Impossible de lancer Avast/spybot/ [résolu]

Arnoras · le 25 février 2009

Bonsoir, voilà j'ai un léger ( très léger ???? ) problème, identique qu'a celui ci : >>LIEN<<

à savoir :

Mon ordinateur est infecté par un virus qui empéche l'utilisation de mon antivirus Avast, Ccleaner, Spybot, Adward....

Je ne peux pas lancer HiJackThis, ni msn, ni aucun logiciel il me semble a part les navigateur internet...(encore heureux -_-')

voici, comme demander dans le topic que j'ai cité, le rapport fais par combofix :

ComboFix 09-02-24.02 - Arnoras 2009-02-25 20:17:53.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.2047.1729 [GMT 1:00]

Lancé depuis: c:\documents and settings\Arnoras\Bureau\combo-fix.exe

AV: avast! antivirus 4.8.1335 [VPS 090225-1] *On-access scanning disabled* (Updated)

* Un nouveau point de restauration a été créé

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Arnoras\Application Data\BITS

c:\documents and settings\Arnoras\Application Data\BITS\BITS.ini

c:\documents and settings\Arnoras\Application Data\BITS\DHTTable.dat

c:\documents and settings\Arnoras\Application Data\BITS\ProxyList.ini

c:\documents and settings\Arnoras\Application Data\drivers\downld

c:\documents and settings\Arnoras\Application Data\drivers\downld\110843.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\111562.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\112109.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\121343.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\121515.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\121578.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\130750.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\159937.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\160078.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\160109.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\187687.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\188640.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\188781.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\191000.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\191812.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\192437.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\204000.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\205000.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\205125.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\205156.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\205187.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\206109.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\207093.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\207859.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\208546.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\228437.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\229109.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\229781.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\238703.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\239593.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\239750.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\242437.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\244156.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\244703.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\248078.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\248296.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\248437.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\259218.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\260703.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\261250.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\280593.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\281781.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\282562.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\302906.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\303046.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\303218.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\343031.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\343203.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\343265.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\399000.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\400578.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\404343.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\405046.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\405265.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\48390.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\49203.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\49359.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\57703.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\58593.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\58828.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\72171.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\73109.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\73703.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\84171.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\84390.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\84453.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\86171.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\86718.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\86781.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\87062.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\88218.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\88468.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\89296.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\97437.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\97796.exe

c:\documents and settings\Arnoras\Application Data\drivers\downld\97984.exe

c:\documents and settings\Arnoras\Application Data\drivers\srosa2.sys

c:\documents and settings\Arnoras\Application Data\drivers\wfsintwq.sys

c:\documents and settings\Arnoras\Application Data\drivers\winupgro.exe

c:\documents and settings\Arnoras\Application Data\m

c:\documents and settings\Arnoras\Application Data\m\data.oct

c:\documents and settings\Arnoras\Application Data\m\flec006.exe

c:\documents and settings\Arnoras\Application Data\m\list.oct

c:\documents and settings\Arnoras\Application Data\m\shared\3D Patriotic Elf 1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\3D Super Skull 1.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\642-582 Free Test Exam Questions 10.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\8-Ball 1.1a.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Abcc Free 3GP iPod Zune iPhone MP4 FLV Converter 4.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Abcc Free DVD to AVI MPEG WMV MP4 MOV FLV Ripper 4.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Acronyms Master 2.0.0.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Advanced Archive Repair 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Advanced Email2RSS Professional 3.5.64.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Advanced HTML Encrypt and Password Protect 1.09.18.zip

c:\documents and settings\Arnoras\Application Data\m\shared\AfterHour 2.4.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Aiseesoft DVD to Apple TV Converter 3.2.16.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Allgäu Webcams 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Alphabeta.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Alternate Task Manager 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Anxiety Panic Attack 1.3.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Apex Free 3GP Video Converter 6.67.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Argentum Backup 2.60.zip

c:\documents and settings\Arnoras\Application Data\m\shared\AusLogics BoostSpeed 4.2.7.172.zip

c:\documents and settings\Arnoras\Application Data\m\shared\avast!.4.antivirus.protection.server.edition.v4.1.63.zip

c:\documents and settings\Arnoras\Application Data\m\shared\AVI File Viewer 1.0.1.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\AVX Get Host 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\awMail 1.35.zip

