un vitro de plus! • page 2

[bernard53]

Ceci.


Télécharge <<Rkill >> de Grinler sur le bureau,
Double clic pour le lancer.
Sous Vista, faire un clic droit sur le fichier rkill téléchargé puis choisir "Exécuter en tant qu'Administrateur"
Une fenêtre (très rapide) indiquera que tout s'est bien déroulé.
Pour Vista, faire un clic droit sur le fichier rkill téléchargé puis choisir "Exécuter en tant qu'Administrateur" pour lancer l'outil.
il y aura 'un rapport là: %SystemDrive%\rkill.log
donnant la liste de tous les processus arrêtés.


Ensuite re télecharge Combofix et au moment de l'enregistrer tu le renomme en Combofix.com et tu le lancer ensuite.

mais cela me semble mal partis!

[calderon]

Je m'en sors pas, si je sors du mode sans échec le pc est inutilisable...
je crois que je vais tout formater et installer windows 7 64 bits...

[bernard53]

Essai de passer rkill et ComboFix en mode sans échec.

[calderon]

combofix a réussi en mode sans échec...jusqu'au redémarrage...ou le PC a planté immanquablement. Je n'ai pas osé redémarrer en mode sans échec..je vais essayer quand meme.

[calderon]

ca avance !!
voila le log rkill:

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as Moi on 07/04/2010 at 20:12:48.


Processes terminated by Rkill or while it was running:


C:\Documents and Settings\Moi.CALDERON\Bureau\rkill.com


Rkill completed on 07/04/2010 at 20:12:53.

[calderon]

et le log combofix:
ComboFix 10-04-06.05 - Moi 07/04/2010 20:30:14.2.8 - x86 NETWORK
Lancé depuis: c:\documents and settings\Moi.CALDERON\Bureau\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Moi.CALDERON\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\documents and settings\Moi.CALDERON\wuaucldt.exe
c:\windows\system32\BtwSvc.dll
c:\windows\system32\FInstall.sys
c:\windows\system32\Install.txt
c:\windows\system32\ms.bin
c:\windows\system32\msuqddft.dll
c:\windows\system32\PereSvc.exe
c:\windows\system32\so.bin
c:\windows\system32\Thumbs.db
c:\windows\system32\w.exe
c:\windows\system32\wuaucldt.exe
.
---- Exécution préalable -------
.
c:\documents and settings\Moi.CALDERON\wuaucldt.exe
C:\install.exe
c:\recycler\S-1-5-21-484763869-308236825-1801674531-1003
C:\Thumbs.db
c:\windows\system32\SIntf16.dll
c:\windows\system32\Thumbs.db
c:\windows\system32\uninstall.exe
c:\windows\system32\wuaucldt.exe

-- Exécution préalable --

c:\windows\system32\clipsrv.exe . . . est infecté!!

--------

c:\windows\system32\userinit.exe . . . est infecté!!

c:\windows\system32\spoolsv.exe . . . est infecté!!

c:\windows\explorer.exe . . . est infecté!!

c:\windows\system32\clipsrv.exe . . . est infecté!!

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ACPI32
-------\Legacy_ATI64SI
-------\Legacy_BTWSVC
-------\Service_BtwSvc
-------\Legacy_peresvc
-------\Service_peresvc


((((((((((((((((((((((((((((( Fichiers créés du 2010-03-07 au 2010-04-07 ))))))))))))))))))))))))))))))))))))
.

