ICEMOL24

Dans ces étapes je ne peux Accepter le contrat d'utilisateur... après ce message on me dit appuie sur n'importe quelle touche pour quitter l'appli... Que faire?

Non malheureusement pas pour XP Familiale. J'ai le CD XP pro de mon PC perso par contre mais je ne pense pas que cela fasse l'affaire. Puis-je recuperer le fichier manquant d'un autre poste sinon?

Merci pour ta réactivité et pour ton aide Thanos. Voila le rapport. ComboFix 10-02-27.04 - Administrateur 28/02/2010 14:28:54.2.2 - x86 MINIMAL Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1014.817 [GMT 1:00] Lancé depuis: E:\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\Administrateur.LAURA.000\Bureau\CFScript.txt AV: avast! antivirus 4.8.1368 [VPS 100227-2] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FILE :: "c:\windows\system32\drivers\ysoyznw.sys" "c:\windows\system32\er64o8q8.dll" file zipped: c:\documents and settings\All Users\Application Data\fiosejgfse.dll file zipped: c:\documents and settings\Laura\Menu Démarrer\Programmes\Démarrage\ihaupd32.exe file zipped: c:\windows\system32\drivers\drw1.tmp file zipped: c:\windows\system32\drivers\kgwaa.sys . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\fiosejgfse.dll c:\documents and settings\Laura\Menu Démarrer\Programmes\Démarrage\ihaupd32.exe c:\windows\system32\drivers\drw1.tmp c:\windows\system32\drivers\kgwaa.sys c:\windows\system32\drivers\ysoyznw.sys . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_kgwaa -------\Service_kgwaa ((((((((((((((((((((((((((((( Fichiers créés du 2010-01-28 au 2010-02-28 )))))))))))))))))))))))))))))))))))) . 2010-02-28 10:31 . 2010-02-28 10:31 5115823 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-02-27 13:56 . 2010-02-27 13:56 -------- d-sh--w- c:\documents and settings\Administrateur.LAURA.000\PrivacIE 2010-02-27 13:20 . 2010-02-27 16:10 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-02-27 13:20 . 2010-02-27 13:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-02-27 12:54 . 2010-02-27 12:54 -------- d-----w- c:\documents and settings\Administrateur.LAURA.000\Local Settings\Application Data\Mozilla 2010-02-27 11:55 . 2010-02-27 11:55 -------- d-----w- c:\documents and settings\Administrateur.LAURA.000\Application Data\TuneUp Software 2010-02-26 12:56 . 2008-04-13 10:39 5376 -c--a-w- c:\windows\system32\dllcache\mspclock.sys 2010-02-26 12:56 . 2008-04-13 10:39 5376 ----a-w- c:\windows\system32\drivers\mspclock.sys 2010-02-26 12:31 . 2008-04-14 12:00 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys 2010-02-26 12:31 . 2008-04-14 12:00 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys 2010-02-26 11:46 . 2008-04-13 10:41 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys 2010-02-20 09:32 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys 2010-02-20 09:32 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswfsblk.sys 2010-02-19 19:12 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2010-02-19 19:12 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2010-02-19 19:12 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\Aavmker4.sys 2010-02-19 19:12 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr 2010-02-19 19:12 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys 2010-02-19 19:12 . 2009-11-24 23:50 94160 ----a-w- c:\windows\system32\drivers\aswMon2.sys 2010-02-19 19:12 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe 2010-02-19 18:18 . 2010-02-03 12:23 30536 ----a-w- c:\windows\system32\TURegOpt.exe 2010-02-19 18:18 . 2010-02-03 12:17 30024 ----a-w- c:\windows\system32\uxtuneup.dll 2010-02-19 18:17 . 2010-02-19 18:17 -------- d-----w- c:\documents and settings\Laura\Application Data\TuneUp Software 2010-02-19 18:17 . 2010-02-28 01:21 -------- d-----w- c:\program files\TuneUp Utilities 2010 2010-02-19 18:16 . 2010-02-19 18:17 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software 2010-02-19 18:16 . 