c:\documents and settings\Arnoras\Application Data\m\shared\AxelCD 2.17.zip

c:\documents and settings\Arnoras\Application Data\m\shared\BareGrep 3.50a.zip

c:\documents and settings\Arnoras\Application Data\m\shared\BearShare Turbo Accelerator 6.3.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Bw Email Robot 4.50.zip

c:\documents and settings\Arnoras\Application Data\m\shared\CA Personal Firewall 2008 10.0.0.157.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Cabos 0.8.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\CheckOsVer 1.02.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\CMUD 1.34.zip

c:\documents and settings\Arnoras\Application Data\m\shared\CNN 4 in 1 NEWS feed 2.00.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Compact Alarmer 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\CompanionLink Professional 3.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Compare It! 4.01.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Compu-Rx 2.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\ContactKeeper 1.4.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Corpse Flower (Titan Arum) Webcam C 1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\CounterStrike Stats Watcher 0.0.0.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\csASPZipFile 1.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Dai.sy 1.1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\DateCopy 2.01.zip

c:\documents and settings\Arnoras\Application Data\m\shared\DC Simple Calendar 1.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Document Import Kit for SharePoint 2007 (DocKIT) 1.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\DRS 2006 Webreceiver 1.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\DVD Icons For Movies.zip

c:\documents and settings\Arnoras\Application Data\m\shared\DynamicPDF for Java 4.0.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\EaseBackup 5.79.2.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Evening Sanctuary Screen Saver 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Fair Winds Screensaver 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Fast Destination Finder² 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Fast Port Scanner 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Flower Hill 3D Screensaver 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Free Desktop Clock 2.2.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Free InuYasha Screensaver 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\FreeOTFE 4.30.zip

c:\documents and settings\Arnoras\Application Data\m\shared\GAVSubmit 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Google Mini 2.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Google Password Recovery 1.10.02.08.zip

c:\documents and settings\Arnoras\Application Data\m\shared\HDD Scan and Restoration Program 3.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Hippopotamus Screensaver 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\HOST Searching 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\IconEdit2 5.02.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Inspyder InSite 2.0.4.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Investment and Business Valuation 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\iPod 2 iPod 3.52 Build 2911.43016.zip

c:\documents and settings\Arnoras\Application Data\m\shared\IRCbot.KD Remover 3.5.1.11.zip

c:\documents and settings\Arnoras\Application Data\m\shared\IzPack 3.10.2 Build 2007.05.11.zip

c:\documents and settings\Arnoras\Application Data\m\shared\JEP 3.0.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\JobTracker 1.3.zip

c:\documents and settings\Arnoras\Application Data\m\shared\JoyMacro 1.00.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Mail Access Monitor for QMail 3.8.zip

c:\documents and settings\Arnoras\Application Data\m\shared\McAfee.Viruscan.Enterprise.7.Spanish.by.feat.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Medlin Label Printing 2007 3.9.zip

c:\documents and settings\Arnoras\Application Data\m\shared\MemoriesOnTV 4.1.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Mild Winter 3D Screensaver 1.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Minos Zip 3.61.zip

c:\documents and settings\Arnoras\Application Data\m\shared\MLEditor Standard Edition 1.6.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\MonoCalendar 0.7.2.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Mortgage Glossary and Terminology eBook 2.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\MusicGoals Rhythm 2.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Netviewer One2one 3.2 build 870.zip

c:\documents and settings\Arnoras\Application Data\m\shared\OneCable.net Explorer 2.1.2.773.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Open Addons 1.1.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Pak Audio Converter 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Panda.Antivirus.Platinum.(é‰‘é‡‘ç‰ˆ).v7.07.00.ç¹é«”ä¸æ–‡ç‰ˆ.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Panda.Platinum.Internet.Security.8.05.00.ITA.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Param Google Search 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\PaxKel RSS Viewer 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\PhotoRite FX 1.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\phpMySQLConsole 0.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\PirateGirl0003 ScreenMate 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Portable AmoK Date Wizard 1.1b.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Portable Visual Clipboard 2.2.zip

c:\documents and settings\Arnoras\Application Data\m\shared\PortableClipLibrary 1.4.zip

