y_moi

Bonsoir Je te remercie pour tout le temps passé , et si je pouvais te transmettre par MP un pastis bien mérité , ce serait avec plaisir! Je te souhaites une bonne fin de WE Que dois-je faire exactement pour clore le sujet? (c'est ma première expérience d'un forum d'aide) En tout cas , chapeau pour ton expertise Bye bye

Bonsoir Apollo ci-joint le rapport Kaspersky après avoir effectué toutes les manips. Il apparait encore un petit problème, mais c'est de ma faute car la clé USB concernée n'était pas connectée lors des opérations précédentes. Je vais supprimer le dossier en questions qui ne me sert pas. -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0: scan report Saturday, May 8, 2010 Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Friday, May 07, 2010 21:52:22 Records in database: 4085222 -------------------------------------------------------------------------------- Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ L:\ M:\ N:\ Scan statistics: Objects scanned: 97814 Threats found: 1 Infected objects found: 1 Suspicious objects found: 0 Scan duration: 01:36:33 File name / Threat / Threats count G:\OUTILS\Outils Photos Videos\VirtualDubMOD_1.5.10.2_b2540_Fr.exe Infected: not-a-virus:AdWare.Win32.Rabio.db 1 Selected area has been scanned. Il reste sur le bureau le TFC.exe .Dois-je le supprimer? @+

voilà le rapport: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Version de la base de données: 4077 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 08/05/2010 15:33:38 mbam-log-2010-05-08 (15-33-38).txt Type d'examen: Examen rapide Elément(s) analysé(s): 144360 Temps écoulé: 5 minute(s), 33 seconde(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 0 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): (Aucun élément nuisible détecté) Sans vouloir aller trop vite, faut-il supprimer tous les fichiers que j'ai entassés sur le bureau? @+

OK, je fais ça dans la foulée. A tout à l'heure.

Merci Apollo pour tes directives très claires. J'ai effectué les opérations demandées sans être connecté. J'ai ensuite arrêté le PC, puis rebooté apparemment sans problème. La connection internet a l'air opérationnelle. Voici les rapports des opérations effectuées: 14:07:14:953 0920 TDSS rootkit removing tool 2.2.8.1 Mar 22 2010 10:43:04 14:07:14:953 0920 ================================================================================ 14:07:14:953 0920 SystemInfo: 14:07:14:953 0920 OS Version: 5.1.2600 ServicePack: 2.0 14:07:14:953 0920 Product type: Workstation 14:07:14:953 0920 ComputerName: A2 14:07:14:953 0920 UserName: Elisabeth 14:07:14:953 0920 Windows directory: C:\WINDOWS 14:07:14:953 0920 Processor architecture: Intel x86 14:07:14:953 0920 Number of processors: 2 14:07:14:953 0920 Page size: 0x1000 14:07:14:968 0920 Boot type: Normal boot 14:07:14:968 0920 ================================================================================ 14:07:14:968 0920 UnloadDriverW: NtUnloadDriver error 2 14:07:14:968 0920 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2 14:07:14:984 0920 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system 14:07:14:984 0920 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 14:07:14:984 0920 wfopen_ex: Trying to KLMD file open 14:07:14:984 0920 wfopen_ex: File opened ok (Flags 2) 14:07:14:984 0920 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software 14:07:14:984 0920 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 14:07:14:984 0920 wfopen_ex: Trying to KLMD file open 14:07:14:984 0920 wfopen_ex: File opened ok (Flags 2) 14:07:14:984 0920 Initialize success 14:07:14:984 0920 14:07:14:984 0920 Scanning Services ... 14:07:15:078 0920 Raw services enum returned 362 services 14:07:15:093 0920 Suspicious serv lbrtfdc (h: 0, b: 1) 14:07:15:093 0920 14:07:15:093 0920 Hidden service detected! 14:07:15:093 0920 Service name: lbrtfdc 14:07:15:093 0920 Image path: 14:07:15:093 0920 Type "delete" (without quotes) to delete it: 14:07:46:453 0920 14:07:46:453 0920 By user detect lbrtfdc 14:07:46:468 0920 RegNode HKLM\SYSTEM\ControlSet001\services\lbrtfdc infected by TDSS rootkit ... 14:07:46:468 0920 will be deleted on reboot 14:07:46:468 0920 RegNode HKLM\SYSTEM\ControlSet002\services\lbrtfdc infected by TDSS rootkit ... 14:07:46:468 0920 will be deleted on reboot 14:07:46:468 0920 RegNode HKLM\SYSTEM\ControlSet003\services\lbrtfdc infected by TDSS rootkit ... 14:07:46:468 0920 will be deleted on reboot 14:07:46:468 0920 File C:\WINDOWS\system32\drivers\lbrtfdc.sys infected by TDSS rootkit ... 14:07:46:468 0920 will be deleted on reboot 14:07:46:484 0920 14:07:46:484 0920 Scanning Kernel memory ... 14:07:46:484 0920 Devices to scan: 18 14:07:46:484 0920 14:07:46:484 0920 Driver Name: Disk 14:07:46:484 0920 IRP_MJ_CREATE : F765DC30 14:07:46:484 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:484 0920 IRP_MJ_CLOSE : F765DC30 14:07:46:484 0920 IRP_MJ_READ : F7657D9B 14:07:46:484 0920 IRP_MJ_WRITE : F7657D9B 14:07:46:484 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:484 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:484 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:484 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:484 0920 IRP_MJ_FLUSH_BUFFERS : F7658366 14:07:46:484 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:484 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:484 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:484 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:484 0920 IRP_MJ_DEVICE_CONTROL : F765844D 14:07:46:484 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F765BFC3 14:07:46:484 0920 IRP_MJ_SHUTDOWN : F7658366 14:07:46:484 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:484 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:484 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:484 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:484 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:484 0920 IRP_MJ_POWER : F7659EF3 14:07:46:484 0920 IRP_MJ_SYSTEM_CONTROL : F765EA24 14:07:46:484 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:484 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:484 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:500 0920 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:07:46:500 0920 14:07:46:500 0920 Driver Name: USBSTOR 14:07:46:500 0920 IRP_MJ_CREATE : AA8FD218 14:07:46:500 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:500 0920 IRP_MJ_CLOSE : AA8FD218 14:07:46:500 0920 IRP_MJ_READ : AA8FD23C 14:07:46:500 0920 IRP_MJ_WRITE : AA8FD23C 14:07:46:500 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:500 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:500 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:500 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:500 0920 IRP_MJ_FLUSH_BUFFERS : 804F9749 14:07:46:500 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:500 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:500 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:500 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:500 0920 IRP_MJ_DEVICE_CONTROL : AA8FD180 14:07:46:500 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : AA8F89E6 14:07:46:500 0920 IRP_MJ_SHUTDOWN : 804F9749 14:07:46:500 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:500 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:500 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:500 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:500 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:500 0920 IRP_MJ_POWER : AA8FC5F0 14:07:46:500 0920 IRP_MJ_SYSTEM_CONTROL : AA8FAA6E 14:07:46:500 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:500 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:500 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:515 0920 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1 14:07:46:515 0920 14:07:46:515 0920 Driver Name: Disk 14:07:46:515 0920 IRP_MJ_CREATE : F765DC30 14:07:46:515 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:515 0920 IRP_MJ_CLOSE : F765DC30 14:07:46:515 0920 IRP_MJ_READ : F7657D9B 14:07:46:515 0920 IRP_MJ_WRITE : F7657D9B 14:07:46:515 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:515 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:515 0920 IRP_MJ_FLUSH_BUFFERS : F7658366 14:07:46:515 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:515 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:515 0920 IRP_MJ_DEVICE_CONTROL : F765844D 14:07:46:515 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F765BFC3 14:07:46:515 0920 IRP_MJ_SHUTDOWN : F7658366 14:07:46:515 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:515 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:515 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:515 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:515 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:515 0920 IRP_MJ_POWER : F7659EF3 14:07:46:515 0920 IRP_MJ_SYSTEM_CONTROL : F765EA24 14:07:46:515 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:515 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:515 