2010-04-07 18:06 . 2010-04-07 18:59 36864 ----a-w- c:\windows\system32\d.bin
2010-04-07 08:23 . 2010-04-07 08:23 50688 ----a-w- c:\windows\system32\sort.exe
2010-04-06 19:33 . 2010-04-06 19:33 163840 ----a-w- c:\windows\system32\cscript.exe
2010-04-06 19:33 . 2010-04-06 19:33 44544 ----a-w- c:\windows\system32\PING.exe
2010-04-06 19:33 . 2010-04-06 19:33 36864 ----a-w- c:\windows\system32\attrib.exe
2010-04-06 19:27 . 2010-04-06 19:28 -------- d-----w- c:\windows\LastGood.Tmp
2010-04-06 18:53 . 2010-04-06 18:53 463360 ----a-w- c:\windows\system32\wiaacmgr.exe
2010-04-06 18:53 . 2010-04-06 18:53 320000 ----a-w- c:\windows\system32\vssvc.exe
2010-04-06 18:53 . 2010-04-06 18:53 371712 ----a-w- c:\windows\system32\tourstart.exe
2010-04-06 18:53 . 2010-04-06 18:53 563712 ----a-w- c:\windows\system32\spider.exe
2010-04-06 18:53 . 2010-04-06 18:53 58368 ----a-w- c:\windows\system32\rundll32.exe
2010-04-06 18:53 . 2010-04-06 18:53 95232 ----a-w- c:\windows\system32\NOTEPAD.EXE
2010-04-06 18:53 . 2010-04-06 18:53 138752 ----a-w- c:\windows\system32\netdde.exe
2010-04-06 18:53 . 2010-04-06 18:53 57344 ----a-w- c:\windows\system32\mnmsrvc.exe
2010-04-06 18:53 . 2010-04-06 18:53 31232 ----a-w- c:\windows\system32\msdtc.exe
2010-04-06 18:53 . 2010-04-06 18:53 152576 ----a-w- c:\windows\system32\mshearts.exe
2010-04-06 16:56 . 2010-04-06 16:56 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\Malwarebytes
2010-04-06 16:56 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-06 16:56 . 2010-04-06 16:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-06 16:56 . 2010-04-06 16:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2010-04-06 16:56 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-06 14:57 . 2010-03-09 10:12 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-06 14:57 . 2010-03-09 10:08 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-06 14:57 . 2010-03-09 10:09 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-06 14:57 . 2010-03-09 10:12 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-06 14:57 . 2010-03-09 10:08 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-04-06 14:57 . 2010-03-09 10:08 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-04-06 14:57 . 2010-03-09 10:08 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-04-06 14:57 . 2010-03-09 10:24 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-06 14:57 . 2010-04-06 14:57 -------- d-----w- c:\program files\Alwil Software
2010-04-06 14:57 . 2010-04-06 14:57 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Alwil Software
2010-04-06 11:52 . 2010-03-01 19:10 15688 ----a-w- c:\windows\system32\lsdelete.exe
2010-04-06 11:49 . 2010-04-06 11:49 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT\Bureau
2010-04-05 16:41 . 2010-04-05 16:41 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Ubisoft
2010-04-02 15:29 . 2010-04-02 15:30 21840 ----atw- c:\windows\system32\SIntfNT.dll
2010-04-02 15:29 . 2010-04-02 15:30 17212 ----atw- c:\windows\system32\SIntf32.dll
2010-04-02 15:29 . 2010-04-02 15:29 -------- d-----w- c:\program files\directx
2010-03-21 18:57 . 2010-03-21 18:57 -------- d-----w- c:\documents and settings\Moi.CALDERON\Local Settings\Application Data\4A Games
2010-03-21 18:54 . 2010-03-21 18:54 -------- d-----w- c:\program files\NVIDIA Corporation
2010-03-21 18:51 . 2010-02-04 09:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-03-21 18:51 . 2010-02-04 09:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-03-21 18:51 . 2010-02-04 09:01 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-03-21 18:51 . 2010-02-04 09:01 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-07 18:53 . 2010-04-07 18:41 94208 ----a-w- c:\windows\system32\w.exe
2010-04-07 18:53 . 2010-04-07 18:41 35840 ----a-w- c:\windows\system32\ms.bin
2010-04-07 18:53 . 2010-04-07 18:41 44544 ----a-w- c:\windows\system32\so.bin
2010-04-07 18:41 . 2010-04-07 18:41 36865 ----a-w- c:\windows\system32\msuqddft.dll
2010-04-07 18:41 . 2010-04-07 18:41 168786 ----a-w- c:\windows\system32\8014,49.exe
2010-04-07 10:19 . 2009-10-13 15:16 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-06 19:26 . 2010-01-30 15:13 -------- d-----w- c:\program files\Adobe Media Player
2010-04-06 16:32 . 2009-02-23 18:07 -------- d-----w- c:\documents and settings\Moi\Application Data\Dynamique
2010-04-06 16:16 . 2009-02-25 08:42 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2010-04-06 16:16 . 2009-02-24 15:09 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Symantec
2010-04-06 16:13 . 2009-02-25 08:42 -------- d-----w- c:\program files\Symantec
2010-04-06 15:49 . 2009-11-24 17:11 -------- d-----w- c:\program files\PC Connectivity Solution
2010-04-06 11:50 . 2001-08-28 14:00 85196 ----a-w- c:\windows\system32\perfc00C.dat
2010-04-06 11:50 . 2001-08-28 14:00 510290 ----a-w- c:\windows\system32\perfh00C.dat
2010-04-06 11:47 . 2009-02-24 20:48 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\Azureus
2010-04-06 11:43 . 2009-02-24 23:11 -------- d-----w- c:\program files\CCleaner
2010-04-06 08:55 . 2009-05-29 17:56 1 ----a-w- c:\documents and settings\Moi.CALDERON\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-05 19:44 . 2010-01-11 17:06 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\vlc
2010-04-05 16:41 . 2009-09-25 20:47 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\Ubisoft
2010-04-05 16:40 . 2009-09-25 20:39 -------- d-----w- c:\program files\Ubisoft
2010-04-05 16:40 . 2009-02-19 10:05 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-02 20:16 . 2009-03-15 11:56 -------- d-----w- c:\program files\Mozilla Firefox 3.1 Beta 3
2010-03-21 18:54 . 2009-10-02 14:19 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
2010-03-21 18:53 . 2009-06-28 07:29 -------- d-----w- c:\program files\AGEIA Technologies
2010-03-11 06:49 . 2009-08-31 06:55 -------- d-----w- c:\program files\Google
2010-03-07 10:20 . 2010-03-07 10:20 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\Logishrd
2010-03-07 10:20 . 2009-02-23 23:13 -------- d-----w- c:\program files\Fichiers communs\Logishrd
2010-03-07 10:20 . 2009-02-24 16:11 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\Logitech
2010-03-01 19:10 . 2009-06-21 18:08 315736 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-03-01 19:10 . 2009-06-21 18:08 25440 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2010-03-01 19:10 . 2009-06-21 18:08 173408 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-03-01 19:10 . 2009-05-31 18:08 15688 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-03-01 19:10 . 2009-06-21 18:08 350544 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-03-01 19:10 . 2009-06-21 18:08 303456 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-03-01 19:10 . 2009-05-31 18:08 89952 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2010-03-01 19:10 . 2009-06-21 18:08 1630560 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-03-01 19:09 . 2009-05-31 18:08 254832 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-03-01 19:09 . 2009-06-21 18:08 671592 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-03-01 19:09 . 2009-05-31 18:08 45408 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-03-01 19:09 . 2009-09-28 18:08 3726848 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-03-01 19:09 . 2009-06-21 18:08 566648 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-03-01 19:08 . 2009-06-21 18:08 567144 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-03-01 19:08 . 2009-06-21 18:08 2357064 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-03-01 19:08 . 2009-06-21 18:08 524632 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-03-01 19:08 . 2009-06-21 18:08 1029456 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-03-01 18:04 . 2010-03-01 17:32 -------- d-----w- c:\program files\Electronic Arts
2010-02-20 14:37 . 2009-02-24 16:07 327976 ----a-w- c:\documents and settings\LocalService.AUTORITE NT\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-02-20 09:16 . 2010-02-20 09:12 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\albumphoto
2010-02-20 09:16 . 2009-02-24 16:11 22888 ----a-w- c:\documents and settings\Moi.CALDERON\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-16 19:50 . 2010-02-15 10:03 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\Bioshock2
2010-02-15 09:36 . 2009-09-13 11:34 -------- d-----w- c:\program files\SpeedCams_Serveur
2010-02-15 09:33 . 2010-02-15 09:33 -------- d-sh--w- c:\documents and settings\All Users.WINDOWS\Application Data\SecuROM
2010-02-13 15:40 . 2009-02-24 17:51 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\DAEMON Tools Lite
2010-02-13 15:24 . 2010-02-13 15:06 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-02-13 15:07 . 2009-02-24 17:51 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-13 15:06 . 2009-02-24 17:57 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\DAEMON Tools Lite
2010-02-09 00:35 . 2010-02-09 00:35 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton
2010-01-21 11:57 . 2010-01-21 11:57 4 ----a-w- c:\windows\AErroru3.dat
2010-01-21 11:57 . 2010-01-21 11:57 30720 ----a-w- c:\windows\EWhiteu12.dat
2010-01-21 11:57 . 2010-01-21 11:57 30720 ----a-w- c:\windows\EDarku12.dat
2010-01-21 11:57 . 2010-01-21 11:57 6 ----a-w- c:\windows\EExpou.dat
2010-01-21 11:57 . 2010-01-21 11:57 3 ----a-w- c:\windows\EOffsetu.dat
2010-01-21 11:57 . 2010-01-21 11:57 3 ----a-w- c:\windows\EGain6.dat
.