c:\documents and settings\Arnoras\Application Data\m\shared\PowerDesk 6.0.1.3.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Properties Local Pinger 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Publish Query to Word for SQL Server Pro 1.05.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Qucs 0.0.12.zip

c:\documents and settings\Arnoras\Application Data\m\shared\QuickPlayer 1.00 Beta 63b.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Recruiting Database 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\RPS Convertor 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\RssDownloader 1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Scorecard for Life 1.0.224.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Select Edges 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Sensationware 2.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\SleekView 1.0.1.zip

c:\documents and settings\Arnoras\Application Data\m\shared\SlovoEd Compact Portuguese-Spanish 6.4.zip

c:\documents and settings\Arnoras\Application Data\m\shared\South Beach Diet 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\SpyCatcher Express 5.1.1 Build 7.zip

c:\documents and settings\Arnoras\Application Data\m\shared\SWF Lister Lite 1.5.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Synkron 1.4.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\TB0-106 - TIBCO Rendezvous 7 Certification Exam 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\the faster toolbar for IE 4.5.131.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\TopSales Basic 6.50.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Virtual Encrypted Disk Utility 2.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Visual Hindsight Professional Edition 1.2.0.421.zip

c:\documents and settings\Arnoras\Application Data\m\shared\WebInventory 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\WebIssues 0.9.2.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Weissoft ColorPicker 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Windows ID3 Editor 1.10.7.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Windows up time Gadget 1.0.0.2.zip

c:\documents and settings\Arnoras\Application Data\m\shared\WinPLOSION 2.17.zip

c:\documents and settings\Arnoras\Application Data\m\shared\WinXfer 1.0.zip

c:\documents and settings\Arnoras\Application Data\m\shared\WordCounter 2.17.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Wsa - Search For Web Files 1.8.0.6.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Yahoo! Mail Notifier 1.0.0.12.zip

c:\documents and settings\Arnoras\Application Data\m\shared\Zune Video Converter 3.6.50.019.zip

c:\documents and settings\Arnoras\Application Data\m\srvlist.oct

c:\program files\FlashGet Network

c:\program files\FlashGet Network\FlashGet universal\dbtrans_verbose.log

c:\program files\FlashGet Network\FlashGet universal\fgoption.ini

c:\program files\FlashGet Network\FlashGet universal\P2PCfg.ini

c:\program files\FlashGet Network\FlashGet universal\p2spmgr.ini

c:\program files\FlashGet Network\FlashGet universal\p4spmgr.ini

c:\program files\FlashGet Network\FlashGet universal\Profiles\config.dat

c:\program files\FlashGet Network\FlashGet universal\Profiles\tasks.dat

c:\program files\FlashGet Network\FlashGet universal\transaction.log

c:\program files\Windows Live\Messenger\MsnMsgr.exe

c:\windows\system32\AVSredirect.dll

c:\windows\system32\ban_list.txt

c:\windows\system32\drivers\down

c:\windows\system32\drivers\down\254359.exe

c:\windows\system32\drivers\npf.sys

c:\windows\system32\mdelk.exe

c:\windows\system32\packet.dll

c:\windows\system32\pthreadVC.dll

c:\windows\system32\wintems.exe

c:\windows\system32\wpcap.dll

I:\Autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_SROSA

-------\Legacy_SROSA

-------\Legacy_SK9OU0S

-------\Service_NPF

-------\Service_sK9Ou0s

((((((((((((((((((((((((((((( Fichiers créés du 2009-01-25 au 2009-02-25 ))))))))))))))))))))))))))))))))))))

.

2009-02-25 20:03 . 2009-02-25 20:03 <REP> d-------- c:\program files\Trend Micro

2009-02-25 19:59 . 2009-02-25 19:59 <REP> d-------- c:\windows\system32\Kaspersky Lab

2009-02-25 19:30 . 2009-02-25 19:30 <REP> d-------- C:\spywarebegone-fs

2009-02-25 19:30 . 2009-02-25 19:30 724,992 --a------ c:\windows\iun6002.exe

2009-02-25 19:26 . 2009-02-25 19:26 <REP> d-------- c:\program files\Spybot - Search & Destroy

