Blocage d'antivirus et message de privilège insuffisant [RÉSOLU]

Falkra · le 22 octobre 2009

Ben, et le rapport combofix ?

salvo · le 22 octobre 2009

J'ai préferé ne pas laisser inutilement en vitrine le CV de mon PC, je comprend que je ne suis le seul à avoir des problèmes de virus et que vous soyez submergés de demandes.

merci quand même pour le temps consacré à mon problème.

Modifié le 23 octobre 2009 par salvo

Falkra · le 23 octobre 2009

Attends, nous on vient pour désinfecter, il y a du monde bien sûr, mais ce n'est pas grave, on fait au fur et à mesure.

Donc pas de souci, on désinfectera ton PC, mais si tu ne veux pas ou plus, que tu as reformaté ou porté chez un réparateur, c'est plus simple de le dire, si c'est le cas.

salvo · le 23 octobre 2009

Bonjour,

Revoici la copie du rapport combofix alors.

Je précise quand même qu'il n'y a pas eu de reformatage ou de réparation quelconque ormis le fait que Kaspersky soit de nouveau en fonction.

ComboFix 09-10-18.06 - Salvatore 19-10-2009 11:34.1.2 - NTFSx86

Microsoft® Windows Vista™ Édition Intégrale 6.0.6002.2.1252.2.1036.18.2047.1177 [GMT -4:00]

Lancé depuis: c:\users\Salvatore\Desktop\TRALALA.exe

SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}

SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\$recycle.bin\S-1-5-21-51003140-4199384537-3980697693-500

c:\program files\INSTALL.LOG

c:\programdata\ntuser.dat{0c9f4fbf-0fc3-11de-aeec-00125a5d4798}.TMContainer00000000000000000001.regtrans-ms

c:\users\Salvatore\UNINSTALL.EXE

c:\windows\Installer\153f74.msi

c:\windows\Installer\1b755e0.msi

c:\windows\Installer\258b52.msi

c:\windows\Installer\2916411.msi

c:\windows\Installer\2eb9ea.msi

c:\windows\Installer\32baf0.msi

c:\windows\Installer\33f797b.msp

c:\windows\Installer\33f797c.msp

c:\windows\Installer\33f797d.msp

c:\windows\Installer\34786f.msi

c:\windows\Installer\4377e.msi

c:\windows\Installer\63833.msi

c:\windows\system32\Ijl11.dll

Une copie infectée de c:\windows\system32\cngaudit.dll a été trouvée et désinfectée

Copie restaurée à partir de - c:\windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}

-------\Service_NetService

((((((((((((((((((((((((((((( Fichiers créés du 2009-09-19 au 2009-10-19 ))))))))))))))))))))))))))))))))))))

.

2009-10-19 15:51 . 2009-10-19 15:59 -------- d-----w- c:\users\Salvatore\AppData\Local\temp

2009-10-19 15:51 . 2009-10-19 15:51 -------- d-----w- c:\users\Default\AppData\Local\temp

2009-10-18 21:32 . 2009-10-18 21:32 -------- d-----w- c:\users\Salvatore\AppData\Roaming\Malwarebytes

2009-10-18 21:32 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-18 21:32 . 2009-10-18 21:32 -------- d-----w- c:\programdata\Malwarebytes

2009-10-18 21:32 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-18 16:44 . 2009-10-01 14:29 195440 ------w- c:\windows\system32\MpSigStub.exe

2009-10-18 14:01 . 2009-10-18 14:01 -------- d-----w- c:\users\Salvatore\AppData\Local\Sophos

2009-10-18 13:38 . 2009-10-18 13:38 -------- d-----w- c:\program files\Kaspersky Lab

2009-10-18 13:02 . 2009-10-18 16:06 -------- d-----w- c:\programdata\Sophos

2009-10-18 13:02 . 2009-10-18 16:06 -------- d-----w- c:\program files\Sophos

2009-10-18 13:00 . 2009-10-18 13:00 -------- d-----w- C:\stdtsa

2009-10-18 12:46 . 2009-10-18 12:46 -------- d-----w- c:\windows\McAfee.com

2009-10-17 23:12 . 2009-10-17 23:12 -------- d-----w- c:\program files\ESET

2009-10-17 22:16 . 2009-10-17 22:16 -------- d-----w- c:\program files\Common Files\Borland Shared