------- Sigcheck -------

[-] 2010-04-06 . 927385AA6BE189E68089890CB51453A8 . 82432 . . [5.1.2600.5512] . . c:\windows\system32\spoolsv.exe
[-] 2008-04-13 . FAFCCC032AD16996EDE86908E87AC1F9 . 82432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2008-04-13 . 628D5B45B6FF617C889ABE6715CC8E55 . 82432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\spoolsv.exe

[-] 2008-04-13 . 96EB1E1C72AFEEA94D3217327B73F5EA . 51200 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\userinit.exe
[-] 2008-04-13 . 1E169566326AD66451C4268677E7D73D . 51200 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
[-] 2008-04-13 . 29DFD42C3078965CD24AA8DB57E8078A . 51200 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\userinit.exe

[-] 2008-04-13 . 809DC9268AF8718FDCE39BD49A108A40 . 1062400 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2008-04-13 . 3654BBCAA7CD15F89EF3377C8943748B . 1062400 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-13 . 80207B8F28A5B1127D20C80481BE353B . 1062400 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe

[-] 2008-04-13 . C5D38FF67F7038FCDA2604FF076111A4 . 38400 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
[-] 2008-04-13 . 528BFB3065E9109FAE39D42A2DF2F031 . 38400 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
[-] 2008-04-13 . BC27A4D0E0056E0630DECD5CB8C69AA4 . 38912 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wscntfy.exe

[-] 2008-04-13 . 4BC5EFBBEA4D0F667BDA8799AD9A419A . 39936 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2008-04-13 . C979DF7E407BE97256D6C5BEC1D2E5F6 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ctfmon.exe

c:\windows\System32\ctfmon.exe ... manque !!
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-01 524632]
"fzwkht"="c:\windows\system32\msuqddft.dll" [2010-04-07 36865]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"exec"="c:\windows\fonts\services.exe" [2008-04-13 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\explorer.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-18 23:30 72208 ----a-w- c:\program files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^Moi.CALDERON^Menu Démarrer^Programmes^Démarrage^8614335.lnk]
path=c:\documents and settings\Moi.CALDERON\Menu Démarrer\Programmes\Démarrage\8614335.lnk
backup=c:\windows\pss\8614335.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 06:58 611712 ----a-w- c:\program files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CANAL+ CANALSAT A LA DEMANDE]
2010-01-12 16:26 163928 ----a-w- c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 12:07 1289000 ----a-w- c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-04-17 10:41 221184 ----a-w- c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-04-13 04:07 94208 ----a-w- c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-06-25 14:12 1438720 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-09-06 13:09 438272 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2std]
2005-11-16 15:14 368640 ----a-w- c:\windows\vsnp2std.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 00:00 114688 ------w- c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LiveUpdate Notice"=2 (0x2)
"LiveUpdate"=3 (0x3)
"gupdate1ca2a082e2085ce"=2 (0x2)
"DAUpdaterSvc"=3 (0x3)
"CanalPlus.VOD"=2 (0x2)
"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\steam\\SteamApps\\elinefather\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"e:\\GRID\\GRID.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"e:\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"=
"e:\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"=
"e:\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
"e:\\Far Cry 2\\bin\\FC2Editor.exe"=
"e:\\Far Cry 2\\bin\\FarCry2.exe"=
"e:\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\Tom Clancy's H.A.W.X\\HAWX.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Call of Juarez - Bound in Blood\\CoJBiBGame_x86.exe"=
"e:\\FUEL\\FUEL.exe"=
"e:\\FlatOut Ultimate Carnage\\Fouc.exe"=
"e:\\Batman Arkham Asylum\\Binaries\\ShippingPC-BmGame.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"e:\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"=
"e:\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"=
"e:\\Dragon Age\\bin_ship\\daorigins.exe"=
"e:\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"e:\\DiRT2\\dirt2_game.exe"=
"c:\\Program Files\\Fichiers communs\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"e:\\Mass Effect 2\\Binaries\\MassEffect2.exe"=
"e:\\Mass Effect 2\\MassEffect2Launcher.exe"=
"e:\\S.T.A.L.K.E.R. - Call of Pripyat\\bin\\xrEngine.exe"=
"e:\\S.T.A.L.K.E.R. - Call of Pripyat\\bin\\dedicated\\xrEngine.exe"=
"e:\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"e:\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"e:\\Assassin's Creed II\\AssassinsCreedIIGame.exe"=
"e:\\Assassin's Creed II\\AssassinsCreedII.exe"=
"e:\\Assassin's Creed II\\UPlayBrowser.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-02-13 691696]
R1 aswSP;aswSP; [x]
R2 aswFsBlk;aswFsBlk; [x]
R2 LBeepKE;LBeepKE;c:\windows\system32\Drivers\LBeepKE.sys [2008-09-26 10384]
R3 ACCSKMD;Canon Camera Storage Device;c:\windows\system32\DRIVERS\accskmd.sys [2004-02-25 32640]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-09-01 234864]
R3 SampleScanner;Ultima2000 Scanner;c:\windows\system32\DRIVERS\GT680x.sys [2001-06-07 18120]
R4 Conthci;Conthci; [x]
R4 DAUpdaterSvc;Dragon Age: Origins - Content Updater;e:\dragon age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]
R4 gupdate1ca2a082e2085ce;Service Google Update (gupdate1ca2a082e2085ce);c:\program files\Google\Update\GoogleUpdate.exe [2009-08-31 133104]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-04-26 64160]
S0 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys [2008-06-23 150568]
S0 sonypvl3;sonypvl3; [x]
S1 sonypvf3;sonypvf3; [x]
S1 sonypvt3;sonypvt3; [x]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-03-01 1029456]