2009-02-25 19:26 . 2009-02-25 19:26 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-02-25 19:14 . 2009-02-25 20:19 <REP> d--h----- c:\documents and settings\Arnoras\Application Data\drivers

2009-02-25 19:02 . 2009-02-25 19:02 <REP> d-------- c:\documents and settings\Arnoras\Application Data\AVS4YOU

2009-02-25 19:02 . 2009-02-25 19:02 <REP> d-------- c:\documents and settings\All Users\Application Data\AVS4YOU

2009-02-25 19:01 . 2009-02-25 19:02 <REP> d-------- c:\program files\Fichiers communs\AVSMedia

2009-02-25 19:01 . 2009-02-25 19:02 <REP> d-------- c:\program files\AVS4YOU

2009-02-25 19:01 . 2007-10-25 11:20 974,848 --a------ c:\windows\system32\mfc70.dll

2009-02-25 19:01 . 2007-10-25 11:20 487,424 --a------ c:\windows\system32\msvcp70.dll

2009-02-25 17:53 . 2009-02-25 18:34 <REP> d-------- c:\documents and settings\Arnoras\Application Data\eBay

2009-02-25 17:53 . 2009-02-25 18:34 <REP> d-------- c:\documents and settings\All Users\Application Data\eBay

2009-02-25 14:29 . 2009-02-25 14:30 <REP> d-------- c:\program files\PhotoFiltre

2009-02-23 22:53 . 2009-02-23 22:53 <REP> d-------- c:\windows\Intelliremote

2009-02-23 22:53 . 2009-02-25 01:38 <REP> d-------- c:\documents and settings\Arnoras\Application Data\Intelliremote

2009-02-23 19:39 . 2009-02-25 18:24 168 --a------ c:\windows\usdthank.ini

2009-02-23 19:39 . 2009-02-23 19:39 31 --a------ c:\windows\idc.ini

2009-02-22 14:42 . 2006-09-12 12:46 227,328 -r-hs---- c:\windows\system32\ac3DX.ax

2009-02-22 14:42 . 2008-03-16 14:30 216,064 -r-hs---- c:\windows\system32\nbDX.dll

2009-02-22 14:42 . 2006-03-10 22:48 169,472 -r-hs---- c:\windows\system32\MatroskaDX.ax

2009-02-22 14:42 . 2006-05-03 11:06 163,328 -r-hs---- c:\windows\system32\flvDX.dll

2009-02-22 14:42 . 2005-11-25 21:46 161,792 -r-hs---- c:\windows\system32\RealMediaDX.ax

2009-02-22 14:42 . 2006-01-13 00:23 123,904 -r-hs---- c:\windows\system32\AVCDX.ax

2009-02-22 14:42 . 2003-11-21 00:00 54,784 -r-hs---- c:\windows\system32\RLAPEDec.ax

2009-02-22 14:42 . 2004-04-27 00:00 37,888 -r-hs---- c:\windows\system32\RLMPCDec.ax

2009-02-22 14:42 . 2007-02-21 12:47 31,232 -r-hs---- c:\windows\system32\msfDX.dll

2009-02-22 13:51 . 2004-11-28 21:09 679,936 --a------ c:\windows\system32\xvidcore.dll

2009-02-20 23:00 . 2009-02-25 18:34 <REP> d-------- c:\program files\eBay

2009-02-20 23:00 . 2009-02-25 12:15 <REP> d-------- c:\documents and settings\All Users\eBay

2009-02-20 22:42 . 2009-02-20 22:42 <REP> d-------- c:\program files\Fichiers communs\GeoVid

2009-02-20 22:42 . 2007-06-28 18:55 77,824 --a------ c:\windows\system32\xvid.ax

2009-02-20 22:42 . 2005-06-07 15:11 60,416 --a------ c:\windows\system32\dsetup.dll

2009-02-20 21:34 . 2004-02-22 10:11 719,872 --a------ c:\windows\system32\devil.dll

2009-02-20 21:34 . 2007-05-17 17:30 318,976 --a------ c:\windows\system32\avisynth.dll

2009-02-20 21:34 . 2004-01-25 00:00 70,656 --a------ c:\windows\system32\yv12vfw.dll

2009-02-20 21:34 . 2004-01-25 00:00 70,656 --a------ c:\windows\system32\i420vfw.dll

