[Résolu] Malwarebytes en mode sans échec ou pas ?

[PolanX]

Bon et bien je me suis fais peur là:

 

J'ai lancé combofix en respectant tes consignes et après quelques minutes d'analyse et de suppression de fichiers (4 ou 5 fichiers du sytème, des dll), mon portable a tenter de redémarrer pour rester bloqué sur un écran noir avec un curseur clignotant en haut à gauche, au bout d'un quart d'heure, je l'ai forcé à redémarrer (non sans mal) et il s'en est suivi une restauration du sytème.

 

Je ne sais pas ce qu'il s'est passé, mais je pense qu'il y a eu un problème avec combofix, je me retrouve maintenant avec un dossier Combofix et Qoobox à la racine de C...

 

Que dois-je faire?

[Falkra]

Posyte c:\combofix.txt, si présent, ou c:\bug.txt, si présent aussi, il faut qu'on tire ça au clair.

[PolanX]

Voici le contenu (très léger) de combofix.txt situé dans C:\Combofix\

 

ComboFix 09-03-31.04 - Guilhem 2009-04-01 20:17:53.1 - NTFSx86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2045.1085 [GMT 2:00]

Lancé depuis: C:\Users\Guilhem\Desktop\ComboFix.exe

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)

FW: Kaspersky Internet Security *disabled*

* Un nouveau point de restauration a été créé

.

 

 

 

Et c'est tout, je n'ai pas de bug.txt, par contre j'ai tout un tas de fichiers dans C:\Combofix\ dont des fichiers nommés 1234, 5842 etc, sans extension

[Falkra]

Ok, on laisse combofix de côté pour le moment.

 

Fais un nouveau RSIT stp, il ne fera qu'un rapport, c'est normal.

[PolanX]

Le voilà:

 

 

Logfile of random's system information tool 1.06 (written by random/random)

Run by Guilhem at 2009-04-01 22:51:10

Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1

System drive C: has 41 GB (37%) free of 113 GB

Total RAM: 2045 MB (48% free)

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:51, on 2009-04-01

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\rundll32.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Apoint2K\Apoint.exe

C:\Program Files\BOINC\boinctray.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe

C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\BOINC\boincmgr.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\System32\rundll32.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Users\Guilhem\AppData\Local\Temp\RtkBtMnt.exe

C:\Program Files\BOINC\boinc.exe

C:\Program Files\Apoint2K\ApMsgFwd.exe

C:\Program Files\Apoint2K\Apntex.exe

C:\Program Files\BOINC\Data\projects\einstein.phys.uwm.edu\einstein_S5R5_3.01_windows_intelx86.exe

C:\Program Files\BOINC\Data\projects\einstein.phys.uwm.edu\einstein_S5R5_3.01_windows_intelx86_2.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\BOINC\Data\projects\setiathome.berkeley.edu\setiathome_6.03_windows_intelx86.exe

C:\Users\Guilhem\Desktop\RSIT.exe

D:\Utilitaires 2008-2009\Guilhem.exe

C:\Windows\system32\SearchFilterHost.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll

O4 - HKLM\..\Run: [PLFSetL] C:\Windows\PLFSetL.exe

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [boinctray] "C:\Program Files\BOINC\boinctray.exe"

O4 - HKLM\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 10\LaunchList.exe

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\Windows\system32\\PSDrvCheck.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe

O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe

O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\\Programs\Remote\Remoterm.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O4 - Global Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe

O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CS7\Services\Tcpip\..\{17DF5725-0FAF-45AB-920E-2C80F827C0FB}: NameServer = 192.168.0.1

O17 - HKLM\System\CS8\Services\Tcpip\..\{17DF5725-0FAF-45AB-920E-2C80F827C0FB}: NameServer = 192.168.0.1

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll

O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe

O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe

O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

 

--

End of file - 8691 bytes

 

======Registry dump======

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2007-09-05 816400]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{243B17DE-77C7-46BF-B94B-0B5F309A0E64}]

C:\Program Files\Microsoft Money\System\mnyside.dll [2002-07-17 163906]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]

IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-11-11 62728]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}]

ShowBarObj Class - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll [2008-01-03 312368]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll [2008-03-05 142896]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"PLFSetL"=C:\Windows\PLFSetL.exe [2007-07-05 94208]