.
Contenu du dossier 'Tâches planifiées'

2010-04-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 19:08]

2010-04-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-31 06:56]

2010-04-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-31 06:56]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
TCP: {EE3205FC-9E52-4371-B42E-3462877DE51F} = 192.168.1.1
DPF: {50DC58D0-C870-4BE6-BC41-971ED2D5F022} - hxxp://www.super-messenger.fr/tab/HookWlmEx.cab
FF - ProfilePath - c:\documents and settings\Moi.CALDERON\Application Data\Mozilla\Firefox\Profiles\m85jeh1c.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - plugin: c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\npCpVod.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-HotSwap! Applet - c:\documents and settings\Moi\Mes documents\32bit\HotSwap!.EXE
HKLM-Run-syncman - c:\windows\system32\wuaucldt.exe
HKLM-Run-Regedit32 - c:\windows\system32\regedit.exe
HKU-Default-Run-syncman - c:\documents and settings\moi.calderon\wuaucldt.exe
SafeBoot-Wdf01000.sys
MSConfigStartUp-HotSwap! Applet - c:\docume~1\MOI~1.CAL\LOCALS~1\Temp\Rar$EX00.984\32bit\HotSwap!.EXE
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-07 20:38
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...


c:\windows\system32\wuaucldt.exe 54272 bytes executable

Scan terminé avec succès
Fichiers cachés: 1

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x89F46AC8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf765bf28
\Driver\ACPI -> ACPI.sys @ 0xf74a2cb8
\Driver\atapi -> atapi.sys @ 0xf7830852
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e6686
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b9
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e6686
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b9
NDIS: Realtek RTL8168C(P)/8111C(P) PCI-E Gigabit Ethernet NIC #2 -> SendCompleteHandler -> NDIS.sys @ 0xba65fbb0
PacketIndicateHandler -> NDIS.sys @ 0xba66ca21
SendHandler -> NDIS.sys @ 0xba64a87b
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1957994488-651377827-1417001333-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1957994488-651377827-1417001333-1003\Software\SecuROM\License information*]
"datasecu"=hex:0b,c1,9c,39,4f,46,06,f5,3d,43,c8,57,9f,10,ca,3c,1d,f0,f4,3b,4d,
df,56,d5,4c,56,85,43,5c,4f,e7,15,cd,1b,25,02,9f,96,01,31,db,0a,4f,69,d2,b9,\
"rkeysecu"=hex:3d,f4,aa,27,44,dd,35,f5,cf,a0,04,83,74,08,04,1c
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(904)
c:\windows\system32\Ati2evxx.dll
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll
c:\program files\fichiers communs\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(2328)
c:\windows\system32\msuqddft.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\TEMP\VRT2.tmp
c:\windows\system32\w.exe
c:\windows\System32\Rundll32.exe
.
**************************************************************************
.
Heure de fin: 2010-04-07 20:44:38 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-04-07 18:44

Avant-CF: 239 193 821 184 octets libres
Après-CF: 239 164 477 440 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

- - End Of File - - D26E09125D5556E36377C39C7978A0AC

[calderon]

Je vous fais confiance pour trier le bon grain de l'ivraie !

[bernard53]

Télécharges: <<ATF-Cleaner >> de Atribune.

Il ne nécessite pas d'installation.
Clique sur le fichier ATF-Cleaner.exe
Dans Main clique sur Select All et décoche Prefetch
Clique sur Empty Selected
Puis sur OK sur le popup suivant qui t'annonce ce qui a été supprimé.

Tu peux renouveler pour Firefox, Opéra si tu utilises ces navigateurs.
Après Select All il te sera demandé si tu veux supprimer les mots de passes enregistrés.
"Are you sure you want to delete Firefox (ou Opéra) saved password?"
A toi d'en décider en cliquant sur Oui ou Non.