2009-02-20 21:32 . 2009-02-20 21:32 <REP> d-------- c:\program files\eRightSoft

2009-02-20 21:32 . 2005-02-13 00:00 186,880 -r-hs---- c:\windows\system32\RLOgg.ax

2009-02-20 21:32 . 2005-01-18 00:26 179,200 -r-hs---- c:\windows\system32\DiracSplitter.ax

2009-02-20 21:32 . 2006-08-16 15:53 175,104 -r-hs---- c:\windows\system32\CoreAAC.ax

2009-02-20 21:32 . 2005-02-06 00:00 92,672 -r-hs---- c:\windows\system32\RLVorbisDec.ax

2009-02-20 21:32 . 2005-02-22 17:55 81,920 -r-hs---- c:\windows\system32\aac_parser.ax

2009-02-20 21:32 . 2005-02-13 00:00 67,584 -r-hs---- c:\windows\system32\RLTheoraDec.ax

2009-02-20 21:32 . 2005-02-13 00:00 51,712 -r-hs---- c:\windows\system32\RLSpeexDec.ax

2009-02-20 19:45 . 2004-05-25 17:06 417,792 --a------ c:\windows\system32\ac3filter.ax

2009-02-20 19:45 . 2005-02-27 21:48 356,352 --a------ c:\windows\system32\RealMediaSplitter.ax

2009-02-20 19:45 . 2004-01-10 17:02 258,048 --a------ c:\windows\system32\GplMpgDec.ax

2009-02-19 12:54 . 2009-02-20 22:32 <REP> d-------- c:\documents and settings\Arnoras\Application Data\Apple Computer

2009-02-19 12:53 . 2009-02-19 12:53 <REP> d-------- c:\program files\iTunes

2009-02-19 12:53 . 2009-02-19 12:53 <REP> d-------- c:\program files\iPod

2009-02-19 12:53 . 2009-02-19 12:53 <REP> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2009-02-19 12:53 . 2008-04-17 13:12 107,368 --a------ c:\windows\system32\GEARAspi.dll

2009-02-19 12:53 . 2008-04-17 13:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys

2009-02-19 12:52 . 2009-02-19 12:53 <REP> d-------- c:\program files\QuickTime

2009-02-19 12:52 . 2009-02-19 12:53 <REP> d-------- c:\program files\Fichiers communs\Apple

2009-02-19 12:52 . 2009-02-19 12:52 <REP> d-------- c:\program files\Apple Software Update

2009-02-19 12:52 . 2009-02-19 12:53 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple Computer

2009-02-19 12:52 . 2009-02-19 12:52 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple

2009-02-19 12:52 . 2008-11-07 14:23 32,000 --a------ c:\windows\system32\drivers\usbaapl.sys

2009-02-19 12:26 . 2008-04-14 04:33 159,232 --a------ c:\windows\system32\ptpusd.dll

2009-02-19 12:26 . 2008-04-13 20:45 15,104 --a------ c:\windows\system32\drivers\usbscan.sys

2009-02-19 12:26 . 2008-04-13 20:45 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys

2009-02-19 12:26 . 2001-08-23 17:47 5,632 --a------ c:\windows\system32\ptpusb.dll

2009-02-18 02:00 . 2009-02-18 02:05 <REP> d-------- c:\program files\ElcomSoft

2009-02-17 10:51 . 2009-02-20 10:45 <REP> d-------- c:\documents and settings\Arnoras\Application Data\U3

2009-02-16 13:47 . 2009-02-16 13:57 <REP> d-------- c:\documents and settings\Arnoras\Application Data\fretsonfire

2009-02-16 13:46 . 2009-02-17 01:29 <REP> d-------- c:\program files\Frets on Fire

2009-02-16 10:58 . 2009-02-16 11:03 65,536 --a------ c:\windows\IFinst27.exe

2009-02-15 23:14 . 2009-02-15 23:14 <REP> dr-h----- c:\documents and settings\Arnoras\Application Data\SecuROM

2009-02-15 23:09 . 2009-02-15 23:09 <REP> d-------- c:\program files\Aspyr

2009-02-14 18:32 . 2009-02-14 18:32 <REP> d-------- c:\documents and settings\Arnoras\Application Data\GlarySoft

