass.exe" MD5 = dcac82b62c56c277f3b050be9bf14e31 et "C:\FR-files\lsass.exe" MD5 = 259af82a0932eea4f316f92db94707b6 sont différents... Echec du remplacement ----------- Les fichiers "C:\WINDOWS\system32\services.exe" MD5 = a431a9194f2bbf4896d1ab0e7048fb3e et "C:\FR-files\services.exe" MD5 = 63dcde1a0d86eeb8924d6738ff616ead sont différents... Echec du remplacement ----------- Les fichiers "C:\WINDOWS\system32\winlogon.exe" MD5 = 9c15284a3b98aa421597492cf3fc636e et "C:\FR-files\winlogon.exe" MD5 = 123eea158f74d0f67a51dcdf065d1091 sont différents... Echec du remplacement ----------- Les fichiers "C:\WINDOWS\system32\svchost.exe" MD5 = 31b708976ccd24becb9ffc4d6c13c509 et "C:\FR-files\svchost.exe" MD5 = 2979b03d5382a602623c0535b16ab9c0 sont différents... Echec du remplacement ----------- Les fichiers "C:\WINDOWS\system32\spoolsv.exe" MD5 = abcde04f13cd6dd777684ec34815ed5f et "C:\FR-files\spoolsv.exe" MD5 = df9fc62ad51cb082b0ae371919a232cb sont différents... Echec du remplacement ----------- Les fichiers "C:\WINDOWS\Explorer.EXE" MD5 = 321456be8df9da4acd2306a09549541f et "C:\FR-files\Explorer.EXE" MD5 = 2a7bd330924252a2fd80344fc949bb72 sont différents... Echec du remplacement ----------- Les fichiers "C:\WINDOWS\system32\drivers\tcpip.sys" MD5 = 8d8949936913b041c6a0e184fbf1030b et "C:\FR-files\tcpip.sys" MD5 = 9f4b36614a0fc234525ba224957de55c sont différents... Echec du remplacement ----------- Les fichiers "C:\WINDOWS\system32\sfcfiles.dll" MD5 = 0cef991c04073f5ec8bfd65b961705f1 et "C:\FR-files\sfcfiles.dll" MD5 = 6d8f3ac555e3f8a569aa9b2a817698c1 sont différents... Echec du remplacement ----------- Les fichiers "C:\WINDOWS\system32\ctfmon.exe" MD5 : 64e41e8fee655b03e3f19ded21ba5118 et "C:\FR-files\ctfmon.exe" MD5 : 64e41e8fee655b03e3f19ded21ba5118 sont identiques... "C:\WINDOWS\system32\ctfmon.backup" absent... Cela peut indiquer un problème pendant la proc‚dure ----------- ======= Fin du rapport ======= rapport Combofix : ComboFix 09-09-30.05 - ALI 02/10/2009 17:14.6.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.510.172 [GMT 2:00] Lancé depuis: c:\documents and settings\ALI\Bureau\combofix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\lsass.exe . . . est infecté!! c:\windows\system32\services.exe . . . est infecté!! c:\windows\system32\svchost.exe . . . est infecté!! c:\windows\system32\spoolsv.exe . . . est infecté!! c:\windows\explorer.exe . . . est infecté!! . ((((((((((((((((((((((((((((( Fichiers créés du 2009-09-02 au 2009-10-02 )))))))))))))))))))))))))))))))))))) . 2009-10-02 14:48 . 2009-10-02 15:07 -------- d-----w- C:\FR-files 2009-10-02 14:41 . 2009-10-02 15:03 -------- d-----w- C:\WinFileReplace 2009-09-30 14:15 . 2009-09-30 14:28 -------- d-----w- C:\bibitte 2009-09-30 14:05 . 2009-09-30 14:02 13824 ----a-w- c:\windows\system32\wscntfy.exe 2009-09-25 07:38 . 2009-09-25 07:38 -------- d-----w- C:\rsit 2009-09-25 07:34 . 2009-09-25 07:34 -------- d-----w- C:\_OTM 2009-09-24 15:35 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys 2009-09-24 15:35 . 2009-09-24 15:35 -------- d-----w- c:\program files\Panda Security 2009-09-22 16:35 . 2009-09-22 16:35 -------- d-----w- c:\documents and settings\ALI\Tracing 2009-09-22 16:33 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2009-09-21 12:18 . 2009-09-21 12:18 -------- d-----w- c:\documents and settings\NetworkService.AUTORITE NT\Local Settings\Application Data\Apple 2009-09-16 17:11 . 2009-09-16 17:11 -------- d-----w- c:\program files\Fichiers communs\Windows Live 2009-09-15 04:45 . 2009-09-15 04:44 502208 ----a-w- c:\windows\system32\drivers\amon.sys 2009-09-15 04:45 . 2009-09-15 04:44 270336 ----a-w- c:\windows\system32\imon.dll 2009-09-11 06:07 . 2009-09-21 14:14 -------- d-----w- c:\program files\IKEA HomePlanner 2009-09-11 06:06 . 2009-09-11 06:06 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-09-09 05:51 . 2009-09-09 05:51 -------- d-----w- c:\documents and settings\ALI\Local Settings\Application Data\WMTools Downloaded Files . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-28 16:11 . 2008-02-22 17:28 -------- d-----w- c:\program files\Eset 2009-09-27 07:17 . 2008-02-17 07:20 -------- d-----w- c:\program files\CCleaner 2009-09-27 06:56 . 2009-08-25 11:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-22 16:34 . 2008-05-11 15:33 60240 ----a-w- c:\documents and settings\ALI\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-10 12:54 . 2009-08-25 13:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 12:53 . 2009-08-25 13:27 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-04 12:39 . 2008-12-21 18:00 -------- d-----w- c:\documents and settings\ALI\Application Data\Apple Computer 2009-09-01 16:24 . 2008-05-28 09:52 -------- d-----w- c:\documents and settings\ALI\Application Data\Canon 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iTunes 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iPod 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Apple Software Update 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Fichiers communs\Apple 2009-08-25 11:25 . 2008-12-02 19:16 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP 2009-08-25 08:37 . 2009-08-25 08:37 0 ----a-w- c:\windows\nsreg.dat 2009-08-24 16:56 . 2009-08-24 16:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\STOPzilla! 2009-08-19 05:21 . 2009-08-19 05:21 -------- d-----w- c:\program files\MSSOAP 2009-08-19 05:20 . 2009-08-19 05:20 -------- d-----w- c:\program files\Webroot 2009-07-09 10:16 . 2009-08-25 14:30 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-07-09 10:16 . 2009-08-25 14:30 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll 2006-03-27 17:49 . 2008-04-30 07:32 3809280 ----a-w- c:\program files\Guitools.exe 2004-08-19 17:09 . 2008-05-03 14:40 1028096 --sha-w- c:\windows\system32\mfc42.dll 2002-09-06 20:59 . 2008-05-03 14:40 57344 --sha-w- c:\windows\system32\mfc42loc.dll 1995-09-20 14:16 . 2008-07-05 14:43 35088 --sha-w- c:\windows\system32\msjint32.dll 1995-09-20 14:13 . 2008-07-05 14:43 977680 --sha-w- c:\windows\system32\msjt3032.dll 1995-09-20 14:16 . 2008-07-05 14:43 23824 --sha-w- c:\windows\system32\msjter32.dll 2004-08-19 17:09 . 2008-05-03 14:40 413696 --sha-w- c:\windows\system32\msvcp60.dll 2002-09-06 20:59 . 2008-05-03 14:40 253952 --sha-w- c:\windows\system32\msvcrt20.dll 2004-08-19 17:09 . 2008-05-03 14:41 553472 --sha-w- c:\windows\system32\oleaut32.dll 2004-08-19 17:09 . 2008-05-03 14:41 83456 --sha-w- c:\windows\system32\olepro32.dll 2004-08-19 17:09 . 2008-05-03 14:43 30749 --sha-w- c:\windows\system32\vbajet32.dll 1995-09-24 09:02 . 2008-07-05 14:43 243472 --sha-w- c:\windows\system32\vbar2232.dll 1998-05-18 01:06 . 2008-07-05 14:43 368912 --sha-w- c:\windows\system32\vbar332.dll . ------- Sigcheck ------- [-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2gdr\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2qfe\tcpip.sys [-] 2006-11-11 . 8D8949936913B041C6A0E184FBF1030B . 359808 . . [5.1.2600.2892] . . c:\windows\system32\drivers\tcpip.sys [-] 2004-08-19 . DCAC82B62C56C277F3B050BE9BF14E31 . 14848 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe [-] 2004-08-19 . A431A9194F2BBF4896D1AB0E7048FB3E . 110592 . . [5.1.2600.2180] . . c:\windows\system32\services.exe [-] 2006-12-13 . ABCDE04F13CD6DD777684EC34815ED5F . 58368 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe [-] 2004-08-19 . 31B708976CCD24BECB9FFC4D6C13C509 . 17408 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe [-] 2004-08-19 . 9C15284A3B98AA421597492CF3FC636E . 510464 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2gdr\explorer.exe [-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe [-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2qfe\explorer.exe [-] 2006-11-18 . 321456BE8DF9DA4ACD2306A09549541F . 1037312 . . [6.00.2900.2649] . . c:\windows\Explorer.EXE [-] 2009-09-30 . 54CDDAD404557ED98433D6ECBFC92691 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe [-] 2006-12-13 . 0CEF991C04073F5EC8BFD65B961705F1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2009-09-29_16.58.14 ))))))))))))))))))))))))))))))))))))))))) . + 2009-10-02 15:04 . 2009-10-02 15:04 16384 c:\windows\Temp\Perflib_Perfdata_28c.dat + 2009-04-13 15:54 . 2009-10-02 15:08 214880 c:\windows\system32\inetsrv\MetaBase.bin . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-10 397312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "Cloneur Expert Monitor"="c:\program files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [2009-02-04 437675] "Acronis Scheduler2 Service"="c:\program files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [2009-02-04 61440] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "UVS11 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 341488] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-09-15 917504] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-06-23 1519616] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544] c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\ALI\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624] Pinnacle Scheduler.lnk - c:\program files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe [2008-4-30 237568] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoSimpleStartMenu"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 0 (0x0) "NoResolveTrack"= 0 (0x0) "NoSMMyPictures"= 0 (0x0) "MaxRecentDocs"= 15 (0xf) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\GT2002\\gpstrack.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "19793:TCP"= 19793:TCP:BitComet 19793 TCP "19793:UDP"= 19793:UDP:BitComet 19793 UDP R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [24/09/2009 17:35 28544] R3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [30/04/2008 10:12 6400] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [02/03/2009 12:14 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [02/03/2009 12:14 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [02/03/2009 12:14 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [02/03/2009 12:14 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [02/03/2009 12:14 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [02/03/2009 12:14 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [02/03/2009 12:14 115752] . Contenu du dossier 'Tâches planifiées' 2009-09-21 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2009-09-30 c:\windows\Tasks\HPpromotions journeysoftware.job - c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 15:36] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uSearchURL,(Default) = hxxp://www.google.fr/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 LSP: imon.dll DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-02 17:26 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:c0,d7,08,f9,31,8e,b0,1c,9a,2e,00,5c,4c,75,7e,de,43,a2,85,b5,f3,b9,51, f0,6f,a7,97,36,c9,e4,1f,81,fe,af,18,db,6d,92,73,80,eb,f6,70,64,14,33,75,52,\ "??"=hex:9c,d9,e4,f4,dd,c3,5d,1d,ea,4c,fa,e2,06,f7,3d,8c [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:87,9b,67,be,f7,4d,c0,6b,40,27,b8,b2,cf,b5,5e,04,c4,ad,d2,a8,bf, e5,5c,47,a8,1c,d9,62,87,f1,23,08,66,e6,50,e5,3e,13,01,80,22,12,4a,0c,b0,43,\ "rkeysecu"=hex:c8,9d,f3,27,d6,13,ee,5b,0c,3f,42,18,e6,bb,ee,f4 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'lsass.exe'(892) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll - - - - - - - > 'explorer.exe'(3052) c:\windows\system32\msi.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Heure de fin: 2009-10-02 17:32 ComboFix-quarantined-files.txt 2009-10-02 15:32 ComboFix2.txt 2009-09-30 05:26 ComboFix3.txt 2009-09-30 04:55 ComboFix4.txt 2009-09-29 17:06 Avant-CF: 53 153 742 848 octets libres Après-CF: 53 169 946 624 octets libres Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=,1,2,3,4 227 --- E O F --- 2008-05-04 06:01

salut, voici les rapports, apparemment les fichiers n 'ont pas été accepté par VIRUS TOTAL. à bientôt, et encore merci pour ton aide... rapport GMER : GMER 1.0.15.15087 - http://www.gmer.net Rootkit scan 2009-10-01 18:18:05 Windows 5.1.2600 Service Pack 2 Running: gmer.exe; Driver: C:\DOCUME~1\ALI\LOCALS~1\Temp\pxtdrpog.sys ---- System - GMER 1.0.15 ---- SSDT sptd.sys ZwCreateKey [0xF86410B0] SSDT sptd.sys ZwEnumerateKey [0xF864684E] SSDT sptd.sys ZwEnumerateValueKey [0xF8646BEE] SSDT sptd.sys ZwOpenKey [0xF8641090] SSDT sptd.sys ZwQueryKey [0xF8646CC6] SSDT sptd.sys ZwQueryValueKey [0xF8646B46] SSDT sptd.sys ZwSetValueKey [0xF8646D58] ---- Kernel code sections - GMER 1.0.15 ---- ? C:\WINDOWS\system32\drivers\sptd.sys Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus. .text USBPORT.SYS!DllUnload F760162C 5 Bytes JMP 82D88960 ? System32\Drivers\acjycx5j.SYS Le chemin d'accès spécifié est introuvable. ! ---- User code sections - GMER 1.0.15 ---- .rsrc C:\WINDOWS\system32\winlogon.exe[808] C:\WINDOWS\system32\winlogon.exe section is executable [0x01076000, 0xC000, 0x60000060] .rsrc C:\WINDOWS\system32\winlogon.exe[808] C:\WINDOWS\system32\winlogon.exe entry point in ".rsrc" section [0x01081000] .rsrc C:\WINDOWS\system32\services.exe[884] C:\WINDOWS\system32\services.exe section is executable [0x0101B000, 0x2000, 0x60000060] .rsrc C:\WINDOWS\system32\services.exe[884] C:\WINDOWS\system32\services.exe entry point in ".rsrc" section [0x0101C000] .rsrc C:\WINDOWS\system32\svchost.exe[1112] C:\WINDOWS\system32\svchost.exe section is executable [0x01005000, 0x2000, 0x60000060] .rsrc C:\WINDOWS\system32\svchost.exe[1112] C:\WINDOWS\system32\svchost.exe entry point in ".rsrc" section [0x01006000] .rsrc C:\WINDOWS\system32\svchost.exe[1196] C:\WINDOWS\system32\svchost.exe section is executable [0x01005000, 0x2000, 0x60000060] .rsrc C:\WINDOWS\system32\svchost.exe[1196] C:\WINDOWS\system32\svchost.exe entry point in ".rsrc" section [0x01006000] .rsrc C:\WINDOWS\System32\svchost.exe[1296] C:\WINDOWS\System32\svchost.exe section is executable [0x01005000, 0x2000, 0x60000060] .rsrc C:\WINDOWS\System32\svchost.exe[1296] C:\WINDOWS\System32\svchost.exe entry point in ".rsrc" section [0x01006000] .rsrc C:\WINDOWS\system32\svchost.exe[1340] C:\WINDOWS\system32\svchost.exe section is executable [0x01005000, 0x2000, 0x60000060] .rsrc C:\WINDOWS\system32\svchost.exe[1340] C:\WINDOWS\system32\svchost.exe entry point in ".rsrc" section [0x01006000] .rsrc C:\WINDOWS\system32\svchost.exe[1432] C:\WINDOWS\system32\svchost.exe section is executable [0x01005000, 0x2000, 0x60000060] .rsrc C:\WINDOWS\system32\svchost.exe[1432] C:\WINDOWS\system32\svchost.exe entry point in ".rsrc" section [0x01006000] .reloc C:\WINDOWS\Explorer.EXE[1764] C:\WINDOWS\Explorer.EXE section is executable [0x010FB000, 0x5000, 0x62000060] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2204] USER32.dll!DialogBoxIndirectParamW 77D3204B 5 Bytes JMP 7E38C510 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2204] USER32.dll!MessageBoxIndirectA 77D3A062 5 Bytes JMP 7E38C491 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2204] USER32.dll!DialogBoxParamA 77D3B124 5 Bytes JMP 7E38C4D5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2204] USER32.dll!MessageBoxExW 77D50540 5 Bytes JMP 7E38C3D9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2204] USER32.dll!MessageBoxExA 77D50564 5 Bytes JMP 7E38C413 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2204] USER32.dll!DialogBoxIndirectParamA 77D56CB5 5 Bytes JMP 7E38C54B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2204] USER32.dll!MessageBoxIndirectW 77D6609B 5 Bytes JMP 7E38C44D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!IoConnectInterrupt] [F8655480] sptd.sys IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F865542C] sptd.sys IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F866FAB8] sptd.sys IAT atapi.sys[ntoskrnl.exe!IoConnectInterrupt] [F8655480] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F8641ABA] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F8641C00] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F8641B82] sptd.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F864272E] sptd.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F8642604] sptd.sys IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F8654A9A] sptd.sys ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [10001D50] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [10001D00] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [10001D50] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [10001D00] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [10001D50] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [10001D00] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [10001D00] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [10001D00] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [10001D50] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [10001D20] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHELL32.dll [uSER32.dll!AdjustWindowRectEx] [1002DE60] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHELL32.dll [uSER32.dll!AdjustWindowRect] [1002DED0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [10001D20] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [10001D50] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [10001D00] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\SHLWAPI.dll [uSER32.dll!SetWindowLongA] [1002DEF0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [10001D00] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [10001D50] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [10001D20] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [10001D00] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [10001D50] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\WININET.dll [uSER32.dll!SetWindowLongA] [1002DEF0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [10001D00] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA] [10001D20] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW] [10001D50] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [10001D00] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [10001D20] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [10001050] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) IAT C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2572] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [10001CE0] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software) ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 82F671D8 AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset ) Device \Driver\NetBT \Device\NetBT_Tcpip_{3F94A333-DBE7-47E6-98A6-4353B5580B32} 829E2878 Device \Driver\usbuhci \Device\USBPDO-0 82D7D1D8 Device \Driver\00000047 \Device\00000044 sptd.sys Device \Driver\dmio \Device\DmControl\DmIoDaemon 82FD71D8 Device \Driver\dmio \Device\DmControl\DmConfig 82FD71D8 Device \Driver\dmio \Device\DmControl\DmPnP 82FD71D8 Device \Driver\dmio \Device\DmControl\DmInfo 82FD71D8 Device \Driver\usbuhci \Device\USBPDO-1 82D7D1D8 Device \Driver\usbuhci \Device\USBPDO-2 82D7D1D8 Device \Driver\usbuhci \Device\USBPDO-3 82D7D1D8 Device \Driver\usbehci \Device\USBPDO-4 82D501D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 82F691D8 AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis) Device \Driver\Ftdisk \Device\HarddiskVolume2 82F691D8 AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis) Device \Driver\Cdrom \Device\CdRom0 82CA2980 Device \Driver\Cdrom \Device\CdRom1 82CA2980 Device \Driver\atapi \Device\Ide\IdePort0 82F681D8 Device \Driver\atapi \Device\Ide\IdePort1 82F681D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 82F681D8 Device \Driver\atapi \Device\Ide\IdePort2 82F681D8 Device \Driver\atapi \Device\Ide\IdePort3 82F681D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c 82F681D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1b 82F681D8 Device \Driver\NetBT \Device\NetBt_Wins_Export 829E2878 Device \Driver\NetBT \Device\NetbiosSmb 829E2878 Device \Driver\usbuhci \Device\USBFDO-0 82D7D1D8 Device \Driver\usbuhci \Device\USBFDO-1 82D7D1D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 82C328B0 Device \Driver\usbuhci \Device\USBFDO-2 82D7D1D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector 82C328B0 Device \Driver\usbuhci \Device\USBFDO-3 82D7D1D8 Device \Driver\usbehci \Device\USBFDO-4 82D501D8 Device \Driver\Ftdisk \Device\FtControl 82F691D8 Device \Driver\acjycx5j \Device\Scsi\acjycx5j1Port4Path0Target0Lun0 82DB2478 Device \Driver\acjycx5j \Device\Scsi\acjycx5j1 82DB2478 Device \FileSystem\Cdfs \Cdfs 82C09460 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys@start 1 Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys@type 1 Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys@imagepath \systemroot\system32\drivers\gxvxckyxmbfamrqhemovhemqeltwbeeveohxr.sys Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys@group file system Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys\modules (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys\modules@gxvxcserv \\?\globalroot\systemroot\system32\drivers\gxvxckyxmbfamrqhemovhemqeltwbeeveohxr.sys Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys\modules@gxvxcl \\?\globalroot\systemroot\system32\gxvxcfskpmbpdxlllnrjftmgvxfuxptofjefv.dll Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\ Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x85 0x29 0xB4 0x70 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xBD 0x2A 0x0F 0xA4 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x53 0xB0 0xD1 0x4D ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x85 0x29 0xB4 0x70 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xBD 0x2A 0x0F 0xA4 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x6F 0xCB 0xE1 0xEE ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 1947596920 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 1554747531 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x85 0x29 0xB4 0x70 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xBD 0x2A 0x0F 0xA4 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x53 0xB0 0xD1 0x4D ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\ Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x85 0x29 0xB4 0x70 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xBD 0x2A 0x0F 0xA4 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x53 0xB0 0xD1 0x4D ... ---- EOF - GMER 1.0.15 ---- rapport VIRUS TOTAL : 0 bytes size received / Se ha recibido un archivo vacio 0 bytes size received / Se ha recibido un archivo vacio