2010-02-19 18:16 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC} 2010-02-19 17:47 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll 2010-02-19 16:24 . 2010-02-19 16:24 -------- d-----w- c:\documents and settings\Laura\DoctorWeb 2010-02-19 00:05 . 2010-02-19 00:05 -------- d-----w- c:\documents and settings\Administrateur.LAURA.000\DoctorWeb 2010-02-18 23:23 . 2010-02-18 23:23 -------- d-----w- c:\documents and settings\Administrateur.LAURA.000\Local Settings\Application Data\Adobe 2010-02-18 22:19 . 2010-02-18 22:19 -------- d-----w- c:\documents and settings\Administrateur.LAURA.000\Application Data\Malwarebytes 2010-02-18 20:31 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-02-18 20:31 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-02-18 20:31 . 2010-02-28 10:31 -------- d-----w- C:\Malwarebytes' Anti-Malware 2010-02-18 15:58 . 2010-02-18 15:58 -------- d-----w- c:\documents and settings\Laura\Application Data\Malwarebytes 2010-02-18 15:54 . 2010-02-18 15:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-02-18 14:21 . 2010-02-18 14:21 -------- d-----w- c:\documents and settings\Administrateur.SAGE-349223619D\Application Data\Malwarebytes 2010-02-18 13:56 . 2010-02-18 13:18 -------- d--h--w- c:\documents and settings\Default User.TEST 2010-02-18 13:56 . 2010-02-18 13:10 -------- d-----w- c:\documents and settings\All Users.TEST 2010-02-18 13:50 . 2010-02-18 13:13 -------- d-----w- C:\winapps 2010-02-18 13:45 . 2010-02-18 21:33 -------- d-----w- C:\TEST 2010-02-18 13:31 . 2010-02-18 13:31 -------- d-----w- c:\program files\Microsoft.NET 2010-02-18 13:26 . 2010-02-18 13:26 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT\Local Settings\Application Data\Microsoft 2010-02-18 13:12 . 2010-02-18 13:12 -------- d-----w- c:\program files\Fichiers communs\Java 2010-02-18 13:12 . 2010-02-18 13:12 -------- d-----w- c:\documents and settings\Default User.TEST\Local Settings\Application Data\Sun 2010-02-18 13:12 . 2010-02-18 13:12 -------- d-----w- c:\documents and settings\Default User.TEST\Local Settings\Application Data\Microsoft 2010-02-18 13:10 . 2010-02-18 13:11 -------- d-sh--w- c:\documents and settings\All Users.TEST\DRM 2010-02-17 06:54 . 2010-02-17 06:54 -------- d-sh--w- c:\documents and settings\Administrateur.LAURA.000\IETldCache 2010-02-16 19:14 . 2010-02-16 19:14 -------- d-sh--w- c:\documents and settings\Administrateur.LAURA\PrivacIE 2010-02-16 19:14 . 2010-02-16 19:14 -------- d-sh--w- c:\documents and settings\Administrateur.LAURA\IETldCache 2010-02-16 18:59 . 2009-04-15 05:29 -------- d--h--w- c:\documents and settings\Administrateur\Voisinage réseau 2010-02-16 17:27 . 2010-02-16 17:27 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2010-02-08 20:29 . 2010-02-08 20:29 -------- d-----w- c:\documents and settings\Laura\Local Settings\Application Data\Packard Bell 2010-02-08 20:28 . 2010-02-08 20:28 -------- d-----w- c:\program files\Packard Bell 2010-02-05 13:12 . 2007-10-23 08:27 110592 ----a-w- c:\documents and settings\Laura\Application Data\U3\temp\cleanup.exe 2010-02-05 13:11 . 2008-05-02 09:41 3493888 ---ha-w- c:\documents and settings\Laura\Application Data\U3\temp\Launchpad Removal.exe 2010-02-05 13:11 . 2008-04-13 17:57 58752 -c--a-w- c:\windows\system32\dllcache\redbook.sys 2010-02-05 13:11 . 2008-04-13 17:57 58752 ----a-w- c:\windows\system32\drivers\redbook.sys 2010-02-05 13:11 . 2010-02-05 13:12 -------- d-----w- c:\documents and settings\Laura\Application Data\U3 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-25 20:53 . 2009-09-21 08:36 1 ----a-w- c:\documents and settings\Laura\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2010-02-20 09:24 . 2009-09-09 14:54 47224 ----a-w- c:\documents and settings\Laura\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-02-19 18:00 . 2009-06-26 15:38 -------- d-----w- c:\program files\Launch Manager 2010-02-18 13:29 . 2009-04-15 04:47 -------- d-----w- c:\program files\Microsoft Works 2010-02-18 13:13 . 