2009-10-17 22:16 . 1999-01-20 09:01 210032 ----a-w- c:\windows\system32\DBCLIENT.DLL

2009-10-16 22:01 . 2009-10-16 22:01 -------- d-----w- c:\program files\Trend Micro

2009-10-16 20:26 . 2009-10-16 20:26 -------- d-----w- c:\programdata\F-Secure

2009-10-16 20:25 . 2009-10-18 16:11 -------- d-----w- c:\program files\Windows Live Safety Center

2009-10-16 20:10 . 2009-10-16 20:10 -------- d-----w- c:\windows\BDOSCAN8

2009-10-16 20:05 . 2009-05-07 07:04 157712 ----a-w- c:\windows\system32\drivers\tmcomm.sys

2009-10-16 19:29 . 2009-10-16 19:52 -------- d-----w- c:\users\Salvatore\.housecall6.6

2009-10-16 19:22 . 2009-10-16 19:22 -------- d-----w- C:\Trend Micro

2009-10-16 03:27 . 2009-10-16 17:21 -------- d-----w- c:\users\Salvatore\{4e8c355b-e688-4091-bf26-3cca1bb7e7df}

2009-10-16 03:26 . 2009-08-20 03:50 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll

2009-10-16 03:26 . 2009-08-20 03:50 46928 ----a-r- c:\windows\system32\AdobePDF.dll

2009-10-16 03:22 . 2009-10-16 17:21 -------- d-----w- C:\_AcroTemp

2009-10-16 03:12 . 2009-10-19 13:44 0 ----a-r- c:\windows\win32k.sys

2009-10-14 19:30 . 2009-10-14 20:05 -------- d-----w- c:\programdata\NOS

2009-10-14 19:30 . 2009-10-14 19:30 -------- d-----w- c:\program files\NOS

2009-10-14 17:40 . 2009-09-10 16:48 218624 ----a-w- c:\windows\system32\msv1_0.dll

2009-10-14 13:04 . 2009-10-14 13:04 -------- d-----w- c:\users\Salvatore\AppData\Roaming\Windows Live Writer

2009-10-14 13:03 . 2009-10-14 13:04 -------- d-----w- c:\users\Salvatore\AppData\Local\Windows Live Writer

2009-10-13 18:26 . 2009-10-13 18:26 -------- d-----w- c:\program files\Realtek AC97

2009-10-13 18:08 . 2009-06-19 07:45 4172832 ----a-w- c:\windows\system32\drivers\RTKVAC.SYS

2009-10-13 18:08 . 2009-04-14 19:43 10975264 ----a-w- c:\windows\system32\RTLCPL.EXE

2009-10-13 18:08 . 2009-04-14 19:43 154144 ----a-w- c:\windows\system32\RTLCPAPI.dll

2009-10-13 18:08 . 2009-04-14 19:43 965664 ----a-w- c:\windows\system32\RtkPgExt.dll

2009-10-13 18:03 . 2009-10-13 18:03 -------- d-----w- c:\program files\Marvell

2009-10-11 00:19 . 2008-03-29 21:36 106768 ----a-w- c:\windows\system32\dneinobj.dll

2009-10-11 00:19 . 2008-03-29 21:36 125328 ----a-w- c:\windows\system32\drivers\dne2000.sys

2009-10-08 11:50 . 2009-10-16 17:21 -------- d-----w- C:\System Software Updates

2009-10-07 21:58 . 2009-10-19 15:53 -------- d-----w- c:\windows\PRIndex

2009-10-07 21:58 . 2009-10-15 14:47 -------- d-----w- c:\users\Salvatore\AppData\Roaming\NewspaperDirect

2009-10-07 21:57 . 2009-10-07 21:57 -------- d-----w- c:\program files\NewspaperDirect

2009-10-07 12:28 . 2009-10-07 12:28 -------- d-----w- c:\users\Salvatore\AppData\Local\Seven Zip

2009-10-06 18:06 . 2009-10-06 18:20 -------- d-----w- c:\users\Salvatore\AppData\Roaming\SmartDraw

2009-10-03 17:25 . 2009-10-03 17:26 -------- d-----w- c:\program files\Microsoft IntelliType Pro

