PC infecté : plus rien ne marche !

alpina d10 · le 12 janvier 2010

BON DEJA UN BON POINT :JE PEUX OUVRIR MON PARE FEU WINDOWS LE RESTE TOUJOURS RIEN VOICI LE RAPPORT DE COMBO

ComboFix 10-01-12.02 - uset 2010-01-13 0:11.7.1 - x86

Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1022.734 [GMT 1:00]

Lancé depuis: c:\documents and settings\uset\Bureau\ComboFix.exe

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.A PLUS

.

---- Exécution préalable -------

.

c:\windows\system32\qugrwbeu.ini

c:\windows\system32\rqtwa.ini

c:\windows\system32\rqtwa.ini2

c:\windows\system32\tmp.reg

.

((((((((((((((((((((((((((((( Fichiers créés du 2009-12-12 au 2010-01-12 ))))))))))))))))))))))))))))))))))))

.

2010-01-12 18:35 . 2010-01-12 18:35 152576 ----a-w- c:\documents and settings\uset\Application Data\Sun\Java\jre1.6.0_17\lzma.dll

2010-01-12 18:35 . 2010-01-12 18:35 79488 ----a-w- c:\documents and settings\uset\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

2010-01-12 17:44 . 2010-01-12 17:44 -------- d-----w- C:\_OTM

2010-01-12 13:03 . 2008-04-13 18:05 14720 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys

2010-01-12 13:03 . 2008-04-13 18:05 14720 ----a-w- c:\windows\system32\drivers\kbdhid.sys

2010-01-12 12:53 . 2010-01-12 18:35 -------- d-----w- c:\program files\Java

2010-01-12 12:51 . 2010-01-12 12:52 -------- d--h--w- c:\windows\ie8

2010-01-12 12:35 . 2010-01-12 12:35 -------- d-----w- c:\documents and settings\uset\Application Data\vlc

2010-01-12 12:35 . 2010-01-12 12:35 -------- d-----w- c:\program files\ATI Technologies

2010-01-07 21:02 . 2010-01-07 21:07 -------- d-----w- C:\rsit

2010-01-05 17:34 . 2009-10-21 05:39 75776 -c----w- c:\windows\system32\dllcache\strmfilt.dll

2010-01-05 17:34 . 2009-10-21 05:39 25088 -c----w- c:\windows\system32\dllcache\httpapi.dll

2010-01-05 17:34 . 2009-10-20 16:20 265728 -c----w- c:\windows\system32\dllcache\http.sys

2010-01-05 17:34 . 2009-10-12 13:39 79872 -c----w- c:\windows\system32\dllcache\raschap.dll

2010-01-05 17:34 . 2009-10-12 13:39 150528 -c----w- c:\windows\system32\dllcache\rastls.dll

2010-01-05 17:34 . 2009-10-13 10:33 271360 -c----w- c:\windows\system32\dllcache\oakley.dll

2010-01-04 23:03 . 2010-01-12 12:46 -------- d-----w- c:\program files\Java(3)

2010-01-03 19:21 . 2010-01-03 19:21 -------- d-----w- c:\documents and settings\uset\Application Data\HouseCall 6.6

2010-01-03 17:21 . 2010-01-03 17:21 -------- d-----w- C:\spoolerlogs

2009-12-28 20:03 . 2010-01-12 12:52 -------- d-----w- c:\program files\Microsoft Games(2)

2009-12-23 16:56 . 2009-12-23 16:56 -------- d-----w- c:\program files\Eidos

2009-12-20 19:49 . 2010-01-12 12:53 -------- d-----w- c:\program files\Java(2)

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-12 23:10 . 2009-05-05 19:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2010-01-12 23:05 . 2009-03-22 20:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira(2)

2010-01-12 22:09 . 2007-07-23 20:25 -------- d-----w- c:\program files\Lx_cats

2010-01-12 22:00 . 2010-01-12 22:00 2748 ----a-w- c:\windows\system32\PerfStringBackup.TMP

2010-01-12 22:00 . 2005-05-23 11:03 80088 ----a-w- c:\windows\system32\perfc00C.dat

2010-01-12 22:00 . 2005-05-23 11:03 478892 ----a-w- c:\windows\system32\perfh00C.dat