"NvSvc"=C:\Windows\system32\nvsvc.dll [2007-11-15 86016]

"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-11-15 8534560]

"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-11-15 81920]

"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-07-12 178712]

"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2007-07-21 159744]

"eRecoveryService"= []

"boinctray"=C:\Program Files\BOINC\boinctray.exe [2008-08-17 58112]

"LaunchList"=C:\Program Files\Pinnacle\Studio 10\LaunchList.exe [2004-08-09 45056]

"PinnacleDriverCheck"=C:\Windows\system32\\PSDrvCheck.exe [2004-03-11 406016]

"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-09-03 4702208]

"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-02-04 206088]

"TrueImageMonitor.exe"=C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [2007-10-07 2620336]

"AcronisTimounterMonitor"=C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe [2007-10-07 904880]

"Acronis Scheduler2 Service"=C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [2007-10-07 140568]

"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]

"PMCRemote"=C:\Program Files\Pinnacle\Shared Files\\Programs\Remote\Remoterm.exe [2008-06-12 214288]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe []

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eAudio]

C:\Acer\Empowering Technology\eAudio\eAudio.exe [2007-10-10 1286144]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]

C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe [2008-03-05 525360]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2007-12-13 1688872]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]

C:\PROGRA~1\LAUNCH~1\LManager.exe [2008-01-04 768520]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]

C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2007-12-03 2213160]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2007-03-01 153136]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMCLoader]

C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe [2008-06-23 644368]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMCRemote]

C:\Program Files\Pinnacle\Shared Files\\Programs\Remote\Remoterm.exe [2008-06-12 214288]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]

C:\Acer\EMPOWE~1\EAPLAU~1.EXE [2007-04-14 535336]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Pinnacle Streaming Server.lnk]

C:\PROGRA~1\Pinnacle\SHARED~1\Programs\STRMSE~1\STRMSE~1.EXE [2008-03-25 603408]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Guilhem^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Orion.lnk]

C:\CONVES~1\Orion\MESSEN~1.EXE []

 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

BOINC Manager.lnk - C:\Program Files\BOINC\boincmgr.exe

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]

C:\Windows\system32\klogon.dll [2008-11-11 218376]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

"authentication packages"=msv1_0

relog_ap

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PSEXESVC]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"EnableUIADesktopToggle"=0

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d712f94d-19ff-11de-922d-001eec4707e5}]

shell\AutoRun\command - G:\LaunchU3.exe -a

 

 

======List of files/folders created in the last 1 months======

 