2009-09-18 16:21 -------- d-----w- c:\program files\Java 2010-02-17 07:01 . 2010-02-17 06:53 64016 ----a-w- c:\documents and settings\Administrateur.LAURA.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-02-16 23:32 . 2009-10-10 15:14 -------- d-----w- c:\documents and settings\Laura\Application Data\Skype 2010-02-16 23:29 . 2009-10-10 15:16 -------- d-----w- c:\documents and settings\Laura\Application Data\skypePM 2010-02-16 08:58 . 2009-04-15 13:17 81816 ----a-w- c:\windows\system32\perfc00C.dat 2010-02-16 08:58 . 2009-04-15 13:17 502688 ----a-w- c:\windows\system32\perfh00C.dat 2010-01-24 11:56 . 2010-01-24 11:55 -------- d-----w- c:\program files\Fichiers communs\Adobe 2009-12-31 16:50 . 2009-04-15 13:16 353792 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-21 19:07 . 2009-04-15 13:16 916480 ------w- c:\windows\system32\wininet.dll 2009-12-17 07:41 . 2009-04-15 03:34 347648 ----a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:09 . 2009-04-15 13:16 33280 ----a-w- c:\windows\system32\csrsrv.dll 2009-12-09 10:08 . 2008-04-13 19:07 2147328 ------w- c:\windows\system32\ntoskrnl.exe 2009-12-09 10:08 . 2008-04-13 19:07 2025984 ------w- c:\windows\system32\ntkrnlpa.exe 2009-12-04 18:22 . 2009-04-15 13:16 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys . ------- Sigcheck ------- [-] 2007-10-13 . E46FB493E3B33704F0715020CF52106B . 578048 . . [5.1.2600.2180] . . c:\windows\system32\user32.DLL [7] 2008-04-14 . 59DC5BB82E4C8E0B3EADCFDBC44BA6E4 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ctfmon.exe c:\windows\System32\ctfmon.exe ... manque !! . ((((((((((((((((((((((((((((( SnapShot@2010-02-28_11.06.30 ))))))))))))))))))))))))))))))))))))))))) . + 2010-02-28 13:49 . 2010-02-28 13:49 16384 c:\windows\temp\Perflib_Perfdata_b8.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LManager"="c:\program files\Launch Manager\LManager.exe" [2009-02-20 817672] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "HotKeysCmds"=c:\windows\system32\hkcmd.exe "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "LManager"=c:\program files\Launch Manager\LManager.exe "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" "SynTPEnh"=c:\program files\Synaptics\SynTP\SynTPEnh.exe "MSPY2002"=c:\windows\system32\IME\PINTLGNT\ImScInst.exe /SYNC "IgfxTray"=c:\windows\system32\igfxtray.exe "PersistenceThread"=c:\windows\system32\PersistenceThread.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [20/02/2010 10:32 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswfsblk.sys [20/02/2010 10:32 20560] R2 PowerSave;PowerSave Service;c:\program files\Packard Bell\Software Suite\PowerSave\PSPBSSS.exe [06/04/2009 10:35 1002016] R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [15/04/2009 06:46 237568] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [03/02/2010 13:20 1043784] R3 igd;igd;c:\windows\system32\drivers\igxpmp32.sys [15/04/2009 05:38 5096544] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\tuneuputilitiesdriver32.sys [14/10/2009 07:24 10064] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [18/02/2010 21:31 38224] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contenu du dossier 'Tâches planifiées' 2010-02-28 c:\windows\Tasks\Recherche de problèmes automatique.job - c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2010-02-03 12:26] 2010-02-28 c:\windows\Tasks\User_Feed_Synchronization-{F537AE05-058F-4A81-BED2-BB2CB3A29FE9}.job - c:\windows\system32\msfeedssync.exe [2007-08-13 02:31] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=0&o=xph&d=0909&m=ao751h uInternet Connection Wizard,ShellNext = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=0&o=xph&d=0909&m=ao751h IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Administrateur.LAURA.000\Application Data\Mozilla\Firefox\Profiles\l2693mnk.default\ FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-28 14:49 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'Explorer.EXE'(536) c:\windows\system32\eappprxy.dll c:\windows\system32\webcheck.dll . ------------------------ Autres processus actifs ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\program files\Alwil Software\Avast4\setup\avast.setup . ************************************************************************** . Heure de fin: 2010-02-28 14:53:29 - La machine a redémarré ComboFix-quarantined-files.txt 2010-02-28 13:53 ComboFix2.txt 2010-02-28 11:10 Avant-CF: 139 434 356 736 octets libres Après-CF: 138 291 408 896 octets libres - - End Of File - - 62E56D6BE9279378E0C1ABFA0788D6B5