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:515 0920 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:07:46:515 0920 14:07:46:515 0920 Driver Name: Disk 14:07:46:515 0920 IRP_MJ_CREATE : F765DC30 14:07:46:515 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:515 0920 IRP_MJ_CLOSE : F765DC30 14:07:46:515 0920 IRP_MJ_READ : F7657D9B 14:07:46:515 0920 IRP_MJ_WRITE : F7657D9B 14:07:46:515 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:515 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:515 0920 IRP_MJ_FLUSH_BUFFERS : F7658366 14:07:46:515 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:515 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:515 0920 IRP_MJ_DEVICE_CONTROL : F765844D 14:07:46:515 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F765BFC3 14:07:46:515 0920 IRP_MJ_SHUTDOWN : F7658366 14:07:46:515 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:515 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:515 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:515 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:515 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:515 0920 IRP_MJ_POWER : F7659EF3 14:07:46:515 0920 IRP_MJ_SYSTEM_CONTROL : F765EA24 14:07:46:515 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:515 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:515 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:515 0920 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:07:46:515 0920 14:07:46:515 0920 Driver Name: Disk 14:07:46:515 0920 IRP_MJ_CREATE : F765DC30 14:07:46:515 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:515 0920 IRP_MJ_CLOSE : F765DC30 14:07:46:515 0920 IRP_MJ_READ : F7657D9B 14:07:46:515 0920 IRP_MJ_WRITE : F7657D9B 14:07:46:515 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:515 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:515 0920 IRP_MJ_FLUSH_BUFFERS : F7658366 14:07:46:515 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:515 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:515 0920 IRP_MJ_DEVICE_CONTROL : F765844D 14:07:46:515 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F765BFC3 14:07:46:515 0920 IRP_MJ_SHUTDOWN : F7658366 14:07:46:515 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:515 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:515 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:515 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:515 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:515 0920 IRP_MJ_POWER : F7659EF3 14:07:46:515 0920 IRP_MJ_SYSTEM_CONTROL : F765EA24 14:07:46:515 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:515 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:515 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:515 0920 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:07:46:515 0920 14:07:46:515 0920 Driver Name: Disk 14:07:46:515 0920 IRP_MJ_CREATE : F765DC30 14:07:46:515 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:515 0920 IRP_MJ_CLOSE : F765DC30 14:07:46:515 0920 IRP_MJ_READ : F7657D9B 14:07:46:515 0920 IRP_MJ_WRITE : F7657D9B 14:07:46:515 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:515 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:515 0920 IRP_MJ_FLUSH_BUFFERS : F7658366 14:07:46:515 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:515 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:515 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:515 0920 IRP_MJ_DEVICE_CONTROL : F765844D 14:07:46:515 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F765BFC3 14:07:46:515 0920 IRP_MJ_SHUTDOWN : F7658366 14:07:46:515 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:515 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:531 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:531 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:531 0920 IRP_MJ_POWER : F7659EF3 14:07:46:531 0920 IRP_MJ_SYSTEM_CONTROL : F765EA24 14:07:46:531 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:531 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:531 0920 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:07:46:531 0920 14:07:46:531 0920 Driver Name: USBSTOR 14:07:46:531 0920 IRP_MJ_CREATE : AA8FD218 14:07:46:531 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:531 0920 IRP_MJ_CLOSE : AA8FD218 14:07:46:531 0920 IRP_MJ_READ : AA8FD23C 14:07:46:531 0920 IRP_MJ_WRITE : AA8FD23C 14:07:46:531 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:531 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:531 0920 IRP_MJ_FLUSH_BUFFERS : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_DEVICE_CONTROL : AA8FD180 14:07:46:531 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : AA8F89E6 14:07:46:531 0920 IRP_MJ_SHUTDOWN : 804F9749 14:07:46:531 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:531 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:531 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:531 0920 IRP_MJ_POWER : AA8FC5F0 14:07:46:531 0920 IRP_MJ_SYSTEM_CONTROL : AA8FAA6E 14:07:46:531 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:531 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:531 0920 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1 14:07:46:531 0920 14:07:46:531 0920 Driver Name: USBSTOR 14:07:46:531 0920 IRP_MJ_CREATE : AA8FD218 14:07:46:531 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:531 0920 IRP_MJ_CLOSE : AA8FD218 14:07:46:531 0920 IRP_MJ_READ : AA8FD23C 14:07:46:531 0920 IRP_MJ_WRITE : AA8FD23C 14:07:46:531 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:531 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:531 0920 IRP_MJ_FLUSH_BUFFERS : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_DEVICE_CONTROL : AA8FD180 14:07:46:531 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : AA8F89E6 14:07:46:531 0920 IRP_MJ_SHUTDOWN : 804F9749 14:07:46:531 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:531 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:531 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:531 0920 IRP_MJ_POWER : AA8FC5F0 14:07:46:531 0920 IRP_MJ_SYSTEM_CONTROL : AA8FAA6E 14:07:46:531 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:531 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:531 0920 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1 14:07:46:531 0920 14:07:46:531 0920 Driver Name: USBSTOR 14:07:46:531 0920 IRP_MJ_CREATE : AA8FD218 14:07:46:531 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:531 0920 IRP_MJ_CLOSE : AA8FD218 14:07:46:531 0920 IRP_MJ_READ : AA8FD23C 14:07:46:531 0920 IRP_MJ_WRITE : AA8FD23C 14:07:46:531 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:531 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:531 0920 IRP_MJ_FLUSH_BUFFERS : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_DEVICE_CONTROL : AA8FD180 14:07:46:531 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : AA8F89E6 14:07:46:531 0920 IRP_MJ_SHUTDOWN : 804F9749 14:07:46:531 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:531 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:531 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:531 0920 IRP_MJ_POWER : AA8FC5F0 14:07:46:531 0920 IRP_MJ_SYSTEM_CONTROL : AA8FAA6E 14:07:46:531 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:531 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:531 0920 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1 14:07:46:531 0920 14:07:46:531 0920 Driver Name: USBSTOR 14:07:46:531 0920 IRP_MJ_CREATE : AA8FD218 14:07:46:531 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:531 0920 IRP_MJ_CLOSE : AA8FD218 14:07:46:531 0920 IRP_MJ_READ : AA8FD23C 14:07:46:531 0920 IRP_MJ_WRITE : AA8FD23C 14:07:46:531 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:531 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:531 0920 IRP_MJ_FLUSH_BUFFERS : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_DEVICE_CONTROL : AA8FD180 14:07:46:531 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : AA8F89E6 14:07:46:531 0920 IRP_MJ_SHUTDOWN : 804F9749 14:07:46:531 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:531 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:531 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:531 0920 IRP_MJ_POWER : AA8FC5F0 14:07:46:531 0920 IRP_MJ_SYSTEM_CONTROL : AA8FAA6E 14:07:46:531 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:531 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:531 0920 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1 14:07:46:531 0920 14:07:46:531 0920 Driver Name: Disk 14:07:46:531 0920 IRP_MJ_CREATE : F765DC30 14:07:46:531 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:531 0920 IRP_MJ_CLOSE : F765DC30 14:07:46:531 0920 IRP_MJ_READ : F7657D9B 14:07:46:531 0920 IRP_MJ_WRITE : F7657D9B 14:07:46:531 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:531 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:531 0920 IRP_MJ_FLUSH_BUFFERS : F7658366 14:07:46:531 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:531 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_DEVICE_CONTROL : F765844D 14:07:46:531 