Puis::


Pour vista

Ouvre le Menu Démarrer > Exécuter (Touche Windows+ R : en raccourci)

Dans la boîte de dialogue, copie/colle tout ce qui est en citation ci-dessous :

fsutil file createnew "%userprofile%\desktop\CFScript.txt" 0

Pour XP

Ouvre le Menu Démarrer > Exécuter (Touche Windows+ R : en raccourci)

Dans la boîte de dialogue, copie/colle tout ce qui est en citation ci-dessous :

fsutil file createnew "%userprofile%\bureau\CFScript.txt" 0

2/ Ouvre CFScript.txt (sur ton Bureau) . > copie dedans cette nouvelle citation :

File::
c:\windows\system32\w.exe
c:\windows\system32\ms.bin
c:\windows\system32\so.bin
c:\windows\system32\msuqddft.dll
c:\windows\system32\8014,49.exe
c:\windows\system32\wuaucldt.exe
c:\windows\fonts\services.exe
c:\windows\TEMP\VRT2.tmp

Registry::

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"exec"=-

Fait un glisser/déposer de ce fichier CFScript.txt sur le fichier ComboFix.exe comme sur la capture:




Une fenêtre bleue va apparaître et ComboFix vas de nouveau faire une analyse.

Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu, en précisant où en sont tes soucis.

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

[calderon]

ok je fais ca.
en mode sans echec, c'est toujours bon?

[bernard53]

ok je fais ca.
en mode sans echec, c'est toujours bon?

si tu peux en mode normal fait le.

[calderon]

mince, j ai eu ta reponse trop tard, je l'ai relancé en sans echec, voici le rapport. Entre temps je teste le mode normal

ComboFix 10-04-06.05 - Moi 07/04/2010 21:35:40.3.8 - x86 NETWORK
Lancé depuis: c:\documents and settings\Moi.CALDERON\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Moi.CALDERON\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé

FILE ::
"c:\windows\fonts\services.exe"
"c:\windows\system32\8014,49.exe"
"c:\windows\system32\ms.bin"
"c:\windows\system32\msuqddft.dll"
"c:\windows\system32\so.bin"
"c:\windows\system32\w.exe"
"c:\windows\system32\wuaucldt.exe"
"c:\windows\TEMP\VRT2.tmp"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\fonts\services.exe
c:\windows\system32\8014,49.exe
c:\windows\system32\9470,438.exe
c:\windows\system32\ms.bin
c:\windows\system32\msuqddft.dll
c:\windows\system32\so.bin
c:\windows\system32\w.exe
c:\windows\TEMP\VRT2.tmp

c:\windows\system32\userinit.exe . . . est infecté!!

c:\windows\system32\spoolsv.exe . . . est infecté!!

c:\windows\explorer.exe . . . est infecté!!

c:\windows\system32\clipsrv.exe . . . est infecté!!

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-03-07 au 2010-04-07 ))))))))))))))))))))))))))))))))))))
.

