PC Antispyware 2010 et braviaxe.exe

[st22026]

Mbam n'a rien trouvé :

 

Malwarebytes' Anti-Malware 1.40

Version de la base de données: 2656

Windows 5.1.2600 Service Pack 3

 

21/08/2009 13:38:40

mbam-log-2009-08-21 (13-38-40).txt

 

Type de recherche: Examen complet (C:\|D:\|)

Eléments examinés: 189217

Temps écoulé: 55 minute(s), 54 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 0

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

(Aucun élément nuisible détecté)

 

 

J'ai supprimé pc antispyware à la main puis redémarrer et pour l'instant il n'est pas revenu.Braviax n'est plus dans system32.

Par contre j'ai un problème je ne peux pas activer le pare feu windows,ça doit venir d'un virus?

[pear]

Voyons ce qu'en dit combofix.

[st22026]

Le rapport combofix :

 

ComboFix 09-08-20.07 - Adrien 21/08/2009 14:46.5.1 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.767.485 [GMT 2:00]

Running from: c:\documents and settings\Adrien\Bureau\37237-CF.exe

 

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\ihuvo._dl

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\vivo.sys

c:\windows\dexapizojo.dll

c:\windows\ibodasipu.scr

c:\windows\kulyvipoto.dll

c:\windows\ocazosyg.dll

c:\windows\ogysepujaw.dll

c:\windows\pvc11.dll

c:\windows\system32\404Fix.exe

c:\windows\system32\Agent.OMZ.Fix.exe

c:\windows\system32\dumphive.exe

c:\windows\system32\IEDFix.C.exe

c:\windows\system32\IEDFix.exe

c:\windows\system32\o4Patch.exe

c:\windows\system32\Process.exe

c:\windows\system32\SrchSTS.exe

c:\windows\system32\tmp.reg

c:\windows\system32\VACFix.exe

c:\windows\system32\VCCLSID.exe

c:\windows\system32\WS2Fix.exe

c:\windows\yhevasuvy.scr

c:\windows\yvuvot.dll

 

.

((((((((((((((((((((((((( Files Created from 2009-07-21 to 2009-08-21 )))))))))))))))))))))))))))))))

.

 

2009-08-20 13:38 . 2004-08-10 20:00 4224 -c--a-w- c:\windows\system32\dllcache\beep.sys

2009-08-20 13:38 . 2004-08-10 20:00 4224 ----a-w- c:\windows\system32\drivers\beep.sys

2009-08-20 13:09 . 2009-08-20 13:09 19879 ----a-w- c:\program files\Fichiers communs\urezol.dat

2009-08-20 13:09 . 2009-08-20 13:09 19324 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\yrap.pif

2009-08-20 13:09 . 2009-08-20 13:09 18003 ----a-w- c:\documents and settings\All Users\Application Data\homivogada.pif

2009-08-20 13:09 . 2009-08-20 13:09 16767 ----a-w- c:\windows\system32\eqyhotyso.dll

2009-08-20 13:09 . 2009-08-20 13:09 14730 ----a-w- c:\documents and settings\LocalService\Application Data\wuxydu.scr

2009-08-20 13:09 . 2009-08-20 13:09 10517 ----a-w- c:\windows\system32\hakaderem.dat

2009-08-20 12:59 . 2009-08-20 12:59 -------- d-----w- C:\_OTM

2009-08-19 16:18 . 2009-08-19 16:18 19941 ----a-w- c:\documents and settings\LocalService\Application Data\ihacuzawiq.sys

2009-08-19 16:18 . 2009-08-19 16:18 18282 ----a-w- c:\windows\hesewov.pif

2009-08-19 16:18 . 2009-08-19 16:18 17957 ----a-w- c:\program files\Fichiers communs\anatagona.bin

2009-08-19 16:18 . 2009-08-19 16:18 14337 ----a-w- c:\windows\isereju.sys

2009-08-19 16:18 . 2009-08-19 16:18 14193 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\ogosezujil.scr

2009-08-19 16:18 . 2009-08-19 16:18 13429 ----a-w- c:\windows\zezig.sys

2009-08-19 16:18 . 2009-08-19 16:18 13307 ----a-w- c:\windows\system32\xybexi.pif

2009-08-19 16:18 . 2009-08-19 16:18 11198 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\mimeru.vbs

2009-08-19 15:47 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-19 15:47 . 2009-08-19 15:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-19 15:47 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-17 21:20 . 2009-08-18 17:02 664 ----a-w- c:\windows\system32\d3d9caps.dat

2009-08-17 13:57 . 2009-08-17 13:57 19476 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\ixosigajez.exe

2009-08-17 13:57 . 2009-08-17 13:57 18972 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\lasuvu.scr

2009-08-17 13:57 . 2009-08-17 13:57 17626 ----a-w- c:\program files\Fichiers communs\ejenytazof.scr

2009-08-17 13:57 . 2009-08-17 13:57 15168 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\ozacuh.pif

2009-08-17 13:57 . 2009-08-17 13:57 13805 ----a-w- c:\documents and settings\All Users\Application Data\epiqyby.bat

2009-08-17 13:57 . 2009-08-17 13:57 13718 ----a-w- c:\windows\system32\vilowor.sys

2009-08-17 13:57 . 2009-08-17 13:57 13390 ----a-w- c:\documents and settings\All Users\Application Data\odoz.scr

2009-08-17 13:57 . 2009-08-17 13:57 12543 ----a-w- c:\program files\Fichiers communs\zuduhenajy.dat

2009-08-17 13:25 . 2009-08-17 13:25 -------- d-----w- c:\documents and settings\Adrien\Application Data\Malwarebytes

2009-08-17 13:25 . 2009-08-17 13:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-08-16 21:16 . 2009-08-16 21:16 -------- d-----w- C:\WinFileReplace

2009-08-16 19:19 . 2009-08-16 19:19 19376 ----a-w- c:\windows\system32\zyxecu.scr