2009-10-03 12:56 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll

2009-10-03 12:56 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe

2009-10-03 12:56 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll

2009-10-03 12:56 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll

2009-10-03 12:55 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll

2009-10-03 12:55 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll

2009-10-03 12:55 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll

2009-10-03 12:55 . 2009-08-06 23:23 171608 ----a-w- c:\windows\system32\wuwebv.dll

2009-10-03 12:55 . 2009-08-06 22:44 33792 ----a-w- c:\windows\system32\wuapp.exe

2009-09-28 09:22 . 2009-09-28 09:22 364544 ----a-w- c:\windows\system32\yk60x86.dll

2009-09-28 09:22 . 2009-09-28 09:22 312832 ----a-w- c:\windows\system32\drivers\yk60x86.sys

2009-09-28 00:26 . 2009-09-28 00:26 -------- d-----w- c:\users\Salvatore\AppData\Roaming\RibbonSoft

2009-09-27 23:56 . 2009-09-27 23:56 -------- d-----w- c:\users\Salvatore\.coban

2009-09-27 21:46 . 2009-09-27 21:46 4942440 ----a-w- c:\windows\system32\nvdisps.dll

2009-09-27 21:46 . 2009-09-27 21:46 13949544 ----a-w- c:\windows\system32\nvcpl.dll

2009-09-27 20:12 . 2009-09-27 20:12 9509832 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

2009-09-27 20:12 . 2009-09-27 20:12 490088 ----a-w- c:\windows\system32\nvudisp.exe

2009-09-27 20:12 . 2009-09-27 20:12 2169448 ----a-w- c:\windows\system32\nvcuvid.dll

2009-09-27 20:12 . 2009-09-27 20:12 1997416 ----a-w- c:\windows\system32\nvcuda.dll

2009-09-27 20:12 . 2009-09-27 20:12 1714792 ----a-w- c:\windows\system32\nvcuvenc.dll

2009-09-27 20:12 . 2009-09-27 20:12 170600 ----a-w- c:\windows\system32\nvcod167.dll

2009-09-27 20:12 . 2009-09-27 20:12 170600 ----a-w- c:\windows\system32\nvcod.dll

2009-09-27 20:12 . 2009-09-27 20:12 11197032 ----a-w- c:\windows\system32\nvoglv32.dll

2009-09-27 01:32 . 2009-09-27 01:32 -------- d-----w- c:\users\Salvatore\AppData\Roaming\CadSoft

2009-09-27 01:11 . 2009-09-27 01:12 -------- d-----w- c:\users\Salvatore\AppData\Roaming\qet

2009-09-27 01:04 . 2009-09-27 01:06 -------- d-----w- c:\users\Salvatore\Download

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-19 15:59 . 2009-05-31 16:39 35275 ----a-w- c:\programdata\nvModes.dat

2009-10-19 15:57 . 2007-02-24 03:25 -------- d-----w- c:\programdata\NVIDIA

2009-10-19 15:56 . 2009-01-18 23:27 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs

2009-10-19 15:54 . 2008-01-01 02:24 6193 ----a-w- c:\windows\bthservsdp.dat

2009-10-19 13:52 . 2009-03-09 00:11 -------- d-----w- c:\users\Salvatore\AppData\Roaming\Skype

2009-10-19 13:50 . 2007-02-21 22:59 -------- d-----w- c:\programdata\Google Updater

2009-10-19 13:50 . 2009-03-09 00:19 -------- d-----w- c:\users\Salvatore\AppData\Roaming\skypePM

2009-10-18 13:47 . 2007-02-22 23:59 -------- d-----w- c:\programdata\Kaspersky Lab

2009-10-18 13:41 . 2009-08-11 16:48 94643 ----a-w- c:\windows\system32\drivers\klick.dat

2009-10-18 13:41 . 2009-08-11 16:48 105395 ----a-w- c:\windows\system32\drivers\klin.dat

2009-10-18 12:37 . 2009-02-24 00:47 -------- d-----w- c:\programdata\Lavasoft

2009-10-16 19:56 . 2008-05-19 16:13 -------- d-----w- c:\program files\Java

2009-10-16 17:32 . 2009-10-16 17:32 56 ---ha-w- c:\programdata\ezsidmv.dat

2009-10-16 17:31 . 2007-02-21 19:49 202328 ----a-w- c:\users\Salvatore\AppData\Local\GDIPFONTCACHEV1.DAT