2010-04-07 19:44 . 2010-04-07 19:44 54272 ----a-w- c:\windows\system32\wuaucldt.exe
2010-04-07 19:44 . 2010-04-07 19:44 54272 ----a-w- c:\documents and settings\Moi.CALDERON\wuaucldt.exe
2010-04-07 18:06 . 2010-04-07 18:59 36864 ----a-w- c:\windows\system32\d.bin
2010-04-07 08:23 . 2010-04-07 08:23 50688 ----a-w- c:\windows\system32\sort.exe
2010-04-06 19:33 . 2010-04-06 19:33 163840 ----a-w- c:\windows\system32\cscript.exe
2010-04-06 19:33 . 2010-04-06 19:33 44544 ----a-w- c:\windows\system32\PING.exe
2010-04-06 19:33 . 2010-04-06 19:33 36864 ----a-w- c:\windows\system32\attrib.exe
2010-04-06 19:27 . 2010-04-06 19:28 -------- d-----w- c:\windows\LastGood.Tmp
2010-04-06 18:53 . 2010-04-06 18:53 463360 ----a-w- c:\windows\system32\wiaacmgr.exe
2010-04-06 18:53 . 2010-04-06 18:53 320000 ----a-w- c:\windows\system32\vssvc.exe
2010-04-06 18:53 . 2010-04-06 18:53 371712 ----a-w- c:\windows\system32\tourstart.exe
2010-04-06 18:53 . 2010-04-06 18:53 563712 ----a-w- c:\windows\system32\spider.exe
2010-04-06 18:53 . 2010-04-06 18:53 58368 ----a-w- c:\windows\system32\rundll32.exe
2010-04-06 18:53 . 2010-04-06 18:53 95232 ----a-w- c:\windows\system32\NOTEPAD.EXE
2010-04-06 18:53 . 2010-04-06 18:53 138752 ----a-w- c:\windows\system32\netdde.exe
2010-04-06 18:53 . 2010-04-06 18:53 57344 ----a-w- c:\windows\system32\mnmsrvc.exe
2010-04-06 18:53 . 2010-04-06 18:53 31232 ----a-w- c:\windows\system32\msdtc.exe
2010-04-06 18:53 . 2010-04-06 18:53 152576 ----a-w- c:\windows\system32\mshearts.exe
2010-04-06 16:56 . 2010-04-06 16:56 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\Malwarebytes
2010-04-06 16:56 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-06 16:56 . 2010-04-06 16:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-06 16:56 . 2010-04-06 16:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2010-04-06 16:56 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-06 14:57 . 2010-04-07 18:48 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Alwil Software
2010-04-06 14:57 . 2010-04-06 14:57 -------- d-----w- c:\program files\Alwil Software
2010-04-06 11:52 . 2010-03-01 19:10 15688 ----a-w- c:\windows\system32\lsdelete.exe
2010-04-06 11:49 . 2010-04-06 11:49 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT\Bureau
2010-04-05 16:41 . 2010-04-05 16:41 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Ubisoft
2010-04-02 15:29 . 2010-04-02 15:30 21840 ----atw- c:\windows\system32\SIntfNT.dll
2010-04-02 15:29 . 2010-04-02 15:30 17212 ----atw- c:\windows\system32\SIntf32.dll
2010-04-02 15:29 . 2010-04-02 15:29 -------- d-----w- c:\program files\directx
2010-03-21 18:57 . 2010-03-21 18:57 -------- d-----w- c:\documents and settings\Moi.CALDERON\Local Settings\Application Data\4A Games
2010-03-21 18:54 . 2010-03-21 18:54 -------- d-----w- c:\program files\NVIDIA Corporation
2010-03-21 18:51 . 2010-02-04 09:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-03-21 18:51 . 2010-02-04 09:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-03-21 18:51 . 2010-02-04 09:01 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-03-21 18:51 . 2010-02-04 09:01 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-07 10:19 . 2009-10-13 15:16 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-06 19:26 . 2010-01-30 15:13 -------- d-----w- c:\program files\Adobe Media Player
2010-04-06 16:32 . 2009-02-23 18:07 -------- d-----w- c:\documents and settings\Moi\Application Data\Dynamique
2010-04-06 16:16 . 2009-02-25 08:42 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2010-04-06 16:16 . 2009-02-24 15:09 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Symantec
2010-04-06 16:13 . 2009-02-25 08:42 -------- d-----w- c:\program files\Symantec
2010-04-06 15:49 . 2009-11-24 17:11 -------- d-----w- c:\program files\PC Connectivity Solution
2010-04-06 11:50 . 2001-08-28 14:00 85196 ----a-w- c:\windows\system32\perfc00C.dat
2010-04-06 11:50 . 2001-08-28 14:00 510290 ----a-w- c:\windows\system32\perfh00C.dat
2010-04-06 11:47 . 2009-02-24 20:48 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\Azureus
2010-04-06 11:43 . 2009-02-24 23:11 -------- d-----w- c:\program files\CCleaner
2010-04-06 08:55 . 2009-05-29 17:56 1 ----a-w- c:\documents and settings\Moi.CALDERON\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-05 19:44 . 2010-01-11 17:06 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\vlc
2010-04-05 16:41 . 2009-09-25 20:47 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\Ubisoft
2010-04-05 16:40 . 2009-09-25 20:39 -------- d-----w- c:\program files\Ubisoft
2010-04-05 16:40 . 2009-02-19 10:05 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-02 20:16 . 2009-03-15 11:56 -------- d-----w- c:\program files\Mozilla Firefox 3.1 Beta 3
2010-03-21 18:54 . 2009-10-02 14:19 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
2010-03-21 18:53 . 2009-06-28 07:29 -------- d-----w- c:\program files\AGEIA Technologies
2010-03-11 06:49 . 2009-08-31 06:55 -------- d-----w- c:\program files\Google
2010-03-07 10:20 . 2010-03-07 10:20 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\Logishrd
2010-03-07 10:20 . 2009-02-23 23:13 -------- d-----w- c:\program files\Fichiers communs\Logishrd
2010-03-07 10:20 . 2009-02-24 16:11 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\Logitech
2010-03-01 19:10 . 2009-06-21 18:08 315736 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-03-01 19:10 . 2009-06-21 18:08 25440 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2010-03-01 19:10 . 2009-06-21 18:08 173408 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-03-01 19:10 . 2009-05-31 18:08 15688 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-03-01 19:10 . 2009-06-21 18:08 350544 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-03-01 19:10 . 2009-06-21 18:08 303456 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-03-01 19:10 . 2009-05-31 18:08 89952 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2010-03-01 19:10 . 2009-06-21 18:08 1630560 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-03-01 19:09 . 2009-05-31 18:08 254832 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-03-01 19:09 . 2009-06-21 18:08 671592 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-03-01 19:09 . 2009-05-31 18:08 45408 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-03-01 19:09 . 2009-09-28 18:08 3726848 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-03-01 19:09 . 2009-06-21 18:08 566648 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-03-01 19:08 . 2009-06-21 18:08 567144 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-03-01 19:08 . 2009-06-21 18:08 2357064 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-03-01 19:08 . 2009-06-21 18:08 524632 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-03-01 19:08 . 2009-06-21 18:08 1029456 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-03-01 18:04 . 2010-03-01 17:32 -------- d-----w- c:\program files\Electronic Arts
2010-02-20 14:37 . 2009-02-24 16:07 327976 ----a-w- c:\documents and settings\LocalService.AUTORITE NT\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-02-20 09:16 . 2010-02-20 09:12 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\albumphoto
2010-02-20 09:16 . 2009-02-24 16:11 22888 ----a-w- c:\documents and settings\Moi.CALDERON\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-16 19:50 . 2010-02-15 10:03 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\Bioshock2
2010-02-15 09:36 . 2009-09-13 11:34 -------- d-----w- c:\program files\SpeedCams_Serveur
2010-02-15 09:33 . 2010-02-15 09:33 -------- d-sh--w- c:\documents and settings\All Users.WINDOWS\Application Data\SecuROM
2010-02-13 15:40 . 2009-02-24 17:51 -------- d-----w- c:\documents and settings\Moi.CALDERON\Application Data\DAEMON Tools Lite
2010-02-13 15:24 . 2010-02-13 15:06 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-02-13 15:07 . 2009-02-24 17:51 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-13 15:06 . 2009-02-24 17:57 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\DAEMON Tools Lite
2010-02-09 00:35 . 2010-02-09 00:35 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton
2010-01-21 11:57 . 2010-01-21 11:57 4 ----a-w- c:\windows\AErroru3.dat
2010-01-21 11:57 . 2010-01-21 11:57 30720 ----a-w- c:\windows\EWhiteu12.dat
2010-01-21 11:57 . 2010-01-21 11:57 30720 ----a-w- c:\windows\EDarku12.dat
2010-01-21 11:57 . 2010-01-21 11:57 6 ----a-w- c:\windows\EExpou.dat
2010-01-21 11:57 . 2010-01-21 11:57 3 ----a-w- c:\windows\EOffsetu.dat
2010-01-21 11:57 . 2010-01-21 11:57 3 ----a-w- c:\windows\EGain6.dat
.