2010-01-12 18:36 . 2006-10-04 17:26 -------- d-----w- c:\program files\Google

2010-01-12 12:56 . 2009-03-07 09:55 -------- d-----w- c:\program files\GalaadV4.0

2010-01-12 12:53 . 2008-09-10 20:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-12 12:46 . 2007-06-16 16:34 -------- d-----w- c:\program files\Windows Media Connect 2

2010-01-12 12:36 . 2007-06-21 14:13 -------- d-----w- c:\program files\Windows Live

2010-01-12 12:35 . 2005-05-23 12:45 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-01-12 12:34 . 2009-05-05 19:14 -------- d-----w- c:\program files\Avira

2010-01-12 12:34 . 2009-10-18 08:08 -------- d-----w- c:\documents and settings\uset\Application Data\vlc(3)

2010-01-12 12:32 . 2008-09-05 19:47 -------- d-----w- c:\program files\Call of Duty Game of the Year Edition

2010-01-10 13:09 . 2009-05-05 19:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2010-01-08 20:36 . 2006-06-07 15:40 53608 -c--a-w- c:\documents and settings\uset\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-01-03 16:10 . 2010-01-03 16:10 1179867 ----a-w- c:\documents and settings\All Users\SPL136.tmp

2009-10-26 17:46 . 2009-10-26 17:46 0 ----a-w- c:\windows\system32\atiicdxx.dat

2009-10-26 09:01 . 2009-10-18 08:56 664 ----a-w- c:\windows\system32\d3d9caps.dat

2009-10-21 05:39 . 2005-05-23 11:02 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 05:39 . 2005-05-23 11:02 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 16:20 . 2004-08-03 23:00 265728 ----a-w- c:\windows\system32\drivers\http.sys

2009-10-18 08:43 . 2009-10-18 08:35 108059 ----a-w- c:\windows\system32\drivers\klin.dat

2009-10-18 08:43 . 2009-10-18 08:35 95259 ----a-w- c:\windows\system32\drivers\klick.dat

2009-10-18 08:36 . 2009-10-18 08:36 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat

.

------- Sigcheck -------

[-] 2004-08-11 00:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\system32\mspmsnsv.dll

[-] 2004-08-11 00:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\system32\dllcache\mspmsnsv.dll

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"LXCTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 106496]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

c:\documents and settings\uset\Menu D‚marrer\Programmes\D‚marrage\

Secunia PSI (RC4).lnk - c:\program files\Secunia\PSI (RC4)\psi.exe [2008-10-29 695656]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Bluetooth Manager.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Bluetooth Manager.lnk

backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^hpoddt01.exe.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\hpoddt01.exe.lnk

backup=c:\windows\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk

backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech Desktop Messenger.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk

backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk

backup=c:\windows\pss\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^uset^Menu Démarrer^Programmes^Démarrage^Lancement rapide de Microsoft Office OneNote 2003.lnk]

path=c:\documents and settings\uset\Menu Démarrer\Programmes\Démarrage\Lancement rapide de Microsoft Office OneNote 2003.lnk

backup=c:\windows\pss\Lancement rapide de Microsoft Office OneNote 2003.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^uset^Menu Démarrer^Programmes^Démarrage^Ubisoft register.lnk]

path=c:\documents and settings\uset\Menu Démarrer\Programmes\Démarrage\Ubisoft register.lnk

backup=c:\windows\pss\Ubisoft register.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CFSServ.exe]

CFSServ.exe -NoClient [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-02-27 15:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]

2005-04-12 13:23 88358 ----a-w- c:\windows\agrsmmsg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]

2003-10-30 14:46 192512 ----a-w- c:\program files\Apoint2K\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]

2005-03-22 19:05 339968 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]

2008-07-18 18:58 266497 ----a-w- c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJLaunchEXE]

2002-03-14 07:42 630784 ----a-w- c:\program files\Canon\BJCard\BJLaunch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CeEKEY]

2005-04-28 18:08 675840 ----a-w- c:\program files\TOSHIBA\E-KEY\CeEKey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cselect]

2005-04-12 15:33 110592 ----a-w- c:\windows\system32\cselect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-13 17:34 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]