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F765BFC3 14:07:46:531 0920 IRP_MJ_SHUTDOWN : F7658366 14:07:46:531 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:531 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:531 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:531 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:531 0920 IRP_MJ_POWER : F7659EF3 14:07:46:531 0920 IRP_MJ_SYSTEM_CONTROL : F765EA24 14:07:46:531 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:531 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:531 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:546 0920 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:07:46:546 0920 14:07:46:546 0920 Driver Name: Disk 14:07:46:546 0920 IRP_MJ_CREATE : F765DC30 14:07:46:546 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:546 0920 IRP_MJ_CLOSE : F765DC30 14:07:46:546 0920 IRP_MJ_READ : F7657D9B 14:07:46:546 0920 IRP_MJ_WRITE : F7657D9B 14:07:46:546 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:546 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:546 0920 IRP_MJ_FLUSH_BUFFERS : F7658366 14:07:46:546 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_DEVICE_CONTROL : F765844D 14:07:46:546 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F765BFC3 14:07:46:546 0920 IRP_MJ_SHUTDOWN : F7658366 14:07:46:546 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:546 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:546 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:546 0920 IRP_MJ_POWER : F7659EF3 14:07:46:546 0920 IRP_MJ_SYSTEM_CONTROL : F765EA24 14:07:46:546 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:546 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:546 0920 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:07:46:546 0920 14:07:46:546 0920 Driver Name: Disk 14:07:46:546 0920 IRP_MJ_CREATE : F765DC30 14:07:46:546 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:546 0920 IRP_MJ_CLOSE : F765DC30 14:07:46:546 0920 IRP_MJ_READ : F7657D9B 14:07:46:546 0920 IRP_MJ_WRITE : F7657D9B 14:07:46:546 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:546 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:546 0920 IRP_MJ_FLUSH_BUFFERS : F7658366 14:07:46:546 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_DEVICE_CONTROL : F765844D 14:07:46:546 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F765BFC3 14:07:46:546 0920 IRP_MJ_SHUTDOWN : F7658366 14:07:46:546 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:546 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:546 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:546 0920 IRP_MJ_POWER : F7659EF3 14:07:46:546 0920 IRP_MJ_SYSTEM_CONTROL : F765EA24 14:07:46:546 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:546 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:546 0920 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:07:46:546 0920 14:07:46:546 0920 Driver Name: Disk 14:07:46:546 0920 IRP_MJ_CREATE : F765DC30 14:07:46:546 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:546 0920 IRP_MJ_CLOSE : F765DC30 14:07:46:546 0920 IRP_MJ_READ : F7657D9B 14:07:46:546 0920 IRP_MJ_WRITE : F7657D9B 14:07:46:546 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:546 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:546 0920 IRP_MJ_FLUSH_BUFFERS : F7658366 14:07:46:546 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_DEVICE_CONTROL : F765844D 14:07:46:546 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F765BFC3 14:07:46:546 0920 IRP_MJ_SHUTDOWN : F7658366 14:07:46:546 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:546 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:546 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:546 0920 IRP_MJ_POWER : F7659EF3 14:07:46:546 0920 IRP_MJ_SYSTEM_CONTROL : F765EA24 14:07:46:546 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:546 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:546 0920 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:07:46:546 0920 14:07:46:546 0920 Driver Name: Disk 14:07:46:546 0920 IRP_MJ_CREATE : F765DC30 14:07:46:546 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:546 0920 IRP_MJ_CLOSE : F765DC30 14:07:46:546 0920 IRP_MJ_READ : F7657D9B 14:07:46:546 0920 IRP_MJ_WRITE : F7657D9B 14:07:46:546 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:546 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:546 0920 IRP_MJ_FLUSH_BUFFERS : F7658366 14:07:46:546 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_DEVICE_CONTROL : F765844D 14:07:46:546 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F765BFC3 14:07:46:546 0920 IRP_MJ_SHUTDOWN : F7658366 14:07:46:546 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:546 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:546 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:546 0920 IRP_MJ_POWER : F7659EF3 14:07:46:546 0920 IRP_MJ_SYSTEM_CONTROL : F765EA24 14:07:46:546 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:546 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:546 0920 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:07:46:546 0920 14:07:46:546 0920 Driver Name: Disk 14:07:46:546 0920 IRP_MJ_CREATE : F765DC30 14:07:46:546 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:546 0920 IRP_MJ_CLOSE : F765DC30 14:07:46:546 0920 IRP_MJ_READ : F7657D9B 14:07:46:546 0920 IRP_MJ_WRITE : F7657D9B 14:07:46:546 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:546 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:546 0920 IRP_MJ_FLUSH_BUFFERS : F7658366 14:07:46:546 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:546 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_DEVICE_CONTROL : F765844D 14:07:46:546 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F765BFC3 14:07:46:546 0920 IRP_MJ_SHUTDOWN : F7658366 14:07:46:546 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:546 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:546 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:546 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:546 0920 IRP_MJ_POWER : F7659EF3 14:07:46:546 0920 IRP_MJ_SYSTEM_CONTROL : F765EA24 14:07:46:546 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:546 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:546 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:562 0920 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:07:46:562 0920 14:07:46:562 0920 Driver Name: ultra 14:07:46:562 0920 IRP_MJ_CREATE : F749944C 14:07:46:562 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:562 0920 IRP_MJ_CLOSE : F749944C 14:07:46:562 0920 IRP_MJ_READ : 804F9749 14:07:46:562 0920 IRP_MJ_WRITE : 804F9749 14:07:46:562 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:562 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:562 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:562 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:562 0920 IRP_MJ_FLUSH_BUFFERS : 804F9749 14:07:46:562 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:562 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:562 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:562 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:562 0920 IRP_MJ_DEVICE_CONTROL : F749944C 14:07:46:562 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F749944C 14:07:46:562 0920 IRP_MJ_SHUTDOWN : 804F9749 14:07:46:562 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:562 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:562 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:562 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:562 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:562 0920 IRP_MJ_POWER : F749944C 14:07:46:562 0920 IRP_MJ_SYSTEM_CONTROL : F749944C 14:07:46:562 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:562 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:562 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:562 0920 C:\WINDOWS\system32\DRIVERS\ultra.sys - Verdict: 1 14:07:46:562 0920 14:07:46:562 0920 Driver Name: iaStor 14:07:46:562 0920 IRP_MJ_CREATE : F7B18186 14:07:46:562 0920 IRP_MJ_CREATE_NAMED_PIPE : 804F9749 14:07:46:562 0920 IRP_MJ_CLOSE : F7B18186 14:07:46:562 0920 IRP_MJ_READ : 804F9749 14:07:46:562 0920 IRP_MJ_WRITE : 804F9749 14:07:46:562 0920 IRP_MJ_QUERY_INFORMATION : 804F9749 14:07:46:562 0920 IRP_MJ_SET_INFORMATION : 804F9749 14:07:46:562 0920 IRP_MJ_QUERY_EA : 804F9749 14:07:46:562 0920 IRP_MJ_SET_EA : 804F9749 14:07:46:562 0920 IRP_MJ_FLUSH_BUFFERS : 804F9749 14:07:46:562 0920 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9749 14:07:46:562 0920 IRP_MJ_SET_VOLUME_INFORMATION : 804F9749 14:07:46:562 0920 IRP_MJ_DIRECTORY_CONTROL : 804F9749 14:07:46:562 0920 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9749 14:07:46:562 0920 IRP_MJ_DEVICE_CONTROL : F7B1B896 14:07:46:562 0920 IRP_MJ_INTERNAL_DEVICE_CONTROL : F7B1BB58 14:07:46:562 0920 IRP_MJ_SHUTDOWN : 804F9749 14:07:46:562 0920 IRP_MJ_LOCK_CONTROL : 804F9749 14:07:46:562 0920 IRP_MJ_CLEANUP : 804F9749 14:07:46:562 0920 IRP_MJ_CREATE_MAILSLOT : 804F9749 14:07:46:562 0920 IRP_MJ_QUERY_SECURITY : 804F9749 14:07:46:562 0920 IRP_MJ_SET_SECURITY : 804F9749 14:07:46:562 0920 IRP_MJ_POWER : F7B20E66 14:07:46:562 0920 IRP_MJ_SYSTEM_CONTROL : F7B20FC6 14:07:46:562 0920 IRP_MJ_DEVICE_CHANGE : 804F9749 14:07:46:562 0920 IRP_MJ_QUERY_QUOTA : 804F9749 14:07:46:562 0920 IRP_MJ_SET_QUOTA : 804F9749 14:07:46:593 0920 C:\WINDOWS\system32\drivers\iaStor.sys - Verdict: 1 14:07:46:593 0920 Reboot required for cure complete.. 