ello ! j' ai refait la manip, un petit détail, le combofix est toujours enregistré sous Bibitte.exe est-ce un probléme quand je fais travailler combofix ? Pas de souci particulier lors de sa mise en application. bien à toi.. rapport ComboFix 09-09-30.05 - ALI 01/10/2009 6:41.5.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.510.184 [GMT 2:00] Lancé depuis: c:\documents and settings\ALI\Bureau\bibitte.exe Commutateurs utilisés :: c:\documents and settings\ALI\Bureau\CFScript.txt . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\lsass.exe . . . est infecté!! c:\windows\system32\services.exe . . . est infecté!! c:\windows\system32\svchost.exe . . . est infecté!! c:\windows\system32\spoolsv.exe . . . est infecté!! c:\windows\explorer.exe . . . est infecté!! . ((((((((((((((((((((((((((((( Fichiers créés du 2009-09-01 au 2009-10-01 )))))))))))))))))))))))))))))))))))) . 2009-09-30 14:15 . 2009-09-30 14:28 -------- d-----w- C:\bibitte 2009-09-30 14:05 . 2009-09-30 14:02 13824 ----a-w- c:\windows\system32\wscntfy.exe 2009-09-25 07:38 . 2009-09-25 07:38 -------- d-----w- C:\rsit 2009-09-25 07:34 . 2009-09-25 07:34 -------- d-----w- C:\_OTM 2009-09-24 15:35 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys 2009-09-24 15:35 . 2009-09-24 15:35 -------- d-----w- c:\program files\Panda Security 2009-09-22 16:35 . 2009-09-22 16:35 -------- d-----w- c:\documents and settings\ALI\Tracing 2009-09-22 16:33 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2009-09-21 12:18 . 2009-09-21 12:18 -------- d-----w- c:\documents and settings\NetworkService.AUTORITE NT\Local Settings\Application Data\Apple 2009-09-16 17:11 . 2009-09-16 17:11 -------- d-----w- c:\program files\Fichiers communs\Windows Live 2009-09-15 04:45 . 2009-09-15 04:44 502208 ----a-w- c:\windows\system32\drivers\amon.sys 2009-09-15 04:45 . 2009-09-15 04:44 270336 ----a-w- c:\windows\system32\imon.dll 2009-09-11 06:07 . 2009-09-21 14:14 -------- d-----w- c:\program files\IKEA HomePlanner 2009-09-11 06:06 . 2009-09-11 06:06 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-09-09 05:51 . 2009-09-09 05:51 -------- d-----w- c:\documents and settings\ALI\Local Settings\Application Data\WMTools Downloaded Files . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-28 16:11 . 2008-02-22 17:28 -------- d-----w- c:\program files\Eset 2009-09-27 07:17 . 2008-02-17 07:20 -------- d-----w- c:\program files\CCleaner 2009-09-27 06:56 . 2009-08-25 11:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-22 16:34 . 2008-05-11 15:33 60240 ----a-w- c:\documents and settings\ALI\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-10 12:54 . 2009-08-25 13:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 12:53 . 2009-08-25 13:27 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-04 12:39 . 2008-12-21 18:00 -------- d-----w- c:\documents and settings\ALI\Application Data\Apple Computer 2009-09-01 16:24 . 2008-05-28 09:52 -------- d-----w- c:\documents and settings\ALI\Application Data\Canon 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iTunes 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iPod 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Apple Software Update 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Fichiers communs\Apple 2009-08-25 11:25 . 2008-12-02 19:16 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP 2009-08-25 08:37 . 2009-08-25 08:37 0 ----a-w- c:\windows\nsreg.dat 2009-08-24 16:56 . 2009-08-24 16:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\STOPzilla! 2009-08-19 05:21 . 2009-08-19 05:21 -------- d-----w- c:\program files\MSSOAP 2009-08-19 05:20 . 2009-08-19 05:20 -------- d-----w- c:\program files\Webroot 2009-07-09 10:16 . 2009-08-25 14:30 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-07-09 10:16 . 2009-08-25 14:30 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll 2006-03-27 17:49 . 2008-04-30 07:32 3809280 ----a-w- c:\program files\Guitools.exe 2004-08-19 17:09 . 2008-05-03 14:40 1028096 --sha-w- c:\windows\system32\mfc42.dll 2002-09-06 20:59 . 2008-05-03 14:40 57344 --sha-w- c:\windows\system32\mfc42loc.dll 1995-09-20 14:16 . 2008-07-05 14:43 35088 --sha-w- c:\windows\system32\msjint32.dll 1995-09-20 14:13 . 2008-07-05 14:43 977680 --sha-w- c:\windows\system32\msjt3032.dll 1995-09-20 14:16 . 2008-07-05 14:43 23824 --sha-w- c:\windows\system32\msjter32.dll 2004-08-19 17:09 . 2008-05-03 14:40 413696 --sha-w- c:\windows\system32\msvcp60.dll 2004-08-19 17:09 . 2008-05-03 14:40 343040 --sha-w- c:\windows\system32\msvcrt.dll 2002-09-06 20:59 . 2008-05-03 14:40 253952 --sha-w- c:\windows\system32\msvcrt20.dll 2004-08-19 17:09 . 2008-05-03 14:41 553472 --sha-w- c:\windows\system32\oleaut32.dll 2004-08-19 17:09 . 2008-05-03 14:41 83456 --sha-w- c:\windows\system32\olepro32.dll 2004-08-19 17:09 . 2008-05-03 14:43 30749 --sha-w- c:\windows\system32\vbajet32.dll 1995-09-24 09:02 . 2008-07-05 14:43 243472 --sha-w- c:\windows\system32\vbar2232.dll 1998-05-18 01:06 . 2008-07-05 14:43 368912 --sha-w- c:\windows\system32\vbar332.dll . ------- Sigcheck ------- [-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2gdr\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2qfe\tcpip.sys [-] 2006-11-11 . 8D8949936913B041C6A0E184FBF1030B . 359808 . . [5.1.2600.2892] . . c:\windows\system32\drivers\tcpip.sys [-] 2004-08-19 . DCAC82B62C56C277F3B050BE9BF14E31 . 14848 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe [-] 2004-08-19 . A431A9194F2BBF4896D1AB0E7048FB3E . 110592 . . [5.1.2600.2180] . . c:\windows\system32\services.exe [-] 2006-12-13 . ABCDE04F13CD6DD777684EC34815ED5F . 58368 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe [-] 2004-08-19 . 31B708976CCD24BECB9FFC4D6C13C509 . 17408 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe [-] 2004-08-19 . 9C15284A3B98AA421597492CF3FC636E . 510464 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2gdr\explorer.exe [-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe [-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2qfe\explorer.exe [-] 2006-11-18 . 321456BE8DF9DA4ACD2306A09549541F . 1037312 . . [6.00.2900.2649] . . c:\windows\Explorer.EXE [-] 2009-09-30 . 54CDDAD404557ED98433D6ECBFC92691 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe [-] 2006-12-13 . 0CEF991C04073F5EC8BFD65B961705F1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2009-09-29_16.58.14 ))))))))))))))))))))))))))))))))))))))))) . + 2009-10-01 04:00 . 2009-10-01 04:00 16384 c:\windows\Temp\Perflib_Perfdata_514.dat + 2009-04-13 15:54 . 2009-10-01 04:00 214881 c:\windows\system32\inetsrv\MetaBase.bin . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-10 397312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "Cloneur Expert Monitor"="c:\program files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [2009-02-04 437675] "Acronis Scheduler2 Service"="c:\program files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [2009-02-04 61440] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "UVS11 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 341488] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-09-15 917504] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-06-23 1519616] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544] c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\ALI\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624] Pinnacle Scheduler.lnk - c:\program files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe [2008-4-30 237568] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoSimpleStartMenu"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 0 (0x0) "NoResolveTrack"= 0 (0x0) "NoSMMyPictures"= 0 (0x0) "MaxRecentDocs"= 15 (0xf) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\GT2002\\gpstrack.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "19793:TCP"= 19793:TCP:BitComet 19793 TCP "19793:UDP"= 19793:UDP:BitComet 19793 UDP R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [24/09/2009 17:35 28544] R3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [30/04/2008 10:12 6400] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [02/03/2009 12:14 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [02/03/2009 12:14 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [02/03/2009 12:14 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [02/03/2009 12:14 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [02/03/2009 12:14 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [02/03/2009 12:14 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [02/03/2009 12:14 115752] . Contenu du dossier 'Tâches planifiées' 2009-09-21 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2009-09-30 c:\windows\Tasks\HPpromotions journeysoftware.job - c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 15:36] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uSearchURL,(Default) = hxxp://www.google.fr/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 LSP: imon.dll DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-01 06:53 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:c0,d7,08,f9,31,8e,b0,1c,9a,2e,00,5c,4c,75,7e,de,43,a2,85,b5,f3,b9,51, f0,6f,a7,97,36,c9,e4,1f,81,fe,af,18,db,6d,92,73,80,eb,f6,70,64,14,33,75,52,\ "??"=hex:9c,d9,e4,f4,dd,c3,5d,1d,ea,4c,fa,e2,06,f7,3d,8c [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:87,9b,67,be,f7,4d,c0,6b,40,27,b8,b2,cf,b5,5e,04,c4,ad,d2,a8,bf, e5,5c,47,a8,1c,d9,62,87,f1,23,08,66,e6,50,e5,3e,13,01,80,22,12,4a,0c,b0,43,\ "rkeysecu"=hex:c8,9d,f3,27,d6,13,ee,5b,0c,3f,42,18,e6,bb,ee,f4 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'lsass.exe'(892) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll - - - - - - - > 'explorer.exe'(1564) c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\windows\system32\msi.dll . Heure de fin: 2009-10-01 6:56 ComboFix-quarantined-files.txt 2009-10-01 04:56 ComboFix2.txt 2009-09-30 05:26 ComboFix3.txt 2009-09-30 04:55 ComboFix4.txt 2009-09-29 17:06 Avant-CF: 53 480 992 768 octets libres Après-CF: 53 480 697 856 octets libres Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=,1,2,3,4 227 --- E O F --- 2008-05-04 06:01 rapport Hijackthis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 06:58:14, on 01/10/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\IcoSauve.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\ALI\Bureau\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [uVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [soundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Pinnacle Scheduler.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/51.28/uploader2.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-2.0.cab O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Gestion d'applications (AppMgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Audio Windows (AudioSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Service de transfert intelligent en arrière-plan (BITS) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Explorateur d'ordinateur (Browser) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe O23 - Service: CryptSvc - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Lanceur de processus serveur DCOM (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Client DHCP (Dhcp) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Gestionnaire de disque logique (dmserver) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Client DNS (Dnscache) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Service de rapport d'erreurs (ERSvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Système d'événements de COM+ (EventSystem) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Compatibilité avec le Changement rapide d'utilisateur (FastUserSwitchingCompatibility) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Aide et support (helpsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Serveur (lanmanserver) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Station de travail (lanmanworkstation) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Assistance TCP/IP NetBIOS (LmHosts) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Ouverture de session réseau (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Connexions réseau (Netman) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: NLA (Network Location Awareness) (Nla) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: Fournisseur de la prise en charge de sécurité LM NT (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Stockage amovible (NtmsSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Services IPSEC (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Emplacement protégé (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Gestionnaire de connexion automatique d'accès distant (RasAuto) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Gestionnaire de connexions d'accès distant (RasMan) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Accès à distance au Registre (RemoteRegistry) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Appel de procédure distante (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Gestionnaire de comptes de sécurité (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Planificateur de tâches (Schedule) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Secondary Logon (seclogon) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Notification d'événement système (SENS) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Pare-feu Windows / Partage de connexion Internet (SharedAccess) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Détection matériel noyau (ShellHWDetection) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Service de restauration système (srservice) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Service de découvertes SSDP (SSDPSRV) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Acquisition d'image Windows (WIA) (stisvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Téléphonie (TapiSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Services Terminal Server (TermService) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Thèmes (Themes) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Client de suivi de lien distribué (TrkWks) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Hôte de périphérique universel Plug-and-Play (upnphost) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Horloge Windows (W32Time) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: WebClient - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Infrastructure de gestion Windows (winmgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Service de numéro de série du lecteur multimédia portable (WmdmPmSN) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Extensions du pilote WMI (Wmi) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: wscsvc - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Mises à jour automatiques (wuauserv) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Configuration automatique sans fil (WZCSVC) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Service d'approvisionnement réseau (xmlprov) - Unknown owner - C:\WINDOWS\System32\svchost.exe -- End of file - 12761 bytes

re.. voilà c fait ! voici les rapports : @ suivre ... ComboFix 09-09-29.02 - ALI 30/09/2009 16:17.4.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.510.291 [GMT 2:00] Lancé depuis: c:\documents and settings\ALI\Bureau\bibitte.exe Commutateurs utilisés :: c:\documents and settings\ALI\Bureau\CFScript.txt . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\ctfmon .exe c:\windows\system32\nerocheck .exe c:\windows\system32\lsass.exe . . . est infecté!! c:\windows\system32\services.exe . . . est infecté!! c:\windows\system32\svchost.exe . . . est infecté!! c:\windows\system32\spoolsv.exe . . . est infecté!! c:\windows\explorer.exe . . . est infecté!! . --------------- SCopy --------------- \RP279\A0046707.exe --> c:\windows\system32\ctfmon .exe \RP279\A0046715.exe --> c:\windows\system32\nerocheck .exe . ((((((((((((((((((((((((((((( Fichiers créés du 2009-08-28 au 2009-09-30 )))))))))))))))))))))))))))))))))))) . 2009-09-30 14:05 . 2009-09-30 14:02 13824 ----a-w- c:\windows\system32\wscntfy.exe 2009-09-25 07:38 . 2009-09-25 07:38 -------- d-----w- C:\rsit 2009-09-25 07:34 . 2009-09-25 07:34 -------- d-----w- C:\_OTM 2009-09-24 15:35 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys 2009-09-24 15:35 . 2009-09-24 15:35 -------- d-----w- c:\program files\Panda Security 2009-09-22 16:35 . 2009-09-22 16:35 -------- d-----w- c:\documents and settings\ALI\Tracing 2009-09-22 16:33 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2009-09-21 12:18 . 2009-09-21 12:18 -------- d-----w- c:\documents and settings\NetworkService.AUTORITE NT\Local Settings\Application Data\Apple 2009-09-16 17:11 . 2009-09-16 17:11 -------- d-----w- c:\program files\Fichiers communs\Windows Live 2009-09-15 04:45 . 2009-09-15 04:44 502208 ----a-w- c:\windows\system32\drivers\amon.sys 2009-09-15 04:45 . 2009-09-15 04:44 270336 ----a-w- c:\windows\system32\imon.dll 2009-09-11 06:07 . 2009-09-21 14:14 -------- d-----w- c:\program files\IKEA HomePlanner 2009-09-11 06:06 . 2009-09-11 06:06 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-09-09 05:51 . 2009-09-09 05:51 -------- d-----w- c:\documents and settings\ALI\Local Settings\Application Data\WMTools Downloaded Files . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-28 16:11 . 2008-02-22 17:28 -------- d-----w- c:\program files\Eset 2009-09-27 07:17 . 2008-02-17 07:20 -------- d-----w- c:\program files\CCleaner 2009-09-27 06:56 . 2009-08-25 11:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-22 16:34 . 2008-05-11 15:33 60240 ----a-w- c:\documents and settings\ALI\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-10 12:54 . 2009-08-25 13:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 12:53 . 2009-08-25 13:27 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-04 12:39 . 2008-12-21 18:00 -------- d-----w- c:\documents and settings\ALI\Application Data\Apple Computer 2009-09-01 16:24 . 2008-05-28 09:52 -------- d-----w- c:\documents and settings\ALI\Application Data\Canon 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iTunes 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iPod 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Apple Software Update 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Fichiers communs\Apple 2009-08-25 11:25 . 2008-12-02 19:16 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP 2009-08-25 08:37 . 2009-08-25 08:37 0 ----a-w- c:\windows\nsreg.dat 2009-08-24 16:56 . 2009-08-24 16:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\STOPzilla! 2009-08-19 05:21 . 2009-08-19 05:21 -------- d-----w- c:\program files\MSSOAP 2009-08-19 05:20 . 2009-08-19 05:20 -------- d-----w- c:\program files\Webroot 2009-07-09 10:16 . 2009-08-25 14:30 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-07-09 10:16 . 2009-08-25 14:30 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll 2006-03-27 17:49 . 2008-04-30 07:32 3809280 ----a-w- c:\program files\Guitools.exe 2004-08-19 17:09 . 2008-05-03 14:40 1028096 --sha-w- c:\windows\system32\mfc42.dll 2002-09-06 20:59 . 2008-05-03 14:40 57344 --sha-w- c:\windows\system32\mfc42loc.dll 1995-09-20 14:16 . 2008-07-05 14:43 35088 --sha-w- c:\windows\system32\msjint32.dll 1995-09-20 14:13 . 2008-07-05 14:43 977680 --sha-w- c:\windows\system32\msjt3032.dll 1995-09-20 14:16 . 2008-07-05 14:43 23824 --sha-w- c:\windows\system32\msjter32.dll 2004-08-19 17:09 . 2008-05-03 14:40 413696 --sha-w- c:\windows\system32\msvcp60.dll 2004-08-19 17:09 . 2008-05-03 14:40 343040 --sha-w- c:\windows\system32\msvcrt.dll 2002-09-06 20:59 . 2008-05-03 14:40 253952 --sha-w- c:\windows\system32\msvcrt20.dll 2004-08-19 17:09 . 2008-05-03 14:41 553472 --sha-w- c:\windows\system32\oleaut32.dll 2004-08-19 17:09 . 2008-05-03 14:41 83456 --sha-w- c:\windows\system32\olepro32.dll 2004-08-19 17:09 . 2008-05-03 14:43 30749 --sha-w- c:\windows\system32\vbajet32.dll 1995-09-24 09:02 . 2008-07-05 14:43 243472 --sha-w- c:\windows\system32\vbar2232.dll 1998-05-18 01:06 . 2008-07-05 14:43 368912 --sha-w- c:\windows\system32\vbar332.dll . (((((((((((((((((((((((((((((((((((((((((( SR_Search )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ------- Sigcheck ------- [-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2gdr\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2qfe\tcpip.sys [-] 2006-11-11 . 