Pour commencer bonjour, et merci de me lire. Je suis victime d'un virus Depuis 1 hier matin. Merci Dr.GUARD Avast n'a pas arrêté de lancer des alarmes après détection de fichier douteux. J'ai donc mis en place sur ce PC plusieurs Scan avant de tomber sur un sujet sur ce forum. 1- Avast antivirus au lancement de la machine (plusieurs fichiers supprimés) 2- En mode sans échec: - Lancement de Spybot (67 fichiers supprimés) - Lancement de Web Doctor - Lancement de Malwarebytes Après application de tout ces scans je pensais être tranquille, depuis des que j'ouvre Windows un message Ihaupd32.exe à cessé de fonctionner. Conscient que celui ci est un virus je les supprimé du PC et j'ai supprimé les clé de registre associé. Manque de pot le résultat est toujours le même au démarrage... Ne sachant plus que faire j'ai donc exécuté Combofix et j'ai suivit la procédure d'exécution de: http://www.bleepingcomputer.com/combofix/f...iliser-combofix Je suis conscient de ne pas avoir respecté la procédure mais il vrai que je ne pensais pas devoir aller aussi loin dans les Scan et suppression et constater que le virus est toujours présent, et comme on dit mieux vaut tard que jamais. ComboFix 10-02-27.04 - Laura 28/02/2010 11:53:56.1.2 - x86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1014.458 [GMT 1:00] Lancé depuis: E:\ComboFix.exe AV: avast! antivirus 4.8.1368 [VPS 100227-2] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Administrateur.LAURA.000\Application Data\avdrn.dat c:\documents and settings\Administrateur.LAURA.000\Application Data\wiaservg.log c:\documents and settings\All Users\Application Data\_VOIDkrl32mainweq.dll c:\documents and settings\All Users\Application Data\_VOIDmainqt.dll c:\documents and settings\All Users\Application Data\mswintmp.dat c:\documents and settings\Laura\Application Data\avdrn.dat c:\documents and settings\Laura\Application Data\wiaservg.log c:\program files\Paladin Antivirus c:\program files\Paladin Antivirus\splash.mp3 c:\program files\Paladin Antivirus\virus.mp3 c:\recycler\S-1-5-21-0724961348-1095474359-127262198-2200 c:\recycler\S-1-5-21-1466161448-0933263750-982952368-8929 c:\recycler\S-1-5-21-6641009320-2696259045-258282081-3382 c:\recycler\S-1-5-21-7092100029-2908119676-036291707-8429 C:\restore c:\restore\k-1-3542-4232123213-7676767-8888886\Desktop.ini c:\windows\mqcd.dbt c:\windows\Suyin.reg c:\windows\system32\_VOIDbrqfamyfxr.dat c:\windows\system32\3f5uk.sr c:\windows\system32\467.zt c:\windows\system32\4DW4R3kSSRLKhRnd.dll c:\windows\system32\4DW4R3sv.dat c:\windows\system32\4DW4R3ThGcSNOLsX.dll c:\windows\system32\ctfmon .exe c:\windows\system32\drivers\4DW4R3.sys c:\windows\system32\drivers\4DW4R3cnjlfTEaFf.sys c:\windows\system32\drivers\4DW4R3uDbBwFOyTM.sys c:\windows\system32\fe6hbfe1.an c:\windows\system32\io74f.dll c:\windows\system32\spool\prtprocs\w32x86\9.tmp . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_4DW4R3 -------\Legacy_4DW4R3 -------\Legacy_SSHNAS ((((((((((((((((((((((((((((( Fichiers créés du 2010-01-28 au 2010-02-28 )))))))))))))))))))))))))))))))))))) . 2010-02-28 10:48 . 2010-02-28 11:06 791552 ----a-w- c:\windows\system32\drivers\kgwaa.sys 2010-02-28 10:31 . 2010-02-28 10:31 5115823 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-02-27 13:59 . 2010-02-27 14:05 2096 ----a-w- c:\documents and settings\All Users\Application Data\fiosejgfse.dll 2010-02-27 13:56 . 