------- Sigcheck -------

[-] 2010-04-06 . 927385AA6BE189E68089890CB51453A8 . 82432 . . [5.1.2600.5512] . . c:\windows\system32\spoolsv.exe
[-] 2008-04-13 . FAFCCC032AD16996EDE86908E87AC1F9 . 82432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2008-04-13 . 628D5B45B6FF617C889ABE6715CC8E55 . 82432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\spoolsv.exe

[-] 2008-04-13 . 96EB1E1C72AFEEA94D3217327B73F5EA . 51200 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\userinit.exe
[-] 2008-04-13 . 1E169566326AD66451C4268677E7D73D . 51200 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
[-] 2008-04-13 . 29DFD42C3078965CD24AA8DB57E8078A . 51200 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\userinit.exe

[-] 2008-04-13 . 809DC9268AF8718FDCE39BD49A108A40 . 1062400 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2008-04-13 . 3654BBCAA7CD15F89EF3377C8943748B . 1062400 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-13 . 80207B8F28A5B1127D20C80481BE353B . 1062400 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe

[-] 2008-04-13 . C5D38FF67F7038FCDA2604FF076111A4 . 38400 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
[-] 2008-04-13 . 528BFB3065E9109FAE39D42A2DF2F031 . 38400 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
[-] 2008-04-13 . BC27A4D0E0056E0630DECD5CB8C69AA4 . 38912 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wscntfy.exe

[-] 2008-04-13 . 4BC5EFBBEA4D0F667BDA8799AD9A419A . 39936 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2008-04-13 . C979DF7E407BE97256D6C5BEC1D2E5F6 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ctfmon.exe

c:\windows\System32\ctfmon.exe ... manque !!
.
((((((((((((((((((((((((((((( SnapShot@2010-04-07_18.39.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-24 14:57 . 2010-04-07 19:43 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-02-24 14:57 . 2010-04-07 18:38 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-24 14:57 . 2010-04-07 19:43 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2009-02-24 14:57 . 2010-04-07 18:38 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
+ 2009-02-24 14:57 . 2010-04-07 19:43 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-02-24 14:57 . 2010-04-07 18:38 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-04-07 18:48 . 2010-04-07 18:48 262144 c:\windows\system32\config\systemprofile\NtUser.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-01 524632]
"fzwkht"="c:\windows\system32\msuqddft.dll" [2010-04-07 36865]
"syncman"="c:\windows\system32\wuaucldt.exe" [2010-04-07 54272]
"Regedit32"="c:\windows\system32\regedit.exe" [BU]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"syncman"="c:\documents and settings\moi.calderon\wuaucldt.exe" [2010-04-07 54272]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\explorer.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-18 23:30 72208 ----a-w- c:\program files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^Moi.CALDERON^Menu Démarrer^Programmes^Démarrage^8614335.lnk]
path=c:\documents and settings\Moi.CALDERON\Menu Démarrer\Programmes\Démarrage\8614335.lnk
backup=c:\windows\pss\8614335.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 06:58 611712 ----a-w- c:\program files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CANAL+ CANALSAT A LA DEMANDE]
2010-01-12 16:26 163928 ----a-w- c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 12:07 1289000 ----a-w- c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-04-17 10:41 221184 ----a-w- c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-04-13 04:07 94208 ----a-w- c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-06-25 14:12 1438720 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-09-06 13:09 438272 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2std]
2005-11-16 15:14 368640 ----a-w- c:\windows\vsnp2std.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 00:00 114688 ------w- c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LiveUpdate Notice"=2 (0x2)
"LiveUpdate"=3 (0x3)
"gupdate1ca2a082e2085ce"=2 (0x2)
"DAUpdaterSvc"=3 (0x3)
"CanalPlus.VOD"=2 (0x2)
"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\steam\\SteamApps\\elinefather\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"e:\\GRID\\GRID.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"e:\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"=
"e:\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"=
"e:\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
"e:\\Far Cry 2\\bin\\FC2Editor.exe"=
"e:\\Far Cry 2\\bin\\FarCry2.exe"=
"e:\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\Tom Clancy's H.A.W.X\\HAWX.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Call of Juarez - Bound in Blood\\CoJBiBGame_x86.exe"=
"e:\\FUEL\\FUEL.exe"=
"e:\\FlatOut Ultimate Carnage\\Fouc.exe"=
"e:\\Batman Arkham Asylum\\Binaries\\ShippingPC-BmGame.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"e:\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"=
"e:\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"=
"e:\\Dragon Age\\bin_ship\\daorigins.exe"=
"e:\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"e:\\DiRT2\\dirt2_game.exe"=
"c:\\Program Files\\Fichiers communs\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"e:\\Mass Effect 2\\Binaries\\MassEffect2.exe"=
"e:\\Mass Effect 2\\MassEffect2Launcher.exe"=
"e:\\S.T.A.L.K.E.R. - Call of Pripyat\\bin\\xrEngine.exe"=
"e:\\S.T.A.L.K.E.R. - Call of Pripyat\\bin\\dedicated\\xrEngine.exe"=
"e:\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"e:\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"e:\\Assassin's Creed II\\AssassinsCreedIIGame.exe"=
"e:\\Assassin's Creed II\\AssassinsCreedII.exe"=
"e:\\Assassin's Creed II\\UPlayBrowser.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-02-13 691696]
R2 BtwSvc;BtwSvc;c:\windows\system32\svchost.exe [2008-04-13 14336]
R2 LBeepKE;LBeepKE;c:\windows\system32\Drivers\LBeepKE.sys [2008-09-26 10384]
R2 peresvc;peresvc Service;c:\windows\system32\PereSvc.exe [2001-08-28 69120]
R3 ACCSKMD;Canon Camera Storage Device;c:\windows\system32\DRIVERS\accskmd.sys [2004-02-25 32640]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-09-01 234864]
R3 SampleScanner;Ultima2000 Scanner;c:\windows\system32\DRIVERS\GT680x.sys [2001-06-07 18120]
R4 Conthci;Conthci; [x]
R4 DAUpdaterSvc;Dragon Age: Origins - Content Updater;e:\dragon age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]
R4 gupdate1ca2a082e2085ce;Service Google Update (gupdate1ca2a082e2085ce);c:\program files\Google\Update\GoogleUpdate.exe [2009-08-31 133104]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-04-26 64160]
S0 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys [2008-06-23 150568]
S0 sonypvl3;sonypvl3; [x]
S1 sonypvf3;sonypvf3; [x]
S1 sonypvt3;sonypvt3; [x]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-03-01 1029456]