2009-02-14 16:44 . 2009-02-14 16:44 <REP> d-------- C:\TarguTrans

2009-02-14 16:41 . 2009-02-14 16:42 <REP> d-------- c:\windows\speech

2009-02-14 16:41 . 2009-02-14 16:41 <REP> d-------- c:\windows\Lhsp

2009-02-14 16:32 . 2009-02-14 16:56 <REP> d-------- c:\program files\Power Translator 12

2009-02-14 13:13 . 2009-02-14 13:13 <REP> d-------- C:\profiles

2009-02-14 10:53 . 2009-02-14 10:53 <REP> d-------- c:\program files\WinPcap

2009-02-14 10:52 . 2009-02-14 12:32 <REP> d-------- c:\program files\Net Tools

2009-02-11 15:04 . 2009-02-11 15:04 <REP> d-------- c:\program files\LucasArts

2009-02-06 18:52 . 2009-02-06 18:52 49,504 --a------ c:\windows\system32\sirenacm.dll

2009-02-05 22:55 . 2009-02-05 22:55 <REP> d-------- c:\program files\Glary Utilities

2009-02-05 22:55 . 2009-02-05 22:55 <REP> d-------- c:\program files\CCleaner

2009-02-05 22:52 . 2009-02-05 22:52 <REP> d-------- c:\program files\Auslogics

2009-02-05 22:45 . 2009-02-05 22:45 <REP> d-------- c:\program files\VS Revo Group

2009-02-05 13:37 . 2009-02-05 13:37 1,044,480 -ra------ c:\windows\system32\roboex32.dll

2009-02-05 13:37 . 2009-02-05 13:37 49,152 -ra------ c:\windows\system32\inetwh32.dll

2009-02-04 18:48 . 2009-02-04 18:48 <REP> dr------- c:\documents and settings\Arnoras\Application Data\Brother

2009-02-04 17:00 . 2008-04-13 20:45 20,608 --a------ c:\windows\system32\drivers\usbuhci.sys

2009-02-04 17:00 . 2008-04-13 20:45 20,608 --a--c--- c:\windows\system32\dllcache\usbuhci.sys

2009-02-04 14:12 . 2009-02-04 14:12 166 --a------ c:\windows\Navigma.INI

2009-02-01 22:38 . 2009-02-01 22:38 <REP> d-------- c:\documents and settings\All Users\Application Data\Electronic Arts

2009-02-01 14:58 . 2009-02-01 14:58 <REP> d-------- c:\program files\LoCoSoft

2009-02-01 14:52 . 2009-02-01 14:52 <REP> d-------- c:\documents and settings\Arnoras\Application Data\AlauxSoft

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-25 19:07 --------- d-----w c:\program files\IE8

2009-02-25 18:17 --------- d-----w c:\documents and settings\Arnoras\Application Data\uTorrent

2009-02-25 18:11 --------- d-----w c:\program files\eMule

2009-02-25 17:34 --------- d--h--w c:\program files\InstallShield Installation Information

2009-02-25 00:45 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

2009-02-25 00:44 --------- d-----w c:\program files\DAEMON Tools Toolbar

2009-02-21 20:00 --------- d-----w c:\program files\Steam

2009-02-20 18:19 --------- d-----w c:\program files\Windows Live Safety Center

2009-02-14 18:57 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help

2009-02-14 11:58 --------- d-----w c:\documents and settings\Arnoras\Application Data\LimeWire

2009-02-14 11:33 --------- d-----w c:\program files\AviSynth 2.5

2009-02-12 21:53 --------- d-----w c:\program files\Messenger Plus! Live

2009-02-11 21:27 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!