2010-02-27 13:56 -------- d-sh--w- c:\documents and settings\Administrateur.LAURA.000\PrivacIE 2010-02-27 13:56 . 2010-02-28 05:32 -------- d-----w- c:\program files\Dr. Guard 2010-02-27 13:20 . 2010-02-27 16:10 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-02-27 13:20 . 2010-02-27 13:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-02-27 12:54 . 2010-02-27 12:54 -------- d-----w- c:\documents and settings\Administrateur.LAURA.000\Local Settings\Application Data\Mozilla 2010-02-27 11:55 . 2010-02-27 11:55 -------- d-----w- c:\documents and settings\Administrateur.LAURA.000\Application Data\TuneUp Software 2010-02-26 12:56 . 2008-04-13 10:39 5376 -c--a-w- c:\windows\system32\dllcache\mspclock.sys 2010-02-26 12:56 . 2008-04-13 10:39 5376 ----a-w- c:\windows\system32\drivers\mspclock.sys 2010-02-26 12:31 . 2008-04-14 12:00 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys 2010-02-26 12:31 . 2008-04-14 12:00 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys 2010-02-26 11:46 . 2008-04-13 10:41 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys 2010-02-20 09:32 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys 2010-02-20 09:32 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswfsblk.sys 2010-02-19 19:12 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2010-02-19 19:12 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2010-02-19 19:12 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\Aavmker4.sys 2010-02-19 19:12 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr 2010-02-19 19:12 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys 2010-02-19 19:12 . 2009-11-24 23:50 94160 ----a-w- c:\windows\system32\drivers\aswMon2.sys 2010-02-19 19:12 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe 2010-02-19 18:18 . 2010-02-03 12:23 30536 ----a-w- c:\windows\system32\TURegOpt.exe 2010-02-19 18:18 . 2010-02-03 12:17 30024 ----a-w- c:\windows\system32\uxtuneup.dll 2010-02-19 18:17 . 2010-02-19 18:17 -------- d-----w- c:\documents and settings\Laura\Application Data\TuneUp Software 2010-02-19 18:17 . 2010-02-28 01:21 -------- d-----w- c:\program files\TuneUp Utilities 2010 2010-02-19 18:16 . 2010-02-19 18:17 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software 2010-02-19 18:16 . 2010-02-19 18:16 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC} 2010-02-19 17:47 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll 2010-02-19 16:24 . 2010-02-19 16:24 -------- d-----w- c:\documents and settings\Laura\DoctorWeb 2010-02-19 00:05 . 2010-02-19 00:05 -------- d-----w- c:\documents and settings\Administrateur.LAURA.000\DoctorWeb 2010-02-18 23:23 . 2010-02-18 23:23 -------- d-----w- c:\documents and settings\Administrateur.LAURA.000\Local Settings\Application Data\Adobe 2010-02-18 22:19 . 2010-02-18 22:19 -------- d-----w- c:\documents and settings\Administrateur.LAURA.000\Application Data\Malwarebytes 2010-02-18 20:31 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-02-18 20:31 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-02-18 20:31 . 2010-02-28 10:31 -------- d-----w- C:\Malwarebytes' Anti-Malware 2010-02-18 15:58 . 2010-02-18 15:58 -------- d-----w- c:\documents and settings\Laura\Application Data\Malwarebytes 2010-02-18 15:54 . 2010-02-18 15:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-02-18 14:21 . 2010-02-18 14:21 -------- d-----w- c:\documents and settings\Administrateur.SAGE-349223619D\Application Data\Malwarebytes 2010-02-18 13:56 . 2010-02-18 13:18 -------- d--h--w- c:\documents and settings\Default User.TEST 2010-02-18 13:56 . 2010-02-18 13:10 -------- d-----w- c:\documents and settings\All Users.TEST 2010-02-18 13:50 . 2010-02-18 13:13 -------- d-----w- C:\winapps 2010-02-18 13:45 . 2010-02-18 21:33 -------- d-----w- C:\TEST 2010-02-18 13:31 . 2010-02-18 13:31 -------- d-----w- c:\program files\Microsoft.NET 2010-02-18 13:26 . 2010-02-18 13:26 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT\Local Settings\Application Data\Microsoft 2010-02-18 13:12 . 