2009-08-16 19:19 . 2009-08-16 19:19 17889 ----a-w- c:\windows\wemequtaha.pif

2009-08-16 19:19 . 2009-08-16 19:19 16627 ----a-w- c:\documents and settings\All Users\Application Data\axixime.sys

2009-08-16 19:19 . 2009-08-16 19:19 15444 ----a-w- c:\windows\system32\zemyzy.sys

2009-08-16 19:19 . 2009-08-16 19:19 14737 ----a-w- c:\documents and settings\LocalService\Application Data\bygipozir.dll

2009-08-16 19:19 . 2009-08-16 19:19 13745 ----a-w- c:\documents and settings\LocalService\Application Data\suxogojogu.sys

2009-08-16 11:33 . 2004-08-10 20:00 2944 ----a-w- c:\windows\system32\drivers\null.sys

2009-08-15 22:43 . 2009-08-15 22:43 -------- d-s---w- C:\scan

2009-08-15 12:37 . 2009-08-15 12:37 -------- d-----w- C:\rsit

2009-08-15 09:01 . 2009-08-15 09:01 61440 ----a-w- c:\documents and settings\Adrien\Application Data\HouseCall 6.6\Toolkit.dll

2009-08-15 09:01 . 2009-08-15 09:01 832776 ----a-w- c:\documents and settings\Adrien\Application Data\HouseCall 6.6\lea.dll

2009-08-15 09:01 . 2009-08-15 09:01 439560 ----a-w- c:\documents and settings\Adrien\Application Data\HouseCall 6.6\jlea.dll

2009-08-15 09:01 . 2009-08-15 09:01 42320 ----a-w- c:\documents and settings\Adrien\Application Data\HouseCall 6.6\dsvout.dll

2009-08-15 09:01 . 2009-08-15 09:01 183356 ----a-w- c:\documents and settings\Adrien\Application Data\HouseCall 6.6\Uninstaller.exe

2009-08-15 09:01 . 2009-08-15 11:03 -------- d-----w- c:\documents and settings\Adrien\Application Data\HouseCall 6.6

2009-08-14 15:19 . 2009-08-14 15:19 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2009-08-14 15:11 . 2009-08-14 15:11 18818 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\suwymugynu.reg

2009-08-14 15:11 . 2009-08-14 15:11 17234 ----a-w- c:\documents and settings\All Users\Application Data\gemoputecy.bat

2009-08-14 15:11 . 2009-08-14 15:11 14688 ----a-w- c:\windows\calusexav.vbs

2009-08-14 11:33 . 2009-08-14 11:33 -------- d-----r- c:\documents and settings\NetworkService\Favoris

2009-08-13 21:51 . 2009-08-13 21:51 619584 -c--a-w- c:\windows\system32\dllcache\ntfs.sys

2009-08-12 01:11 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll

2009-08-11 16:20 . 2009-08-11 16:20 15240 ----a-w- c:\documents and settings\Adrien\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll

2009-08-09 01:10 . 2009-08-09 01:10 -------- d-----w- c:\windows\system32\XPSViewer

2009-08-09 01:10 . 2009-08-09 01:10 -------- d-----w- c:\program files\MSBuild

2009-08-09 01:10 . 2009-08-09 01:10 -------- d-----w- c:\program files\Reference Assemblies

2009-08-09 01:09 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-08-09 01:09 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll

2009-08-09 01:09 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll

2009-08-09 01:09 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll

2009-08-09 01:09 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll

2009-08-09 01:09 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll

2009-08-09 01:09 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-08-05 21:08 . 2009-08-10 16:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!

2009-08-05 17:38 . 2009-08-05 17:38 -------- d-----w- c:\program files\Messenger Plus! Live

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-21 11:44 . 2007-12-26 21:42 12 ----a-w- c:\windows\bthservsdp.dat

2009-08-20 13:09 . 2009-08-20 13:09 11059 ----a-w- c:\documents and settings\LocalService\Application Data\lojebiloda.reg

2009-08-19 16:18 . 2009-08-19 16:18 15106 ----a-w- c:\documents and settings\All Users\Application Data\umecodi.bin

2009-08-19 16:18 . 2009-08-19 16:18 13603 ----a-w- c:\documents and settings\All Users\Application Data\qelugyku.dat

2009-08-17 13:57 . 2009-08-17 13:57 18382 ----a-w- c:\program files\Fichiers communs\ikyjek.db

2009-08-17 13:57 . 2009-08-17 13:57 16807 ----a-w- c:\program files\Fichiers communs\fyneqehuca._sy

2009-08-17 13:57 . 2009-08-17 13:57 13100 ----a-w- c:\documents and settings\LocalService\Application Data\uhyg.dat

2009-08-14 16:49 . 2009-03-16 18:47 -------- d-----w- c:\documents and settings\Adrien\Application Data\BitTorrent

2009-08-13 21:53 . 2009-03-16 18:47 -------- d-----w- c:\documents and settings\Adrien\Application Data\DNA

2009-08-13 07:42 . 2009-03-16 18:47 -------- d-----w- c:\program files\DNA

2009-08-12 02:21 . 2009-01-09 16:06 -------- d-----w- c:\documents and settings\Adrien\Application Data\Orbit

2009-08-09 16:33 . 2006-12-23 21:15 58616 -c--a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT

2009-08-09 01:18 . 2006-08-11 17:43 85636 ----a-w- c:\windows\system32\perfc00C.dat

2009-08-09 01:18 . 2006-08-11 17:43 512292 ----a-w- c:\windows\system32\perfh00C.dat

2009-08-05 09:00 . 2004-08-10 20:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll

2009-08-01 08:43 . 2008-12-17 10:35 -------- d-----w- c:\program files\Microsoft Silverlight

2009-07-24 15:04 . 2009-01-10 01:04 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-07-17 19:03 . 2004-08-10 20:00 58880 ----a-w- c:\windows\system32\atl.dll

2009-07-13 21:43 . 2004-08-10 20:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll

2009-07-09 22:20 . 2006-12-24 17:25 -------- d-----w- c:\program files\Fichiers communs\Real