2005-01-13 23:05 122939 ----a-w- c:\windows\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]

2006-11-22 09:11 82864 ----a-w- c:\program files\Lexmark 5400 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HWSetup]

2004-12-24 08:07 28672 ----a-w- c:\program files\TOSHIBA\TOSHIBA Applet\HWSetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 5400 Series Fax Server]

2006-11-22 09:12 304048 ----a-w- c:\program files\Lexmark 5400 Series\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LtMoh]

2005-04-12 13:24 184320 ----a-w- c:\program files\ltmoh\ltmoh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]

2005-09-01 12:04 221184 ----a-w- c:\windows\system32\LVCOMSX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxctmon.exe]

2006-11-22 09:11 291760 ----a-w- c:\program files\Lexmark 5400 Series\lxctmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]

2009-01-14 15:11 1273488 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-13 17:34 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2007-10-18 10:34 5724184 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PadTouch]

2004-11-17 08:56 1077327 ----a-w- c:\program files\TOSHIBA\Touch and Launch\PadExe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]

2005-05-17 07:24 118784 ----a-w- c:\program files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SVPWUTIL]

2005-02-26 05:59 65536 ----a-w- c:\program files\TOSHIBA\Windows Utilities\SVPWUTIL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TCtryIOHook]

2005-04-20 13:56 28672 ----a-w- c:\windows\system32\TCtrlIOHook.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]

2005-04-11 14:08 65536 ----a-w- c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSHIBA Accessibility]

2005-03-08 13:27 24576 ----a-w- c:\program files\TOSHIBA\Accessibility\FnKeyHook.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPNF]

2004-11-30 11:06 53248 ----a-w- c:\program files\TOSHIBA\TouchPad\TPTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]

2005-01-21 08:28 266240 ----a-w- c:\windows\system32\TPSMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs]

2005-04-05 14:25 73728 ----a-w- c:\program files\TOSHIBA\Tvs\TvsTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zooming]

2004-07-14 14:07 24576 ----a-w- c:\windows\system32\ZoomingHook.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"BackWeb Client - 7681197"=2 (0x2)

"F-Secure BackWeb LAN Access"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=

"c:\\Program Files\\eMule\\emule.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\mcoinstall.exe"=

"c:\\WINDOWS\\system32\\lxctcoms.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"3587:TCP"= 3587:TCP:Groupement homologue Windows

"3540:UDP"= 3540:UDP:Protocole PNRP (Peer Name Resolution Protocol)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R1 Dev_UNIDRV;Dev_UNIDRV;c:\windows\system32\drivers\UNIDRV.SYS [2009-05-12 6080]

S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2006-09-03 639224]

S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys --> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2008-09-10 38496]

S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2008-10-27 7808]

S3 vaxscsi;vaxscsi;c:\windows\system32\Drivers\vaxscsi.sys --> c:\windows\system32\Drivers\vaxscsi.sys [?]

S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS --> c:\windows\system32\ZDCndis5.SYS [?]

S4 BackWeb Client - 7681197;F-Secure BackWeb;c:\progra~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE --> c:\progra~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

.

Contenu du dossier 'Tâches planifiées'

2008-12-08 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8220877576.job

- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]

2010-01-12 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-23 19:23]

.

------- Examen supplémentaire -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uStart Page = hxxp://www.google.fr/

mWindow Title =

uInternet Connection Wizard,ShellNext = iexplore

Trusted Zone: ebay.fr\cgi

TCP: {87E4CE68-A48D-47DC-8E97-9FE6ED01D490} = 80.10.246.2,80.10.246.129

DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab

.