2009-10-16 17:21 . 2009-03-14 16:26 -------- d-----w- c:\programdata\HP Product Assistant

2009-10-16 17:21 . 2007-03-12 21:59 -------- d-----w- c:\programdata\FLEXnet

2009-10-15 17:49 . 2007-02-28 01:41 -------- d-----w- c:\program files\Common Files\EZB Systems

2009-10-15 16:28 . 2007-02-24 16:55 -------- d-----w- c:\program files\Common Files\Adobe

2009-10-15 15:09 . 2009-07-06 21:11 662610 ----a-w- c:\windows\system32\perfh010.dat

2009-10-15 15:09 . 2009-07-06 21:11 124280 ----a-w- c:\windows\system32\perfc010.dat

2009-10-15 15:09 . 2006-11-02 16:03 678690 ----a-w- c:\windows\system32\perfh00C.dat

2009-10-15 15:09 . 2006-11-02 16:03 127798 ----a-w- c:\windows\system32\perfc00C.dat

2009-10-14 20:49 . 2007-02-21 21:07 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-10-14 18:51 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail

2009-10-14 18:36 . 2007-02-24 00:43 -------- d-----w- c:\programdata\Microsoft Help

2009-10-13 18:26 . 2007-03-18 16:21 319488 ----a-w- c:\windows\HideWin.exe

2009-10-13 17:46 . 2009-04-11 13:18 -------- d-----w- c:\programdata\ma-config.com

2009-10-13 17:46 . 2009-04-11 13:18 -------- d-----w- c:\program files\ma-config.com

2009-10-03 16:13 . 2008-03-01 22:10 -------- d-----w- c:\program files\Windows Live

2009-09-27 20:12 . 2009-09-27 20:12 10984 ----a-w- c:\windows\system32\drivers\nvBridge.kmd

2009-09-27 20:12 . 2007-04-12 21:07 7614056 ----a-w- c:\windows\system32\nvd3dum.dll

2009-09-27 20:12 . 2007-04-12 21:07 1074280 ----a-w- c:\windows\system32\nvapi.dll

2009-09-24 13:24 . 2007-09-12 09:28 490088 ----a-w- c:\windows\system32\nvuninst.exe

2009-09-20 13:22 . 2009-09-20 13:22 0 ----a-w- c:\windows\system32\REN897D.tmp

2009-09-20 13:22 . 2009-09-20 13:22 0 ----a-w- c:\windows\system32\REN897C.tmp

2009-09-20 13:22 . 2009-09-20 13:22 0 ----a-w- c:\windows\system32\REN897B.tmp

2009-09-17 17:18 . 2009-09-17 17:18 -------- d-----w- c:\program files\iTunes

2009-09-17 17:18 . 2009-09-17 17:18 -------- d-----w- c:\program files\iPod

2009-09-17 17:18 . 2009-04-01 14:05 -------- d-----w- c:\program files\Common Files\Apple

2009-09-17 17:16 . 2009-06-07 23:59 -------- d-----w- c:\program files\QuickTime

2009-09-17 15:04 . 2008-08-13 02:47 -------- d-----w- c:\program files\Apple Software Update

2009-09-17 14:25 . 2009-09-17 14:23 -------- d-----w- c:\program files\iTunes(57)

2009-09-17 14:23 . 2009-09-17 14:23 -------- d-----w- c:\program files\iPod(56)

2009-09-17 14:23 . 2009-09-17 13:49 -------- d-----w- c:\program files\Common Files\Apple(7)

2009-09-17 14:17 . 2009-09-17 14:17 -------- d-----w- c:\program files\QuickTime(58)

2009-09-17 12:27 . 2007-08-21 00:58 -------- d-----w- c:\program files\Bonjour

2009-09-16 14:13 . 2007-03-04 01:13 -------- d-----w- c:\users\Salvatore\AppData\Roaming\Apple Computer

2009-09-14 19:49 . 2009-09-14 19:47 -------- d-----w- c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD}

2009-09-14 09:29 . 2009-10-14 17:39 144896 ----a-w- c:\windows\system32\drivers\srv2.sys

2009-09-14 00:17 . 2007-03-04 00:48 -------- d-----w- c:\users\Salvatore\AppData\Roaming\ZoomBrowser EX

2009-09-13 19:32 . 2009-01-29 19:03 -------- d-----w- c:\programdata\ZoomBrowser

2009-09-10 16:38 . 2009-09-03 16:31 -------- d-----w- c:\users\Salvatore\AppData\Roaming\HpUpdate