2009-07-03 16:57 . 2006-03-04 04:00 915456 ----a-w- c:\windows\system32\wininet.dll

2009-06-25 15:32 . 2009-06-25 15:32 287 ----a-w- c:\windows\EReg072.dat

2009-06-25 09:22 . 2009-06-24 06:41 -------- d-----w- c:\documents and settings\Adrien\Application Data\Wuala

2009-06-25 09:20 . 2009-06-25 09:20 335872 ------w- c:\documents and settings\Adrien\Application Data\Wuala\Program0\swt-win32-3448.dll

2009-06-24 06:54 . 2009-06-24 06:54 53248 ----a-w- c:\documents and settings\Adrien\Application Data\Wuala\Program0\Win32Utils.dll

2009-06-24 06:41 . 2009-06-24 06:41 592175 ----a-w- c:\documents and settings\Adrien\Application Data\Wuala\Program0\orangevolt-4n-1.0.7.dll

2009-06-24 06:41 . 2009-06-24 06:41 184336 ----a-w- c:\documents and settings\Adrien\Application Data\Wuala\Roaming\Wuala.exe

2009-06-24 06:40 . 2009-06-24 06:40 69632 ----a-w- c:\documents and settings\Adrien\Application Data\Wuala\Program0\Win32NetBIOS.dll

2009-06-16 14:40 . 2005-10-17 21:21 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-16 14:40 . 2005-10-17 21:21 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-15 10:44 . 2005-05-11 02:30 78848 ----a-w- c:\windows\system32\telnet.exe

2009-06-15 10:44 . 2004-08-10 20:00 82944 ----a-w- c:\windows\system32\tlntsess.exe

2009-06-10 14:14 . 2004-08-10 20:00 85504 ----a-w- c:\windows\system32\avifil32.dll

2009-06-10 07:21 . 2004-08-10 20:00 2066432 ----a-w- c:\windows\system32\mstscax.dll

2009-06-10 06:15 . 2004-08-10 20:00 132096 ----a-w- c:\windows\system32\wkssvc.dll

2009-06-08 13:33 . 2009-07-13 14:05 8676883 ----a-w- c:\windows\system32\mp3Media2.dll

2009-06-03 19:10 . 2005-08-30 04:16 1297408 ----a-w- c:\windows\system32\quartz.dll

2009-05-28 09:46 . 2009-05-28 09:46 318904 ----a-w- C:\wmpfirefoxplugin.exe

2008-12-28 18:05 . 2008-12-28 18:05 2402832 -c--a-w- c:\program files\WLinstaller.exe

2006-05-03 10:06 . 2009-01-09 22:07 163328 --sh--r- c:\windows\system32\flvDX.dll

2007-02-21 11:47 . 2009-01-09 22:07 31232 -csh--r- c:\windows\system32\msfDX.dll

2008-03-16 13:30 . 2009-01-09 22:07 216064 -csh--r- c:\windows\system32\nbDX.dll

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"flockbox"="d:\folder lockbox\flockbox.exe" [2006-11-10 1065984]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-11 7626752]

"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-12-19 8720384]

 

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]

BTTray.lnk - c:\program files\WIDCOMM\Logiciel Bluetooth\BTTray.exe [2006-5-12 581693]

 

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

 

[HKLM\~\startupfolder\C:^Documents and Settings^Adrien^Mes documents^Menu Démarrer^Programmes^Démarrage^Free Music Zilla.lnk]

path=c:\documents and settings\Adrien\Mes documents\Menu Démarrer\Programmes\Démarrage\Free Music Zilla.lnk

backup=c:\windows\pss\Free Music Zilla.lnkStartup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Acer Empowering Technology.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Acer Empowering Technology.lnk

backup=c:\windows\pss\Acer Empowering Technology.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Regedit32"=c:\windows\system32\regedit.exe

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"d:\\iTunes.exe"=

"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

"d:\\Orbitdownloader\\orbitdm.exe"=

"d:\\Orbitdownloader\\orbitnet.exe"=

"c:\\Program Files\\DNA\\btdna.exe"=

"d:\\Free Music Zilla\\FMZilla.exe"=

"d:\\SopCast\\adv\\SopAdver.exe"=

"d:\\NetXfer\\NetTransport.exe"=

"d:\\StationRipper\\StationRipperConsole.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"d:\\Real Alternative\\Media Player Classic\\mplayerc.exe"=

"d:\\SopCast\\SopCast.exe"=

"d:\\Program Files\\TVAnts\\Tvants.exe"=

"d:\\VLC\\vlc.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"86:TCP"= 86:TCP:BroadCam Web Server

"7000:UDP"= 7000:UDP:*:Disabled:Windows Media Format SDK (chrome.exe)

"7001:UDP"= 7001:UDP:*:Disabled:Windows Media Format SDK (chrome.exe)

"7002:UDP"= 7002:UDP:*:Disabled:Windows Media Format SDK (chrome.exe)

 

R0 MPRIFL;MPRIFL;c:\windows\system32\drivers\mprifl.sys [07/01/2007 13:02 13824]

S2 BroadCamService;BroadCam Service;"c:\program files\NCH Software\BroadCam\broadCam.exe" -service --> c:\program files\NCH Software\BroadCam\broadCam.exe [?]

S2 EyelineService;Eyeline Service;"c:\program files\NCH Software\Eyeline\eyeline.exe" -service --> c:\program files\NCH Software\Eyeline\eyeline.exe [?]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 21:06 951632]

S3 tapavpn;Steganos Anonym VPN Adapter;c:\windows\system32\drivers\tapavpn.sys [19/10/2007 10:50 24320]

.

Contents of the 'Scheduled Tasks' folder

 

2009-08-07 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

 

2009-08-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3874232922-622592756-1272493053-1006Core.job

- c:\documents and settings\Adrien\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-28 11:25]

 

2009-08-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3874232922-622592756-1272493053-1006UA.job

- c:\documents and settings\Adrien\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-28 11:25]

 

2009-08-20 c:\windows\Tasks\User_Feed_Synchronization-{5E39FACB-FF9D-4260-963F-CCB597CFD3B7}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]

.