8D8949936913B041C6A0E184FBF1030B . 359808 . . [5.1.2600.2892] . . c:\windows\system32\drivers\tcpip.sys [-] 2004-08-19 . DCAC82B62C56C277F3B050BE9BF14E31 . 14848 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe [-] 2004-08-19 . A431A9194F2BBF4896D1AB0E7048FB3E . 110592 . . [5.1.2600.2180] . . c:\windows\system32\services.exe [-] 2006-12-13 . ABCDE04F13CD6DD777684EC34815ED5F . 58368 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe [-] 2004-08-19 . 31B708976CCD24BECB9FFC4D6C13C509 . 17408 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe [-] 2004-08-19 . 9C15284A3B98AA421597492CF3FC636E . 510464 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2gdr\explorer.exe [-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe [-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2qfe\explorer.exe [-] 2006-11-18 . 321456BE8DF9DA4ACD2306A09549541F . 1037312 . . [6.00.2900.2649] . . c:\windows\Explorer.EXE [-] 2009-09-30 . 54CDDAD404557ED98433D6ECBFC92691 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe [-] 2006-12-13 . 0CEF991C04073F5EC8BFD65B961705F1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2009-09-29_16.58.14 ))))))))))))))))))))))))))))))))))))))))) . + 2009-09-30 13:31 . 2009-09-30 13:31 16384 c:\windows\Temp\Perflib_Perfdata_7d0.dat + 2009-04-13 15:54 . 2009-09-30 13:31 214889 c:\windows\system32\inetsrv\MetaBase.bin . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-10 397312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "Cloneur Expert Monitor"="c:\program files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [2009-02-04 437675] "Acronis Scheduler2 Service"="c:\program files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [2009-02-04 61440] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "UVS11 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 341488] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-09-15 917504] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-06-23 1519616] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544] c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\ALI\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624] Pinnacle Scheduler.lnk - c:\program files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe [2008-4-30 237568] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoSimpleStartMenu"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 0 (0x0) "NoResolveTrack"= 0 (0x0) "NoSMMyPictures"= 0 (0x0) "MaxRecentDocs"= 15 (0xf) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\GT2002\\gpstrack.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "19793:TCP"= 19793:TCP:BitComet 19793 TCP "19793:UDP"= 19793:UDP:BitComet 19793 UDP R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [24/09/2009 17:35 28544] R3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [30/04/2008 10:12 6400] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [02/03/2009 12:14 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [02/03/2009 12:14 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [02/03/2009 12:14 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [02/03/2009 12:14 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [02/03/2009 12:14 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [02/03/2009 12:14 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [02/03/2009 12:14 115752] . Contenu du dossier 'Tâches planifiées' 2009-09-21 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2009-09-30 c:\windows\Tasks\HPpromotions journeysoftware.job - c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 15:36] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uSearchURL,(Default) = hxxp://www.google.fr/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 LSP: imon.dll DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-09-30 16:25 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:c0,d7,08,f9,31,8e,b0,1c,9a,2e,00,5c,4c,75,7e,de,43,a2,85,b5,f3,b9,51, f0,6f,a7,97,36,c9,e4,1f,81,fe,af,18,db,6d,92,73,80,eb,f6,70,64,14,33,75,52,\ "??"=hex:9c,d9,e4,f4,dd,c3,5d,1d,ea,4c,fa,e2,06,f7,3d,8c [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:87,9b,67,be,f7,4d,c0,6b,40,27,b8,b2,cf,b5,5e,04,c4,ad,d2,a8,bf, e5,5c,47,a8,1c,d9,62,87,f1,23,08,66,e6,50,e5,3e,13,01,80,22,12,4a,0c,b0,43,\ "rkeysecu"=hex:c8,9d,f3,27,d6,13,ee,5b,0c,3f,42,18,e6,bb,ee,f4 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'lsass.exe'(892) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll . Heure de fin: 2009-09-30 16:28 ComboFix-quarantined-files.txt 2009-09-30 14:28 ComboFix2.txt 2009-09-30 05:26 ComboFix3.txt 2009-09-30 04:55 ComboFix4.txt 2009-09-29 17:06 Avant-CF: 53 537 267 712 octets libres Après-CF: 53 516 222 464 octets libres Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=,1,2,3,4 229 --- E O F --- 2008-05-04 06:01 rapport Hijackthis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:35:10, on 30/09/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe C:\WINDOWS\system32\IcoSauve.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Winamp\winamp.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\ALI\Bureau\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [uVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [soundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Pinnacle Scheduler.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/51.28/uploader2.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-2.0.cab O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Gestion d'applications (AppMgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Audio Windows (AudioSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Service de transfert intelligent en arrière-plan (BITS) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Explorateur d'ordinateur (Browser) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe O23 - Service: CryptSvc - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Lanceur de processus serveur DCOM (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Client DHCP (Dhcp) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Gestionnaire de disque logique (dmserver) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Client DNS (Dnscache) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Service de rapport d'erreurs (ERSvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Système d'événements de COM+ (EventSystem) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Compatibilité avec le Changement rapide d'utilisateur (FastUserSwitchingCompatibility) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Aide et support (helpsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Serveur (lanmanserver) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Station de travail (lanmanworkstation) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Assistance TCP/IP NetBIOS (LmHosts) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Ouverture de session réseau (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Connexions réseau (Netman) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: NLA (Network Location Awareness) (Nla) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: Fournisseur de la prise en charge de sécurité LM NT (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Stockage amovible (NtmsSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Services IPSEC (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Emplacement protégé (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Gestionnaire de connexion automatique d'accès distant (RasAuto) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Gestionnaire de connexions d'accès distant (RasMan) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Accès à distance au Registre (RemoteRegistry) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Appel de procédure distante (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Gestionnaire de comptes de sécurité (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Planificateur de tâches (Schedule) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Secondary Logon (seclogon) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Notification d'événement système (SENS) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Pare-feu Windows / Partage de connexion Internet (SharedAccess) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Détection matériel noyau (ShellHWDetection) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Service de restauration système (srservice) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Service de découvertes SSDP (SSDPSRV) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Acquisition d'image Windows (WIA) (stisvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Téléphonie (TapiSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Services Terminal Server (TermService) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Thèmes (Themes) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Client de suivi de lien distribué (TrkWks) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Hôte de périphérique universel Plug-and-Play (upnphost) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Horloge Windows (W32Time) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: WebClient - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Infrastructure de gestion Windows (winmgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Service de numéro de série du lecteur multimédia portable (WmdmPmSN) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Extensions du pilote WMI (Wmi) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: wscsvc - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Mises à jour automatiques (wuauserv) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Configuration automatique sans fil (WZCSVC) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Service d'approvisionnement réseau (xmlprov) - Unknown owner - C:\WINDOWS\System32\svchost.exe -- End of file - 13093 bytes

bonjour, j' ai collé la citation dans Combofix, [/u]mais pas de fenêtre bleue[/u] qui apparaît Type 1 to continue, or 2 to abort , tape 1 puis valide .. J' ai tenté deux fois en vain. Les virus sont toujours présents, des messages NOD 32 apparaissent, il me propose la suppression à chaque fois et me dit que la suppression sera effective dès le prochain démarrage, mais rien... salutations .. voici les rapports : ComboFix 09-09-29.02 - ALI 30/09/2009 7:12.3.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.510.179 [GMT 2:00] Lancé depuis: c:\documents and settings\ALI\Bureau\bibitte.exe Commutateurs utilisés :: c:\documents and settings\ALI\Bureau\CFScript.txt . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\lsass.exe . . . est infecté!! c:\windows\system32\services.exe . . . est infecté!! c:\windows\system32\svchost.exe . . . est infecté!! c:\windows\system32\spoolsv.exe . . . est infecté!! c:\windows\explorer.exe . . . est infecté!! . ((((((((((((((((((((((((((((( Fichiers créés du 2009-08-28 au 2009-09-30 )))))))))))))))))))))))))))))))))))) . 2009-09-25 07:38 . 2009-09-25 07:38 -------- d-----w- C:\rsit 2009-09-25 07:34 . 2009-09-25 07:34 -------- d-----w- C:\_OTM 2009-09-24 15:35 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys 2009-09-24 15:35 . 2009-09-24 15:35 -------- d-----w- c:\program files\Panda Security 2009-09-22 16:35 . 2009-09-22 16:35 -------- d-----w- c:\documents and settings\ALI\Tracing 2009-09-22 16:33 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2009-09-21 12:18 . 2009-09-21 12:18 -------- d-----w- c:\documents and settings\NetworkService.AUTORITE NT\Local Settings\Application Data\Apple 2009-09-16 17:11 . 2009-09-16 17:11 -------- d-----w- c:\program files\Fichiers communs\Windows Live 2009-09-15 04:45 . 2009-09-15 04:44 502208 ----a-w- c:\windows\system32\drivers\amon.sys 2009-09-15 04:45 . 2009-09-15 04:44 270336 ----a-w- c:\windows\system32\imon.dll 2009-09-11 06:07 . 2009-09-21 14:14 -------- d-----w- c:\program files\IKEA HomePlanner 2009-09-11 06:06 . 2009-09-11 06:06 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-09-09 05:51 . 2009-09-09 05:51 -------- d-----w- c:\documents and settings\ALI\Local Settings\Application Data\WMTools Downloaded Files . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-28 16:11 . 2008-02-22 17:28 -------- d-----w- c:\program files\Eset 2009-09-27 07:17 . 2008-02-17 07:20 -------- d-----w- c:\program files\CCleaner 2009-09-27 06:56 . 2009-08-25 11:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-22 16:34 . 2008-05-11 15:33 60240 ----a-w- c:\documents and settings\ALI\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-10 12:54 . 2009-08-25 13:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 12:53 . 2009-08-25 13:27 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-04 12:39 . 2008-12-21 18:00 -------- d-----w- c:\documents and settings\ALI\Application Data\Apple Computer 2009-09-01 16:24 . 2008-05-28 09:52 -------- d-----w- c:\documents and settings\ALI\Application Data\Canon 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iTunes 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iPod 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Apple Software Update 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Fichiers communs\Apple 2009-08-25 11:25 . 2008-12-02 19:16 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP 2009-08-25 08:37 . 2009-08-25 08:37 0 ----a-w- c:\windows\nsreg.dat 2009-08-24 16:56 . 2009-08-24 16:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\STOPzilla! 2009-08-19 05:21 . 2009-08-19 05:21 -------- d-----w- c:\program files\MSSOAP 2009-08-19 05:20 . 2009-08-19 05:20 -------- d-----w- c:\program files\Webroot 2009-07-09 10:16 . 2009-08-25 14:30 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-07-09 10:16 . 2009-08-25 14:30 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll 2006-03-27 17:49 . 2008-04-30 07:32 3809280 ----a-w- c:\program files\Guitools.exe 2004-08-19 17:09 . 2008-05-03 14:40 1028096 --sha-w- c:\windows\system32\mfc42.dll 2002-09-06 20:59 . 2008-05-03 14:40 57344 --sha-w- c:\windows\system32\mfc42loc.dll 1995-09-20 14:16 . 2008-07-05 14:43 35088 --sha-w- c:\windows\system32\msjint32.dll 1995-09-20 14:13 . 2008-07-05 14:43 977680 --sha-w- c:\windows\system32\msjt3032.dll 1995-09-20 14:16 . 2008-07-05 14:43 23824 --sha-w- c:\windows\system32\msjter32.dll 2004-08-19 17:09 . 2008-05-03 14:40 413696 --sha-w- c:\windows\system32\msvcp60.dll 2004-08-19 17:09 . 2008-05-03 14:40 343040 --sha-w- c:\windows\system32\msvcrt.dll 2002-09-06 20:59 . 2008-05-03 14:40 253952 --sha-w- c:\windows\system32\msvcrt20.dll 2004-08-19 17:09 . 2008-05-03 14:41 553472 --sha-w- c:\windows\system32\oleaut32.dll 2004-08-19 17:09 . 2008-05-03 14:41 83456 --sha-w- c:\windows\system32\olepro32.dll 2004-08-19 17:09 . 2008-05-03 14:43 30749 --sha-w- c:\windows\system32\vbajet32.dll 1995-09-24 09:02 . 2008-07-05 14:43 243472 --sha-w- c:\windows\system32\vbar2232.dll 1998-05-18 01:06 . 2008-07-05 14:43 368912 --sha-w- c:\windows\system32\vbar332.dll . (((((((((((((((((((((((((((((((((((((((((( SR_Search )))))))))))))))))))))))))))))))))))))))))))))))))))))))) c:\windows\system32\ctfmon .exe [x] [7] 64E41E8FEE655B03E3F19DED21BA5118 15360 \RP279\A0046707.exe c:\windows\system32\nerocheck .exe [x] [-] 3E4C03CEFAD8DE135263236B61A49C90 155648 \RP279\A0046715.exe . ------- Sigcheck ------- [-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2gdr\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2qfe\tcpip.sys [-] 2006-11-11 . 8D8949936913B041C6A0E184FBF1030B . 359808 . . [5.1.2600.2892] . . c:\windows\system32\drivers\tcpip.sys [-] 2004-08-19 . DCAC82B62C56C277F3B050BE9BF14E31 . 14848 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe [-] 2004-08-19 . A431A9194F2BBF4896D1AB0E7048FB3E . 110592 . . [5.1.2600.2180] . . c:\windows\system32\services.exe [-] 2006-12-13 . ABCDE04F13CD6DD777684EC34815ED5F . 58368 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe [-] 2004-08-19 . 31B708976CCD24BECB9FFC4D6C13C509 . 17408 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe [-] 2004-08-19 . 9C15284A3B98AA421597492CF3FC636E . 510464 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2gdr\explorer.exe [-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe [-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2qfe\explorer.exe [-] 2006-11-18 . 321456BE8DF9DA4ACD2306A09549541F . 1037312 . . [6.00.2900.2649] . . c:\windows\Explorer.EXE [-] 2006-12-13 . 0CEF991C04073F5EC8BFD65B961705F1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll c:\windows\system32\wscntfy.exe ... manque !! . ((((((((((((((((((((((((((((( SnapShot@2009-09-29_16.58.14 ))))))))))))))))))))))))))))))))))))))))) . + 2009-09-30 05:04 . 2009-09-30 05:04 16384 c:\windows\Temp\Perflib_Perfdata_5e8.dat + 2009-04-13 15:54 . 2009-09-30 05:04 214881 c:\windows\system32\inetsrv\MetaBase.bin . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-10 397312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "Cloneur Expert Monitor"="c:\program files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [2009-02-04 437675] "Acronis Scheduler2 Service"="c:\program files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [2009-02-04 61440] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "UVS11 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 341488] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-09-15 917504] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-06-23 1519616] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544] c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\ALI\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624] Pinnacle Scheduler.lnk - c:\program files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe [2008-4-30 237568] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoSimpleStartMenu"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 0 (0x0) "NoResolveTrack"= 0 (0x0) "NoSMMyPictures"= 0 (0x0) "MaxRecentDocs"= 15 (0xf) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\GT2002\\gpstrack.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "19793:TCP"= 19793:TCP:BitComet 19793 TCP "19793:UDP"= 19793:UDP:BitComet 19793 UDP R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [24/09/2009 17:35 28544] R3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [30/04/2008 10:12 6400] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [02/03/2009 12:14 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [02/03/2009 12:14 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [02/03/2009 12:14 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [02/03/2009 12:14 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [02/03/2009 12:14 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [02/03/2009 12:14 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [02/03/2009 12:14 115752] . Contenu du dossier 'Tâches planifiées' 2009-09-21 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2009-09-29 c:\windows\Tasks\HPpromotions journeysoftware.job - c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 15:36] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uSearchURL,(Default) = hxxp://www.google.fr/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 LSP: imon.dll DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-09-30 07:23 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:c0,d7,08,f9,31,8e,b0,1c,9a,2e,00,5c,4c,75,7e,de,43,a2,85,b5,f3,b9,51, f0,6f,a7,97,36,c9,e4,1f,81,fe,af,18,db,6d,92,73,80,eb,f6,70,64,14,33,75,52,\ "??"=hex:9c,d9,e4,f4,dd,c3,5d,1d,ea,4c,fa,e2,06,f7,3d,8c [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:87,9b,67,be,f7,4d,c0,6b,40,27,b8,b2,cf,b5,5e,04,c4,ad,d2,a8,bf, e5,5c,47,a8,1c,d9,62,87,f1,23,08,66,e6,50,e5,3e,13,01,80,22,12,4a,0c,b0,43,\ "rkeysecu"=hex:c8,9d,f3,27,d6,13,ee,5b,0c,3f,42,18,e6,bb,ee,f4 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'lsass.exe'(896) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll - - - - - - - > 'explorer.exe'(776) c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\windows\system32\msi.dll . Heure de fin: 2009-09-30 7:26 ComboFix-quarantined-files.txt 2009-09-30 05:25 ComboFix2.txt 2009-09-30 04:55 ComboFix3.txt 2009-09-29 17:06 Avant-CF: 53 565 841 408 octets libres Après-CF: 53 537 345 536 octets libres Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=,1,2,3,4 230 --- E O F --- 2008-05-04 06:01 rapport Hijackthis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 07:27:09, on 30/09/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\IcoSauve.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\svchost.exe C:\Documents and Settings\ALI\Bureau\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [uVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [soundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Pinnacle Scheduler.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/51.28/uploader2.