2009-09-09 02:07 . 2008-03-01 22:03 -------- d-----w- c:\program files\Microsoft Silverlight

2009-09-04 12:21 . 2007-02-24 01:14 -------- d-----w- c:\program files\Microsoft Works

2009-09-04 11:41 . 2009-10-14 17:39 60928 ----a-w- c:\windows\system32\msasn1.dll

2009-09-03 13:01 . 2007-09-05 15:18 878080 ----a-w- c:\windows\system32\iconv.dll

2009-09-03 13:01 . 2007-09-05 15:18 721920 ----a-w- c:\windows\system32\libxml2.dll

2009-09-03 13:01 . 2007-09-05 15:18 51200 ----a-w- c:\windows\system32\libexslt.dll

2009-09-03 13:01 . 2007-09-05 15:18 150016 ----a-w- c:\windows\system32\libxslt.dll

2009-09-02 11:04 . 2008-12-16 20:31 -------- d-----w- c:\programdata\Avanquest Bluetooth SDK

2009-09-01 20:57 . 2009-01-04 00:18 -------- d-----w- c:\program files\Motorola Phone Tools

2009-09-01 13:00 . 2009-09-01 13:00 -------- d-----w- c:\program files\Microsoft IntelliPoint

2009-09-01 02:17 . 2007-11-19 00:12 -------- d-----w- c:\programdata\Nero

2009-08-31 13:49 . 2007-12-14 03:47 -------- d-----w- c:\program files\DivX

2009-08-31 13:48 . 2009-04-20 14:20 -------- d-----w- c:\program files\Common Files\DivX Shared

2009-08-31 12:15 . 2009-01-18 23:19 -------- d-----w- c:\program files\Common Files\LogiShrd

2009-08-31 12:15 . 2009-01-18 23:18 -------- d-----w- c:\programdata\LogiShrd

2009-08-31 12:15 . 2008-04-09 00:08 -------- d-----w- c:\program files\Logitech

2009-08-30 18:42 . 2009-08-30 18:42 -------- d-----w- c:\program files\Free Audio Pack

2009-08-30 16:36 . 2009-08-29 14:57 -------- d-----w- c:\users\Salvatore\AppData\Roaming\Nero

2009-08-30 11:24 . 2009-08-01 15:35 -------- d-----w- c:\programdata\LightScribe

2009-08-29 14:51 . 2009-08-29 14:39 -------- d-----w- c:\program files\Common Files\Nero

2009-08-29 14:50 . 2009-08-20 22:27 -------- d-----w- c:\program files\Nero

2009-08-29 14:39 . 2009-08-29 14:38 -------- d-----w- c:\program files\Common Files\LightScribe

2009-08-29 00:27 . 2009-09-02 21:48 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll

2009-08-29 00:14 . 2009-09-02 21:48 28672 ----a-w- c:\windows\system32\Apphlpdm.dll

2009-08-27 05:22 . 2009-10-14 17:39 916480 ----a-w- c:\windows\system32\wininet.dll

2009-08-27 05:17 . 2009-10-14 17:39 109056 ----a-w- c:\windows\system32\iesysprep.dll

2009-08-27 05:17 . 2009-10-14 17:39 71680 ----a-w- c:\windows\system32\iesetup.dll

2009-08-27 03:42 . 2009-10-14 17:39 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2009-08-25 20:34 . 2008-03-12 01:26 286720 ------w- c:\windows\Setup1.exe

2009-08-25 13:14 . 2009-08-25 13:14 -------- d-----w- c:\program files\NVIDIA Corporation

2009-08-20 21:44 . 2009-08-20 21:44 -------- d-----w- c:\program files\TomTom International B.V

2009-08-20 21:44 . 2009-08-20 21:44 -------- d-----w- c:\program files\TomTom HOME 2

2009-08-18 03:33 . 2009-08-18 03:33 1193832 ----a-w- c:\windows\system32\FM20.DLL

2009-08-17 04:57 . 2009-08-17 04:57 155648 ----a-w- c:\windows\system32\nvcod162.dll

2009-08-14 16:27 . 2009-09-08 20:49 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys

2009-08-14 15:53 . 2009-09-08 20:49 17920 ----a-w- c:\windows\system32\netevent.dll