.

------- Supplementary Scan -------

.

mStart Page = hxxp://www.google.com

uInternet Connection Wizard,ShellNext = iexplore

IE: &Download by Orbit - d:\orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - d:\orbitdownloader\orbitmxt.dll/204

IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

IE: Do&wnload selected by Orbit - d:\orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - d:\orbitdownloader\orbitmxt.dll/202

IE: Download with &Shareaza - c:\program files\MediaInfo\Nouveau dossier (18)\Nouveau dossier (21)\P2P Rocket\Plugins\RazaWebHook.dll/3000

IE: Envoyer à &Bluetooth - c:\program files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm

IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html

IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html

IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html

IE: Tout télécharger avec NetXfer - d:\netxfer\NXAddList.html

IE: Télécharger avec NetXfer - d:\netxfer\NXAddLink.html

IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html

FF - ProfilePath - c:\documents and settings\Adrien\Application Data\Mozilla\Firefox\Profiles\hjj3vx4k.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=

FF - prefs.js: browser.startup.homepage - hxxp://www.neufportail.fr/

FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIAWB1&q=

FF - plugin: c:\documents and settings\Adrien\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

FF - plugin: d:\divx content uploader\npUpload.dll

FF - plugin: d:\divx player\npDivxPlayerPlugin.dll

FF - plugin: d:\divx web player\npdivx32.dll

FF - plugin: d:\real alternative\browser\plugins\nppl3260.dll

FF - plugin: d:\real alternative\browser\plugins\nprpjplug.dll

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-21 14:51

Windows 5.1.2600 Service Pack 3 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2009-08-21 14:53

ComboFix-quarantined-files.txt 2009-08-21 12:53

ComboFix2.txt 2009-08-17 15:41

 

Pre-Run: 34 835 644 416 octets libres

Post-Run: 34 931 322 880 octets libres

 

268 --- E O F --- 2009-08-20 16:38

 

 

 

C'est braviax qui a désactivé le pare feu et l'antivirus mais maintenant qu'il n'est plus la je devrais pouvoir le réactiver

non?

[pear]

C'est braviax qui a désactivé le pare feu et l'antivirus mais maintenant qu'il n'est plus la je devrais pouvoir le réactiver

non?

 

Oui, bien sûr.

 

 

Combo, Nettoyage

Déconnectez-vous du net et désactivez l'antivirus (juste le temps de la procédure !)

Connecter tous les disques amovibles (disque dur externe, clé USB…).

Dans certaines circonstances , le Mode sans échec peut être nécessaire

Ouvrez Combofix

# Dans le bloc-note ,copiez-collez ces lignes :

 

KillAll::

Folder::

 

c:\program files\Fichiers communs\urezol.dat

c:\windows\system32\hakaderem.dat

c:\documents and settings\All Users\Application Data\qelugyku.dat

c:\documents and settings\LocalService\Application Data\uhyg.dat

c:\program files\Fichiers communs\zuduhenajy.dat

c:\documents and settings\All Users\Application Data\qelugyku.dat

c:\documents and settings\LocalService\Application Data\uhyg.dat

 

File::

c:\documents and settings\LocalService\Local Settings\Application Data\yrap.pif

c:\documents and settings\All Users\Application Data\homivogada.pif

c:\windows\system32\eqyhotyso.dll

c:\documents and settings\LocalService\Application Data\wuxydu.scr

 

c:\documents and settings\LocalService\Application Data\ihacuzawiq.sys

c:\windows\hesewov.pif

c:\program files\Fichiers communs\anatagona.bin

c:\windows\isereju.sys

c:\documents and settings\LocalService\Local Settings\Application Data\ogosezujil.scr

c:\windows\zezig.sys

c:\windows\system32\xybexi.pif

c:\documents and settings\LocalService\Local Settings\Application Data\mimeru.vbs

 

c:\documents and settings\LocalService\Application Data\lojebiloda.reg

c:\documents and settings\All Users\Application Data\umecodi.bin

 

c:\program files\Fichiers communs\ikyjek.db

c:\program files\Fichiers communs\fyneqehuca._sy

 

c:\documents and settings\LocalService\Local Settings\Application Data\ixosigajez.exe

c:\documents and settings\LocalService\Local Settings\Application Data\lasuvu.scr

c:\program files\Fichiers communs\ejenytazof.scr

c:\documents and settings\LocalService\Local Settings\Application Data\ozacuh.pif

c:\documents and settings\All Users\Application Data\epiqyby.bat

c:\windows\system32\vilowor.sys

c:\documents and settings\All Users\Application Data\odoz.scr

c:\windows\system32\zyxecu.scr

c:\windows\wemequtaha.pif

c:\documents and settings\All Users\Application Data\axixime.sys

c:\windows\system32\zemyzy.sys

c:\documents and settings\LocalService\Application Data\bygipozir.dll

c:\documents and settings\LocalService\Application Data\suxogojogu.sys

c:\documents and settings\LocalService\Local Settings\Application Data\suwymugynu.reg

c:\documents and settings\All Users\Application Data\gemoputecy.bat

c:\windows\calusexav.vbs

c:\documents and settings\LocalService\Application Data\lojebiloda.reg

c:\documents and settings\All Users\Application Data\umecodi.bin

 

c:\program files\Fichiers communs\ikyjek.db

c:\program files\Fichiers communs\fyneqehuca._sy

 

* Attention, ce code a été rédigé spécialement pour cet utilisateur, il serait dangereux de le réutiliser dans d'autres cas !

Enregistrez-le en lui donnant le nom CFScript.txt

* Faire un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe

 

* Au message qui apparait dans une fenêtre bleue ( Type 1 to continue, or 2 to abort) , taper 1 puis valider.

* Patienter le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!

Ne toucher à rien tant que le scan n'est pas terminé.