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-2.0.cab O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Gestion d'applications (AppMgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Audio Windows (AudioSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Service de transfert intelligent en arrière-plan (BITS) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Explorateur d'ordinateur (Browser) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe O23 - Service: CryptSvc - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Lanceur de processus serveur DCOM (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Client DHCP (Dhcp) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Gestionnaire de disque logique (dmserver) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Client DNS (Dnscache) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Service de rapport d'erreurs (ERSvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Système d'événements de COM+ (EventSystem) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Compatibilité avec le Changement rapide d'utilisateur (FastUserSwitchingCompatibility) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Aide et support (helpsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Serveur (lanmanserver) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Station de travail (lanmanworkstation) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Assistance TCP/IP NetBIOS (LmHosts) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Ouverture de session réseau (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Connexions réseau (Netman) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: NLA (Network Location Awareness) (Nla) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: Fournisseur de la prise en charge de sécurité LM NT (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Stockage amovible (NtmsSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Services IPSEC (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Emplacement protégé (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Gestionnaire de connexion automatique d'accès distant (RasAuto) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Gestionnaire de connexions d'accès distant (RasMan) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Accès à distance au Registre (RemoteRegistry) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Appel de procédure distante (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Gestionnaire de comptes de sécurité (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Planificateur de tâches (Schedule) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Secondary Logon (seclogon) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Notification d'événement système (SENS) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Pare-feu Windows / Partage de connexion Internet (SharedAccess) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Détection matériel noyau (ShellHWDetection) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Service de restauration système (srservice) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Service de découvertes SSDP (SSDPSRV) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Acquisition d'image Windows (WIA) (stisvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Téléphonie (TapiSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Services Terminal Server (TermService) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Thèmes (Themes) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Client de suivi de lien distribué (TrkWks) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Hôte de périphérique universel Plug-and-Play (upnphost) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Horloge Windows (W32Time) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: WebClient - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Infrastructure de gestion Windows (winmgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Service de numéro de série du lecteur multimédia portable (WmdmPmSN) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Extensions du pilote WMI (Wmi) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: wscsvc - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Mises à jour automatiques (wuauserv) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Configuration automatique sans fil (WZCSVC) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Service d'approvisionnement réseau (xmlprov) - Unknown owner - C:\WINDOWS\System32\svchost.exe -- End of file - 12794 bytes

hug ! bon, encore du mieux, je navigue normalement sans être redirigé intenpestivement ( exoclik mouru ??). J' ai bien suivi tes recommandations, mais j' ai encore des fichiers infectés et verrouillés voici ce que ça donne : à bientôt. rapport Combofix : ComboFix 09-09-28.01 - ALI 29/09/2009 18:46.1.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.510.163 [GMT 2:00] Lancé depuis: c:\documents and settings\ALI\Bureau\bibitte.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\ALI\Application Data\Microsoft\Clip Organizer\mstore10.mgc c:\documents and settings\ALI\Application Data\Microsoft\Clip Organizer\Offic10.MGC c:\recycler\S-1-5-21-1644491937-113007714-725345543-500 c:\windows\Downloaded Program Files\bdcore.dll c:\windows\Downloaded Program Files\libfn.dll c:\windows\Installer\192bc9.msi c:\windows\system32\Cache c:\windows\system32\ctfmon .exe c:\windows\system32\images c:\windows\system32\images\+ DOSSIER UTILISE PAR LE PROGRAMME 'ENREGISTREZ SOUS EDITEUR' c:\windows\system32\images\1.ico c:\windows\system32\images\2.ico c:\windows\system32\images\3.ico c:\windows\system32\images\4.ico c:\windows\system32\images\5.ico c:\windows\system32\images\Flèche bas.ico c:\windows\system32\images\Flèche haut.ico c:\windows\system32\nerocheck .exe c:\windows\system32\test.ttt c:\windows\system32\lsass.exe . . . est infecté!! c:\windows\system32\services.exe . . . est infecté!! c:\windows\system32\svchost.exe . . . est infecté!! c:\windows\system32\spoolsv.exe . . . est infecté!! c:\windows\explorer.exe . . . est infecté!! . ((((((((((((((((((((((((((((( Fichiers créés du 2009-08-28 au 2009-09-29 )))))))))))))))))))))))))))))))))))) . 2009-09-25 07:38 . 2009-09-25 07:38 -------- d-----w- C:\rsit 2009-09-25 07:34 . 2009-09-25 07:34 -------- d-----w- C:\_OTM 2009-09-24 15:35 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys 2009-09-24 15:35 . 2009-09-24 15:35 -------- d-----w- c:\program files\Panda Security 2009-09-22 16:35 . 2009-09-22 16:35 -------- d-----w- c:\documents and settings\ALI\Tracing 2009-09-22 16:33 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2009-09-21 12:18 . 2009-09-21 12:18 -------- d-----w- c:\documents and settings\NetworkService.AUTORITE NT\Local Settings\Application Data\Apple 2009-09-16 17:11 . 2009-09-16 17:11 -------- d-----w- c:\program files\Fichiers communs\Windows Live 2009-09-15 04:45 . 2009-09-15 04:44 502208 ----a-w- c:\windows\system32\drivers\amon.sys 2009-09-15 04:45 . 2009-09-15 04:44 270336 ----a-w- c:\windows\system32\imon.dll 2009-09-11 06:07 . 2009-09-21 14:14 -------- d-----w- c:\program files\IKEA HomePlanner 2009-09-11 06:06 . 2009-09-11 06:06 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-09-09 05:51 . 2009-09-09 05:51 -------- d-----w- c:\documents and settings\ALI\Local Settings\Application Data\WMTools Downloaded Files . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-28 16:11 . 2008-02-22 17:28 -------- d-----w- c:\program files\Eset 2009-09-27 07:17 . 2008-02-17 07:20 -------- d-----w- c:\program files\CCleaner 2009-09-27 06:56 . 2009-08-25 11:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-22 16:34 . 2008-05-11 15:33 60240 ----a-w- c:\documents and settings\ALI\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-10 12:54 . 2009-08-25 13:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 12:53 . 2009-08-25 13:27 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-04 12:39 . 2008-12-21 18:00 -------- d-----w- c:\documents and settings\ALI\Application Data\Apple Computer 2009-09-01 16:24 . 2008-05-28 09:52 -------- d-----w- c:\documents and settings\ALI\Application Data\Canon 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iTunes 2009-08-25 14:31 . 2009-08-25 14:31 -------- d-----w- c:\program files\iPod 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Apple Software Update 2009-08-25 14:30 . 2009-08-25 14:30 -------- d-----w- c:\program files\Fichiers communs\Apple 2009-08-25 11:25 . 2008-12-02 19:16 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP 2009-08-25 08:37 . 2009-08-25 08:37 0 ----a-w- c:\windows\nsreg.dat 2009-08-24 16:56 . 2009-08-24 16:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\STOPzilla! 2009-08-19 05:21 . 2009-08-19 05:21 -------- d-----w- c:\program files\MSSOAP 2009-08-19 05:20 . 2009-08-19 05:20 -------- d-----w- c:\program files\Webroot 2009-07-09 10:16 . 2009-08-25 14:30 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-07-09 10:16 . 2009-08-25 14:30 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll 2006-03-27 17:49 . 2008-04-30 07:32 3809280 ----a-w- c:\program files\Guitools.exe 2006-12-13 12:54 . 2008-05-03 14:38 617472 --sha-w- c:\windows\system32\comctl32.dll 2004-08-19 17:09 . 2008-05-03 14:40 1028096 --sha-w- c:\windows\system32\mfc42.dll 2002-09-06 20:59 . 2008-05-03 14:40 57344 --sha-w- c:\windows\system32\mfc42loc.dll 1995-09-20 14:16 . 2008-07-05 14:43 35088 --sha-w- c:\windows\system32\msjint32.dll 1995-09-20 14:13 . 2008-07-05 14:43 977680 --sha-w- c:\windows\system32\msjt3032.dll 1995-09-20 14:16 . 2008-07-05 14:43 23824 --sha-w- c:\windows\system32\msjter32.dll 2004-08-19 17:09 . 2008-05-03 14:40 413696 --sha-w- c:\windows\system32\msvcp60.dll 2004-08-19 17:09 . 2008-05-03 14:40 343040 --sha-w- c:\windows\system32\msvcrt.dll 2002-09-06 20:59 . 2008-05-03 14:40 253952 --sha-w- c:\windows\system32\msvcrt20.dll 2004-08-19 17:09 . 2008-05-03 14:41 553472 --sha-w- c:\windows\system32\oleaut32.dll 2004-08-19 17:09 . 2008-05-03 14:41 83456 --sha-w- c:\windows\system32\olepro32.dll 2004-08-19 17:09 . 2008-05-03 14:43 30749 --sha-w- c:\windows\system32\vbajet32.dll 1995-09-24 09:02 . 2008-07-05 14:43 243472 --sha-w- c:\windows\system32\vbar2232.dll 1998-05-18 01:06 . 2008-07-05 14:43 368912 --sha-w- c:\windows\system32\vbar332.dll . ------- Sigcheck ------- [-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2gdr\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\sp2qfe\tcpip.sys [-] 2006-11-11 . 8D8949936913B041C6A0E184FBF1030B . 359808 . . [5.1.2600.2892] . . c:\windows\system32\drivers\tcpip.sys [-] 2004-08-19 17:09 . !HASH: COULD NOT OPEN FILE !!!!! . 14848 . . [------] . . c:\windows\system32\lsass.exe [-] 2004-08-19 17:10 . !HASH: COULD NOT OPEN FILE !!!!! . 110592 . . [------] . . c:\windows\system32\services.exe [-] 2006-12-13 . ABCDE04F13CD6DD777684EC34815ED5F . 58368 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe [-] 2004-08-19 17:10 . !HASH: COULD NOT OPEN FILE !!!!! . 17408 . . [------] . . c:\windows\system32\svchost.exe [-] 2004-08-19 17:10 . !HASH: COULD NOT OPEN FILE !!!!! . 510464 . . [------] . . c:\windows\system32\winlogon.exe [-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2gdr\explorer.exe [-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe [-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2qfe\explorer.exe [-] 2006-11-18 . 321456BE8DF9DA4ACD2306A09549541F . 1037312 . . [6.00.2900.2649] . . c:\windows\Explorer.EXE [-] 2006-12-13 . 0CEF991C04073F5EC8BFD65B961705F1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll c:\windows\system32\wscntfy.exe ... manque !! . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-10 397312] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "Cloneur Expert Monitor"="c:\program files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [2009-02-04 437675] "Acronis Scheduler2 Service"="c:\program files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [2009-02-04 61440] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "UVS11 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 341488] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-09-15 917504] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-06-23 1519616] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544] c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\ALI\Menu D‚marrer\Programmes\D‚marrage\ IcoSauve.lnk - c:\windows\system32\IcoSauve.exe [2008-4-30 112128] c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624] Pinnacle Scheduler.lnk - c:\program files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe [2008-4-30 237568] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoSimpleStartMenu"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 0 (0x0) "NoResolveTrack"= 0 (0x0) "NoSMMyPictures"= 0 (0x0) "MaxRecentDocs"= 15 (0xf) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\GT2002\\gpstrack.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "19793:TCP"= 19793:TCP:BitComet 19793 TCP "19793:UDP"= 19793:UDP:BitComet 19793 UDP R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [24/09/2009 17:35 28544] R3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [30/04/2008 10:12 6400] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [02/03/2009 12:14 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [02/03/2009 12:14 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [02/03/2009 12:14 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [02/03/2009 12:14 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [02/03/2009 12:14 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [02/03/2009 12:14 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [02/03/2009 12:14 115752] . Contenu du dossier 'Tâches planifiées' 2009-09-21 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2009-09-27 c:\windows\Tasks\HPpromotions journeysoftware.job - c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 15:36] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uSearchURL,(Default) = hxxp://www.google.fr/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 LSP: imon.dll DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab . - - - - ORPHELINS SUPPRIMES - - - - HKLM-Run-NWEReboot - (no file) HKU-Default-RunOnce-nltide2 - rundll32 advpack.dll AddRemove-eMule - c:\program files\eMule\Uninstall.exe AddRemove-BitTorrent - c:\program files\BitTorrent\uninst.exe AddRemove-BitTorrent DNA - c:\program files\DNA\btdna.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-09-29 18:57 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:c0,d7,08,f9,31,8e,b0,1c,9a,2e,00,5c,4c,75,7e,de,43,a2,85,b5,f3,b9,51, f0,6f,a7,97,36,c9,e4,1f,81,fe,af,18,db,6d,92,73,80,eb,f6,70,64,14,33,75,52,\ "??"=hex:9c,d9,e4,f4,dd,c3,5d,1d,ea,4c,fa,e2,06,f7,3d,8c [HKEY_USERS\S-1-5-21-57989841-1767777339-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:87,9b,67,be,f7,4d,c0,6b,40,27,b8,b2,cf,b5,5e,04,c4,ad,d2,a8,bf, e5,5c,47,a8,1c,d9,62,87,f1,23,08,66,e6,50,e5,3e,13,01,80,22,12,4a,0c,b0,43,\ "rkeysecu"=hex:c8,9d,f3,27,d6,13,ee,5b,0c,3f,42,18,e6,bb,ee,f4 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'lsass.exe'(896) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll - - - - - - - > 'explorer.exe'(2200) c:\windows\system32\msi.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Autres processus actifs ------------------------ . c:\program files\Fichiers communs\Acronis\Schedule2\schedul2.exe c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\system32\rundll32.exe c:\program files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe c:\windows\system32\inetsrv\inetinfo.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Eset\nod32krn.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\snmp.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe c:\program files\HP\Digital Imaging\bin\hpqste08.exe c:\windows\system32\wbem\wmiapsrv.exe . ************************************************************************** . Heure de fin: 2009-09-29 19:06 - La machine a redémarré ComboFix-quarantined-files.txt 2009-09-29 17:06 Avant-CF: 53 692 624 896 octets libres Après-CF: 53 596 880 896 octets libres WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect /bootlogo Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=,1,2,3,4 268 --- E O F --- 2008-05-04 06:01 rapport RSIT : Logfile of random's system information tool 1.06 (written by random/random) Run by ALI at 2009-09-29 19:16:00 Microsoft Windows XP Professionnel Service Pack 2 System drive C: has 51 GB (67%) free of 76 GB Total RAM: 510 MB (32% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:16:02, on 29/09/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\WINDOWS\system32\IcoSauve.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\ALI\Bureau\RSIT.exe C:\Documents and Settings\ALI\Bureau\ALI.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [uVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [soundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Pinnacle Scheduler.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/51.28/uploader2.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-2.0.cab O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Gestion d'applications (AppMgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Audio Windows (AudioSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Service de transfert intelligent en arrière-plan (BITS) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Explorateur d'ordinateur (Browser) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe O23 - Service: CryptSvc - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Lanceur de processus serveur DCOM (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Client DHCP (Dhcp) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Gestionnaire de disque logique (dmserver) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Client DNS (Dnscache) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Service de rapport d'erreurs (ERSvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Système d'événements de COM+ (EventSystem) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Compatibilité avec le Changement rapide d'utilisateur (FastUserSwitchingCompatibility) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Aide et support (helpsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Serveur (lanmanserver) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Station de travail (lanmanworkstation) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Assistance TCP/IP NetBIOS (LmHosts) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Ouverture de session réseau (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Connexions réseau (Netman) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: NLA (Network Location Awareness) (Nla) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: Fournisseur de la prise en charge de sécurité LM NT (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Stockage amovible (NtmsSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Services IPSEC (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Emplacement protégé (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Gestionnaire de connexion automatique d'accès distant (RasAuto) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Gestionnaire de connexions d'accès distant (RasMan) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Accès à distance au Registre (RemoteRegistry) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Appel de procédure distante (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Gestionnaire de comptes de sécurité (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe O23 - Service: Planificateur de tâches (Schedule) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Secondary Logon (seclogon) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Notification d'événement système (SENS) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Pare-feu Windows / Partage de connexion Internet (SharedAccess) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Détection matériel noyau (ShellHWDetection) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Service de restauration système (srservice) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Service de découvertes SSDP (SSDPSRV) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Acquisition d'image Windows (WIA) (stisvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Téléphonie (TapiSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Services Terminal Server (TermService) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Thèmes (Themes) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Client de suivi de lien distribué (TrkWks) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Hôte de périphérique universel Plug-and-Play (upnphost) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Horloge Windows (W32Time) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: WebClient - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Infrastructure de gestion Windows (winmgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Service de numéro de série du lecteur multimédia portable (WmdmPmSN) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Extensions du pilote WMI (Wmi) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: wscsvc - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Mises à jour automatiques (wuauserv) - Unknown owner - C:\WINDOWS\system32\svchost.exe O23 - Service: Configuration automatique sans fil (WZCSVC) - Unknown owner - C:\WINDOWS\System32\svchost.exe O23 - Service: Service d'approvisionnement réseau (xmlprov) - Unknown owner - C:\WINDOWS\System32\svchost.exe -- End of file - 12954 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\HPpromotions journeysoftware.