2009-04-01 22:45:14 ----D---- C:\rsit

2009-04-01 20:21:38 ----D---- C:\Windows\temp

2009-04-01 20:16:31 ----A---- C:\Windows\zip.exe

2009-04-01 20:16:31 ----A---- C:\Windows\VFIND.exe

2009-04-01 20:16:31 ----A---- C:\Windows\SWXCACLS.exe

2009-04-01 20:16:31 ----A---- C:\Windows\SWSC.exe

2009-04-01 20:16:31 ----A---- C:\Windows\SWREG.exe

2009-04-01 20:16:31 ----A---- C:\Windows\sed.exe

2009-04-01 20:16:31 ----A---- C:\Windows\NIRCMD.exe

2009-04-01 20:16:31 ----A---- C:\Windows\grep.exe

2009-04-01 20:16:31 ----A---- C:\Windows\fdsv.exe

2009-04-01 20:16:23 ----D---- C:\Windows\ERDNT

2009-04-01 20:16:22 ----D---- C:\ComboFix

2009-04-01 20:16:21 ----A---- C:\Windows\system32\CF27495.exe

2009-04-01 20:16:07 ----A---- C:\Windows\system32\swsc.exe

2009-04-01 20:16:04 ----D---- C:\Qoobox

2009-03-28 11:33:49 ----D---- C:\Program Files\SSC Service Utility

2009-03-28 00:14:45 ----D---- C:\Users\Guilhem\AppData\Roaming\Thunderbird

2009-03-28 00:14:32 ----D---- C:\Program Files\Mozilla Thunderbird

2009-03-25 00:05:07 ----A---- C:\Windows\system32\javaws.exe

2009-03-25 00:05:07 ----A---- C:\Windows\system32\javaw.exe

2009-03-25 00:05:07 ----A---- C:\Windows\system32\java.exe

2009-03-23 21:55:14 ----D---- C:\Users\Guilhem\AppData\Roaming\Malwarebytes

2009-03-23 21:55:07 ----D---- C:\ProgramData\Malwarebytes

2009-03-23 21:55:07 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

2009-03-23 15:20:56 ----D---- C:\ProgramData\Acronis

2009-03-23 15:19:25 ----D---- C:\Program Files\Common Files\Acronis

2009-03-23 15:19:25 ----D---- C:\Program Files\Acronis

2009-03-23 14:42:35 ----D---- C:\Program Files\MozBackup

2009-03-20 14:19:51 ----D---- C:\Users\Guilhem\AppData\Roaming\MMTVConfig

2009-03-20 14:19:28 ----D---- C:\Program Files\MMTVConfig

2009-03-12 19:11:48 ----D---- C:\Users\Guilhem\AppData\Roaming\AVSMedia

2009-03-12 18:48:14 ----A---- C:\Windows\system32\xvidvfw.dll

2009-03-12 18:48:14 ----A---- C:\Windows\system32\xvidcore.dll

2009-03-12 18:48:14 ----A---- C:\Windows\system32\mpg4c32.dll

2009-03-12 18:48:14 ----A---- C:\Windows\system32\mcdvd_32.dll

2009-03-11 20:44:22 ----A---- C:\Windows\system32\wmp.dll

2009-03-11 20:44:21 ----A---- C:\Windows\system32\spwmp.dll

2009-03-11 20:44:20 ----A---- C:\Windows\system32\wmploc.DLL

2009-03-11 20:44:20 ----A---- C:\Windows\system32\dxmasf.dll

2009-03-11 20:42:44 ----A---- C:\Windows\system32\schannel.dll

2009-03-10 23:56:19 ----D---- C:\Users\Guilhem\AppData\Roaming\AVS4YOU

2009-03-10 23:56:15 ----D---- C:\ProgramData\AVS4YOU

2009-03-10 23:53:10 ----D---- C:\Program Files\Common Files\AVSMedia

2009-03-10 23:53:10 ----A---- C:\Windows\system32\msxml3a.dll

2009-03-06 20:14:01 ----D---- C:\Program Files\uTorrent

2009-03-06 20:13:46 ----D---- C:\Users\Guilhem\AppData\Roaming\uTorrent

 

======List of files/folders modified in the last 1 months======

 