2010-02-18 13:12 -------- d-----w- c:\program files\Fichiers communs\Java 2010-02-18 13:12 . 2010-02-18 13:12 -------- d-----w- c:\documents and settings\Default User.TEST\Local Settings\Application Data\Sun 2010-02-18 13:12 . 2010-02-18 13:12 -------- d-----w- c:\documents and settings\Default User.TEST\Local Settings\Application Data\Microsoft 2010-02-18 13:10 . 2010-02-18 13:11 -------- d-sh--w- c:\documents and settings\All Users.TEST\DRM 2010-02-17 06:54 . 2010-02-17 06:54 -------- d-sh--w- c:\documents and settings\Administrateur.LAURA.000\IETldCache 2010-02-16 19:14 . 2010-02-16 19:14 -------- d-sh--w- c:\documents and settings\Administrateur.LAURA\PrivacIE 2010-02-16 19:14 . 2010-02-16 19:14 -------- d-sh--w- c:\documents and settings\Administrateur.LAURA\IETldCache 2010-02-16 18:59 . 2009-04-15 05:29 -------- d--h--w- c:\documents and settings\Administrateur\Voisinage réseau 2010-02-16 17:29 . 2010-02-16 19:51 0 ----a-w- c:\windows\system32\drivers\ysoyznw.sys 2010-02-16 17:27 . 2010-02-16 17:27 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2010-02-08 20:29 . 2010-02-08 20:29 -------- d-----w- c:\documents and settings\Laura\Local Settings\Application Data\Packard Bell 2010-02-08 20:28 . 2010-02-08 20:28 -------- d-----w- c:\program files\Packard Bell 2010-02-05 13:12 . 2007-10-23 08:27 110592 ----a-w- c:\documents and settings\Laura\Application Data\U3\temp\cleanup.exe 2010-02-05 13:11 . 2008-05-02 09:41 3493888 ---ha-w- c:\documents and settings\Laura\Application Data\U3\temp\Launchpad Removal.exe 2010-02-05 13:11 . 2008-04-13 17:57 58752 -c--a-w- c:\windows\system32\dllcache\redbook.sys 2010-02-05 13:11 . 2008-04-13 17:57 58752 ----a-w- c:\windows\system32\drivers\redbook.sys 2010-02-05 13:11 . 2010-02-05 13:12 -------- d-----w- c:\documents and settings\Laura\Application Data\U3 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-25 20:53 . 2009-09-21 08:36 1 ----a-w- c:\documents and settings\Laura\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2010-02-20 09:24 . 2009-09-09 14:54 47224 ----a-w- c:\documents and settings\Laura\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-02-19 18:00 . 2009-06-26 15:38 -------- d-----w- c:\program files\Launch Manager 2010-02-19 08:19 . 2010-02-19 08:19 62976 ------w- c:\windows\system32\drivers\drw1.tmp 2010-02-18 13:29 . 2009-04-15 04:47 -------- d-----w- c:\program files\Microsoft Works 2010-02-18 13:13 . 2009-09-18 16:21 -------- d-----w- c:\program files\Java 2010-02-17 07:01 . 2010-02-17 06:53 64016 ----a-w- c:\documents and settings\Administrateur.LAURA.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-02-16 23:32 . 2009-10-10 15:14 -------- d-----w- c:\documents and settings\Laura\Application Data\Skype 2010-02-16 23:29 . 2009-10-10 15:16 -------- d-----w- c:\documents and settings\Laura\Application Data\skypePM 2010-02-16 08:58 . 2009-04-15 13:17 81816 ----a-w- c:\windows\system32\perfc00C.dat 2010-02-16 08:58 . 2009-04-15 13:17 502688 ----a-w- c:\windows\system32\perfh00C.dat 2010-01-24 11:56 . 2010-01-24 11:55 -------- d-----w- c:\program files\Fichiers communs\Adobe 2009-12-31 16:50 . 2009-04-15 13:16 353792 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-21 19:07 . 2009-04-15 13:16 916480 ----a-w- c:\windows\system32\wininet.dll 2009-12-17 07:41 . 2009-04-15 03:34 347648 ----a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:09 . 2009-04-15 13:16 33280 ----a-w- c:\windows\system32\csrsrv.dll 2009-12-09 10:08 . 2008-04-13 19:07 2147328 ----a-w- c:\windows\system32\ntoskrnl.exe 2009-12-09 10:08 . 2008-04-13 19:07 2025984 ----a-w- c:\windows\system32\ntkrnlpa.exe 2009-12-04 18:22 . 2009-04-15 13:16 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys . ------- Sigcheck ------- [-] 2007-10-13 . E46FB493E3B33704F0715020CF52106B . 578048 . . [5.1.2600.2180] . . c:\windows\system32\user32.DLL [7] 2008-04-14 . 