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-10-22 86016] "DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2006-11-12 157592] "Cloneur Expert Monitor"=C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe [2009-02-04 437675] "Acronis Scheduler2 Service"=C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe [2009-02-04 61440] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888] "UVS11 Preload"=C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [2007-03-03 341488] "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840] "SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-07-27 1388544] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-05-26 413696] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-07-13 292128] "nod32kui"=C:\Program Files\Eset\nod32kui.exe [2009-09-15 917504] "Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Sony Ericsson PC Suite"=C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe [2008-07-10 397312] C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe Pinnacle Scheduler.lnk - C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe C:\Documents and Settings\ALI\Menu Démarrer\Programmes\Démarrage IcoSauve.lnk - C:\WINDOWS\system32\IcoSauve.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "SynchronousMachineGroupPolicy"=0 "SynchronousUserGroupPolicy"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=323 "NoStrCmpLogical"=0 "LockTaskbar"=0 "NoResolveTrack"=0 "NoResolveSearch"=0 "NoSMMyPictures"=0 "NoStartMenuMFUprogramsList"=0 "NoUserNameInStartMenu"=0 "MaxRecentDocs"=15 "NoInstrumentation"=0 "MemCheckBoxInRunDlg"=1 "NoSMBalloonTip"=0 "NoDriveAutoRun"=67108863 "NoDrives"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoSimpleStartMenu"= "NoDriveAutoRun"= "NoDriveTypeAutoRun"= "NoDrives"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\GT2002\gpstrack.exe"="C:\Program Files\GT2002\gpstrack.exe:*:Enabled:Gpstrack" "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" ======List of files/folders created in the last 3 months====== 2009-09-29 19:09:25 ----SHD---- C:\RECYCLER 2009-09-29 19:06:24 ----A---- C:\ComboFix.txt 2009-09-29 18:43:45 ----A---- C:\Boot.bak 2009-09-29 18:43:36 ----RASHD---- C:\cmdcons 2009-09-29 18:41:43 ----A---- C:\WINDOWS\zip.exe 2009-09-29 18:41:43 ----A---- C:\WINDOWS\SWXCACLS.exe 2009-09-29 18:41:43 ----A---- C:\WINDOWS\SWSC.exe 2009-09-29 18:41:43 ----A---- C:\WINDOWS\SWREG.exe 2009-09-29 18:41:43 ----A---- C:\WINDOWS\sed.exe 2009-09-29 18:41:43 ----A---- C:\WINDOWS\PEV.exe 2009-09-29 18:41:43 ----A---- C:\WINDOWS\NIRCMD.exe 2009-09-29 18:41:43 ----A---- C:\WINDOWS\grep.exe 2009-09-29 18:41:37 ----D---- C:\WINDOWS\ERDNT 2009-09-29 18:41:11 ----D---- C:\Qoobox 2009-09-27 09:19:02 ----A---- C:\WINDOWS\ntbtlog.txt 2009-09-25 09:38:41 ----D---- C:\rsit 2009-09-25 09:34:23 ----D---- C:\_OTM 2009-09-24 17:35:12 ----D---- C:\Program Files\Panda Security 2009-09-22 18:33:36 ----D---- C:\WINDOWS\system32\DirectX 2009-09-22 18:33:36 ----A---- C:\WINDOWS\system32\d3dx9_32.dll 2009-09-22 18:33:02 ----HDC---- C:\WINDOWS\$NtUninstallWIC$ 2009-09-16 19:11:15 ----D---- C:\Program Files\Fichiers communs\Windows Live 2009-09-15 06:45:02 ----A---- C:\WINDOWS\system32\imon.dll 2009-09-11 08:07:09 ----D---- C:\Program Files\IKEA HomePlanner 2009-09-11 08:06:36 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard 2009-08-25 16:31:23 ----D---- C:\Program Files\iPod 2009-08-25 16:31:20 ----D---- C:\Program Files\iTunes 2009-08-25 16:30:55 ----D---- C:\Program Files\Apple Software Update 2009-08-25 16:30:40 ----A---- C:\WINDOWS\system32\usbaaplrc.dll 2009-08-25 16:30:22 ----D---- C:\Program Files\Fichiers communs\Apple 2009-08-25 13:33:05 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-08-25 13:30:34 ----SHD---- C:\WINDOWS\CSC 2009-08-25 11:47:41 ----A---- C:\Documents and Settings\ALI\Application Data\install.txt 2009-08-25 09:01:44 ----D---- C:\WINDOWS\system32\CatRoot2 2009-08-25 08:34:12 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-08-24 18:56:17 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla! 2009-08-19 07:21:41 ----D---- C:\Program Files\MSSOAP 2009-08-19 07:20:29 ----D---- C:\Program Files\Webroot ======List of files/folders modified in the last 3 months====== 2009-09-29 19:09:38 ----D---- C:\WINDOWS\Prefetch 2009-09-29 19:06:29 ----D---- C:\WINDOWS\system32\drivers 2009-09-29 19:06:29 ----D---- C:\WINDOWS\system32 2009-09-29 19:06:27 ----D---- C:\WINDOWS\Temp 2009-09-29 19:02:33 ----D---- C:\WINDOWS\system32\inetsrv 2009-09-29 18:58:14 ----D---- C:\WINDOWS 2009-09-29 18:58:14 ----A---- C:\WINDOWS\system.ini 2009-09-29 18:56:23 ----D---- C:\WINDOWS\system32\config 2009-09-29 18:55:08 ----SHD---- C:\WINDOWS\Installer 2009-09-29 18:55:08 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-09-29 18:50:38 ----D---- C:\WINDOWS\AppPatch 2009-09-29 18:50:20 ----D---- C:\Program Files\Fichiers communs 2009-09-29 18:43:45 ----RASH---- C:\boot.ini 2009-09-29 18:32:56 ----A---- C:\WINDOWS\winamp.ini 2009-09-29 17:49:14 ----D---- C:\WINDOWS\system32\NtmsData 2009-09-28 18:11:34 ----D---- C:\Program Files\Eset 2009-09-27 09:27:08 ----D---- C:\WINDOWS\Debug 2009-09-27 09:26:36 ----D---- C:\WINDOWS\ehome 2009-09-27 09:17:20 ----D---- C:\Program Files\CCleaner 2009-09-26 12:01:33 ----RD---- C:\Program Files 2009-09-24 17:35:12 ----HD---- C:\WINDOWS\inf 2009-09-22 20:39:22 ----D---- C:\WINDOWS\Minidump 2009-09-22 20:34:36 ----D---- C:\Config.Msi 2009-09-22 18:50:57 ----SD---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft 2009-09-22 18:50:57 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared 2009-09-22 18:48:32 ----RSD---- C:\WINDOWS\assembly 2009-09-22 18:46:51 ----D---- C:\WINDOWS\WinSxS 2009-09-22 18:30:40 ----RSD---- C:\WINDOWS\Fonts 2009-09-04 14:39:22 ----D---- C:\Documents and Settings\ALI\Application Data\Apple Computer 2009-09-01 18:26:01 ----A---- C:\WINDOWS\CSTBox.INI 2009-09-01 18:24:04 ----D---- C:\Documents and Settings\ALI\Application Data\Canon 2009-08-27 20:13:50 ----A---- C:\WINDOWS\ModemLog_SoftV92 Data Fax Modem.txt 2009-08-25 16:31:00 ----SD---- C:\WINDOWS\Tasks 2009-08-25 16:30:45 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-08-25 14:03:42 ----D---- C:\WINDOWS\security 2009-08-25 13:25:52 ----AD---- C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP 2009-08-25 13:23:42 ----D---- C:\Program Files\Mozilla Firefox 2009-08-25 09:02:46 ----D---- C:\WINDOWS\system32\CatRoot 2009-08-25 08:00:12 ----D---- C:\WINDOWS\Registration 2009-08-19 18:02:13 ----D---- C:\Documents and Settings 2009-08-19 07:22:43 ----A---- C:\WINDOWS\win.ini ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-12-13 40320] R1 sf;SFI Service; C:\WINDOWS\system32\drivers\sf.sys [2004-08-28 33995] R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2002-09-06 12032] R2 AMON;AMON; \??\C:\WINDOWS\system32\drivers\amon.sys [] R2 Aspi32;Aspi32; C:\WINDOWS\System32\drivers\aspi32.sys [1999-09-10 25244] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-08-04 11868] R2 ROB_A;Pinnacle WDM PCTV Audio Capture; C:\WINDOWS\system32\DRIVERS\rob_a.sys [2003-02-10 17664] R2 ROB_V;Pinnacle WDM PCTV Video Capture; C:\WINDOWS\system32\drivers\rob_v.sys [2003-04-11 125568] R2 tifsfilter;Acronis TrueImage FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2009-02-04 28768] R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2004-05-17 133200] R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2006-12-13 60800] R3 catchme;catchme; \??\C:\bibitte\catchme.sys [] R3 E100B;Intel® PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2006-10-31 165760] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400] R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSFDPSP2.sys [2004-08-04 1041536] R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFBS2S2.sys [2004-08-04 220032] R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2006-12-13 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-10-22 3994624] R3 pctvvbi;PCTVVBI; C:\WINDOWS\system32\DRIVERS\pctvvbi.sys [2002-11-11 6400] R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-06-17 14604] R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-04-26 381056] R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2004-09-01 259648] R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2006-12-13 26624] R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2006-12-13 57600] R3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2006-12-13 20480] R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSFCXTS2.sys [2004-08-04 685056] S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys [] S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys [] S3 ahum2u14;ahum2u14; C:\WINDOWS\system32\drivers\ahum2u14.sys [] S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 grmnusb;grmnusb; C:\WINDOWS\system32\drivers\grmnusb.sys [2007-08-01 8320] S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-03-08 51120] S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-03-08 16496] S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-03-08 21744] S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100] S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2006-12-13 10880] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s0016obex.sys [2008-05-16 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 115752] S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2006-12-13 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2006-12-13 15360] S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-07-09 39424] S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856] S3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2006-12-13 26496] S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe [2009-02-04 151552] R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-07-09 144712] R2 Capture Device Service;Capture Device Service; C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe [2007-03-06 198168] R2 IISADMIN;Administration IIS; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-19 15872] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984] R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2009-09-15 495616] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-10-22 159810] R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP); C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-19 15872] R2 SNMP;Service SNMP; C:\WINDOWS\System32\snmp.exe [2004-08-19 32768] R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056] R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe [2007-03-03 67056] R2 W3SVC;Publication World Wide Web; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-19 15872] S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120] S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496] S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 SNMPTRAP;Service d'interruption SNMP; C:\WINDOWS\System32\snmptrap.exe [2004-08-19 8704] S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016] -----------------EOF-----------------

salut, bon voilà c fait ! autre point, mon antivirus NOD 32 à détecté les fichiers infectés notamment, j'ai la possibilité de le supprimer mais après redémarrage, il me les signalent comme encore présent (??), par contre il a apparemment supprimé celui-ci: \\?\globalroot\systemroot\system32\gxvxcfskpmbpdxlllnrjftmgvxfuxptofjefv.dll (Trojan.Agent) . je te joins les deux rapports et comme tu écris : à suivre ...... rapport Malwarebytes' : Malwarebytes' Anti-Malware 1.41 Version de la base de données: 2867 Windows 5.1.2600 Service Pack 2 28/09/2009 18:55:35 mbam-log-2009-09-28 (18-55-35).txt Type de recherche: Examen rapide Eléments examinés: 122862 Temps écoulé: 6 minute(s), 20 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 0 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): (Aucun élément nuisible détecté) RAPPORT NOD 32: Date et heure Module Objet Nom Menace Action Utilisateur Info 28/09/2009 19:01:13 AMON fichier C:\WINDOWS\SYSTEM32\WINLOGON.EXE Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier. 28/09/2009 18:55:20 AMON fichier C:\WINDOWS\system32\Winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 28/09/2009 18:55:18 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 28/09/2009 18:55:14 AMON fichier C:\WINDOWS\system32\Services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 28/09/2009 18:55:12 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 28/09/2009 18:52:50 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 28/09/2009 18:52:48 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 28/09/2009 18:52:46 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 28/09/2009 18:52:38 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 28/09/2009 18:49:45 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus nettoyé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 28/09/2009 18:49:39 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus mis en Quarantaine - nettoyé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 28/09/2009 18:49:31 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus mis en Quarantaine - supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 28/09/2009 18:49:09 AMON fichier C:\WINDOWS\SYSTEM32\WINLOGON.EXE Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier. 28/09/2009 18:48:53 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus nettoyé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:49 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:48 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:45 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:43 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:42 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:41 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:40 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:38 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:37 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:36 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:34 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:32 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:29 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:25 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:48:23 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\iPod\bin\iPodService.exe. 28/09/2009 18:47:58 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:47:58 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\iTunes\iTunesHelper.exe. 28/09/2009 18:39:09 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:39:04 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\notepad.exe. 28/09/2009 18:30:42 AMON fichier C:\WINDOWS\SYSTEM32\WINLOGON.EXE Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier. 28/09/2009 18:29:49 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:29:14 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:28:55 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:28:51 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:28:30 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:27:58 AMON fichier C:\WINDOWS\SYSTEM32\WINLOGON.EXE Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier. 28/09/2009 18:27:54 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:20:32 Kernel fichier c:\windows\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus L'alerte a été générée durant le contrôle des fichiers au démarrage. 28/09/2009 18:20:09 Kernel fichier c:\windows\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus L'alerte a été générée durant le contrôle des fichiers au démarrage. 28/09/2009 18:19:53 Kernel fichier c:\windows\system32\services.exe Win32/TrojanProxy.Agent.NCI virus L'alerte a été générée durant le contrôle des fichiers au démarrage. 28/09/2009 18:19:46 Kernel fichier c:\windows\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus L'alerte a été générée durant le contrôle des fichiers au démarrage. 28/09/2009 18:14:00 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Winamp\winamp.exe. 28/09/2009 18:13:43 AMON fichier C:\WINDOWS\SYSTEM32\WINLOGON.EXE Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier. 28/09/2009 18:11:52 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus mis en Quarantaine AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:11:45 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus mis en Quarantaine AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:11:40 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:11:36 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus mis en Quarantaine - supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:11:12 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:11:10 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:11:09 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:11:04 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:11:02 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:10:58 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:10:56 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\wbem\wmiapsrv.exe. 28/09/2009 18:10:55 AMON fichier C:\WINDOWS\System32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:10:48 AMON fichier C:\WINDOWS\SYSTEM32\WINLOGON.EXE Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier. 28/09/2009 18:10:45 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\iPod\bin\iPodService.exe. 28/09/2009 18:10:37 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe. 28/09/2009 18:10:30 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:10:29 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\iTunes\iTunesHelper.exe. 28/09/2009 18:08:57 AMON fichier C:\WINDOWS\SYSTEM32\WINLOGON.EXE Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier. 28/09/2009 18:08:53 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:08:52 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:08:51 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:08:49 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:08:45 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:08:43 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:08:40 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:08:38 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:08:32 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:08:28 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe. 28/09/2009 18:08:14 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\iPod\bin\iPodService.exe. 28/09/2009 18:08:05 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:08:04 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe. 28/09/2009 18:06:40 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:06:39 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:06:37 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:06:34 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus nettoyé (après le prochain redémarrage) Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 28/09/2009 18:05:34 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:05:33 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:05:33 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SERVICE LOCAL Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\System32\alg.exe. 28/09/2009 18:05:32 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:05:31 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:05:31 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:05:30 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\wbem\wmiapsrv.exe. 28/09/2009 18:05:24 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\spoolsv.exe. 28/09/2009 18:05:22 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:05:22 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe. 28/09/2009 18:04:04 AMON fichier C:\WINDOWS\SYSTEM32\WINLOGON.EXE Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\wuauclt.exe. 28/09/2009 18:04:02 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:03:59 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:03:57 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:03:50 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:03:45 AMON fichier C:\WINDOWS\System32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:03:43 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:03:40 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:03:34 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:03:31 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:03:28 AMON fichier C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:03:25 AMON fichier C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Java\jre6\bin\jqs.exe. 28/09/2009 18:03:21 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus supprimé (après le prochain redémarrage) AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\iPod\bin\iPodService.exe. 28/09/2009 18:03:02 AMON fichier C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus AUTORITE NT\SYSTEM Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\WINDOWS\system32\services.exe. 28/09/2009 18:03:01 AMON fichier C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\iTunes\iTunesHelper.exe. 28/09/2009 17:57:16 AMON fichier C:\WINDOWS\system32\Drivers\gxvxckyxmbfamrqhemovhemqeltwbeeveohxr.sys Win32/TrojanClicker.Agent.NGF cheval de Troie supprimé ALOU\ALI Un événement s'est produit lors de la tentative d'accès au fichier par l'application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe. 26/09/2009 18:26:04 Kernel fichier \\?\globalroot\systemroot\system32\gxvxcfskpmbpdxlllnrjftmgvxfuxptofjefv.dll Win32/TrojanClicker.Agent.NGF cheval de Troie L'alerte a été générée durant le contrôle des fichiers au démarrage.