2009-08-14 13:49 . 2009-09-08 20:49 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE

2009-08-14 13:49 . 2009-09-08 20:49 17920 ----a-w- c:\windows\system32\ROUTE.EXE

2009-08-14 13:49 . 2009-09-08 20:49 11264 ----a-w- c:\windows\system32\MRINFO.EXE

2009-08-14 13:49 . 2009-09-08 20:49 27136 ----a-w- c:\windows\system32\NETSTAT.EXE

2009-08-14 13:49 . 2009-09-08 20:49 19968 ----a-w- c:\windows\system32\ARP.EXE

2009-08-14 13:49 . 2009-09-08 20:49 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE

2009-08-14 13:49 . 2009-09-08 20:49 10240 ----a-w- c:\windows\system32\finger.exe

2009-08-14 13:48 . 2009-09-08 20:49 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys

2009-08-14 13:48 . 2009-09-08 20:49 105984 ----a-w- c:\windows\system32\netiohlp.dll

2009-08-11 16:51 . 2009-08-11 16:51 604140 --sha-w- c:\windows\system32\drivers\ISwift3(98).dat

2009-08-11 16:51 . 2009-08-11 16:51 604140 ----a-w- c:\windows\system32\drivers\ISwift3(751).dat

2009-08-11 16:51 . 2009-08-11 16:51 604140 ----a-w- c:\windows\system32\drivers\ISwift3(437).dat

2007-12-07 23:15 . 2007-12-07 23:11 24 --sh--w- c:\windows\SF63CD005.tmp

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-03 68856]

"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]

"RocketDock"="c:\program files\Utilitaires\RocketDock\RocketDock.exe" [2007-09-02 495616]

"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]

"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-08-27 247144]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-07-16 25604904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]

"PDF4 Registry Controller"="c:\program files\ScanSoft\PDF Professional 4.0\RegistryController.exe" [2007-01-17 46632]

"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]

"LiveUpdate"="c:\program files\Samsung\Samsung PC Studio 3\\Update\Copyer.exe" [2009-05-21 270336]

"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-05-08 2780432]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-05-28 1468296]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]

"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-05-28 1501064]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2009-10-03 38768]

"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2009-10-03 640376]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2009-04-14 604704]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Application de mise … jour de QuickBooks.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-12-12 967960]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]

Mises … jour planifi‚es de Quicken.lnk - c:\program files\Quicken\bagent.exe [2009-1-11 62752]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\acaptuser32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\startupfolder\C:^Users^Salvatore^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Lotus Organizer EasyClip.lnk]

path=c:\users\Salvatore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Lotus Organizer EasyClip.lnk

backup=c:\windows\pss\Lotus Organizer EasyClip.lnk.Startup

backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiSpywareOverride"=dword:00000001

"VistaSp2"=hex(b):fb,65,d0,f6,27,df,c9,01

R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [15-05-2009 18:50 21008]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [17-08-2009 01:32 239648]

R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [27-08-2009 11:05 92008]

R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [30-03-2009 16:28 1533808]

R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\System32\drivers\klmouflt.sys [16-05-2009 20:59 19472]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?]

S2 UDNT;UDNT;c:\windows\System32\drivers\UDNT.SYS [28-06-2008 10:31 24576]

S3 getPlusHelper;getPlus® Helper;c:\windows\System32\svchost.exe -k getPlusHelper [20-03-2008 22:59 21504]

S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23-09-2009 14:50 238960]

S3 RT-USB;Ross-Tech USB driver;c:\windows\System32\drivers\RT-USB.SYS [05-02-2007 13:38 54176]

S3 SureThing Labelflash service;SureThing Labelflash service;c:\program files\Common Files\SureThing Shared\stllssvr.exe [03-08-2007 16:05 74392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs REG_MULTI_SZ BthServ

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

HPService REG_MULTI_SZ HPSLPSVC

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

getPlusHelper REG_MULTI_SZ getPlusHelper

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

"c:\program files\Common Files\LightScribe\LSRunOnce.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]

%SystemRoot%\system32\soundschemes.exe /AddRegistration

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]

%SystemRoot%\system32\soundschemes2.exe /AddRegistration

.