2009-04-02 07:21:52 ----D---- C:\Windows\system32\config

2009-04-02 07:21:46 ----D---- C:\Windows\Tasks

2009-04-02 07:21:46 ----D---- C:\Windows\system32\x64

2009-04-02 07:21:46 ----D---- C:\Windows\system32\drivers

2009-04-02 07:21:46 ----D---- C:\Windows\system32\catroot2

2009-04-02 07:21:45 ----D---- C:\Windows\system32\wbem

2009-04-02 07:21:45 ----D---- C:\Windows\registration

2009-04-02 07:20:57 ----SHD---- C:\System Volume Information

2009-04-01 21:30:09 ----D---- C:\Windows\System32

2009-04-01 21:30:09 ----A---- C:\Windows\system32\PerfStringBackup.INI

2009-04-01 21:30:08 ----D---- C:\Windows\inf

2009-04-01 21:25:56 ----D---- C:\ProgramData\Kaspersky Lab

2009-04-01 21:23:32 ----D---- C:\Windows\Minidump

2009-04-01 21:23:32 ----D---- C:\Windows

2009-04-01 20:20:25 ----D---- C:\Windows\AppPatch

2009-04-01 20:20:23 ----D---- C:\Program Files\Common Files

2009-04-01 20:17:29 ----D---- C:\Windows\Prefetch

2009-04-01 20:16:21 ----D---- C:\Windows\system32\fr-FR

2009-03-30 23:22:46 ----D---- C:\Program Files\Mozilla Firefox

2009-03-29 19:21:48 ----SHD---- C:\Windows\Installer

2009-03-28 11:33:49 ----RD---- C:\Program Files

2009-03-28 00:14:50 ----D---- C:\Users\Guilhem\AppData\Roaming\Mozilla

2009-03-25 00:05:03 ----D---- C:\Program Files\Java

2009-03-24 17:42:51 ----RD---- C:\Users

2009-03-24 16:47:07 ----SHD---- C:\$RECYCLE.BIN

2009-03-23 21:55:07 ----HD---- C:\ProgramData

2009-03-14 23:12:49 ----D---- C:\Windows\Debug

2009-03-14 09:57:15 ----D---- C:\Program Files\ZebHelpProcess 2

2009-03-13 23:24:25 ----RSD---- C:\Windows\Fonts

2009-03-12 18:48:28 ----D---- C:\Windows\winsxs

2009-03-12 08:03:40 ----D---- C:\Windows\system32\catroot

2009-03-12 08:00:59 ----D---- C:\Program Files\Windows Media Player

2009-03-12 08:00:59 ----D---- C:\Program Files\Windows Mail

2009-03-09 06:19:08 ----A---- C:\Windows\system32\deploytk.dll

2009-03-05 08:47:32 ----D---- C:\Program Files\Common Files\microsoft shared

 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

 

R1 DritekPortIO;Dritek General Port I/O; \??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2006-11-02 20112]

R1 kl1;kl1; C:\Windows\system32\DRIVERS\kl1.sys [2008-07-21 121872]

R1 KLIF;Kaspersky Lab Driver; C:\Windows\system32\DRIVERS\klif.sys [2009-02-04 239120]

R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter; C:\Windows\system32\DRIVERS\klim6.sys [2008-07-09 20496]

R1 PCLEPCI;PCLEPCI; \??\C:\Windows\system32\drivers\pclepci.sys [2005-02-09 14165]

R1 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2008-11-04 5632]

R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; \??\C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2008-01-04 41456]

R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2007-07-03 15392]

R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]

R2 PSDNServ;PSDNServ; C:\Windows\system32\DRIVERS\PSDNServ.sys [2008-01-03 16432]

R2 psdvdisk;PSDVdisk; C:\Windows\system32\DRIVERS\PSDVdisk.sys [2008-01-03 59952]

R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-08-08 45568]

R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-07-30 43008]

R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-07-30 38400]

R2 tifsfilter;Acronis True Image FS Filter; C:\Windows\system32\DRIVERS\tifsfilt.sys [2009-03-23 44384]

R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-01-30 8704]

R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-12-11 163376]

R3 ASAPIW2K;ASAPIW2K; C:\Windows\System32\Drivers\ASAPIW2K.sys [2005-01-10 11264]

R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-07-22 180736]

R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208]

R3 DKbFltr;Dritek Keyboard Filter Driver; C:\Windows\system32\DRIVERS\DKbFltr.sys [2006-11-02 21264]

R3 enecir;ENE CIR Receiver; C:\Windows\system32\DRIVERS\enecir.sys [2007-03-07 32256]

R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-04-26 984064]

R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-04-26 208384]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-09-05 1953944]

R3 KLFLTDEV;Kaspersky Lab KLFltDev; C:\Windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]

R3 NETw4v32;Pilote de carte Intel® Wireless WiFi Link pour Windows Vista 32 bits; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-12-29 2252800]

R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2008-03-18 6144]

R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-11-15 8234176]

R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-21 88576]

R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2007-08-13 1749376]

R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-04-26 660480]

R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\Windows\system32\drivers\WmBEnum.sys [2008-01-24 19336]

R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264]

R3 WmXlCore;Logitech Translation Layer Driver; C:\Windows\system32\drivers\WmXlCore.sys [2008-01-24 48904]

S3 catchme;catchme; \??\C:\Users\Guilhem\AppData\Local\Temp\catchme.sys []

S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]

S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]

S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2008-01-21 200704]

S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]

S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]

S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]

S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]

S3 NETw3v32;Pilote de carte Intel® PRO/sans fil 3945BG pour Windows Vista 32 bits; C:\Windows\system32\DRIVERS\NETw3v32.sys [2008-01-21 2225664]

S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2008-02-22 87936]

S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2008-02-22 14976]

S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2008-02-22 114304]

S3 USB28xxBGA;PCTV 330e/8x0e Device; C:\Windows\system32\DRIVERS\emBDA.sys [2007-08-08 476288]