--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - BTWSVC
*NewlyCreated* - PERESVC
.
Contenu du dossier 'Tâches planifiées'

2010-04-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 19:08]

2010-04-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-31 06:56]

2010-04-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-31 06:56]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
TCP: {EE3205FC-9E52-4371-B42E-3462877DE51F} = 192.168.1.1
DPF: {50DC58D0-C870-4BE6-BC41-971ED2D5F022} - hxxp://www.super-messenger.fr/tab/HookWlmEx.cab
FF - ProfilePath - c:\documents and settings\Moi.CALDERON\Application Data\Mozilla\Firefox\Profiles\m85jeh1c.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-07 21:44
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...


c:\windows\system32\wuaucldt.exe 54272 bytes executable

Scan terminé avec succès
Fichiers cachés: 1

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x89F91AC8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf765bf28
\Driver\ACPI -> ACPI.sys @ 0xf74a2cb8
\Driver\atapi -> atapi.sys @ 0xf7830852
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e6686
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b9
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e6686
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b9
NDIS: Realtek RTL8168C(P)/8111C(P) PCI-E Gigabit Ethernet NIC #2 -> SendCompleteHandler -> NDIS.sys @ 0xba65fbb0
PacketIndicateHandler -> NDIS.sys @ 0xba66ca21
SendHandler -> NDIS.sys @ 0xba64a87b
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1957994488-651377827-1417001333-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1957994488-651377827-1417001333-1003\Software\SecuROM\License information*]
"datasecu"=hex:0b,c1,9c,39,4f,46,06,f5,3d,43,c8,57,9f,10,ca,3c,1d,f0,f4,3b,4d,
df,56,d5,4c,56,85,43,5c,4f,e7,15,cd,1b,25,02,9f,96,01,31,db,0a,4f,69,d2,b9,\
"rkeysecu"=hex:3d,f4,aa,27,44,dd,35,f5,cf,a0,04,83,74,08,04,1c
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(904)
c:\windows\system32\Ati2evxx.dll
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll
c:\program files\fichiers communs\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(2180)
c:\windows\system32\msuqddft.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\msi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\TEMP\VRT2.tmp
c:\windows\system32\w.exe
c:\windows\System32\Rundll32.exe
c:\windows\system32\8637.exe
c:\windows\fonts\services.exe
.
**************************************************************************
.
Heure de fin: 2010-04-07 21:49:27 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-04-07 19:49
ComboFix2.txt 2010-04-07 18:44

Avant-CF: 239 253 168 128 octets libres
Après-CF: 239 210 115 072 octets libres

- - End Of File - - 901BD7C5D2AC4ED9FD4DFAE21E25D0AF


Merci encore !

[calderon]

Ca avance !!

J'ai pu démarrer normalement, mettre à jour malwarebyte's et là il me scan le PC complet.
Sur un scan rapide, il m'a effacé une trentaine de fichiers !

Que me conseilles tu comme antivirus gratuit?
et comment obliger le parefeu windows à vérifier les connections entrantes ET sortantes ?

Merci Énormément !

[bernard53]

fini ton scan complet avec malwarebyte's puis

Désactives AVAST pour le moment et télécharges ANTIVIR .

http://www.free-av.com/

Mets le a jour puis fait un scan complet et mets moi le rapport.

[calderon]

lol je devais sentir ta réponse,
c'est EXACTEMENT ce que j ai fait !
le scan complet tourne, j'ai désinstallé avast et installé antivir (il fini de s installer maintenant)
je te posterais le log certainement demain, cela va prendre plusieurs heures je pense

@ demain !

[calderon]

bon c'est pas encore gagné mais ca avance...
je ne peux pas installer les mises à jour d antivir et je ne peux pas lancer antivir guard...
j'ai toujours des pop ups sur mes fenêtres firefox...
voici le log de malwarebyte's:

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Version de la base de données: 3961

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

07/04/2010 22:01:18
mbam-log-2010-04-07 (22-01-18).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 131035
Temps écoulé: 2 minute(s), 25 seconde(s)

Processus mémoire infecté(s): 4
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 12
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 16

Processus mémoire infecté(s):
C:\WINDOWS\system32\PowerDes.exe (Backdoor.Bot) -> Unloaded process successfully.
C:\WINDOWS\temp\VRT3.tmp (Spyware.OnlineGames) -> Unloaded process successfully.
C:\WINDOWS\temp\VRT4.tmp (Trojan.Agent) -> Unloaded process successfully.
C:\WINDOWS\system32\PereSvc.exe (Backdoor.Bot) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\BtwSvc.dll (Trojan.Agent) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\btwsvc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\peresvc (Backdoor.Bot) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\syncman (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\syncman (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\buildw (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\guid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\i (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\uid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ulrn (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\update (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\updatenew (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\udpe (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mpe (Malware.Trace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\WINDOWS\system32\wuaucldt.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\PowerDes.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\BtwSvc.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\VRT3.tmp (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\VRT4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\PereSvc.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\2215,8.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ms.bin (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\w.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\so.bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\BtwSvc.dllx (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\d.bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\services.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Moi.CALDERON\wuaucldt.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\FInstall.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Moi.CALDERON\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.