59DC5BB82E4C8E0B3EADCFDBC44BA6E4 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ctfmon.exe c:\windows\System32\ctfmon.exe ... manque !! . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LManager"="c:\program files\Launch Manager\LManager.exe" [2009-02-20 817672] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000] c:\documents and settings\Laura\Menu D‚marrer\Programmes\D‚marrage\ ihaupd32.exe [2008-4-14 33280] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Remote System Protection"=rundll32.exe c:\windows\system32\er64o8q8.dll, HUI_proc [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "HotKeysCmds"=c:\windows\system32\hkcmd.exe "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "LManager"=c:\program files\Launch Manager\LManager.exe "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" "SynTPEnh"=c:\program files\Synaptics\SynTP\SynTPEnh.exe "MSPY2002"=c:\windows\system32\IME\PINTLGNT\ImScInst.exe /SYNC "IgfxTray"=c:\windows\system32\igfxtray.exe "PersistenceThread"=c:\windows\system32\PersistenceThread.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [20/02/2010 10:32 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswfsblk.sys [20/02/2010 10:32 20560] R2 PowerSave;PowerSave Service;c:\program files\Packard Bell\Software Suite\PowerSave\PSPBSSS.exe [06/04/2009 10:35 1002016] R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [15/04/2009 06:46 237568] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [03/02/2010 13:20 1043784] R3 igd;igd;c:\windows\system32\drivers\igxpmp32.sys [15/04/2009 05:38 5096544] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\tuneuputilitiesdriver32.sys [14/10/2009 07:24 10064] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [18/02/2010 21:31 38224] --- Autres Services/Pilotes en mémoire --- *Deregistered* - kgwaa HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contenu du dossier 'Tâches planifiées' 2010-02-28 c:\windows\Tasks\Recherche de problèmes automatique.job - c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2010-02-03 12:26] 2010-02-28 c:\windows\Tasks\User_Feed_Synchronization-{F537AE05-058F-4A81-BED2-BB2CB3A29FE9}.job - c:\windows\system32\msfeedssync.exe [2007-08-13 02:31] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=0&o=xph&d=0909&m=ao751h uInternet Connection Wizard,ShellNext = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=0&o=xph&d=0909&m=ao751h IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Laura\Application Data\Mozilla\Firefox\Profiles\1y0g7ezb.default\ FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- PARAMETRES FIREFOX ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . - - - - ORPHELINS SUPPRIMES - - - - BHO-{A3BA40A2-74F0-42BD-F434-00B15A2C8953} - c:\windows\system32\io74f.dll HKCU-Run-Remote System Protection - c:\windows\system32\io74f.dll SharedTaskScheduler-{A3BA40A2-74F0-42BD-F434-00B15A2C8953} - c:\windows\system32\io74f.dll AddRemove-Dr. Guard - c:\program files\Dr. Guard\Uninstall.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-28 12:06 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\kgwaa] . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'Explorer.EXE'(736) c:\windows\system32\eappprxy.dll c:\windows\system32\webcheck.dll . ------------------------ Autres processus actifs ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\documents and settings\Laura\Menu Démarrer\Programmes\Démarrage\ihaupd32.exe c:\windows\system32\dwwin.exe c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe . ************************************************************************** . Heure de fin: 2010-02-28 12:10:18 - La machine a redémarré ComboFix-quarantined-files.txt 2010-02-28 11:10 Avant-CF: 138 325 905 408 octets libres Après-CF: 138 341 089 280 octets libres WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect multi(0)disk(0)rdisk(0)partition(2)\TEST="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect - - End Of File - - BB3B779FA99ED7E6C1FDB91E5BA62FC1