Contenu du dossier 'Tâches planifiées'

2009-10-19 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-21 19:25]

2009-10-19 c:\windows\Tasks\User_Feed_Synchronization-{F10C0B6F-FF1B-408F-A6D3-BD55198AD8F8}.job

- c:\windows\system32\msfeedssync.exe [2009-10-14 03:41]

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.google.ca/webhp?sourceid=navclient&hl=fr&ie=UTF-8

uInternet Settings,ProxyOverride = *.local

IE: Ajouter au fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Consulter les dictionnaires (SYSTRAN) - c:\program files\SYSTRAN\6\\GUIres.dll/lookup.js

IE: Convertir au format PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir la cible du lien en Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Dictionnaires en ligne - c:\program files\PRMT8\PRMTIE\oda.htm

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Mots inconnus - c:\program files\PRMT8\PRMTIE\infopanel.htm

IE: Ouvrir avec ScanSoft PDF Converter 4.1 - c:\program files\ScanSoft\PDF Professional 4.0\cnvres_fre.dll /100

IE: Ouvrir l'entrée - c:\program files\PRMT8\PRMTIE\addentry.htm

IE: Personnaliser les options de la traduction - c:\program files\PRMT8\PRMTIE\options.htm

IE: Rechercher sur le Web - c:\program files\PRMT8\PRMTIE\search.htm

IE: Traduire - c:\program files\PRMT8\PRMTIE\translat.htm

IE: Traduire (SYSTRAN) - c:\program files\SYSTRAN\6\\GUIres.dll/translate.js

IE: Traduire la page - c:\program files\PRMT8\PRMTIE\page.htm

Handler: intu-ir2008 - {729D3592-92E7-4cbc-8E44-3C22B3F457B3} - c:\program files\ImpotRapide 2008\ic2008pp.dll

DPF: {123BBFF5-F9E4-4B0A-A75B-B545AC5AAB91} - hxxps://honda.portal.honda.ca/portal/DiagClient.cab

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

DPF: {3C9ECC99-D050-4AA2-9D9A-C0EA26252005} - hxxps://honda.portal.honda.ca/portal/DealerIdentity.CAB

DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab

DPF: {680285A8-96D3-43DA-9D3D-51DD987D0B77} - hxxp://www.nero.com/doc/NeroVersionCheckerControl.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab

DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab

DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} - hxxps://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-19 11:59

Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(4164)

c:\program files\Utilitaires\RocketDock\RocketDock.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\System32\nvvsvc.exe

c:\windows\System32\audiodg.exe

c:\windows\System32\nvvsvc.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe

c:\windows\System32\IoctlSvc.exe

c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\System32\WUDFHost.exe

c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

c:\tralala\CF9937.exe

c:\program files\Windows Media Player\wmpnscfg.exe

c:\windows\System32\wbem\unsecapp.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\ehome\ehmsas.exe

c:\program files\Microsoft IntelliType Pro\dpupdchk.exe

c:\program files\Common Files\LogiShrd\LQCVFX\COCIManager.exe

c:\program files\Skype\Plugin Manager\skypePM.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\HP\Digital Imaging\bin\hpqste08.exe

c:\program files\HP\Digital Imaging\bin\hpqbam08.exe

c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe

c:\program files\Windows Live\Contacts\wlcomm.exe

.

**************************************************************************

.

Heure de fin: 2009-10-19 12:12 - La machine a redémarré

ComboFix-quarantined-files.txt 2009-10-19 16:12

Avant-CF: 34 425 053 184 octets libres

Après-CF: 40 263 569 408 octets libres

- - End Of File - - 5776CCA93A942491750351A0F73B18BE

Falkra · le 24 octobre 2009

Ok, continuons.

Il y avait une grosse infection.

Est-ce que maintenant MBAM se laisse télécharger ?

salvo · le 24 octobre 2009

Bonjour,

J'ai donc réinstaller MBAM et procédé à un examen tel que décrit dans tes instructions du 18 octobre dernier

"Trojan Dropper" a été détecté et supprimé, ensuite j'ai du redémarrer.

Copie du rapport:

Malwarebytes' Anti-Malware 1.41

Version de la base de données: 3024

Windows 6.0.6002 Service Pack 2

24-10-2009 09:39:47

mbam-log-2009-10-24 (09-39-47).txt

Type de recherche: Examen rapide

Eléments examinés: 100036

Temps écoulé: 7 minute(s), 1 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 1

Processus mémoire infecté(s):