* Une fois le scan achevé, un rapport va s'afficher: poster son contenu.

* Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

 

 

Après cela , ça devrait aller mieux.

 

Lancez Mbam et postez en aussi le rapport.

[st22026]

Ok c'est bon j'ai pu activer le pare feu.

Le rapport combofix :

 

ComboFix 09-08-10.06 - Adrien 17/08/2009 17:34.4.1 - NTFSx86 NETWORK

Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.767.478 [GMT 2:00]

Running from: c:\documents and settings\Adrien\Bureau\65026-CF.exe

AV: avast! antivirus 4.8.1335 [VPS 090812-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

 

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\azyxosim.dat

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\coboxike.dll

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\fusyjygyt.db

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\odawufota.pif

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\ojynen._dl

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\sivajamove.sys

c:\windows\system32\_scui.cpl

c:\windows\system32\404Fix.exe

c:\windows\system32\Agent.OMZ.Fix.exe

c:\windows\system32\braviax.exe

c:\windows\system32\dumphive.exe

c:\windows\system32\IEDFix.C.exe

c:\windows\system32\IEDFix.exe

c:\windows\system32\o4Patch.exe

c:\windows\system32\Process.exe

c:\windows\system32\SrchSTS.exe

c:\windows\system32\tmp.reg

c:\windows\system32\VACFix.exe

c:\windows\system32\VCCLSID.exe

c:\windows\system32\WS2Fix.exe

.

---- Previous Run -------

.

c:\documents and settings\All Users\Application Data\ahonywu.vbs

c:\documents and settings\All Users\Application Data\butofaqoc.scr

c:\documents and settings\All Users\Application Data\firi.dat

c:\documents and settings\All Users\Application Data\gydybyj.com

c:\documents and settings\All Users\Application Data\oboroxyt.bin

c:\documents and settings\All Users\Application Data\ziredowot.bat

c:\documents and settings\LocalService\Application Data\caxepuhaw.bat

c:\documents and settings\LocalService\Application Data\ilamajeje.dat

c:\documents and settings\LocalService\Application Data\unuhiha.bat

c:\documents and settings\LocalService\Application Data\ygal.exe

c:\documents and settings\LocalService\Local Settings\Application Data\daqud.bat

c:\documents and settings\LocalService\Local Settings\Application Data\zaqota.bat

c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd

c:\program files\configmm.ini

c:\program files\Fichiers communs\datoteky.bat

c:\program files\Fichiers communs\evadamafi.inf

c:\program files\Fichiers communs\guzuvizil.db

c:\program files\Fichiers communs\laheviqi.lib

c:\program files\Fichiers communs\sejibuhelu.reg

c:\program files\PC_Antispyware2010\AVEngn.dll

c:\program files\PC_Antispyware2010\data\daily.cvd

c:\program files\PC_Antispyware2010\htmlayout.dll

c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest

c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcm80.dll

c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcp80.dll

c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcr80.dll

c:\program files\PC_Antispyware2010\PC_Antispyware2010.cfg

c:\program files\PC_Antispyware2010\PC_Antispyware2010.exe

c:\program files\PC_Antispyware2010\pthreadVC2.dll

c:\program files\PC_Antispyware2010\Uninstall.exe

c:\program files\PC_Antispyware2010\wscui.cpl

c:\windows\dulav.dll

c:\windows\duxibesoga.bin

c:\windows\evugo.dll

c:\windows\gyzomygib.dat

c:\windows\obive.sys

c:\windows\system32\1220883340.dat

c:\windows\uxoras.com

c:\windows\xemuzyji.sys

 

.

((((((((((((((((((((((((( Files Created from 2009-07-17 to 2009-08-17 )))))))))))))))))))))))))))))))

.

 

2009-08-17 13:57 . 2009-08-17 13:57 19476 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\ixosigajez.exe

2009-08-17 13:57 . 2009-08-17 13:57 18972 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\lasuvu.scr

2009-08-17 13:57 . 2009-08-17 13:57 18799 ----a-w- c:\windows\ocazosyg.dll

2009-08-17 13:57 . 2009-08-17 13:57 17626 ----a-w- c:\program files\Fichiers communs\ejenytazof.scr

2009-08-17 13:57 . 2009-08-17 13:57 15168 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\ozacuh.pif

2009-08-17 13:57 . 2009-08-17 13:57 13805 ----a-w- c:\documents and settings\All Users\Application Data\epiqyby.bat

2009-08-17 13:57 . 2009-08-17 13:57 13718 ----a-w- c:\windows\system32\vilowor.sys

2009-08-17 13:57 . 2009-08-17 13:57 13390 ----a-w- c:\documents and settings\All Users\Application Data\odoz.scr

2009-08-17 13:57 . 2009-08-17 13:57 12543 ----a-w- c:\program files\Fichiers communs\zuduhenajy.dat

2009-08-17 13:57 . 2009-08-17 13:57 10449 ----a-w- c:\documents and settings\LocalService\Application Data\gezexolo.dll

2009-08-17 13:57 . 2009-08-17 15:33 -------- d-----w- c:\program files\PC_Antispyware2010

2009-08-17 13:25 . 2009-08-17 13:25 -------- d-----w- c:\documents and settings\Adrien\Application Data\Malwarebytes

2009-08-17 13:25 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-17 13:25 . 2009-08-17 13:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-08-17 13:25 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-17 13:25 . 2009-08-17 13:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-16 21:16 . 2009-08-16 21:16 -------- d-----w- C:\WinFileReplace

2009-08-16 19:19 . 2009-08-16 19:19 19376 ----a-w- c:\windows\system32\zyxecu.scr

2009-08-16 19:19 . 2009-08-16 19:19 17889 ----a-w- c:\windows\wemequtaha.pif

2009-08-16 19:19 . 2009-08-16 19:19 16627 ----a-w- c:\documents and settings\All Users\Application Data\axixime.sys

2009-08-16 19:19 . 2009-08-16 19:19 15444 ----a-w- c:\windows\system32\zemyzy.sys