14:07:46:609 0920 Cure on reboot scheduled successfully 14:07:46:609 0920 14:07:46:609 0920 Completed 14:07:46:609 0920 14:07:46:609 0920 Results: 14:07:46:609 0920 Memory objects infected / cured / cured on reboot: 0 / 0 / 0 14:07:46:609 0920 Registry objects infected / cured / cured on reboot: 3 / 0 / 3 14:07:46:609 0920 File objects infected / cured / cured on reboot: 1 / 0 / 1 14:07:46:609 0920 14:07:46:609 0920 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system 14:07:46:609 0920 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software 14:07:46:609 0920 KLMD(ARK) unloaded successfully ComboFix 10-05-07.07 - Elisabeth 08/05/2010 14:23:15.2.2 - x86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3582.2838 [GMT 2:00] Lancé depuis: c:\documents and settings\Elisabeth\Bureau\panpan.exe AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} . ((((((((((((((((((((((((((((( Fichiers créés du 2010-04-08 au 2010-05-08 )))))))))))))))))))))))))))))))))))) . 2010-05-08 12:07 . 2010-05-08 12:07 36488 ----a-w- c:\windows\system32\drivers\klmdb.sys 2010-05-08 08:00 . 2009-11-25 09:19 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2010-05-08 08:00 . 2009-03-30 07:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys 2010-05-08 08:00 . 2009-02-13 09:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys 2010-05-08 08:00 . 2009-02-13 09:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys 2010-05-08 08:00 . 2010-05-08 08:00 -------- d-----w- c:\program files\Avira 2010-05-08 08:00 . 2010-05-08 08:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira 2010-05-06 12:45 . 2010-05-06 12:59 -------- d-----w- C:\capus1 2010-05-05 19:07 . 2010-05-05 19:07 -------- d-sh--w- c:\documents and settings\Yvon\PrivacIE 2010-05-05 18:51 . 2010-05-05 18:51 -------- d-----w- c:\program files\Unlocker 2010-05-05 17:27 . 2010-05-05 17:27 -------- d-----w- c:\documents and settings\NetworkService\Bureau 2010-05-05 14:40 . 2010-05-08 12:26 755200 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-05 15:06 . 2006-05-24 03:22 76376 ----a-w- c:\windows\system32\perfc00C.dat 2010-05-05 15:06 . 2006-05-24 03:22 470040 ----a-w- c:\windows\system32\perfh00C.dat 2010-05-05 14:40 . 2008-04-21 07:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-05-05 14:37 . 2008-05-25 19:30 6153352 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-04-29 13:39 . 2008-07-23 20:03 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-29 13:39 . 2008-05-25 19:30 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-04-16 07:32 . 2008-02-04 16:13 -------- d-----w- c:\program files\Google 2010-03-28 11:45 . 2010-03-28 11:45 0 ----a-w- c:\windows\nsreg.dat 2010-03-26 13:59 . 2006-05-24 03:38 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-03-26 11:11 . 2010-03-26 11:11 -------- d-----w- c:\documents and settings\Elisabeth\Application Data\Nokia 2010-03-26 11:11 . 2010-03-26 11:11 -------- d-----w- c:\documents and settings\Elisabeth\Application Data\PC Suite 2010-03-26 11:11 . 2010-03-26 11:11 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite 2010-03-26 11:11 . 2010-03-26 11:10 -------- d-----w- c:\program files\DIFX 2010-03-26 11:09 . 2010-03-26 11:09 95232 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\pcswpcsi.exe 2010-03-26 11:09 . 2010-03-26 11:09 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstCCD.exe 2010-03-26 11:09 . 2010-03-26 11:09 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstPCSFEMsi.exe 2010-03-26 11:09 . 2010-03-26 11:09 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstPCS.exe 2010-03-26 11:09 . 2010-03-26 11:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations 2010-03-26 11:03 . 2010-03-26 11:10 34503960 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Nokia_PC_Suite_fre_web.exe 2010-03-17 14:37 . 2009-10-05 06:51 3803208 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe 2010-02-25 13:03 . 2009-06-20 08:52 389784 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll 2010-02-25 13:03 . 2009-06-20 08:52 823928 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe 2010-02-25 13:03 . 2009-06-20 08:51 1181328 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe . ------- Sigcheck ------- [-] 2008-04-14 . E853F84D3CE2FAA2A802E33CF89AC023 . 579584 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\user32.dll [7] 2007-03-08 . 4D88AAF39ADABFE45958EA1384E2C4FF . 579072 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll [7] 2005-03-02 . C34920EB988CE98910BD6B0417F334EB . 578048 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll [7] 2005-03-02 . 0DF75FB73F705B011630159A43D7C354 . 578048 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB925902$\user32.dll [-] 2004-08-19 . 61C8C283AD063BB697AE61A155C64A5A . 578048 . . [5.1.2600.2180] . . c:\windows\system32\user32.dll [7] 2004-08-10 . E46FB493E3B33704F0715020CF52106B . 578048 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\user32.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TClockEx"="c:\progra~1\TClockEx\TCLOCKEX.EXE" [2000-03-09 90112] "Cld2000.exe"="c:\program files\Calendrier\Cld2000.exe" [2009-10-14 3029504] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-11 68856] "TomTomHOME.exe"="c:\program files\TomTom HOME 2\HOMERunner.exe" [2008-12-09 234856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="Alaunch" [X] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584] "RTHDCPL"="RTHDCPL.EXE" [2005-11-10 15473664] "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-12 139264] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952] "IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-10 44032] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2006-04-18 49152] "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-10-28 401408] "CCUTRAYICON"="c:\program files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2006-04-13 303104] "ImageItEncrypt"="c:\windows\system32\ImageItEncrypt.exe" [2005-12-30 40960] "SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-30 286720] "HP Lamp"="c:\scanjet\PrecisionScanPro\HPLamp.exe" [1999-07-22 42496] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-01-30 788880] "WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2009-05-27 90112] "ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] D‚marrage d'Office.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-8-29 51984] Microsoft Recherche acc‚l‚r‚e.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-8-29 111376] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Acer Zone\\Plug and Record\\Component\\ARAWP.exe"= "c:\\Program Files\\Acer Zone\\Plug and Record\\Component\\DVAX2Process.exe"= "c:\\Program Files\\Acer Zone\\Picture Slide DVD\\Component\\CLSLDVD.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\WINDOWS\\system32\\spoolsv.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "c:\\Program Files\\Outlook Express\\msimn.exe"= "c:\\Program Files\\adslTV\\adsltv.exe"= "c:\\Program Files\\adslTV\\vlc.exe"= "c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"= "c:\\Program Files\\TomTom HOME 2\\TomTomHOME.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Spotify\\spotify.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [16/04/2009 21:49 64288] R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [08/05/2010 10:00 108289] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24/09/2009 13:17 1181328] R3 hpusbfd;Hewlett-Packard USB Filter Class;c:\windows\system32\drivers\hpusbfd.sys [04/10/2006 23:20 7552] R3 LVHybrid;LVHybrid service;c:\windows\system32\drivers\LVHybrid.sys [29/06/2006 21:04 660736] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [29/06/2009 22:40 133104] S3 EPPSCSIx;EPPSCSI Driver;c:\windows\system32\drivers\eppscan.sys [30/09/2006 22:10 97880] --- Autres Services/Pilotes en mémoire --- *NewlyCreated* - KLMD21 *Deregistered* - klmd21 *Deregistered* - lbrtfdc [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . Contenu du dossier 'Tâches planifiées' 2010-05-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-06-29 20:39] 2010-05-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-06-29 20:39] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://news.google.fr/nwshp?hl=fr&tab=wn uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s TCP: {CD0B7E54-EB9A-4C5F-9755-03805F3E4586} = 212.27.40.240,212.27.40.241 FF - ProfilePath - c:\documents and settings\Elisabeth\Application Data\Mozilla\Firefox\Profiles\yu4elve9.default\ FF - prefs.js: browser.startup.homepage - hxxp://news.google.fr/nwshp?hl=fr&tab=wn FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll ---- PARAMETRES FIREFOX ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - ORPHELINS SUPPRIMES - - - - SafeBoot-klmdb.sys ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-08 14:26 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... c:\docume~1\ELISAB~1\LOCALS~1\Temp\Perflib_Perfdata_db0.dat 16384 bytes Scan terminé avec succès Fichiers cachés: 1 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lbrtfdc] . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(600) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(2348) c:\windows\system32\msi.dll c:\windows\system32\webcheck.dll . Heure de fin: 2010-05-08 14:28:43 ComboFix-quarantined-files.txt 2010-05-08 12:28 Avant-CF: 105 316 646 912 octets libres Après-CF: 105 263 329 280 octets libres - - End Of File - - 86EF9FF8BA674E049DBE36EEF8452631 J'attends bien sûr tes instructions sur la suite à donner. Merci et à plus tard.