bonjour, on dirait qu' il ya du mieux, j' arrive à naviguer sur ce site normalement, alors , qu' avant la derniére citation ça "pédalait" sévère.. voici les rapports, ( 4 fichiers infectés et supprimés). Bien à toi. rapport OTM All processes killed ========== SERVICES/DRIVERS ========== Service\Driver a5mm1fss not found. Service\Driver a5mm1fss not found. ========== REGISTRY ========== HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLs"|”” /E : value set successfully! Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\uMOlFo deleted successfully. Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Documents and Settings\ALI\Local Settings\Temp\IXP001.TMP\garmin.exe deleted successfully. Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Documents and Settings\ALI\Local Settings\Temp\IXP000.TMP\garmin.exe deleted successfully. Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Documents and Settings\ALI\ddmgtf.exe deleted successfully. ========== FILES ========== File/Folder C:\Documents and Settings\ALI\Local Settings\Temp\IXP000.TMP not found. File/Folder C:\Documents and Settings\ALI\ddmgtf.exe not found. DllUnregisterServer procedure not found in C:\WINDOWS\System32\amw.dll C:\WINDOWS\System32\amw.dll NOT unregistered. File move failed. C:\WINDOWS\System32\amw.dll scheduled to be moved on reboot. ========== COMMANDS ========== [EMPTYTEMP] User: Administrateur ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes User: ALI ->Temp folder emptied: 7323033 bytes ->Temporary Internet Files folder emptied: 15520596 bytes ->Java cache emptied: 0 bytes User: All Users User: All Users.WINDOWS User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User.WINDOWS ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.AUTORITE NT ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService.AUTORITE NT\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.AUTORITE NT ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\NetworkService.AUTORITE NT\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 147456 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 21,99 mb OTM by OldTimer - Version 3.0.0.6 log created on 09272009_085858 Files moved on Reboot... DllUnregisterServer procedure not found in C:\WINDOWS\System32\amw.dll C:\WINDOWS\System32\amw.dll NOT unregistered. File move failed. C:\WINDOWS\System32\amw.dll scheduled to be moved on reboot. Registry entries deleted on Reboot... rapport RSIT : Logfile of random's system information tool 1.06 (written by random/random) Run by ALI at 2009-09-27 09:36:13 Microsoft Windows XP Professionnel Service Pack 2 System drive C: has 51 GB (67%) free of 76 GB Total RAM: 510 MB (33% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:36:19, on 27/09/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe C:\WINDOWS\system32\IcoSauve.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\ALI\Bureau\RSIT.exe C:\Documents and Settings\ALI\Bureau\ALI.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [soundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [uVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [soundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-19\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Pinnacle Scheduler.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/51.28/uploader2.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-2.0.cab O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O20 - AppInit_DLLs: ”” O21 - SSODL: uMOlFo - {2496A76E-8E3C-0DC4-A958-343C5BE15689} - C:\WINDOWS\system32\amw.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 8608 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\HPpromotions journeysoftware.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-10-22 86016] "NWEReboot"= [] "DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2006-11-12 157592] "Cloneur Expert Monitor"=C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe [2009-02-04 437675] "Acronis Scheduler2 Service"=C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe [2009-02-04 61440] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888] "SoundMax"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2004-08-06 860160] "UVS11 Preload"=C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [2007-03-03 341488] "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840] "SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-07-27 1388544] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-05-26 413696] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-07-13 292128] "nod32kui"=C:\Program Files\Eset\nod32kui.exe [2009-09-15 917504] "Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-19 15360] "Sony Ericsson PC Suite"=C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe [2008-07-10 397312] C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe Pinnacle Scheduler.lnk - C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe C:\Documents and Settings\ALI\Menu Démarrer\Programmes\Démarrage IcoSauve.lnk - C:\WINDOWS\system32\IcoSauve.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="””" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] uMOlFo - {2496A76E-8E3C-0DC4-A958-343C5BE15689} - C:\WINDOWS\system32\amw.dll [2006-12-13 32768] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "notification packages"= scecli [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "SynchronousMachineGroupPolicy"=0 "SynchronousUserGroupPolicy"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 "NoStrCmpLogical"=0 "LockTaskbar"=0 "NoResolveTrack"=0 "NoResolveSearch"=0 "NoRun"=0 "NoFind"=0 "NoSMMyPictures"=0 "NoStartMenuMFUprogramsList"=0 "NoUserNameInStartMenu"=0 "NoStartMenuMorePrograms"=0 "MaxRecentDocs"=15 "NoInstrumentation"=0 "MemCheckBoxInRunDlg"=1 "NoSMBalloonTip"=0 "NoActiveDesktopChanges"=0 "NoSetActiveDesktop"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoSimpleStartMenu"= "NoSetActiveDesktop"= "NoActiveDesktopChanges"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\GT2002\gpstrack.exe"="C:\Program Files\GT2002\gpstrack.exe:*:Enabled:Gpstrack" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" ======List of files/folders created in the last 3 months====== 2009-09-27 09:19:02 ----A---- C:\WINDOWS\ntbtlog.txt 2009-09-25 09:38:41 ----D---- C:\rsit 2009-09-25 09:34:23 ----D---- C:\_OTM 2009-09-24 17:35:12 ----D---- C:\Program Files\Panda Security 2009-09-22 18:33:36 ----D---- C:\WINDOWS\system32\DirectX 2009-09-22 18:33:36 ----A---- C:\WINDOWS\system32\d3dx9_32.dll 2009-09-22 18:33:02 ----HDC---- C:\WINDOWS\$NtUninstallWIC$ 2009-09-16 19:11:15 ----D---- C:\Program Files\Fichiers communs\Windows Live 2009-09-15 06:45:02 ----A---- C:\WINDOWS\system32\imon.dll 2009-09-11 08:07:09 ----D---- C:\Program Files\IKEA HomePlanner 2009-09-11 08:06:36 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard 2009-08-25 16:31:23 ----D---- C:\Program Files\iPod 2009-08-25 16:31:20 ----D---- C:\Program Files\iTunes 2009-08-25 16:30:55 ----D---- C:\Program Files\Apple Software Update 2009-08-25 16:30:40 ----A---- C:\WINDOWS\system32\usbaaplrc.dll 2009-08-25 16:30:22 ----D---- C:\Program Files\Fichiers communs\Apple 2009-08-25 13:33:05 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-08-25 13:30:34 ----SHD---- C:\WINDOWS\CSC 2009-08-25 11:47:41 ----A---- C:\Documents and Settings\ALI\Application Data\install.txt 2009-08-25 09:01:44 ----D---- C:\WINDOWS\system32\CatRoot2 2009-08-25 08:34:12 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-08-24 18:56:17 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla! 2009-08-19 07:21:41 ----D---- C:\Program Files\MSSOAP 2009-08-19 07:20:29 ----D---- C:\Program Files\Webroot ======List of files/folders modified in the last 3 months====== 2009-09-27 09:31:15 ----D---- C:\WINDOWS\system32\inetsrv 2009-09-27 09:28:48 ----D---- C:\WINDOWS\Temp 2009-09-27 09:27:28 ----D---- C:\WINDOWS 2009-09-27 09:27:23 ----D---- C:\WINDOWS\system32\NtmsData 2009-09-27 09:27:08 ----D---- C:\WINDOWS\Debug 2009-09-27 09:26:36 ----D---- C:\WINDOWS\system32\drivers 2009-09-27 09:26:05 ----D---- C:\WINDOWS\system32 2009-09-27 09:17:37 ----D---- C:\WINDOWS\Prefetch 2009-09-27 09:17:20 ----D---- C:\Program Files\CCleaner 2009-09-26 19:03:00 ----A---- C:\WINDOWS\winamp.ini 2009-09-26 12:01:33 ----RD---- C:\Program Files 2009-09-24 17:35:12 ----HD---- C:\WINDOWS\inf 2009-09-24 17:34:52 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-09-22 20:39:22 ----D---- C:\WINDOWS\Minidump 2009-09-22 20:34:36 ----D---- C:\Program Files\Eset 2009-09-22 20:34:36 ----D---- C:\Config.Msi 2009-09-22 18:50:57 ----SHD---- C:\WINDOWS\Installer 2009-09-22 18:50:57 ----SD---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft 2009-09-22 18:50:57 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared 2009-09-22 18:48:32 ----RSD---- C:\WINDOWS\assembly 2009-09-22 18:46:51 ----D---- C:\WINDOWS\WinSxS 2009-09-22 18:30:40 ----RSD---- C:\WINDOWS\Fonts 2009-09-16 19:11:15 ----D---- C:\Program Files\Fichiers communs 2009-09-04 14:39:22 ----D---- C:\Documents and Settings\ALI\Application Data\Apple Computer 2009-09-01 18:26:01 ----A---- C:\WINDOWS\CSTBox.INI 2009-09-01 18:24:04 ----D---- C:\Documents and Settings\ALI\Application Data\Canon 2009-08-27 20:13:50 ----A---- C:\WINDOWS\ModemLog_SoftV92 Data Fax Modem.txt 2009-08-25 16:31:00 ----SD---- C:\WINDOWS\Tasks 2009-08-25 16:30:45 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-08-25 14:03:42 ----D---- C:\WINDOWS\security 2009-08-25 13:25:52 ----AD---- C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP 2009-08-25 13:23:42 ----D---- C:\Program Files\Mozilla Firefox 2009-08-25 09:02:46 ----D---- C:\WINDOWS\system32\CatRoot 2009-08-25 08:00:12 ----D---- C:\WINDOWS\Registration 2009-08-19 18:02:13 ----D---- C:\Documents and Settings 2009-08-19 07:22:43 ----A---- C:\WINDOWS\win.ini ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-12-13 40320] R1 sf;SFI Service; C:\WINDOWS\system32\drivers\sf.sys [2004-08-28 33995] R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2002-09-06 12032] R2 AMON;AMON; \??\C:\WINDOWS\system32\drivers\amon.sys [] R2 Aspi32;Aspi32; C:\WINDOWS\System32\drivers\aspi32.sys [1999-09-10 25244] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-08-04 11868] R2 ROB_A;Pinnacle WDM PCTV Audio Capture; C:\WINDOWS\system32\DRIVERS\rob_a.sys [2003-02-10 17664] R2 ROB_V;Pinnacle WDM PCTV Video Capture; C:\WINDOWS\system32\drivers\rob_v.sys [2003-04-11 125568] R2 tifsfilter;Acronis TrueImage FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2009-02-04 28768] R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2004-05-17 133200] R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2006-12-13 60800] R3 E100B;Intel® PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2006-10-31 165760] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400] R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSFDPSP2.sys [2004-08-04 1041536] R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFBS2S2.sys [2004-08-04 220032] R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2006-12-13 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-10-22 3994624] R3 pctvvbi;PCTVVBI; C:\WINDOWS\system32\DRIVERS\pctvvbi.sys [2002-11-11 6400] R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-06-17 14604] R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-04-26 381056] R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2004-09-01 259648] R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2006-12-13 26624] R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2006-12-13 57600] R3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2006-12-13 20480] R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSFCXTS2.sys [2004-08-04 685056] S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys [] S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys [] S3 a9gg4g0v;a9gg4g0v; C:\WINDOWS\system32\drivers\a9gg4g0v.sys [] S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 grmnusb;grmnusb; C:\WINDOWS\system32\drivers\grmnusb.sys [2007-08-01 8320] S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-03-08 51120] S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-03-08 16496] S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-03-08 21744] S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100] S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2006-12-13 10880] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s0016obex.sys [2008-05-16 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 115752] S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2006-12-13 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2006-12-13 15360] S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-07-09 39424] S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856] S3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2006-12-13 26496] S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe [2009-02-04 151552] R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-07-09 144712] R2 Capture Device Service;Capture Device Service; C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe [2007-03-06 198168] R2 IISADMIN;Administration IIS; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-19 15872] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984] R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2009-09-15 495616] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-10-22 159810] R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP); C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-19 15872] R2 SNMP;Service SNMP; C:\WINDOWS\System32\snmp.exe [2004-08-19 32768] R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056] R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe [2007-03-03 67056] R2 W3SVC;Publication World Wide Web; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-19 15872] R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496] S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120] S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 SNMPTRAP;Service d'interruption SNMP; C:\WINDOWS\System32\snmptrap.exe [2004-08-19 8704] S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016] -----------------EOF----------------- rapport antimalware : Malwarebytes' Anti-Malware 1.41 Version de la base de données: 2864 Windows 5.1.2600 Service Pack 2 27/09/2009 09:24:49 mbam-log-2009-09-27 (09-24-45).txt Type de recherche: Examen rapide Eléments examinés: 122162 Temps écoulé: 5 minute(s), 19 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 1 Clé(s) du Registre infectée(s): 1 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 2 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): \\?\globalroot\systemroot\system32\gxvxcfskpmbpdxlllnrjftmgvxfuxptofjefv.dll (Trojan.Agent) -> No action taken. Clé(s) du Registre infectée(s): HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\gxvxcserv.sys (Trojan.Agent) -> No action taken. Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): \\?\globalroot\systemroot\system32\gxvxcfskpmbpdxlllnrjftmgvxfuxptofjefv.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\gxvxccounter (Trojan.DNSChanger) -> No action taken.

elle est toujours là la petite bête ! ( ??) merci de ton aide.

voici, All processes killed ========== SERVICES/DRIVERS ========== Service\Driver a4s9b2v1 not found. Service\Driver a4s9b2v1 not found. ========== REGISTRY ========== HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\\"Authentication Packages"|hex(7):6d,73,76,31,5f,30,00,00 /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLs"|”” /E : value set successfully! Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\uMOlFo deleted successfully. Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{25cf0c22-c2ef-11dd-a6e5-0007e962e558}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25cf0c22-c2ef-11dd-a6e5-0007e962e558}\ not found. Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Program Files\DNA\btdna.exe not found. Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Program Files\BitTorrent\bittorrent.exe not found. Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\system32\xvs.exe not found. ========== FILES ========== DllUnregisterServer procedure not found in C:\WINDOWS\System32\amw.dll C:\WINDOWS\System32\amw.dll NOT unregistered. File move failed. C:\WINDOWS\System32\amw.dll scheduled to be moved on reboot. File/Folder C:\WINDOWS\system32\drivers\a4s9b2v1.sys not found. File/Folder C:\WINDOWS\system32\xvs.exe not found. File/Folder C:\Program Files\DNA not found. File/Folder C:\Program Files\BitTorrent not found. File/Folder C:\Program Files\eMule not found. File/Folder C:\Documents and Settings\ALI\Application Data\BitTorrent not found. File/Folder C:\Documents and Settings\ALI\Application Data\DNA not found. File/Folder C:\Documents and Settings\ALI\Application Data\eMule not found. ========== COMMANDS ========== [EMPTYTEMP] User: Administrateur ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes User: ALI ->Temp folder emptied: 9038 bytes ->Temporary Internet Files folder emptied: 1094864 bytes ->Java cache emptied: 0 bytes User: All Users User: All Users.WINDOWS User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User.WINDOWS ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.AUTORITE NT ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService.AUTORITE NT\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33237 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.AUTORITE NT ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\NetworkService.AUTORITE NT\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_23c.dat scheduled to be deleted on reboot. Windows Temp folder emptied: 49152 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 1,16 mb OTM by OldTimer - Version 3.0.0.6 log created on 09262009_122128 Files moved on Reboot... DllUnregisterServer procedure not found in C:\WINDOWS\System32\amw.dll C:\WINDOWS\System32\amw.dll NOT unregistered. File move failed. C:\WINDOWS\System32\amw.dll scheduled to be moved on reboot. File C:\WINDOWS\temp\Perflib_Perfdata_23c.dat not found! Registry entries deleted on Reboot... le rapport RSIT : Logfile of random's system information tool 1.06 (written by random/random) Run by ALI at 2009-09-26 12:28:43 Microsoft Windows XP Professionnel Service Pack 2 System drive C: has 51 GB (67%) free of 76 GB Total RAM: 510 MB (32% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:28:50, on 26/09/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\notepad.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe C:\WINDOWS\system32\IcoSauve.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\ALI\Bureau\RSIT.exe C:\Documents and Settings\ALI\Bureau\ALI.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [soundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [uVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [soundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-19\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Pinnacle Scheduler.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/51.28/uploader2.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-2.0.cab O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O20 - AppInit_DLLs: ”” O21 - SSODL: uMOlFo - {2496A76E-8E3C-0DC4-A958-343C5BE15689} - C:\WINDOWS\System32\amw.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 8478 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\HPpromotions journeysoftware.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-10-22 86016] "NWEReboot"= [] "DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2006-11-12 157592] "Cloneur Expert Monitor"=C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe [2009-02-04 437675] "Acronis Scheduler2 Service"=C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe [2009-02-04 61440] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888] "SoundMax"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2004-08-06 860160] "UVS11 Preload"=C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [2007-03-03 341488] "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840] "SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-07-27 1388544] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-05-26 413696] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-07-13 292128] "nod32kui"=C:\Program Files\Eset\nod32kui.exe [2009-09-15 917504] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-19 15360] "Sony Ericsson PC Suite"=C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe [2008-07-10 397312] C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe Pinnacle Scheduler.lnk - C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe C:\Documents and Settings\ALI\Menu Démarrer\Programmes\Démarrage IcoSauve.lnk - C:\WINDOWS\system32\IcoSauve.