2009-08-16 19:19 . 2009-08-16 19:19 14737 ----a-w- c:\documents and settings\LocalService\Application Data\bygipozir.dll

2009-08-16 19:19 . 2009-08-16 19:19 13745 ----a-w- c:\documents and settings\LocalService\Application Data\suxogojogu.sys

2009-08-16 19:19 . 2009-08-16 19:19 12161 ----a-w- c:\windows\ogysepujaw.dll

2009-08-16 19:19 . 2009-08-16 19:19 11038 ----a-w- c:\windows\dexapizojo.dll

2009-08-16 19:19 . 2009-08-16 19:19 -------- d-----w- C:\PC_Antispyware2010

2009-08-16 11:33 . 2004-08-10 20:00 2944 ----a-w- c:\windows\system32\drivers\null.sys

2009-08-15 22:43 . 2009-08-15 22:43 -------- d-s---w- C:\scan

2009-08-15 12:37 . 2009-08-15 12:37 -------- d-----w- C:\rsit

2009-08-15 09:01 . 2009-08-15 09:01 61440 ----a-w- c:\documents and settings\Adrien\Application Data\HouseCall 6.6\Toolkit.dll

2009-08-15 09:01 . 2009-08-15 09:01 832776 ----a-w- c:\documents and settings\Adrien\Application Data\HouseCall 6.6\lea.dll

2009-08-15 09:01 . 2009-08-15 09:01 439560 ----a-w- c:\documents and settings\Adrien\Application Data\HouseCall 6.6\jlea.dll

2009-08-15 09:01 . 2009-08-15 09:01 42320 ----a-w- c:\documents and settings\Adrien\Application Data\HouseCall 6.6\dsvout.dll

2009-08-15 09:01 . 2009-08-15 09:01 183356 ----a-w- c:\documents and settings\Adrien\Application Data\HouseCall 6.6\Uninstaller.exe

2009-08-15 09:01 . 2009-08-15 11:03 -------- d-----w- c:\documents and settings\Adrien\Application Data\HouseCall 6.6

2009-08-14 15:19 . 2009-08-14 15:19 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2009-08-14 15:11 . 2009-08-14 15:11 18818 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\suwymugynu.reg

2009-08-14 15:11 . 2009-08-14 15:11 17234 ----a-w- c:\documents and settings\All Users\Application Data\gemoputecy.bat

2009-08-14 15:11 . 2009-08-14 15:11 14688 ----a-w- c:\windows\calusexav.vbs

2009-08-14 11:33 . 2009-08-14 11:33 -------- d-----r- c:\documents and settings\NetworkService\Favoris

2009-08-13 21:51 . 2009-08-13 21:51 619584 -c--a-w- c:\windows\system32\dllcache\ntfs.sys

2009-08-12 01:11 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll

2009-08-11 16:20 . 2009-08-11 16:20 15240 ----a-w- c:\documents and settings\Adrien\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll

2009-08-09 01:10 . 2009-08-09 01:10 -------- d-----w- c:\windows\system32\XPSViewer

2009-08-09 01:10 . 2009-08-09 01:10 -------- d-----w- c:\program files\MSBuild

2009-08-09 01:10 . 2009-08-09 01:10 -------- d-----w- c:\program files\Reference Assemblies

2009-08-09 01:09 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-08-09 01:09 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll

2009-08-09 01:09 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll

2009-08-09 01:09 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll

2009-08-09 01:09 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll

2009-08-09 01:09 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll

2009-08-09 01:09 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-08-05 21:08 . 2009-08-10 16:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!

2009-08-05 17:38 . 2009-08-05 17:38 -------- d-----w- c:\program files\Messenger Plus! Live

2009-07-21 11:17 . 2009-01-22 13:28 290816 ----a-w- c:\windows\system32\decdll.dll

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-17 13:57 . 2009-08-17 13:57 18382 ----a-w- c:\program files\Fichiers communs\ikyjek.db

2009-08-17 13:57 . 2009-08-17 13:57 16807 ----a-w- c:\program files\Fichiers communs\fyneqehuca._sy

2009-08-17 13:57 . 2009-08-17 13:57 13100 ----a-w- c:\documents and settings\LocalService\Application Data\uhyg.dat

2009-08-14 16:49 . 2009-03-16 18:47 -------- d-----w- c:\documents and settings\Adrien\Application Data\BitTorrent

2009-08-13 21:53 . 2009-03-16 18:47 -------- d-----w- c:\documents and settings\Adrien\Application Data\DNA

2009-08-13 21:51 . 2004-08-10 20:00 619584 ----a-w- c:\windows\system32\drivers\ntfs.sys

2009-08-13 07:42 . 2009-03-16 18:47 -------- d-----w- c:\program files\DNA

2009-08-13 06:23 . 2007-12-26 21:42 12 ----a-w- c:\windows\bthservsdp.dat

2009-08-12 02:21 . 2009-01-09 16:06 -------- d-----w- c:\documents and settings\Adrien\Application Data\Orbit

2009-08-09 16:33 . 2006-12-23 21:15 58616 -c--a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT

2009-08-09 01:18 . 2006-08-11 17:43 85636 ----a-w- c:\windows\system32\perfc00C.dat

2009-08-09 01:18 . 2006-08-11 17:43 512292 ----a-w- c:\windows\system32\perfh00C.dat

2009-08-05 09:00 . 2004-08-10 20:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll

2009-08-01 08:43 . 2008-12-17 10:35 -------- d-----w- c:\program files\Microsoft Silverlight

2009-07-24 15:04 . 2009-01-10 01:04 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-07-17 19:03 . 2004-08-10 20:00 58880 ----a-w- c:\windows\system32\atl.dll

2009-07-13 21:43 . 2004-08-10 20:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll

2009-07-09 22:20 . 2006-12-24 17:25 -------- d-----w- c:\program files\Fichiers communs\Real

2009-07-03 16:57 . 2006-03-04 04:00 915456 ----a-w- c:\windows\system32\wininet.dll