2009-02-08 23:02 --------- d-----w c:\program files\DeskSpace

2009-02-08 22:54 --------- d-----w c:\program files\Gpotato.eu

2009-01-15 18:47 --------- d-----w c:\program files\Common Files

2009-01-11 01:40 --------- d-----w c:\program files\Woonoz

2009-01-11 01:40 --------- d-----w c:\program files\Anniversaire

2009-01-09 19:20 --------- d-----w c:\documents and settings\Arnoras\Application Data\Mumble

2009-01-07 19:10 --------- d-----w c:\program files\Packard Bell

2009-01-07 18:48 --------- d-----w c:\program files\Fichiers communs\InstallShield

2008-12-29 17:50 --------- d-----w c:\program files\Conquete 2.0

2008-12-28 15:01 --------- d-----w c:\documents and settings\Arnoras\Application Data\SiteAdvisor

2008-12-26 20:19 --------- d-----w c:\program files\Team JPN

2008-11-16 21:15 29,138,232 ----a-w c:\program files\IE8.exe

2008-10-30 19:33 106 ----a-w c:\program files\path.ini

2008-10-08 14:37 0 ----a-w c:\program files\checkversion.txt

2008-07-17 16:36 7,710,016 ----a-w c:\program files\FLV PlayerRCATSetup.exe

2008-05-08 23:58 222 ----a-w c:\program files\pink.bmp

2008-04-10 23:15 4,162 ----a-w c:\program files\color1.bmp

2008-03-24 21:49 474 ----a-w c:\program files\color.bmp

2007-12-07 09:18 19,636 ----a-w c:\program files\th_07.jpg

2007-12-07 09:05 680 ----a-w c:\program files\bl_07.jpg

2007-12-05 13:15 23,446 ----a-w c:\program files\bk2.jpg

2007-12-05 01:06 10,528 ----a-w c:\program files\else.gif

2006-05-03 10:06 163,328 --sh--r c:\windows\system32\flvDX.dll

2007-02-21 11:47 31,232 --sh--r c:\windows\system32\msfDX.dll

2008-03-16 13:30 216,064 --sh--r c:\windows\system32\nbDX.dll

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]

"Google Update"="c:\documents and settings\Arnoras\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-14 133104]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-02-25 2144088]

"Spyware Begone"="c:\spywarebegone-fs\freescan.exe" [2005-06-09 2951168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992]

"Lachesis"="c:\program files\Razer\Lachesis\razerhid.exe" [2007-09-12 172032]

"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-25 81000]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]

"!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]

"SoundMan"="SOUNDMAN.EXE" [2004-11-15 c:\windows\SOUNDMAN.EXE]

"nwiz"="nwiz.exe" [2008-05-16 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.I420"= i420vfw.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"LDM"=c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" boot

"Steam"="c:\program files\Steam\Steam.exe" -silent

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" -autorun

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"LogitechVideoRepair"=c:\program files\Logitech\Video\ISStart.exe

"LogitechVideoTray"=c:\program files\Logitech\Video\LogiTray.exe

"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"13040:TCP"= 13040:TCP:Utorrent

"13040:UDP"= 13040:UDP:Utorrent2

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2008-07-05 12032]

S1 aswSP;avast! Self Protection; [x]

S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys --> c:\windows\system32\DRIVERS\aswFsBlk.sys [?]

S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-07-05 31592]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{794b094a-4a7c-11dd-8b4c-0013d4ab966d}]

\Shell\AutoRun\command - N:\ClickMe.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{81a04a39-4e53-11dd-add4-0013d4ab966d}]

\Shell\Auto\command - cmd /C launch.bat

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

.

Contenu du dossier 'Tâches planifiées'

2009-02-19 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-02-25 c:\windows\Tasks\GlaryInitialize.job

- c:\program files\Glary Utilities\initialize.exe [2009-01-10 17:02]

2009-02-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-506798661-420042220-3537155185-1007.job

- c:\documents and settings\Arnoras\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-14 13:16]

2009-01-02 c:\windows\Tasks\Maintenance en 1 clic.job

- c:\program files\TuneUp Utilities 2008\OneClick.exe []

.

- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.dufpy.com

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Recherche sur eBay - c:\program files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html

FF - ProfilePath - c:\documents and settings\Arnoras\Application Data\Mozilla\Firefox\Profiles\w0wpsbtq.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1460988&SearchSource=3&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/

FF - component: c:\documents and settings\Arnoras\Application Data\Mozilla\Firefox\Profiles\w0wpsbtq.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll

FF - component: c:\documents and settings\Arnoras\Application Data\Mozilla\Firefox\Profiles\w0wpsbtq.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll

FF - component: c:\documents and settings\Arnoras\Application Data\Mozilla\Firefox\Profiles\w0wpsbtq.default\extensions\{8241b8d6-6bac-4f48-b012-464cf0f636e9}\components\FFAlert.dll

FF - plugin: c:\documents and settings\Arnoras\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-25 20:22:07

Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

.