Je viens de terminer l'analyse avec Antivir ( PC déconnecter du réseau). Voici le rapport: Avira AntiVir Personal Date de création du fichier de rapport : samedi 8 mai 2010 10:06 La recherche porte sur 2081209 souches de virus. Détenteur de la licence : Avira AntiVir Personal - FREE Antivirus Numéro de série : 0000149996-ADJIE-0000001 Plateforme : Windows XP Version de Windows : (Service Pack 2) [5.1.2600] Mode Boot : Démarré normalement Identifiant : SYSTEM Nom de l'ordinateur : A2 Informations de version : BUILD.DAT : 9.0.0.74 21698 Bytes 04/12/2009 13:56:00 AVSCAN.EXE : 9.0.3.10 466689 Bytes 13/10/2009 09:25:46 AVSCAN.DLL : 9.0.3.0 49409 Bytes 03/03/2009 08:21:02 LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 09:35:11 LUKERES.DLL : 9.0.2.0 13569 Bytes 03/03/2009 08:21:31 VBASE000.VDF : 7.10.0.0 19875328 Bytes 06/11/2009 12:20:32 VBASE001.VDF : 7.10.1.0 1372672 Bytes 19/11/2009 12:20:32 VBASE002.VDF : 7.10.3.1 3143680 Bytes 20/01/2010 12:20:32 VBASE003.VDF : 7.10.3.75 996864 Bytes 26/01/2010 12:20:32 VBASE004.VDF : 7.10.4.203 1579008 Bytes 05/03/2010 12:20:32 VBASE005.VDF : 7.10.6.82 2494464 Bytes 15/04/2010 12:20:32 VBASE006.VDF : 7.10.6.83 2048 Bytes 15/04/2010 12:20:32 VBASE007.VDF : 7.10.6.84 2048 Bytes 15/04/2010 12:20:32 VBASE008.VDF : 7.10.6.85 2048 Bytes 15/04/2010 12:20:32 VBASE009.VDF : 7.10.6.86 2048 Bytes 15/04/2010 12:20:32 VBASE010.VDF : 7.10.6.87 2048 Bytes 15/04/2010 12:20:32 VBASE011.VDF : 7.10.6.88 2048 Bytes 15/04/2010 12:20:32 VBASE012.VDF : 7.10.6.89 2048 Bytes 15/04/2010 12:20:32 VBASE013.VDF : 7.10.6.90 2048 Bytes 15/04/2010 12:20:32 VBASE014.VDF : 7.10.6.123 126464 Bytes 19/04/2010 12:20:32 VBASE015.VDF : 7.10.6.152 123392 Bytes 21/04/2010 12:20:32 VBASE016.VDF : 7.10.6.178 122880 Bytes 22/04/2010 12:20:32 VBASE017.VDF : 7.10.6.206 120320 Bytes 26/04/2010 12:20:32 VBASE018.VDF : 7.10.6.232 99328 Bytes 28/04/2010 12:20:32 VBASE019.VDF : 7.10.7.2 155648 Bytes 30/04/2010 12:20:32 VBASE020.VDF : 7.10.7.26 119808 Bytes 04/05/2010 12:20:32 VBASE021.VDF : 7.10.7.51 118272 Bytes 06/05/2010 12:20:32 VBASE022.VDF : 7.10.7.52 2048 Bytes 06/05/2010 12:20:32 VBASE023.VDF : 7.10.7.53 2048 Bytes 06/05/2010 12:20:32 VBASE024.VDF : 7.10.7.54 2048 Bytes 06/05/2010 12:20:32 VBASE025.VDF : 7.10.7.55 2048 Bytes 06/05/2010 12:20:32 VBASE026.VDF : 7.10.7.56 2048 Bytes 06/05/2010 12:20:32 VBASE027.VDF : 7.10.7.57 2048 Bytes 06/05/2010 12:20:32 VBASE028.VDF : 7.10.7.58 2048 Bytes 06/05/2010 12:20:32 VBASE029.VDF : 7.10.7.59 2048 Bytes 06/05/2010 12:20:32 VBASE030.VDF : 7.10.7.60 2048 Bytes 06/05/2010 12:20:32 VBASE031.VDF : 7.10.7.66 70656 Bytes 07/05/2010 12:20:32 Version du moteur : 8.2.1.236 AEVDF.DLL : 8.1.2.0 106868 Bytes 07/05/2010 12:20:30 AESCRIPT.DLL : 8.1.3.28 1298810 Bytes 07/05/2010 12:20:30 AESCN.DLL : 8.1.5.0 127347 Bytes 07/05/2010 12:20:30 AESBX.DLL : 8.1.3.1 254324 Bytes 07/05/2010 12:20:30 AERDL.DLL : 8.1.4.6 541043 Bytes 07/05/2010 12:20:30 AEPACK.DLL : 8.2.1.1 426358 Bytes 07/05/2010 12:20:30 AEOFFICE.DLL : 8.1.0.41 201083 Bytes 07/05/2010 12:20:30 AEHEUR.DLL : 8.1.1.27 2670967 Bytes 07/05/2010 12:20:30 AEHELP.DLL : 8.1.11.3 242039 Bytes 07/05/2010 12:20:30 AEGEN.DLL : 8.1.3.7 373106 Bytes 07/05/2010 12:20:30 AEEMU.DLL : 8.1.2.0 393588 Bytes 07/05/2010 12:20:30 AECORE.DLL : 8.1.15.1 192886 Bytes 07/05/2010 12:20:28 AEBB.DLL : 8.1.1.0 53618 Bytes 07/05/2010 12:20:28 AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 06:47:30 AVPREF.DLL : 9.0.3.0 44289 Bytes 26/08/2009 13:13:31 AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 12:34:28 AVREG.DLL : 9.0.0.0 36609 Bytes 07/11/2008 13:24:42 AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 13:05:22 AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 08:36:37 SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 13:03:49 SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 06:20:57 NETNT.DLL : 9.0.0.0 11521 Bytes 07/11/2008 13:40:59 RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 17/06/2009 11:44:26 RCTEXT.DLL : 9.0.73.0 88321 Bytes 02/11/2009 14:58:32 Configuration pour la recherche actuelle : Nom de la tâche...............................: Contrôle intégral du système Fichier de configuration......................: c:\program files\avira\antivir desktop\sysscan.avp Documentation.................................: bas Action principale.............................: interactif Action secondaire.............................: ignorer Recherche sur les secteurs d'amorçage maître..: marche Recherche sur les secteurs d'amorçage.........: marche Secteurs d'amorçage...........................: C:, D:, K:, L:, M:, Recherche dans les programmes actifs..........: marche Recherche en cours sur l'enregistrement.......: marche Recherche de Rootkits.........................: marche Contrôle d'intégrité de fichiers système......: arrêt Fichier mode de recherche.....................: Tous les fichiers Recherche sur les archives....................: marche Limiter la profondeur de récursivité..........: 20 Archive Smart Extensions......................: marche Heuristique de macrovirus.....................: marche Heuristique fichier...........................: moyen Début de la recherche : samedi 8 mai 2010 10:06 La recherche d'objets cachés commence. HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Eventlog\System\lbrtfdc\eventmessagefile [iNFO] L'entrée d'enregistrement n'est pas visible. HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Eventlog\System\lbrtfdc\typessupported [iNFO] L'entrée d'enregistrement n'est pas visible. HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lbrtfdc\errorcontrol [iNFO] L'entrée d'enregistrement n'est pas visible. HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lbrtfdc\group [iNFO] L'entrée d'enregistrement n'est pas visible. HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lbrtfdc\start [iNFO] L'entrée d'enregistrement n'est pas visible. HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lbrtfdc\tag [iNFO] L'entrée d'enregistrement n'est pas visible. HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lbrtfdc\type [iNFO] L'entrée d'enregistrement n'est pas visible. HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lbrtfdc\wywts1iy1 [iNFO] L'entrée d'enregistrement n'est pas visible. HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lbrtfdc\r5cw2fhl1 [iNFO] L'entrée d'enregistrement n'est pas visible. HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lbrtfdc\g8n2dm0y2 [iNFO] L'entrée d'enregistrement n'est pas visible. '54244' objets ont été contrôlés, '10' objets cachés ont été trouvés. La recherche sur les processus démarrés commence : Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés Processus de recherche 'msiexec.exe' - '1' module(s) sont contrôlés Processus de recherche 'FINDFAST.EXE' - '1' module(s) sont contrôlés Processus de recherche 'OSA.EXE' - '1' module(s) sont contrôlés Processus de recherche 'ctfmon.exe' - '1' module(s) sont contrôlés Processus de recherche 'HOMERunner.exe' - '1' module(s) sont contrôlés Processus de recherche 'iPodService.exe' - '1' module(s) sont contrôlés Processus de recherche 'GoogleToolbarNotifier.exe' - '1' module(s) sont contrôlés Processus de recherche 'Cld2000.exe' - '1' module(s) sont contrôlés Processus de recherche 'UnlockerAssistant.exe' - '1' module(s) sont contrôlés Processus de recherche 'jusched.exe' - '1' module(s) sont contrôlés Processus de recherche 'ACDaemon.exe' - '1' module(s) sont contrôlés Processus de recherche 'DTVSchdl.exe' - '1' module(s) sont contrôlés Processus de recherche 'CCU_Engine.exe' - '1' module(s) sont contrôlés Processus de recherche 'AAWTray.exe' - '1' module(s) sont contrôlés Processus de recherche 'iTunesHelper.exe' - '1' module(s) sont contrôlés Processus de recherche 'HPLamp.exe' - '1' module(s) sont contrôlés Processus de recherche 'vsnpstd2.exe' - '1' module(s) sont contrôlés Processus de recherche 'CCU_TrayIcon.exe' - '1' module(s) sont contrôlés Processus de recherche 'eRAgent.exe' - '1' module(s) sont contrôlés Processus de recherche 'SysMonitor.exe' - '1' module(s) sont contrôlés Processus de recherche 'ehmsas.exe' - '1' module(s) sont contrôlés Processus de recherche 'IAAnotif.exe' - '1' module(s) sont contrôlés Processus de recherche 'PDVDServ.exe' - '1' module(s) sont contrôlés Processus de recherche 'RTHDCPL.exe' - '1' module(s) sont contrôlés Processus de recherche 'ehtray.exe' - '1' module(s) sont contrôlés Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés Processus de recherche 'ati2evxx.exe' - '1' module(s) sont contrôlés Processus de recherche 'rsvp.exe' - '1' module(s) sont contrôlés Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés Processus de recherche 'wmiprvse.exe' - '1' module(s) sont contrôlés Processus de recherche 'wmiapsrv.exe' - '1' module(s) sont contrôlés Processus de recherche 'unsecapp.exe' - '1' module(s) sont contrôlés Processus de recherche 'dllhost.exe' - '1' module(s) sont contrôlés Processus de recherche 'mediaserver.exe' - '1' module(s) sont contrôlés Processus de recherche 'ELService.exe' - '1' module(s) sont contrôlés Processus de recherche 'Remote UI Service.exe' - '1' module(s) sont contrôlés Processus de recherche 'mcrdsvc.exe' - '1' module(s) sont contrôlés Processus de recherche 'MCLServiceATL.exe' - '1' module(s) sont contrôlés Processus de recherche 'ISSM.exe' - '1' module(s) sont contrôlés Processus de recherche 'wdfmgr.exe' - '1' module(s) sont contrôlés Processus de recherche 'ULCDRSvr.