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="””" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] uMOlFo - {2496A76E-8E3C-0DC4-A958-343C5BE15689} - C:\WINDOWS\System32\amw.dll [2006-12-13 32768] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "notification packages"= scecli [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "SynchronousMachineGroupPolicy"=0 "SynchronousUserGroupPolicy"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 "NoStrCmpLogical"=0 "LockTaskbar"=0 "NoResolveTrack"=0 "NoResolveSearch"=0 "NoRun"=0 "NoFind"=0 "NoSMMyPictures"=0 "NoStartMenuMFUprogramsList"=0 "NoUserNameInStartMenu"=0 "NoStartMenuMorePrograms"=0 "MaxRecentDocs"=15 "NoInstrumentation"=0 "MemCheckBoxInRunDlg"=1 "NoSMBalloonTip"=0 "NoActiveDesktopChanges"=0 "NoSetActiveDesktop"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoSimpleStartMenu"= "NoSetActiveDesktop"= "NoActiveDesktopChanges"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\GT2002\gpstrack.exe"="C:\Program Files\GT2002\gpstrack.exe:*:Enabled:Gpstrack" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\Documents and Settings\ALI\Local Settings\Temp\IXP001.TMP\garmin.exe"="C:\Documents and Settings\ALI\Local Settings\Temp\IXP001.TMP\garmin.exe:*:Enabled:Windows Messanger" "C:\Documents and Settings\ALI\Local Settings\Temp\IXP000.TMP\garmin.exe"="C:\Documents and Settings\ALI\Local Settings\Temp\IXP000.TMP\garmin.exe:*:Enabled:Windows Messanger" "C:\Documents and Settings\ALI\ddmgtf.exe"="C:\Documents and Settings\ALI\ddmgtf.exe:*:Enabled:ENABLE" "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" ======List of files/folders created in the last 3 months====== 2009-09-25 09:38:41 ----D---- C:\rsit 2009-09-25 09:34:23 ----D---- C:\_OTM 2009-09-24 17:35:12 ----D---- C:\Program Files\Panda Security 2009-09-22 20:39:52 ----A---- C:\WINDOWS\ntbtlog.txt 2009-09-22 18:33:36 ----D---- C:\WINDOWS\system32\DirectX 2009-09-22 18:33:36 ----A---- C:\WINDOWS\system32\d3dx9_32.dll 2009-09-22 18:33:02 ----HDC---- C:\WINDOWS\$NtUninstallWIC$ 2009-09-16 19:11:15 ----D---- C:\Program Files\Fichiers communs\Windows Live 2009-09-15 06:45:02 ----A---- C:\WINDOWS\system32\imon.dll 2009-09-11 08:07:09 ----D---- C:\Program Files\IKEA HomePlanner 2009-09-11 08:06:36 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard 2009-08-25 16:31:23 ----D---- C:\Program Files\iPod 2009-08-25 16:31:20 ----D---- C:\Program Files\iTunes 2009-08-25 16:30:55 ----D---- C:\Program Files\Apple Software Update 2009-08-25 16:30:40 ----A---- C:\WINDOWS\system32\usbaaplrc.dll 2009-08-25 16:30:22 ----D---- C:\Program Files\Fichiers communs\Apple 2009-08-25 13:33:05 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-08-25 13:30:34 ----SHD---- C:\WINDOWS\CSC 2009-08-25 11:47:41 ----A---- C:\Documents and Settings\ALI\Application Data\install.txt 2009-08-25 09:01:44 ----D---- C:\WINDOWS\system32\CatRoot2 2009-08-25 08:34:12 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-08-24 18:56:17 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla! 2009-08-19 07:21:41 ----D---- C:\Program Files\MSSOAP 2009-08-19 07:20:29 ----D---- C:\Program Files\Webroot ======List of files/folders modified in the last 3 months====== 2009-09-26 12:26:38 ----D---- C:\WINDOWS\system32\inetsrv 2009-09-26 12:23:50 ----D---- C:\WINDOWS\system32\NtmsData 2009-09-26 12:21:34 ----D---- C:\WINDOWS\Temp 2009-09-26 12:01:33 ----RD---- C:\Program Files 2009-09-26 08:57:10 ----A---- C:\WINDOWS\winamp.ini 2009-09-26 08:00:01 ----D---- C:\WINDOWS\Prefetch 2009-09-25 11:24:10 ----D---- C:\WINDOWS 2009-09-25 09:35:54 ----D---- C:\WINDOWS\system32 2009-09-24 17:35:21 ----D---- C:\WINDOWS\system32\drivers 2009-09-24 17:35:12 ----HD---- C:\WINDOWS\inf 2009-09-24 17:34:52 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-09-23 07:37:05 ----D---- C:\WINDOWS\Debug 2009-09-22 20:39:22 ----D---- C:\WINDOWS\Minidump 2009-09-22 20:34:36 ----D---- C:\Program Files\Eset 2009-09-22 20:34:36 ----D---- C:\Config.Msi 2009-09-22 18:50:57 ----SHD---- C:\WINDOWS\Installer 2009-09-22 18:50:57 ----SD---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft 2009-09-22 18:50:57 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared 2009-09-22 18:48:32 ----RSD---- C:\WINDOWS\assembly 2009-09-22 18:46:51 ----D---- C:\WINDOWS\WinSxS 2009-09-22 18:30:40 ----RSD---- C:\WINDOWS\Fonts 2009-09-16 19:11:15 ----D---- C:\Program Files\Fichiers communs 2009-09-04 14:39:22 ----D---- C:\Documents and Settings\ALI\Application Data\Apple Computer 2009-09-01 18:26:01 ----A---- C:\WINDOWS\CSTBox.INI 2009-09-01 18:24:04 ----D---- C:\Documents and Settings\ALI\Application Data\Canon 2009-08-27 20:13:50 ----A---- C:\WINDOWS\ModemLog_SoftV92 Data Fax Modem.txt 2009-08-25 16:31:00 ----SD---- C:\WINDOWS\Tasks 2009-08-25 16:30:45 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-08-25 14:03:42 ----D---- C:\WINDOWS\security 2009-08-25 13:25:52 ----AD---- C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP 2009-08-25 13:23:42 ----D---- C:\Program Files\Mozilla Firefox 2009-08-25 09:02:46 ----D---- C:\WINDOWS\system32\CatRoot 2009-08-25 08:00:12 ----D---- C:\WINDOWS\Registration 2009-08-19 18:02:13 ----D---- C:\Documents and Settings 2009-08-19 07:22:43 ----A---- C:\WINDOWS\win.ini ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-12-13 40320] R1 sf;SFI Service; C:\WINDOWS\system32\drivers\sf.sys [2004-08-28 33995] R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2002-09-06 12032] R2 AMON;AMON; \??\C:\WINDOWS\system32\drivers\amon.sys [] R2 Aspi32;Aspi32; C:\WINDOWS\System32\drivers\aspi32.sys [1999-09-10 25244] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-08-04 11868] R2 ROB_A;Pinnacle WDM PCTV Audio Capture; C:\WINDOWS\system32\DRIVERS\rob_a.sys [2003-02-10 17664] R2 ROB_V;Pinnacle WDM PCTV Video Capture; C:\WINDOWS\system32\drivers\rob_v.sys [2003-04-11 125568] R2 tifsfilter;Acronis TrueImage FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2009-02-04 28768] R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2004-05-17 133200] R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2006-12-13 60800] R3 E100B;Intel® PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2006-10-31 165760] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400] R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSFDPSP2.sys [2004-08-04 1041536] R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFBS2S2.sys [2004-08-04 220032] R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2006-12-13 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-10-22 3994624] R3 pctvvbi;PCTVVBI; C:\WINDOWS\system32\DRIVERS\pctvvbi.sys [2002-11-11 6400] R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-06-17 14604] R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-04-26 381056] R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2004-09-01 259648] R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2006-12-13 26624] R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2006-12-13 57600] R3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2006-12-13 20480] R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSFCXTS2.sys [2004-08-04 685056] S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys [] S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys [] S3 a5mm1fss;a5mm1fss; C:\WINDOWS\system32\drivers\a5mm1fss.sys [] S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 grmnusb;grmnusb; C:\WINDOWS\system32\drivers\grmnusb.sys [2007-08-01 8320] S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-03-08 51120] S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-03-08 16496] S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-03-08 21744] S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100] S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2006-12-13 10880] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s0016obex.sys [2008-05-16 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 115752] S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2006-12-13 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2006-12-13 15360] S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-07-09 39424] S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856] S3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2006-12-13 26496] S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe [2009-02-04 151552] R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-07-09 144712] R2 Capture Device Service;Capture Device Service; C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe [2007-03-06 198168] R2 IISADMIN;Administration IIS; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-19 15872] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984] R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2009-09-15 495616] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-10-22 159810] R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP); C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-19 15872] R2 SNMP;Service SNMP; C:\WINDOWS\System32\snmp.exe [2004-08-19 32768] R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056] R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe [2007-03-03 67056] R2 W3SVC;Publication World Wide Web; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-19 15872] R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496] S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120] S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 SNMPTRAP;Service d'interruption SNMP; C:\WINDOWS\System32\snmptrap.exe [2004-08-19 8704] S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016] -----------------EOF-----------------

ello ! voici : le même, mais complété. thank' s ! Logfile of random's system information tool 1.06 (written by random/random) Run by ALI at 2009-09-25 15:35:05 Microsoft Windows XP Professionnel Service Pack 2 System drive C: has 51 GB (67%) free of 76 GB Total RAM: 510 MB (58% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:35:07, on 25/09/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe C:\WINDOWS\system32\IcoSauve.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Anuman Interactive\Permis de construire Expert CAD\Permis de construire Expert CAD.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\ALI\Bureau\RSIT.exe C:\Documents and Settings\ALI\Bureau\ALI.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [soundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [uVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [soundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-19\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Pinnacle Scheduler.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/51.28/uploader2.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-2.0.cab O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O20 - AppInit_DLLs: ”” O21 - SSODL: uMOlFo - {2496A76E-8E3C-0DC4-A958-343C5BE15689} - C:\WINDOWS\System32\amw.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 8706 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\HPpromotions journeysoftware.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-10-22 86016] "NWEReboot"= [] "DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2006-11-12 157592] "Cloneur Expert Monitor"=C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe [2009-02-04 437675] "Acronis Scheduler2 Service"=C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe [2009-02-04 61440] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888] "SoundMax"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2004-08-06 860160] "UVS11 Preload"=C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [2007-03-03 341488] "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840] "SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-07-27 1388544] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-05-26 413696] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-07-13 292128] "nod32kui"=C:\Program Files\Eset\nod32kui.exe [2009-09-15 917504] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-19 15360] "Sony Ericsson PC Suite"=C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe [2008-07-10 397312] C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe Pinnacle Scheduler.lnk - C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe C:\Documents and Settings\ALI\Menu Démarrer\Programmes\Démarrage IcoSauve.lnk - C:\WINDOWS\system32\IcoSauve.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="””" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] uMOlFo - {2496A76E-8E3C-0DC4-A958-343C5BE15689} - C:\WINDOWS\System32\amw.dll [2006-12-13 32768] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "notification packages"= scecli [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "SynchronousMachineGroupPolicy"=0 "SynchronousUserGroupPolicy"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 "NoStrCmpLogical"=0 "LockTaskbar"=0 "NoResolveTrack"=0 "NoResolveSearch"=0 "NoRun"=0 "NoFind"=0 "NoSMMyPictures"=0 "NoStartMenuMFUprogramsList"=0 "NoUserNameInStartMenu"=0 "NoStartMenuMorePrograms"=0 "MaxRecentDocs"=15 "NoInstrumentation"=0 "MemCheckBoxInRunDlg"=1 "NoSMBalloonTip"=0 "NoActiveDesktopChanges"=0 "NoSetActiveDesktop"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoSimpleStartMenu"= "NoSetActiveDesktop"= "NoActiveDesktopChanges"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\GT2002\gpstrack.exe"="C:\Program Files\GT2002\gpstrack.exe:*:Enabled:Gpstrack" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA" "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent" "C:\Documents and Settings\ALI\Local Settings\Temp\IXP001.TMP\garmin.exe"="C:\Documents and Settings\ALI\Local Settings\Temp\IXP001.TMP\garmin.exe:*:Enabled:Windows Messanger" "C:\Documents and Settings\ALI\Local Settings\Temp\IXP000.TMP\garmin.exe"="C:\Documents and Settings\ALI\Local Settings\Temp\IXP000.TMP\garmin.exe:*:Enabled:Windows Messanger" "C:\WINDOWS\system32\xvs.exe"="C:\WINDOWS\system32\xvs.exe:*:Enabled:ENABLE" "C:\Documents and Settings\ALI\ddmgtf.exe"="C:\Documents and Settings\ALI\ddmgtf.exe:*:Enabled:ENABLE" "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{25cf0c22-c2ef-11dd-a6e5-0007e962e558}] shell\AutoRun\command - H:\Setup.exe ======List of files/folders created in the last 3 months====== 2009-09-25 09:38:41 ----D---- C:\rsit 2009-09-25 09:34:23 ----D---- C:\_OTM 2009-09-24 17:35:12 ----D---- C:\Program Files\Panda Security 2009-09-22 20:39:52 ----A---- C:\WINDOWS\ntbtlog.txt 2009-09-22 18:33:36 ----D---- C:\WINDOWS\system32\DirectX 2009-09-22 18:33:36 ----A---- C:\WINDOWS\system32\d3dx9_32.dll 2009-09-22 18:33:02 ----HDC---- C:\WINDOWS\$NtUninstallWIC$ 2009-09-16 19:11:15 ----D---- C:\Program Files\Fichiers communs\Windows Live 2009-09-15 06:45:02 ----A---- C:\WINDOWS\system32\imon.dll 2009-09-11 08:07:09 ----D---- C:\Program Files\IKEA HomePlanner 2009-09-11 08:06:36 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard 2009-08-25 16:31:23 ----D---- C:\Program Files\iPod 2009-08-25 16:31:20 ----D---- C:\Program Files\iTunes 2009-08-25 16:30:55 ----D---- C:\Program Files\Apple Software Update 2009-08-25 16:30:40 ----A---- C:\WINDOWS\system32\usbaaplrc.dll 2009-08-25 16:30:22 ----D---- C:\Program Files\Fichiers communs\Apple 2009-08-25 13:33:05 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-08-25 13:30:34 ----SHD---- C:\WINDOWS\CSC 2009-08-25 11:47:41 ----A---- C:\Documents and Settings\ALI\Application Data\install.txt 2009-08-25 09:01:44 ----D---- C:\WINDOWS\system32\CatRoot2 2009-08-25 08:34:12 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-08-24 18:56:17 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla! 2009-08-19 07:21:41 ----D---- C:\Program Files\MSSOAP 2009-08-19 07:20:29 ----D---- C:\Program Files\Webroot ======List of files/folders modified in the last 3 months====== 2009-09-25 14:40:02 ----D---- C:\WINDOWS\system32\inetsrv 2009-09-25 14:36:22 ----D---- C:\WINDOWS\system32\NtmsData 2009-09-25 12:00:39 ----A---- C:\WINDOWS\winamp.ini 2009-09-25 11:24:16 ----D---- C:\WINDOWS\Prefetch 2009-09-25 11:24:10 ----D---- C:\WINDOWS 2009-09-25 09:35:54 ----D---- C:\WINDOWS\Temp 2009-09-25 09:35:54 ----D---- C:\WINDOWS\system32 2009-09-24 17:35:21 ----D---- C:\WINDOWS\system32\drivers 2009-09-24 17:35:12 ----RD---- C:\Program Files 2009-09-24 17:35:12 ----HD---- C:\WINDOWS\inf 2009-09-24 17:34:52 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-09-23 07:37:05 ----D---- C:\WINDOWS\Debug 2009-09-22 20:39:22 ----D---- C:\WINDOWS\Minidump 2009-09-22 20:34:36 ----D---- C:\Program Files\Eset 2009-09-22 20:34:36 ----D---- C:\Config.Msi 2009-09-22 18:50:57 ----SHD---- C:\WINDOWS\Installer 2009-09-22 18:50:57 ----SD---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft 2009-09-22 18:50:57 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared 2009-09-22 18:48:32 ----RSD---- C:\WINDOWS\assembly 2009-09-22 18:46:51 ----D---- C:\WINDOWS\WinSxS 2009-09-22 18:30:40 ----RSD---- C:\WINDOWS\Fonts 2009-09-16 19:11:15 ----D---- C:\Program Files\Fichiers communs 2009-09-04 14:39:22 ----D---- C:\Documents and Settings\ALI\Application Data\Apple Computer 2009-09-03 17:10:12 ----D---- C:\Documents and Settings\ALI\Application Data\BitTorrent 2009-09-01 18:26:01 ----A---- C:\WINDOWS\CSTBox.INI 2009-09-01 18:24:04 ----D---- C:\Documents and Settings\ALI\Application Data\Canon 2009-08-28 19:13:20 ----D---- C:\Program Files\eMule 2009-08-27 20:13:50 ----A---- C:\WINDOWS\ModemLog_SoftV92 Data Fax Modem.txt 2009-08-25 16:31:00 ----SD---- C:\WINDOWS\Tasks 2009-08-25 16:30:45 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-08-25 14:03:42 ----D---- C:\WINDOWS\security 2009-08-25 13:25:52 ----AD---- C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP 2009-08-25 13:23:42 ----D---- C:\Program Files\Mozilla Firefox 2009-08-25 09:02:46 ----D---- C:\WINDOWS\system32\CatRoot 2009-08-25 08:00:12 ----D---- C:\WINDOWS\Registration 2009-08-19 18:02:13 ----D---- C:\Documents and Settings 2009-08-19 07:22:43 ----A---- C:\WINDOWS\win.ini ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-12-13 40320] R1 sf;SFI Service; C:\WINDOWS\system32\drivers\sf.sys [2004-08-28 33995] R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2002-09-06 12032] R2 AMON;AMON; \??\C:\WINDOWS\system32\drivers\amon.sys [] R2 Aspi32;Aspi32; C:\WINDOWS\System32\drivers\aspi32.sys [1999-09-10 25244] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-08-04 11868] R2 ROB_A;Pinnacle WDM PCTV Audio Capture; C:\WINDOWS\system32\DRIVERS\rob_a.sys [2003-02-10 17664] R2 ROB_V;Pinnacle WDM PCTV Video Capture; C:\WINDOWS\system32\drivers\rob_v.sys [2003-04-11 125568] R2 tifsfilter;Acronis TrueImage FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2009-02-04 28768] R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2004-05-17 133200] R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2006-12-13 60800] R3 E100B;Intel® PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2006-10-31 165760] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400] R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-03-08 51120] R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-03-08 16496] R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-03-08 21744] R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSFDPSP2.sys [2004-08-04 1041536] R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFBS2S2.sys [2004-08-04 220032] R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2006-12-13 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-10-22 3994624] R3 pctvvbi;PCTVVBI; C:\WINDOWS\system32\DRIVERS\pctvvbi.sys [2002-11-11 6400] R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-06-17 14604] R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-04-26 381056] R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2004-09-01 259648] R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2006-12-13 26624] R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2006-12-13 57600] R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856] R3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2006-12-13 20480] R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSFCXTS2.sys [2004-08-04 685056] S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys [] S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys [] S3 a4s9b2v1;a4s9b2v1; C:\WINDOWS\system32\drivers\a4s9b2v1.sys [] S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 grmnusb;grmnusb; C:\WINDOWS\system32\drivers\grmnusb.sys [2007-08-01 8320] S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100] S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2006-12-13 10880] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s0016obex.sys [2008-05-16 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 115752] S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2006-12-13 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2006-12-13 15360] S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-07-09 39424] S3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2006-12-13 26496] S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe [2009-02-04 151552] R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-07-09 144712] R2 Capture Device Service;Capture Device Service; C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe [2007-03-06 198168] R2 IISADMIN;Administration IIS; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-19 15872] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984] R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2009-09-15 495616] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-10-22 159810] R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728] R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP); C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-19 15872] R2 SNMP;Service SNMP; C:\WINDOWS\System32\snmp.exe [2004-08-19 32768] R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056] R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe [2007-03-03 67056] R2 W3SVC;Publication World Wide Web; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-19 15872] R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120] S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 SNMPTRAP;Service d'interruption SNMP; C:\WINDOWS\System32\snmptrap.exe [2004-08-19 8704] S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016] -----------------EOF-----------------