------------------------ Autres processus actifs ------------------------

.

c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\program files\Razer\Lachesis\OSD.exe

c:\program files\Razer\Lachesis\razertra.exe

c:\program files\Razer\Lachesis\razerofa.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Heure de fin: 2009-02-25 20:27:00 - La machine a redémarré

ComboFix-quarantined-files.txt 2009-02-25 19:26:58

Avant-CF: 108,331,491,328 octets libres

Après-CF: 108,158,828,544 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4

523 --- E O F --- 2009-02-14 18:58:32

Merci de m'aider, ce problème est vraiment très gênant...

Modifié le 26 février 2009 par Arnoras

Falkra · le 25 février 2009

Bonsoir, on traite chaque cas sur mesure, et sur combofix, je rabâche le même truc toute la journée : ne pas utiliser seul. Ne pas copier une procédure d'ailleurs (si l'autre a une bestiole différente, on fait quoi ? Si l'autre a des bestioles que tu n'as pas, on fait quoi ?)

As-tu besoin d'aide, ou sais-tu déjà faire ?

On ne se formalisera pas.

Voir ici :

http://forum.zebulon.fr/faq-fonctionnement...on-t158392.html

Arnoras · le 25 février 2009

Si je m'en suis servi, c'est parceque j'ai trouvé sur google quelqu'un qui avait sensiblement le même problème que moi, et je ne voulais pas posté un autre topic inutile parmis ceux qui pullue déjà la toile... Pardon.

On recommence depuis le début.

Symptome : je ne peux utiliser ni Avast, ni spybot, ni msn, msn je ne peux plus l'installer, quand je lance l'installeur, il me dit qu'il est déjà installer =/ et quand je clique sur le raccourci, il me dit que le dossier est introuvable XD.

après différente manip, j'ai quand même le mode sans echec qui est utilisable, j'ai réussis a utiliser HiJackThis Voici le log qu'il m'a donné :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:32:43, on 26/02/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Safe mode

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe

C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll

O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: (no name) - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - (no file)

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exe

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe

O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe

--

End of file - 6044 bytes

Modifié le 25 février 2009 par Arnoras

Falkra · le 25 février 2009

Refais un rapport en mode normal stp, le mode normal devrait fonctionner (et le rapport sera différent).

Arnoras · le 25 février 2009

effectivement pour la première fois il a fonctionné xD, le voici :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:50:03, on 26/02/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Razer\Lachesis\razerhid.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\Documents and Settings\Arnoras\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\Program Files\Razer\Lachesis\OSD.exe

C:\Program Files\Razer\Lachesis\razertra.exe

C:\Program Files\Razer\Lachesis\razerofa.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dufpy.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll

O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll (file missing)

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: (no name) - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - (no file)

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exe

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Arnoras\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [spyware Begone] C:\spywarebegone-fs\freescan.exe -FastScan

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html

O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe

O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe

--

End of file - 7697 bytes

Falkra · le 25 février 2009

IL est possible que Kasperky ne fonctionne plus totalement, auquel cas il faudra le réinstaller.

Ta machine est très vulnérable, et sinon, Bagle s'attrape par des cracks (facile à éviter).

Télécharge Malwarebytes' Anti-Malware (MBAM)

Double clique sur le fichier téléchargé pour lancer le processus d'installation.
Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
Sélectionne "Exécuter un examen rapide"
Clique sur "Rechercher"
L'analyse démarre, le scan est relativement long, c'est normal.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.
Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.

NB : Si MBAM te demande à redémarrer, fais-le.

Arnoras · le 26 février 2009

Voila le rapport d'analyse de MBAM, apparemment tout est "en ordre" :

Malwarebytes' Anti-Malware 1.34

Version de la base de données: 1804

Windows 5.1.2600 Service Pack 3

26/02/2009 00:59:14

mbam-log-2009-02-26 (00-59-14).txt

Type de recherche: Examen rapide

Eléments examinés: 65663

Temps écoulé: 3 minute(s), 9 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 0

Processus mémoire infecté(s):