S3 USB28xxOEM;USB 28xx OEM Filter; C:\Windows\system32\DRIVERS\emOEM.sys [2007-08-08 38656]

S3 WmFilter;Logitech Gaming HID Filter Driver; C:\Windows\system32\drivers\WmFilter.sys [2008-01-24 28168]

S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\Windows\system32\drivers\WmVirHid.sys [2008-01-24 14728]

S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]

S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]

S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

 

R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [2007-10-07 427288]

R2 avp;Kaspersky Internet Security; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-02-04 206088]

R2 eDataSecurity Service;eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe [2008-03-05 497712]

R2 eLockService;eLock Service; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [2007-10-01 24576]

R2 eNet Service;eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-12-20 131072]

R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-09-10 57344]

R2 eSettingsService;eSettings Service; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-12-19 24576]

R2 IAANTMON;Intel® Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-07-12 354840]

R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]

R2 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2007-11-27 110592]

R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-12-03 869672]

R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-12-04 266343]

R2 TryAndDecideService;Acronis Try And Decide Service; C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe [2007-10-08 493200]

R2 WMIService;ePower Service; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-09-20 167936]

R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-01-30 386560]

S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2007-12-13 447784]

S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]

S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]

S4 ALaunchService;ALaunch Service; C:\Acer\ALaunch\ALaunchSvc.exe [2007-09-19 51200]

 

-----------------EOF-----------------

[Falkra]

Télécharge OTMoveIt3 par OldTimer.

• Enregistre ce fichier sur le Bureau.
  
• Fais un double clic sur OTMoveIt3.exe pour lancer l'exécution de l'outil. (Note: Si tu utilises Vista, fais un clic droit sur le fichier puis choisir Exécuter en tant qu'administrateur).
  
• Copie les lignes de la zone "Code" ci-dessous dans le Presse-papiers en les sélectionnant toutes puis en appuyant simultanément sur les touches CTRL et C (ou, après les avoir sélectionnées, en faisant un clic droit puis en choisissant Copier):
  

  :processes
  explorer.exe 
  :files
  C:\Windows\system32\x64
  :commands
  [start explorer]

  
  

• Retourne dans la fenêtre de OTMoveIt3, fais un clic droit dans la zone de gauche intitulée "Paste List Of Files/Folders to Move" (sous la barre jaune) puis choisir Coller.
  
• Clique sur le bouton rouge Moveit!.
  
• Ferme OTMoveIt3
  
• Poste dans ta prochaine réponse le rapport de OTMoveIt3 (contenu du fichier C:\_OTMoveIt\MovedFiles\********_******.log - les *** sont des chiffres représentant la date [moisjourannée] et l'heure)
  

Note: Si un fichier ou un dossier ne peut pas être déplacé immédiatement, un redémarrage sera peut-être nécessaire pour permettre de terminer le processus de déplacement. Si le redémarrage de la machine vous est demandé, choisir Oui/Yes.

[PolanX]

Voivi le rapport, par contre à la fin de l'analyse j'ai été obligé de relancé explorer "manuellement" j'étais devant un bureau vide.

 

========== PROCESSES ==========

Process explorer.exe killed successfully.

========== FILES ==========

C:\Windows\system32\x64 moved successfully.

File/Folder [start explorer] not found.

 

OTMoveIt3 by OldTimer - Version 1.0.10.0 log created on 04012009_230149

[Falkra]

Ok. OtMoveIt a déplacé le dossier, ça, c'est bien.

 

Est-ce que tu constates encore des symptômes sur la machine ?

[PolanX]

Et bien ecoute, non pas pour l'instant. Est ce que je peux supprimer les dossiers crées par les différentes applications utilisées?

[Falkra]

Désinstalle combofix : entre combofix /u dans la boite exécuter du menu démarrer.

Après cela, efface ce dossier s'il existe encore.

C:\QooBox

 

Supprime RSIT, et le dossier c:\RSIT

 

Supprime OtMoveit et le dossier c:\_Otmoveit

 

Voici de quoi nettoyer et surtout vacciner/protéger tes clés USB

http://forum.zebulon.fr/index.php?autocom=...p;showentry=540 (par Gof).