2009-06-25 15:32 . 2009-06-25 15:32 287 ----a-w- c:\windows\EReg072.dat

2009-06-25 09:22 . 2009-06-24 06:41 -------- d-----w- c:\documents and settings\Adrien\Application Data\Wuala

2009-06-25 09:20 . 2009-06-25 09:20 335872 ------w- c:\documents and settings\Adrien\Application Data\Wuala\Program0\swt-win32-3448.dll

2009-06-24 06:54 . 2009-06-24 06:54 53248 ----a-w- c:\documents and settings\Adrien\Application Data\Wuala\Program0\Win32Utils.dll

2009-06-24 06:41 . 2009-06-24 06:41 592175 ----a-w- c:\documents and settings\Adrien\Application Data\Wuala\Program0\orangevolt-4n-1.0.7.dll

2009-06-24 06:41 . 2009-06-24 06:41 184336 ----a-w- c:\documents and settings\Adrien\Application Data\Wuala\Roaming\Wuala.exe

2009-06-24 06:40 . 2009-06-24 06:40 69632 ----a-w- c:\documents and settings\Adrien\Application Data\Wuala\Program0\Win32NetBIOS.dll

2009-06-16 14:40 . 2005-10-17 21:21 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-16 14:40 . 2005-10-17 21:21 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-15 10:44 . 2005-05-11 02:30 78848 ----a-w- c:\windows\system32\telnet.exe

2009-06-15 10:44 . 2004-08-10 20:00 82944 ----a-w- c:\windows\system32\tlntsess.exe

2009-06-10 14:14 . 2004-08-10 20:00 85504 ----a-w- c:\windows\system32\avifil32.dll

2009-06-10 07:21 . 2004-08-10 20:00 2066432 ----a-w- c:\windows\system32\mstscax.dll

2009-06-10 06:15 . 2004-08-10 20:00 132096 ----a-w- c:\windows\system32\wkssvc.dll

2009-06-08 13:33 . 2009-07-13 14:05 8676883 ----a-w- c:\windows\system32\mp3Media2.dll

2009-06-03 19:10 . 2005-08-30 04:16 1297408 ----a-w- c:\windows\system32\quartz.dll

2009-05-28 09:46 . 2009-05-28 09:46 318904 ----a-w- C:\wmpfirefoxplugin.exe

2008-12-28 18:05 . 2008-12-28 18:05 2402832 -c--a-w- c:\program files\WLinstaller.exe

2006-05-03 10:06 . 2009-01-09 22:07 163328 --sh--r- c:\windows\system32\flvDX.dll

2007-02-21 11:47 . 2009-01-09 22:07 31232 -csh--r- c:\windows\system32\msfDX.dll

2008-03-16 13:30 . 2009-01-09 22:07 216064 -csh--r- c:\windows\system32\nbDX.dll

.

 

------- Sigcheck -------

 

[-] 2006-01-13 17:07 360448 5562CC0A47B2AEF06D3417B733F3C195 c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys

[-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys

[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys

[7] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys

[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys

[7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys

[7] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\$NtServicePackUninstall$\tcpip.sys

[7] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys

[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtUninstallKB951748_0$\tcpip.sys

[-] 2008-04-13 19:20 361344 ACCF5A9A1FFAA490F33DBA1C632B95E1 c:\windows\ServicePackFiles\i386\tcpip.sys

[-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\dllcache\tcpip.sys

[-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\drivers\tcpip.sys

 

 

[-] 2007-02-09 11:23 574976 05AB81909514BFD69CBB1F2C147CF6B9 c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys

[-] 2007-02-09 11:10 574464 19A811EF5F1ED5C926A028CE107FF1AF c:\windows\$NtServicePackUninstall$\ntfs.sys

[7] 2008-04-13 19:15 574976 78A08DD6A8D65E697C18E1DB01C5CDCA c:\windows\ServicePackFiles\i386\ntfs.sys

[-] 2009-08-13 21:51 619584 4DFB45D14330ACE7FD32EE8DBCF50C97 c:\windows\system32\dllcache\ntfs.sys

[-] 2009-08-13 21:51 619584 4DFB45D14330ACE7FD32EE8DBCF50C97 c:\windows\system32\drivers\ntfs.sys

 

c:\windows\system32\drivers\beep.sys ... is missing !!

.

((((((((((((((((((((((((((((( SnapShot@2009-08-16_14.03.09 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-08-17 13:57 . 2009-08-17 13:57 16384 c:\windows\temp\Perflib_Perfdata_8c.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe" [2009-02-03 240544]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 172544]

"flockbox"="d:\folder lockbox\flockbox.exe" [2006-11-10 1065984]

"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-12-19 8720384]

 

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

 

[HKLM\~\startupfolder\C:^Documents and Settings^Adrien^Mes documents^Menu Démarrer^Programmes^Démarrage^Free Music Zilla.lnk]

path=c:\documents and settings\Adrien\Mes documents\Menu Démarrer\Programmes\Démarrage\Free Music Zilla.lnk

backup=c:\windows\pss\Free Music Zilla.lnkStartup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Acer Empowering Technology.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Acer Empowering Technology.lnk

backup=c:\windows\pss\Acer Empowering Technology.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Acer WLAN 11g USB Dongle.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Acer WLAN 11g USB Dongle.lnk

backup=c:\windows\pss\Acer WLAN 11g USB Dongle.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BTTray.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\BTTray.lnk

backup=c:\windows\pss\BTTray.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Regedit32"=c:\windows\system32\regedit.exe

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"d:\\iTunes.exe"=

"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

"d:\\Orbitdownloader\\orbitdm.exe"=

"d:\\Orbitdownloader\\orbitnet.exe"=

"c:\\Program Files\\DNA\\btdna.exe"=

"d:\\Free Music Zilla\\FMZilla.exe"=

"d:\\SopCast\\adv\\SopAdver.exe"=

"d:\\NetXfer\\NetTransport.exe"=

"d:\\StationRipper\\StationRipperConsole.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"d:\\Real Alternative\\Media Player Classic\\mplayerc.exe"=