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'jqs.exe' - '1' module(s) sont contrôlés Processus de recherche 'IAANTMon.exe' - '1' module(s) sont contrôlés Processus de recherche 'ehSched.exe' - '1' module(s) sont contrôlés Processus de recherche 'ehrecvr.exe' - '1' module(s) sont contrôlés Processus de recherche 'AlertService.exe' - '1' module(s) sont contrôlés Processus de recherche 'MemCheck.exe' - '1' module(s) sont contrôlés Processus de recherche 'ACService.exe' - '1' module(s) sont contrôlés Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés Processus de recherche 'AAWService.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'ati2evxx.exe' - '1' module(s) sont contrôlés Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés Processus de recherche 'services.exe' - '1' module(s) sont contrôlés Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés '69' processus ont été contrôlés avec '69' modules La recherche sur les secteurs d'amorçage maître commence : Secteur d'amorçage maître HD0 [iNFO] Aucun virus trouvé ! Secteur d'amorçage maître HD1 [iNFO] Aucun virus trouvé ! Secteur d'amorçage maître HD2 [iNFO] Aucun virus trouvé ! Secteur d'amorçage maître HD3 [iNFO] Aucun virus trouvé ! Secteur d'amorçage maître HD4 [iNFO] Aucun virus trouvé ! Secteur d'amorçage maître HD5 [iNFO] Aucun virus trouvé ! Secteur d'amorçage maître HD6 [iNFO] Aucun virus trouvé ! La recherche sur les secteurs d'amorçage commence : Secteur d'amorçage 'C:\' [iNFO] Aucun virus trouvé ! Secteur d'amorçage 'D:\' [iNFO] Aucun virus trouvé ! Secteur d'amorçage 'K:\' [iNFO] Aucun virus trouvé ! Secteur d'amorçage 'L:\' [iNFO] Aucun virus trouvé ! Secteur d'amorçage 'M:\' [iNFO] Aucun virus trouvé ! La recherche sur les renvois aux fichiers exécutables (registre) commence : Le registre a été contrôlé ( '81' fichiers). La recherche sur les fichiers sélectionnés commence : Recherche débutant dans 'C:\' <ACER> C:\pagefile.sys [AVERTISSEMENT] Impossible d'ouvrir le fichier ! [REMARQUE] Ce fichier est un fichier système Windows. [REMARQUE] Il est correct que ce fichier ne puisse pas être ouvert pour la recherche. C:\Documents and Settings\All Users\Documents\GPS\altitude\editeur hexa\install.exe [RESULTAT] Contient le modèle de détection du logiciel publicitaire ADWARE/Adware.Gen C:\Documents and Settings\Elisabeth\Menu Démarrer\Programmes\Démarrage\wwwzuc32.exe [RESULTAT] Contient le cheval de Troie TR/Agent.AR.205 [AVERTISSEMENT] Impossible d'ouvrir le fichier ! C:\WINDOWS\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\lbrtfdc.sys [AVERTISSEMENT] Impossible d'ouvrir le fichier ! C:\WINDOWS\system32\drivers\lbrtfdc.sys [RESULTAT] Contient le modèle de détection du rootkit RKIT/Bubnix.S [AVERTISSEMENT] Impossible d'ouvrir le fichier ! Recherche débutant dans 'D:\' <ACERDATA> Recherche débutant dans 'K:\' <VIDEO1> K:\PROGRAM FILES\VirtualDubMod 15102 fr\VirtualDubMOD_1.5.10.2_b2540_Fr.exe [RESULTAT] Contient le modèle de détection du logiciel espion ou publicitaire ADSPY/Rabio.DB K:\Download\fichiers reçus\rockxp.exe [RESULTAT] Contient le modèle de détection du dropper DR/PSW.RAS.A.50 Recherche débutant dans 'L:\' <VIDEO2> Recherche débutant dans 'M:\' <DATA3> M:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138434.sys [RESULTAT] Contient le modèle de détection du rootkit RKIT/Bubnix.S M:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138435.sys [RESULTAT] Contient le modèle de détection du rootkit RKIT/Bubnix.S M:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138436.sys [RESULTAT] Contient le modèle de détection du rootkit RKIT/Bubnix.S M:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138437.sys [RESULTAT] Contient le modèle de détection du rootkit RKIT/Bubnix.S Début de la désinfection : C:\Documents and Settings\All Users\Documents\GPS\altitude\editeur hexa\install.exe [RESULTAT] Contient le modèle de détection du logiciel publicitaire ADWARE/Adware.Gen [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4c582896.qua' ! C:\Documents and Settings\Elisabeth\Menu Démarrer\Programmes\Démarrage\wwwzuc32.exe [RESULTAT] Contient le cheval de Troie TR/Agent.AR.205 [AVERTISSEMENT] Erreur lors de la création d'une copie de sécurité du fichier. Le fichier n'a pas été supprimé. Code d'erreur : 26004 [AVERTISSEMENT] Impossible de trouver le fichier source. [REMARQUE] Tentative en cours d'exécuter l'action à l'aide de la bibliothèque ARK. [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4c5c289f.qua' ! C:\WINDOWS\system32\drivers\lbrtfdc.sys [RESULTAT] Contient le modèle de détection du rootkit RKIT/Bubnix.S [AVERTISSEMENT] Erreur lors de la création d'une copie de sécurité du fichier. Le fichier n'a pas été supprimé. Code d'erreur : 26004 [AVERTISSEMENT] Impossible de trouver le fichier source. [REMARQUE] Tentative en cours d'exécuter l'action à l'aide de la bibliothèque ARK. [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4c57288c.qua' ! K:\PROGRAM FILES\VirtualDubMod 15102 fr\VirtualDubMOD_1.5.10.2_b2540_Fr.exe [RESULTAT] Contient le modèle de détection du logiciel espion ou publicitaire ADSPY/Rabio.DB [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4c572895.qua' ! K:\Download\fichiers reçus\rockxp.exe [RESULTAT] Contient le modèle de détection du dropper DR/PSW.RAS.A.50 [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4c48289b.qua' ! M:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138434.sys [RESULTAT] Contient le modèle de détection du rootkit RKIT/Bubnix.S [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4c16285c.qua' ! M:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138435.sys [RESULTAT] Contient le modèle de détection du rootkit RKIT/Bubnix.S [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4d8872e5.qua' ! M:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138436.sys [RESULTAT] Contient le modèle de détection du rootkit RKIT/Bubnix.S [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4d81cb45.qua' ! M:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138437.sys [RESULTAT] Contient le modèle de détection du rootkit RKIT/Bubnix.S [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4d835a85.qua' ! Fin de la recherche : samedi 8 mai 2010 11:00 Temps nécessaire: 49:53 Minute(s) La recherche a été effectuée intégralement 10470 Les répertoires ont été contrôlés 452106 Des fichiers ont été contrôlés 9 Des virus ou programmes indésirables ont été trouvés 0 Des fichiers ont été classés comme suspects 0 Des fichiers ont été supprimés 0 Des virus ou programmes indésirables ont été réparés 9 Les fichiers ont été déplacés dans la quarantaine 0 Les fichiers ont été renommés 4 Impossible de contrôler des fichiers 452093 Fichiers non infectés 3065 Les archives ont été contrôlées 4 Avertissements 10 Consignes 54244 Des objets ont été contrôlés lors du Rootkitscan 10 Des objets cachés ont été trouvés voilà.Pour rappel, j'ai en permanence sur le bureau du PC une fenêtre : Protection de fichiers Windows Des fichiers nécessaires au fonctionnement de Windows ont été remplacés par des fichiers d'une version non reconnue. Pour maintenir la stabilité du système, Windows doit restaurer la version originale de ces fichiers. Insérer votre CD du SP2 pour Windows XP Fenêtre impossible à supprimer, et je n'ai pas de CD SP2 pour ce système préinstallé, uniquement 2 DVD crées à l'achat avec le recovery system de Acer. A plus tard

Bonjour Apollo Je te remercie d'avoir pris le temps de me répondre. Je suis plutôt un adepte du gratuit, je vais donc essayer Antivir. Je te recontacte dès que j'aurai fait l'analyse. Encore merci et à plus tard.

Bonjour, apparemment j'ai du faire une erreur dans mon premier message puisqu'il n'a pas été pris en compte depuis 2 jours. Peut-être n'ai-je pas posté au bon endroit?Merci dans ce cas de me faire savoir la marche à suivre.Je débute sur le forum et mon PC étant quasiment inutilisable , je fais au mieux à partir d'un portable pour tenter de trouver une solution. Merci encore aux bonnes âmes qui me donneront un coup de main.