- - - - ORPHELINS SUPPRIMES - - - -

Toolbar-SITEguard - (no file)

MSConfigStartUp-c42ded96 - c:\windows\system32\uebwrguq.dll

MSConfigStartUp-ccApp - c:\program files\Fichiers communs\Symantec Shared\ccApp.exe

MSConfigStartUp-CursorXP - c:\program files\CursorXP\CursorXP.exe

MSConfigStartUp-F-Secure Manager - c:\program files\F-Secure\Common\FSM32.EXE

MSConfigStartUp-FreeRAM XP - c:\program files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe

MSConfigStartUp-IntelliPoint - c:\program files\Microsoft IntelliPoint\point32.exe

MSConfigStartUp-LDM - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

MSConfigStartUp-LogitechCameraAssistant - c:\program files\Logitech\Video\CameraAssistant.exe

MSConfigStartUp-LogitechCameraService(E) - c:\windows\system32\ElkCtrl.exe

MSConfigStartUp-LogitechSoftwareUpdate - c:\program files\Logitech\Video\ManifestEngine.exe

MSConfigStartUp-LogitechVideo[inspector] - c:\program files\Logitech\Video\InstallHelper.exe

MSConfigStartUp-meowplatformflawsize - c:\documents and settings\All Users\Application Data\internet slow meow platform\DASHWMA.exe

MSConfigStartUp-MessengerPlus3 - c:\program files\MessengerPlus! 3\MsgPlus.exe

MSConfigStartUp-NDSTray - NDSTray.exe

MSConfigStartUp-PopUpStopperFreeEdition - c:\progra~1\PANICW~1\POP-UP~1\PSFree.exe

MSConfigStartUp-SpySweeper - c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe

MSConfigStartUp-SSC_UserPrompt - c:\program files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe

MSConfigStartUp-SweetIM - c:\program files\Macrogaming\SweetIM\SweetIM.exe

MSConfigStartUp-TFncKy - TFncKy.exe

MSConfigStartUp-WOOKIT - c:\progra~1\Wanadoo\Shell.exe

MSConfigStartUp-WOOTASKBARICON - c:\progra~1\Wanadoo\GestMaj.exe

MSConfigStartUp-WOOWATCH - c:\progra~1\Wanadoo\Watch.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-13 00:16

Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LXCTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]

"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(564)

c:\windows\system32\Ati2evxx.dll

.

Heure de fin: 2010-01-13 00:19:25

ComboFix-quarantined-files.txt 2010-01-12 23:19

Avant-CF: 26,011,156,480 octets libres

Après-CF: 25,879,801,856 octets libres

- - End Of File - - 9A96759CFE9EAA737387A20CD6CA6145

alpina d10 · le 13 janvier 2010

c est deja un debut

did71 · le 13 janvier 2010

Bonsoir Alpina,

peux tu poster un nouveau rapport RSIT?

a+

alpina d10 · le 13 janvier 2010

ok je fais sa

alpina d10 · le 13 janvier 2010

LA JE FAIS UN RAPPORT GRACE A UN DEUXIEME PC CAR TOUJOURS IMPOSSIBLE LE COPIER SUR LES PAGES D INTERNET DE PLUS J ENTENDS DE NOUVEAU LE PETIT BRUIT DE L ACTIVE X MAIS JE NE LE VOIS PAS

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:49 0, on 2010-01-13

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Canon\BJCard\Bjmcmng.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\WINDOWS\system32\lxctcoms.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Secunia\PSI (RC4)\psi.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.google.fr/keyword/%s

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Secunia PSI (RC4).lnk = C:\Program Files\Secunia\PSI (RC4)\psi.exe

O4 - Global Startup: Bootvis.lnk = C:\Documents and Settings\uset\Bureau\BootVisfr\Bootvis_Sleep.exe

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow...llerControl.cab

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://.spaces.msn.com//PhotoUpload/MsnPUpld.cab

O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} - http://www.nanoscan.com/as/cabs/ascstubie.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1155119580000

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{87E4CE68-A48D-47DC-8E97-9FE6ED01D490}: NameServer = 80.10.246.2,80.10.246.129

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Canon BJ Memory Card Manager (Bjmcmng) - CANON INC. - C:\Program Files\Canon\BJCard\Bjmcmng.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 6899 bytes

did71 · le 13 janvier 2010

re,

c'est le rapport RSIT que je voudrais voir!

a+

alpina d10 · le 13 janvier 2010

RE OUPS!!

Malwarebytes' Anti-Malware 1.44

Version de la base de données: 3556

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

2010-01-13 22:44:20 0

mbam-log-2010-01-13 (22-44-12).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)

Eléments examinés: 225508

Temps écoulé: 1 hour(s), 4 minute(s), 1 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 2

Processus mémoire infecté(s):