"d:\\SopCast\\SopCast.exe"=

"d:\\Program Files\\TVAnts\\Tvants.exe"=

"d:\\VLC\\vlc.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"86:TCP"= 86:TCP:BroadCam Web Server

"7000:UDP"= 7000:UDP:*:Disabled:Windows Media Format SDK (chrome.exe)

"7001:UDP"= 7001:UDP:*:Disabled:Windows Media Format SDK (chrome.exe)

"7002:UDP"= 7002:UDP:*:Disabled:Windows Media Format SDK (chrome.exe)

 

R0 MPRIFL;MPRIFL;c:\windows\system32\drivers\mprifl.sys [07/01/2007 13:02 13824]

S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [08/04/2008 22:14 114768]

S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [08/04/2008 22:14 20560]

S2 BroadCamService;BroadCam Service;"c:\program files\NCH Software\BroadCam\broadCam.exe" -service --> c:\program files\NCH Software\BroadCam\broadCam.exe [?]

S3 tapavpn;Steganos Anonym VPN Adapter;c:\windows\system32\drivers\tapavpn.sys [19/10/2007 10:50 24320]

.

Contents of the 'Scheduled Tasks' folder

 

2009-08-07 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

 

2009-08-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3874232922-622592756-1272493053-1006Core.job

- c:\documents and settings\Adrien\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-28 11:25]

 

2009-08-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3874232922-622592756-1272493053-1006UA.job

- c:\documents and settings\Adrien\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-28 11:25]

 

2009-08-13 c:\windows\Tasks\User_Feed_Synchronization-{5E39FACB-FF9D-4260-963F-CCB597CFD3B7}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]

.

.

------- Supplementary Scan -------

.

mStart Page = hxxp://www.google.com

uInternet Connection Wizard,ShellNext = iexplore

IE: &Download by Orbit - d:\orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - d:\orbitdownloader\orbitmxt.dll/204

IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

IE: Do&wnload selected by Orbit - d:\orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - d:\orbitdownloader\orbitmxt.dll/202

IE: Download with &Shareaza - c:\program files\MediaInfo\Nouveau dossier (18)\Nouveau dossier (21)\P2P Rocket\Plugins\RazaWebHook.dll/3000

IE: Envoyer à &Bluetooth - c:\program files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm

IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html

IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html

IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html

IE: Tout télécharger avec NetXfer - d:\netxfer\NXAddList.html

IE: Télécharger avec NetXfer - d:\netxfer\NXAddLink.html

IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html

FF - ProfilePath - c:\documents and settings\Adrien\Application Data\Mozilla\Firefox\Profiles\hjj3vx4k.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=

FF - prefs.js: browser.startup.homepage - hxxp://www.neufportail.fr/

FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIAWB1&q=

FF - plugin: c:\documents and settings\Adrien\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

FF - plugin: d:\divx content uploader\npUpload.dll

FF - plugin: d:\divx player\npDivxPlayerPlugin.dll

FF - plugin: d:\divx web player\npdivx32.dll

FF - plugin: d:\real alternative\browser\plugins\nppl3260.dll

FF - plugin: d:\real alternative\browser\plugins\nprpjplug.dll

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-17 17:39

Windows 5.1.2600 Service Pack 3 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2009-08-17 17:41

ComboFix-quarantined-files.txt 2009-08-17 15:40

ComboFix2.txt 2009-08-16 14:04

ComboFix3.txt 2009-08-16 11:38

 

Pre-Run: 35 769 335 808 octets libres

Post-Run: 35 760 971 776 octets libres

 

328 --- E O F --- 2009-08-12 02:24

 

 

 

Je pense que tout est fini.

 

 

 

Merci.

[pear]

Je pense que tout est fini.

 

Pas tout à fait.J'attends le rapport Mbam:

 

 

Téléchargez MBAM

 

[branchez tous les supports amovibles avant de faire ce scan (clé usb/disque dur externe etc)

Si vous utilisez Spybot

Pour désactiver TeaTimer qui ne set à rien et peut faire échouer une désinfection:!

Afficher d'abord le Mode Avancé dans SpyBot

->Options Avancées :

- >menu Mode, Mode Avancé.

Une colonne de menus apparaît dans la partie gauche :

- >cliquer sur Outils,

- >cliquer sur Résident,

Dans Résident :

- >décocher Résident "TeaTimer" pour le désactiver.

* Double cliquez sur l'icône Download_mbam-setup.exe pour lancer le processus d'installation.

Enregistrez le sur le bureau .

Fermer toutes les fenêtres et programmes

Suivez les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet)

N'apportez aucune modification aux réglages par défaut et, en fin d'installation,

Vérifiez que les options Update et Launch soient cochées

MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse.

cliquer sur OK pour fermer la boîte de dialogue..

* Dans l'onglet "mise à jour", cliquez sur le bouton Recherche de mise à jour:

Si le pare-feu demande l'autorisation à MBAM de se connecter, acceptez.

* Une fois la mise à jour terminée, allez dans l'onglet Recherche.

* Sélectionnez "Exécuter un examen complet"

* Cliquez sur "Rechercher"

* .L' analyse prendra un certain temps, soyez patient !

* A la fin , un message affichera :

L'examen s'est terminé normalement.

 

*Si MBAM n'a rien trouvé, il le dira aussi.

Cliquez sur "Ok" pour poursuivre.

*Fermez les navigateurs.

Cliquez sur Afficher les résultats .

 

*Sélectionnez tout et cliquez sur Supprimer la sélection ,

MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

puis ouvrir le Bloc-notes et y copier le rapport d'analyse qui peut être retrouvé sous l'onglet Rapports/logs.

* Copiez-collez ce rapport dans la prochaine réponse.

[st22026]

Mbam n'a rien trouvé.

[pear]

Parfait!

Si vous estimez votre problème résolu, éditez l'en tête de votre premier message pour que ceux qui la recherchent y trouvent une solution.