rebonjour en plus des rapports hijackthis et combofix déjà envoyés, faut-il faire d'autres controles? Merci de votre aide

Bonjour, c'est ma première demande, désolé si quelques erreurs. Problème après infection et tentatives infructueuses d'éradication avec mes outils (avast, spybot, adaware, mbam). Résultat actuel: UC de 70 à100%, fenêtre permanente sur le bureau ci-dessous: "protection de fichier windows, des fichiers nécessaires ont été remplacés.....insérer votre CD du service Pack2" .Je n'ai pas de CD (système préinstallé). Je poste d'un autre PC. Ci-joint les infos que j'ai pu recueillir: journal avast, hijackthis.log, Combofix.txt Merci de ce que vous pourrez faire pour me guider. Avast: 05/05/2010 16:32:50 SYSTEM 1768 Sign of "JS:Jaderun-A [Expl]" has been found in "C:\Documents and Settings\Elisabeth\Local Settings\Temporary Internet Files\Content.IE5\ODWS94EX\Applet1[1].htm" file. 05/05/2010 16:34:02 SYSTEM 1768 Sign of "Win32:Malware-gen" has been found in "C:\WINDOWS\TEMP\~TM1677.tmp" file. 05/05/2010 16:34:36 SYSTEM 1768 Sign of "VBS:Malware-gen" has been found in "C:\WINDOWS\system32\fjhdyfhsn.bat" file. 05/05/2010 16:34:52 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\aec.sys" file. 05/05/2010 16:34:57 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\ASPI32.sys" file. 05/05/2010 16:35:01 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\asyncmac.sys" file. 05/05/2010 16:35:11 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\atmarpc.sys" file. 05/05/2010 16:35:17 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\brgsp50.sys" file. 05/05/2010 16:35:20 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\btnetdrv.sys" file. 05/05/2010 16:35:52 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\btcusb.sys" file. 05/05/2010 16:36:01 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\btcusb.sys" file. 05/05/2010 16:36:15 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\System32\Drivers\btcusb.sys" file. 05/05/2010 16:39:15 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\program files\ivt corporation\bluesoleil\device\win2k\btnetfilter.sys" file. 05/05/2010 16:39:22 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\ccdecode.sys" file. 05/05/2010 16:39:27 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\Cdaudio.sys" file. 05/05/2010 16:39:31 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\Changer.sys" file. 05/05/2010 16:39:37 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\changer.sys" file. 05/05/2010 16:40:47 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\dmusic.sys" file. 05/05/2010 16:40:47 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\DMusic.sys" file. 05/05/2010 16:40:47 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\drmkaud.sys" file. 05/05/2010 16:40:47 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\drmkaud.sys" file. 05/05/2010 16:40:47 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\drmkaud.sys" file. 05/05/2010 16:40:47 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\eppscan.sys" file. 05/05/2010 16:40:47 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\EPPSCAN.sys" file. 05/05/2010 16:40:48 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\eppscan.sys" file. 05/05/2010 16:40:48 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\fdc.sys" file. 05/05/2010 16:40:48 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\fdc.sys" file. 05/05/2010 16:40:48 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\fdc.sys" file. 05/05/2010 16:40:48 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\flpydisk.sys" file. 05/05/2010 16:40:48 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\flpydisk.sys" file. 05/05/2010 16:40:48 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\flpydisk.sys" file. 05/05/2010 16:40:48 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\goprot51.sys" file. 05/05/2010 16:40:49 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\goprot51.sys" file. 05/05/2010 16:40:49 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\goprot51.sys" file. 05/05/2010 16:40:49 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\hidir.sys" file. 05/05/2010 16:40:49 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\hidir.sys" file. 05/05/2010 16:40:49 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\hidir.sys" file. 05/05/2010 16:40:49 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\i2omgmt.sys" file. 05/05/2010 16:40:49 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\System32\Drivers\i2omgmt.SYS" file. 05/05/2010 16:40:49 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\i2omgmt.sys" file. 05/05/2010 16:40:49 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\i8042prt.sys" file. 05/05/2010 16:40:49 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\i8042prt.sys" file. 05/05/2010 16:40:50 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\i8042prt.sys" file. 05/05/2010 16:40:50 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\ip6fw.sys" file. 05/05/2010 16:40:50 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys" file. 05/05/2010 16:40:50 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\ip6fw.sys" file. 05/05/2010 16:40:50 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\ipfltdrv.sys" file. 05/05/2010 16:40:50 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys" file. 05/05/2010 16:40:50 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\ipfltdrv.sys" file. 05/05/2010 16:40:50 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\ipinip.sys" file. 05/05/2010 16:40:50 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\ipinip.sys" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\ipinip.sys" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\irbus.sys" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\IrBus.sys" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\irbus.sys" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\irenum.sys" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\irenum.sys" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\irenum.sys" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\lbrtfdc.sys" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\System32\Drivers\lbrtfdc.SYS" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\lbrtfdc.sys" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\lkbdflt2.sys" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\lkbdflt2.sys" file. 05/05/2010 16:40:51 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\lkbdflt2.sys" file. 05/05/2010 16:40:52 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\mhndrv.sys" file. 05/05/2010 16:40:52 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\mhndrv.sys" file. 05/05/2010 16:40:52 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\mhndrv.sys" file. 05/05/2010 16:40:52 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\mpe.sys" file. 05/05/2010 16:40:52 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\DRIVERS\MPE.sys" file. 05/05/2010 16:40:52 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\mpe.sys" file. 05/05/2010 16:40:52 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\mskssrv.sys" file. 05/05/2010 16:40:52 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\MSKSSRV.sys" file. 05/05/2010 16:40:53 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "\\127.0.0.1\admin$\system32\drivers\mskssrv.sys" file. 05/05/2010 16:41:50 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\i2omgmt.sys" file. 05/05/2010 16:41:50 SYSTEM 1768 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\lbrtfdc.sys" file. 05/05/2010 17:52:27 SYSTEM 236 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\btcusb.sys" file. 05/05/2010 17:52:32 SYSTEM 236 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\aec.sys" file. 05/05/2010 17:52:34 SYSTEM 236 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\aec.sys.tmp" file. 05/05/2010 17:52:39 SYSTEM 236 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\ccdecode.sys" file. 05/05/2010 17:52:44 SYSTEM 236 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\ccdecode.sys.tmp" file. 05/05/2010 17:52:45 SYSTEM 236 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\cdaudio.sys" file. 05/05/2010 17:52:47 SYSTEM 236 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\cdaudio.sys.tmp" file. 05/05/2010 17:52:51 SYSTEM 236 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\changer.sys" file. 05/05/2010 23:07:21 Elisabeth 408 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\RECYCLER\S-1-5-21-4059982494-2053908314-2402570644-1006\Dc2.sys" file. 05/05/2010 23:08:32 Elisabeth 408 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\drivers\i2omgmt.sys" file. 05/05/2010 23:23:50 SYSTEM 1576 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004. 05/05/2010 23:24:31 SYSTEM 1576 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004. 05/05/2010 23:24:32 SYSTEM 1576 An error has occured while attempting to update. Please check the logs. 06/05/2010 09:58:22 Elisabeth 300 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "M:\btcusb.sys" file. 06/05/2010 09:58:36 Elisabeth 300 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "M:\ASPI32.sys" file. 06/05/2010 09:58:52 Elisabeth 300 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "M:\Changer.sys" file. 06/05/2010 09:59:08 Elisabeth 300 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "M:\brgsp50.sys" file. 06/05/2010 11:12:34 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\System32\Drivers\lbrtfdc.sys" file. 06/05/2010 11:12:39 Elisabeth 4656 Sign of "" has been found in "C:\WINDOWS\System32\Drivers\lbrtfdc.sys||AntiRootkit [sVC]||Win32:Rootkit-gen [Rtk]|40|0|2|COO1||COO2||" file. 06/05/2010 11:26:34 Elisabeth 4656 Sign of "JS:Jaderun-A [Expl]" has been found in "C:\Documents and Settings\Elisabeth\Local Settings\Temporary Internet Files\Content.IE5\ODWS94EX\Applet1[1].htm" file. 06/05/2010 11:36:33 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\Program Files\IVT Corporation\BlueSoleil\device\Win2k\btnetfilter.sys" file. 06/05/2010 11:51:46 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138281.sys" file. 06/05/2010 11:54:29 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138282.sys" file. 06/05/2010 11:54:34 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138283.sys" file. 06/05/2010 11:54:36 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138284.sys" file. 06/05/2010 11:54:38 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138285.sys" file. 06/05/2010 11:54:41 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138331.sys" file. 06/05/2010 11:54:43 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138332.sys" file. 06/05/2010 11:54:46 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138333.sys" file. 06/05/2010 11:54:47 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138334.sys" file. 06/05/2010 11:54:48 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138335.sys" file. 06/05/2010 11:54:51 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138366.sys" file. 06/05/2010 11:54:54 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138367.sys" file. 06/05/2010 11:54:57 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138373.sys" file. 06/05/2010 11:55:01 Elisabeth 4656 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{F07B5E64-A334-4E33-9EA9-D4A193219473}\RP1119\A0138439.sys" file. 06/05/2010 12:01:52 SYSTEM 1600 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004. 