RE.. je possède bien la licence; 2/ voici le rapport qu 'il te manque : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:35:07, on 25/09/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe C:\WINDOWS\system32\IcoSauve.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Anuman Interactive\Permis de construire Expert CAD\Permis de construire Expert CAD.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\ALI\Bureau\RSIT.exe C:\Documents and Settings\ALI\Bureau\ALI.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [soundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [uVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [soundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-19\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Pinnacle Scheduler.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/51.28/uploader2.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-2.0.cab O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O20 - AppInit_DLLs: ”” O21 - SSODL: uMOlFo - {2496A76E-8E3C-0DC4-A958-343C5BE15689} - C:\WINDOWS\System32\amw.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 8706 bytes Merci encore

salut mr Sioux! er merci de m' aider voici les deux rapports .. LE PREMIER :[/b] All processes killed ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{150E44D5-314A-4E8C-A11C-B806C6882AEF}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{150E44D5-314A-4E8C-A11C-B806C6882AEF}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{339f7a5b-1ecb-456c-a310-46d331dcab04}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{339f7a5b-1ecb-456c-a310-46d331dcab04}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{48BACDF8-1B76-49C1-97B8-9A494E316683}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48BACDF8-1B76-49C1-97B8-9A494E316683}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{606895aa-eac6-4e64-9004-5c133a010415}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{606895aa-eac6-4e64-9004-5c133a010415}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B8DC1FE9-889D-4559-8090-FF2E5EFA9086}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8DC1FE9-889D-4559-8090-FF2E5EFA9086}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E35A634B-DC92-4F89-8236-6ADBCA79927B}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E35A634B-DC92-4F89-8236-6ADBCA79927B}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\xvs deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLs"|”” /E : value set successfully! Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\uMOlFo deleted successfully. ========== FILES ========== File/Folder C:\WINDOWS\system32\xvs.exe not found. File/Folder C:\WINDOWS\system32\fheykv.dll not found. File/Folder C:\WINDOWS\system32\rvzbuo.dll not found. DllUnregisterServer procedure not found in C:\WINDOWS\system32\amw.dll C:\WINDOWS\system32\amw.dll NOT unregistered. File move failed. C:\WINDOWS\system32\amw.dll scheduled to be moved on reboot. ========== COMMANDS ========== [EMPTYTEMP] User: Administrateur ->Temp folder emptied: 910777 bytes ->Temporary Internet Files folder emptied: 1559821 bytes ->Java cache emptied: 0 bytes User: ALI ->Temp folder emptied: 455012856 bytes File delete failed. C:\Documents and Settings\ALI\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 50138569 bytes ->Java cache emptied: 0 bytes User: All Users User: All Users.WINDOWS User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User.WINDOWS ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 35539 bytes User: LocalService.AUTORITE NT ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService.AUTORITE NT\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33174 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService.AUTORITE NT ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2114013 bytes %systemroot%\System32 .tmp files removed: 11500606 bytes Windows Temp folder emptied: 1819104 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 499,08 mb OTM by OldTimer - Version 3.0.0.6 log created on 09252009_093423 Files moved on Reboot... DllUnregisterServer procedure not found in C:\WINDOWS\system32\amw.dll C:\WINDOWS\system32\amw.dll NOT unregistered. File move failed. C:\WINDOWS\system32\amw.dll scheduled to be moved on reboot. Registry entries deleted on Reboot... LE SECOND : nfo.txt logfile of random's system information tool 1.06 2009-09-25 09:38:56 ======Uninstall list====== -->"C:\Program Files\InstallShield Installation Information\{BB8AE808-F003-4C7F-B56B-8C80EEAFFE23}\setup.exe" --u:{BB8AE808-F003-4C7F-B56B-8C80EEAFFE23} -->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 -->MsiExec.exe /I{403EF592-953B-4794-BCEF-ECAB835C2095} -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player 9 Plugin-->MsiExec.exe /X{008F31A9-4B8E-4411-AA19-2CB3C8DD7507} Adobe Shockwave Player-->MsiExec.exe /X{A7DB362E-16DC-4E29-8A34-E74381E00B5B} Apple Mobile Device Support-->MsiExec.exe /I{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3} Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033} Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe Avanquest update-->C:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\setup.exe -runfromtemp -l0x040c -removeonly Canon Internet Library for ZoomBrowser EX-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{9E75AF24-815C-4BD1-9A05-F96866CC6005} Canon PhotoRecord-->C:\WINDOWS\IsUn040c.exe -fC:\PROGRA~1\Canon\ZOOMBR~1\..\PhotoRecord\Uninst.isu -c"C:\PROGRA~1\Canon\ZOOMBR~1\..\PhotoRecord\Program\uninstdll.dll" Canon Utilities File Viewer Utility 1.2-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{755D3B4E-D3A3-4D05-99D8-FC35E26A331C} Canon Utilities PhotoStitch 3.1-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{F11A403B-0DE9-4953-B790-7A2F014FBB2B} Canon Utilities RemoteCapture 2.7-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{AB3AC39D-9915-435D-ACC4-9881E75326BC} Canon Utilities ZoomBrowser EX-->MsiExec.exe /X{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2} CanoScan Toolbox 4.1-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BCE46757-7674-4416-BEDB-68205A60409E}\setup.exe" -l0x40c CartoExploreur 3D 1.10-->"C:\Program Files\Bayo\Setup\CartoExploreur 3D 1.10\unins000.exe" cGPSmapper Free 0097-->"C:\Program Files\cGPSmapper\unins000.exe" Client Windows Rights Management avec Service Pack 2-->MsiExec.exe /X{1D13221B-42DE-4B3C-A43F-0F6AF3CF3DA2} Cloneur Expert-->C:\Program Files\Micro Application\Cloneur Expert\MediaBuilder.exe -uninstall eMule-->"C:\Program Files\eMule\Uninstall.exe" Fenêtre d'appareil photo Canon pour ZoomBrowser EX-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{5ADA9741-0570-4096-B5FE-1D55E57537D4} Garmin City Navigator Europe v8-->MsiExec.exe /X{3879E12E-DA5B-4451-B973-DA0E2FEE7039} Garmin TOPO Swiss East-->"C:\Garmin\TOPO Swiss East\unins000.exe" Garmin TOPO Swiss West-->"C:\Garmin\TOPO Swiss West\unins000.exe" Gpstrack 2008-->MsiExec.exe /X{A666A3CB-C3B8-4ACB-B278-5ED5124EFD6E} Guitar Pro 5.2-->"C:\Program Files\Guitar Pro 5\unins000.exe" HijackThis 2.0.2-->"C:\Documents and Settings\ALI\Bureau\HijackThis.exe" /uninstall HP Deskjet 5400 series-->C:\Program Files\HP\Digital Imaging\{EB57A16E-500D-43d7-85B9-FBE279EBBA6E}\setup\hpzscr01.exe -datfile hpfscr05.dat HP Extended Capabilities 5.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat HP Image Zone Express-->MsiExec.exe /X{FE64AE29-0883-4C70-8388-DC026019C900} HP Imaging Device Functions 5.0-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC} HP Solution Center & Imaging Support Tools 5.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB} IKEA Home Planner-->MsiExec.exe /I{B3276CB1-20B6-4AF9-AAEC-E72C83816495} Intel® PRO Network Connections 11.2.0.69-->MsiExec.exe /i{2222B364-0854-4265-B32E-A142DB9DC7BB} ARPREMOVE=1 InterVideo DeviceService-->MsiExec.exe /I{521AAD14-5030-44BB-8B0E-5CE65FCE57E0} iTunes-->MsiExec.exe /I{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944} Java 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF} Java 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040} Java 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070} Java SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000} KC Softwares IDPhotoStudio-->"C:\Program Files\KC Softwares\IDPhotoStudio\unins000.exe" K-Lite Codec Pack 2.71 Full-->"C:\Program Files\K-Lite Codec Pack\unins000.exe" Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe" MapSource Product Install-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{47D50190-9DAD-4FFE-9EFA-6D278B2C4810}\Setup.exe" -l0x40c AddRemove MapSource Product Install-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B8BFB69F-BBBA-48A9-A788-851222571C77}\setup.exe" -l0x40c AddRemove MFCDLL Shared Library - Retail Version-->MsiExec.exe /I{51D569E2-8A28-11D2-B962-006097C4DE24} Microsoft ® C Runtime Library-->MsiExec.exe /I{51D569E0-8A28-11D2-B962-006097C4DE24} Microsoft ® C++ Runtime Library-->MsiExec.exe /I{51D569E3-8A28-11D2-B962-006097C4DE24} Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp" Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe Microsoft Office PowerPoint Viewer 2003-->MsiExec.exe /X{90AF040C-6000-11D3-8CFE-0150048383C9} Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9} Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Microsoft Windows Media Video 9 VCM-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmv9vcm.inf, Uninstall Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe MSXML 3.0-->MsiExec.exe /I{930E3A4D-70B7-4D0D-AF8D-0B351A9B55BE} MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F} MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 4.0 SP2 and SOAP Toolkit 3.0-->MsiExec.exe /I{32343DB6-9A52-40C9-87E4-5E7C79791C87} MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{1787603C-E6E3-42D4-8034-55F358486F1D} Nero 7 Premium-->MsiExec.exe /I{4781569D-5404-1F26-4B2B-6DF444441031} NOD32 Antivirus System-->C:\Program Files\Eset\Setup\setup.exe /UNINSTALL NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI OgcDrv 2.12-->"C:\Program Files\Bayo\Setup\OgcDrv 2.12\unins000.exe" OmniPage SE-->MsiExec.exe /I{6249C22D-E6A8-407B-BA8B-40298848ED94} Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe Permis de construire Expert CAD-->"C:\Program Files\Anuman Interactive\Permis de construire Expert CAD\unins000.exe" Photo d'identité 2008 v3.4-->"C:\Program Files\Emjysoft\Photo\unins000.exe" Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe" Pinnacle PCTV-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3C02ED4F-46B0-4E9E-87F7-47AEBA4031C8}\Setup.exe" -l0x40c -L0x40c UNINSTALL QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68} RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 Réseau Antilles Bayo 0007-Q0-->"C:\Program Files\Bayo\Setup\Réseau Antilles Bayo 0007-Q0\unins000.exe" Réseau Antilles BdAlti 2007-Q1-->"C:\Program Files\Bayo\Setup\Réseau Antilles BdAlti 2007-Q1\unins000.exe" Réseau Antilles BdNyme 2003-Q1-->"C:\Program Files\Bayo\Setup\Réseau Antilles BdNyme 2003-Q1\unins000.exe" Réseau France Bayo 0013-Q0-->"C:\Program Files\Bayo\Setup\Réseau France Bayo 0013-Q0\unins000.exe" Réseau France BdAlti 2006-Q2-->"C:\Program Files\Bayo\Setup\Réseau France BdAlti 2006-Q2\unins000.exe" Réseau France BdNyme 2004-Q4-->"C:\Program Files\Bayo\Setup\Réseau France BdNyme 2004-Q4\unins000.exe" Réseau France NavTeq 2006-Q1-->"C:\Program Files\Bayo\Setup\Réseau France NavTeq 2006-Q1\unins000.exe" Réseau France POI 2006-Q1-->"C:\Program Files\Bayo\Setup\Réseau France POI 2006-Q1\unins000.exe" Réseau France TopoNyme 2004-Q4-->"C:\Program Files\Bayo\Setup\Réseau France TopoNyme 2004-Q4\unins000.exe" Réseau Guyane Bayo 0004-Q0-->"C:\Program Files\Bayo\Setup\Réseau Guyane Bayo 0004-Q0\unins000.exe" Réseau Guyane BdAlti 2003-Q1-->"C:\Program Files\Bayo\Setup\Réseau Guyane BdAlti 2003-Q1\unins000.exe" Réseau Guyane BdNyme 2003-Q1-->"C:\Program Files\Bayo\Setup\Réseau Guyane BdNyme 2003-Q1\unins000.exe" Réseau Reunion Bayo 0007-Q0-->"C:\Program Files\Bayo\Setup\Réseau Reunion Bayo 0007-Q0\unins000.exe" Réseau Reunion BdAlti 2007-Q1-->"C:\Program Files\Bayo\Setup\Réseau Reunion BdAlti 2007-Q1\unins000.exe" Réseau Reunion BdNyme 2007-Q1-->"C:\Program Files\Bayo\Setup\Réseau Reunion BdNyme 2007-Q1\unins000.exe" Security Update for Microsoft .NET Framework 2.0 (KB917283)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {967B098A-042D-4367-BAC9-8BC11684174F} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} Security Update pour Microsoft .NET Framework 2.0 (KB922770)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {0E92DD42-76F5-4EF2-B381-F9C1D72BE23D} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} Sierra Home Architecte-->C:\WINDOWS\IsUn040c.exe -fC:\SIERRA\SHAF\Uninst.isu Sony Ericsson PC Suite 4.010.00-->C:\Program Files\InstallShield Installation Information\{2FFE93F0-BB72-4E52-8761-354D1AAA9387}\ISAdmin.exe -runfromtemp -l0x040c -removeonly SoundMAX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe" -l0x40c -removeonly TrekMap v2-->MsiExec.exe /X{46E7E808-5AD2-44B6-B52C-68EB15182D8A} Ulead VideoStudio 11-->C:\Program Files\InstallShield Installation Information\{F99F9E24-EE2F-47FD-AEB0-FDB82859B5C9}\setup.exe -runfromtemp -l0x0409 VideoLAN VLC media player 0.8.6f-->C:\Program Files\VideoLAN\VLC\uninstall.exe Winamp (remove only)-->"C:\Program Files\Winamp\UninstWA.exe" Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe" Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe" ======Hosts File====== 127.0.0.1 localhost Securitycenter WMI appears to be broken ======System event log====== Computer Name: ALOU Event Code: 10 Message: Ce lecteur ne semble pas prendre en charge la lecture audio numérique. Record Number: 47929 Source Name: redbook Time Written: 20090918131954.000000+120 Event Type: Informations User: Computer Name: ALOU Event Code: 10 Message: Ce lecteur ne semble pas prendre en charge la lecture audio numérique. Record Number: 47928 Source Name: redbook Time Written: 20090918131954.000000+120 Event Type: Informations User: Computer Name: ALOU Event Code: 3095 Message: Cet ordinateur est configuré en tant que membre d'un groupe de travail, et non en tant que membre d'un domaine. Il n'est pas nécessaire d'exécuter le service Accès réseau dans cette configuration. Record Number: 47927 Source Name: NETLOGON Time Written: 20090918131953.000000+120 Event Type: erreur User: Computer Name: ALOU Event Code: 6005 Message: Le service d'Enregistrement d'événement a démarré. Record Number: 47926 Source Name: EventLog Time Written: 20090918131943.000000+120 Event Type: Informations User: Computer Name: ALOU Event Code: 6009 Message: Microsoft ® Windows ® 5.01. 2600 Service Pack 2 Uniprocessor Free. Record Number: 47925 Source Name: EventLog Time Written: 20090918131943.000000+120 Event Type: Informations User: =====Application event log===== Computer Name: ALOU Event Code: 1003 Message: Le paramètre TraceFileName ne se trouve pas dans le Registre. Le fichier de suivi utilisé par défaut est . Record Number: 4267 Source Name: EvntAgnt Time Written: 20090718230212.000000+120 Event Type: Avertissement User: Computer Name: ALOU Event Code: 1 Message: Record Number: 4266 Source Name: Bonjour Service Time Written: 20090718230209.000000+120 Event Type: Informations User: Computer Name: ALOU Event Code: 0 Message: Record Number: 4265 Source Name: Capture Device Service Time Written: 20090718230207.000000+120 Event Type: Informations User: Computer Name: ALOU Event Code: 0 Message: Record Number: 4264 Source Name: Capture Device Service Time Written: 20090718230207.000000+120 Event Type: Informations User: Computer Name: ALOU Event Code: 0 Message: Record Number: 4263 Source Name: Capture Device Service Time Written: 20090718230207.000000+120 Event Type: Informations User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\system32\WindowsPowerShell\v1.0;C:\Program Files\Intel\DMIX;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\QuickTime\QTSystem\ "windir"=%SystemRoot% "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "PROCESSOR_ARCHITECTURE"=x86 "PROCESSOR_LEVEL"=15 "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel "PROCESSOR_REVISION"=0209 "NUMBER_OF_PROCESSORS"=1 "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.PSC1 "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "DEVMGR_SHOW_DETAILS"=1 "CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip "QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip -----------------EOF----------------- A+

salut, je suis en combat avec ce fichu viirus que je n' arrive pas à supprimer définitivement, après avoir cherché, j' en appelle à la communauté merci d 'avance !! voici le rapport fait avec hijackthis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:51:50, on 24/09/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe C:\WINDOWS\system32\IcoSauve.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\ALI\Bureau\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: (no name) - {150E44D5-314A-4E8C-A11C-B806C6882AEF} - (no file) O2 - BHO: (no name) - {339f7a5b-1ecb-456c-a310-46d331dcab04} - (no file) O2 - BHO: (no name) - {48BACDF8-1B76-49C1-97B8-9A494E316683} - (no file) O2 - BHO: (no name) - {606895aa-eac6-4e64-9004-5c133a010415} - (no file) O2 - BHO: (no name) - {B8DC1FE9-889D-4559-8090-FF2E5EFA9086} - (no file) O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: (no name) - {E35A634B-DC92-4F89-8236-6ADBCA79927B} - (no file) O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [xvs] C:\WINDOWS\system32\xvs.exe \u O4 - HKLM\..\Run: [soundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [uVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [soundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-19\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Pinnacle Scheduler.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/51.28/uploader2.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-2.0.cab O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O20 - AppInit_DLLs: fheykv.dll rvzbuo.dll O21 - SSODL: uMOlFo - {2496A76E-8E3C-0DC4-A958-343C5BE15689} - C:\WINDOWS\system32\amw.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 8980 bytes