06/05/2010 12:02:34 SYSTEM 1600 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004. 06/05/2010 12:02:35 SYSTEM 1600 An error has occured while attempting to update. Please check the logs. Combofix: ComboFix 10-05-05.07 - Elisabeth 06/05/2010 14:49:15.1.2 - x86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3582.2899 [GMT 2:00] Lancé depuis: c:\documents and settings\Elisabeth\Bureau\capus1.exe AV: avast! antivirus 4.8.1368 [VPS 100505-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\AUTOLNCH.REG c:\windows\system32\autorun.ini c:\windows\system32\Install.cmd . ((((((((((((((((((((((((((((( Fichiers créés du 2010-04-06 au 2010-05-06 )))))))))))))))))))))))))))))))))))) . 2010-05-05 19:07 . 2010-05-05 19:07 -------- d-sh--w- c:\documents and settings\Yvon\PrivacIE 2010-05-05 18:51 . 2010-05-05 18:51 -------- d-----w- c:\program files\Unlocker 2010-05-05 17:27 . 2010-05-05 17:27 -------- d-----w- c:\documents and settings\NetworkService\Bureau 2010-05-05 14:40 . 2010-05-06 12:56 755200 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-05 15:06 . 2006-05-24 03:22 76376 ----a-w- c:\windows\system32\perfc00C.dat 2010-05-05 15:06 . 2006-05-24 03:22 470040 ----a-w- c:\windows\system32\perfh00C.dat 2010-05-05 14:40 . 2008-04-21 07:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-05-05 14:37 . 2008-05-25 19:30 6153352 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-05-05 14:34 . 2010-05-05 14:34 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\qvjsge.dat 2010-04-29 13:39 . 2008-07-23 20:03 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-29 13:39 . 2008-05-25 19:30 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-04-16 07:32 . 2008-02-04 16:13 -------- d-----w- c:\program files\Google 2010-03-28 11:45 . 2010-03-28 11:45 0 ----a-w- c:\windows\nsreg.dat 2010-03-26 13:59 . 2006-05-24 03:38 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-03-26 11:11 . 2010-03-26 11:11 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite 2010-03-26 11:11 . 2010-03-26 11:10 -------- d-----w- c:\program files\DIFX 2010-03-26 11:09 . 2010-03-26 11:09 95232 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\pcswpcsi.exe 2010-03-26 11:09 . 2010-03-26 11:09 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstCCD.exe 2010-03-26 11:09 . 2010-03-26 11:09 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstPCSFEMsi.exe 2010-03-26 11:09 . 2010-03-26 11:09 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstPCS.exe 2010-03-26 11:09 . 2010-03-26 11:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations 2010-03-26 11:03 . 2010-03-26 11:10 34503960 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Nokia_PC_Suite_fre_web.exe 2010-03-17 14:37 . 2009-10-05 06:51 3803208 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe 2010-02-25 13:03 . 2009-06-20 08:52 389784 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll 2010-02-25 13:03 . 2009-06-20 08:52 823928 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe 2010-02-25 13:03 . 2009-06-20 08:51 1181328 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe . ------- Sigcheck ------- [-] 2008-04-14 . E853F84D3CE2FAA2A802E33CF89AC023 . 579584 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\user32.dll [7] 2007-03-08 . 4D88AAF39ADABFE45958EA1384E2C4FF . 579072 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll [7] 2005-03-02 . C34920EB988CE98910BD6B0417F334EB . 578048 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll [7] 2005-03-02 . 0DF75FB73F705B011630159A43D7C354 . 578048 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB925902$\user32.dll [-] 2004-08-19 . 61C8C283AD063BB697AE61A155C64A5A . 578048 . . [5.1.2600.2180] . . c:\windows\system32\user32.dll [7] 2004-08-10 . E46FB493E3B33704F0715020CF52106B . 578048 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\user32.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TClockEx"="c:\progra~1\TClockEx\TCLOCKEX.EXE" [2000-03-09 90112] "Cld2000.exe"="c:\program files\Calendrier\Cld2000.exe" [2009-10-14 3029504] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-11 68856] "TomTomHOME.exe"="c:\program files\TomTom HOME 2\HOMERunner.exe" [2008-12-09 234856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="Alaunch" [X] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584] "RTHDCPL"="RTHDCPL.EXE" [2005-11-10 15473664] "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-12 139264] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952] "IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-10 44032] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2006-04-18 49152] "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-10-28 401408] "CCUTRAYICON"="c:\program files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2006-04-13 303104] "ImageItEncrypt"="c:\windows\system32\ImageItEncrypt.exe" [2005-12-30 40960] "SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-30 286720] "HP Lamp"="c:\scanjet\PrecisionScanPro\HPLamp.exe" [1999-07-22 42496] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-01-30 788880] "WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2009-05-27 90112] "ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360] c:\documents and settings\Elisabeth\Menu D‚marrer\Programmes\D‚marrage\ wwwzuc32.exe [2004-8-10 30720] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] D‚marrage d'Office.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-8-29 51984] Microsoft Recherche acc‚l‚r‚e.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-8-29 111376] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Acer Zone\\Plug and Record\\Component\\ARAWP.exe"= "c:\\Program Files\\Acer Zone\\Plug and Record\\Component\\DVAX2Process.exe"= "c:\\Program Files\\Acer Zone\\Picture Slide DVD\\Component\\CLSLDVD.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\WINDOWS\\system32\\spoolsv.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "c:\\Program Files\\Outlook Express\\msimn.exe"= "c:\\Program Files\\adslTV\\adsltv.exe"= "c:\\Program Files\\adslTV\\vlc.exe"= "c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"= "c:\\Program Files\\Alwil Software\\Avast4\\ashAvast.exe"= "c:\\Program Files\\TomTom HOME 2\\TomTomHOME.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Spotify\\spotify.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [16/04/2009 21:49 64288] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [06/04/2008 21:55 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [06/04/2008 21:55 20560] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24/09/2009 13:17 1181328] R3 hpusbfd;Hewlett-Packard USB Filter Class;c:\windows\system32\drivers\hpusbfd.sys [04/10/2006 23:20 7552] R3 LVHybrid;LVHybrid service;c:\windows\system32\drivers\LVHybrid.sys [29/06/2006 21:04 660736] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [29/06/2009 22:40 133104] S3 EPPSCSIx;EPPSCSI Driver;c:\windows\system32\drivers\eppscan.sys [30/09/2006 22:10 97880] --- Autres Services/Pilotes en mémoire --- *NewlyCreated* - NAL *Deregistered* - lbrtfdc *Deregistered* - NAL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . Contenu du dossier 'Tâches planifiées' 2010-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-06-29 20:39] 2010-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-06-29 20:39] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://news.google.fr/nwshp?hl=fr&tab=wn uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s TCP: {CD0B7E54-EB9A-4C5F-9755-03805F3E4586} = 212.27.40.240,212.27.40.241 FF - ProfilePath - c:\documents and settings\Elisabeth\Application Data\Mozilla\Firefox\Profiles\yu4elve9.default\ FF - prefs.js: browser.startup.homepage - hxxp://news.google.fr/nwshp?hl=fr&tab=wn FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll ---- PARAMETRES FIREFOX ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-WinFast Schedule - c:\program files\WinFast\WFDTV\WFWIZ.exe HKLM-Run-ITPIPSetup - E:\setupstb.exe ************************************************************************** Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lbrtfdc] . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(620) c:\windows\system32\Ati2evxx.dll . Heure de fin: 2010-05-06 14:59:06 ComboFix-quarantined-files.txt 2010-05-06 12:59 Avant-CF: 100 611 477 504 octets libres Après-CF: 100 987 781 120 octets libres WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect - - End Of File - - BC2431F0F8C1C129EF34844FC556CA15 Hijackthis: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 14:38:39, on 06/05/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe C:\Acer\Empowering Technology\ePerformance\MemCheck.exe C:\Program Files\Intel\IntelDH\CCU\AlertService.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\rsvp.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe C:\WINDOWS\system32\SysMonitor.exe C:\Acer\Empowering Technology\eRecovery\eRAgent.exe C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe C:\WINDOWS\vsnpstd2.exe C:\SCANJET\PrecisionScanPro\HPLamp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\WinFast\WFDTV\DTVSchdl.exe C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Calendrier\Cld2000.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\TomTom HOME 2\HOMERunner.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft Office\Office\OSA.EXE C:\Program Files\Microsoft Office\Office\FINDFAST.EXE C:\Documents and Settings\Elisabeth\Bureau\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.fr/nwshp?hl=fr&tab=wn R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll O3 - Toolbar: TV5 - Dictionnaires - {CEDDA62D-5FBE-4AB2-AE2E-5E069F444444} - C:\Program Files\Dico TV5\MDTV5TB.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe O4 - HKLM\..\Run: [imageItEncrypt] C:\WINDOWS\system32\ImageItEncrypt.exe O4 - HKLM\..\Run: [sNPSTD2] C:\WINDOWS\vsnpstd2.exe O4 - HKLM\..\Run: [HP Lamp] C:\SCANJET\PrecisionScanPro\HPLamp.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [iTPIPSetup] "E:\setupstb.exe" O4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [TClockEx] C:\PROGRA~1\TClockEx\TCLOCKEX.EXE O4 - HKCU\..\Run: [Cld2000.exe] C:\Program Files\Calendrier\Cld2000.exe O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-21-4059982494-2053908314-2402570644-1008\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'IUSR_NMPR') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: wwwzuc32.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Global Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{CD0B7E54-EB9A-4C5F-9755-03805F3E4586}: NameServer = 212.27.40.240,212.27.40.241 O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe O23 - Service: Intel® Alert Service (AlertService) - Intel Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe O23 - Service: Service de planification Media Center (ehSched) - Unknown owner - C:\WINDOWS\eHome\ehSched.exe O23 - Service: Intel® Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Aide et support (helpsvc) - Unknown owner - C:\WINDOWS\System32\svchost.e?e.exe (file missing) O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel® Software Services Manager (ISSM) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Serveur Média Intel® Viiv (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe -- End of file - 14822 bytes