smart antivirus 2009 • page 2

[r@in | b0w]

je vais ressayer alors!

Pardon, j'ai voulu aller trop vite.

Tu nommes le fichier CFScript.txt puis tu l'enregistres sur le Bureau.

[lionel974]

C'est bon, ça a marché après redémarrage. Voici ce que ça donne:


ComboFix 08-09-04.09 - Propriétaire 2008-09-05 19:37:18.2 - NTFSx86
Microsoft Windows XP Edition familiale 5.1.2600.2.1252.1.1036.18.630 [GMT 4:00]
Endroit: C:Documents and SettingsPropriétaireBureauComboFix.exe
Command switches used :: C:Documents and SettingsPropriétaireBureauCFScript.txt
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:Program FilesCalendrier
C:Program FilesCalendrier\Cld2000.exe
C:Program FilesCalendrier\Licence.txt
C:Program FilesCalendrier\StopCld.exe
C:Program FilesCalendrier\unins000.dat
C:Program FilesCalendrier\unins000.exe
C:Program FilesCalendrierCld2000.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2008-08-05 to 2008-09-05 ))))))))))))))))))))))))))))))))))))
.

2008-09-05 18:23 . 2008-09-05 18:23 <REP> d-------- C:e0a26d8ed2089d225e
2008-09-04 09:25 . 2008-09-04 09:25 12,288 --a------ C:WINDOWSsystem32 dssserf.dll
2008-09-04 07:16 . 2004-06-18 16:07 656,542 --a------ C:271_icol.dll
2008-09-03 22:15 . 2008-09-03 22:15 <REP> d-------- C:Documents and SettingsPropriétaireApplication DataFindeXer
2008-09-03 22:10 . 2008-09-03 22:10 152,695 --a------ C:WINDOWSBricoPackUninst.cmd
2008-09-03 22:04 . 2008-09-03 22:04 <REP> d-------- C:Program FilesRK Launcher
2008-09-03 22:04 . 2008-09-04 07:16 <REP> d-------- C:Program FilesCursorXP
2008-09-03 22:03 . 2008-09-04 07:38 <REP> d-------- C:Program FilesMacSearch_v.1.4.3
2008-09-03 22:02 . 2008-09-03 22:13 <REP> d-------- C:Program FilesiColorFolder
2008-09-03 22:01 . 2008-09-03 22:01 3,936,310 --a------ C:WINDOWSBricoPack Wallpaper.bmp
2008-09-03 21:56 . 2008-09-03 22:10 7,915 --a------ C:WINDOWSBricoPackFoldersDelete.cmd
2008-09-03 21:55 . 2008-09-03 21:55 <REP> d-------- C:WINDOWSBricoPacks
2008-09-03 20:46 . 2006-09-05 23:28 38,480 --------- C:WINDOWSsystem32IJRMF.exe
2008-08-29 00:55 . 2008-08-29 17:06 <REP> d-------- C:WINDOWSsystem32CatRoot_bak
2008-08-08 03:04 . 2008-08-08 03:04 <REP> d-------- C:Program FilesMicrosoft CAPICOM 2.1.0.2
2008-08-07 09:07 . 2008-08-07 09:07 <REP> d-------- C:Documents and SettingsPropriétaireApplication DataAmbient Design
2008-08-07 07:33 . 2008-07-18 22:07 270,880 --a------ C:WINDOWSsystem32mucltui.dll
2008-08-07 07:33 . 2008-07-18 22:07 210,976 --a------ C:WINDOWSsystem32muweb.dll
2008-08-07 07:33 . 2008-07-18 22:07 29,728 --a------ C:WINDOWSsystem32mucltui.dll.mui
2008-08-06 14:19 . 2008-08-06 14:19 <REP> d--hsc--- C:Program FilesFichiers communsWindowsLiveInstaller
2008-08-06 14:19 . 2008-08-06 14:19 <REP> d-------- C:Documents and SettingsAll UsersApplication DataWLInstaller

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-05 15:33 --------- d-----w C:Documents and SettingsPropriétaireApplication DatauTorrent
2008-09-05 15:32 --------- d-----w C:Documents and SettingsPropriétaireApplication DataOpenOffice.org2
2008-09-05 14:08 390,919 ----a-w C:WINDOWSsystem32driversfwdrv.err
2008-09-05 13:21 --------- d-----w C:Documents and SettingsPropriétaireApplication DataSkype
2008-09-05 13:19 --------- d-----w C:Documents and SettingsPropriétaireApplication DataskypePM
2008-09-04 16:03 --------- d-----w C:Documents and SettingsAll UsersApplication DataSpybot - Search & Destroy
2008-09-04 15:22 --------- d-----w C:Program FileseMule
2008-09-04 15:02 --------- d-----w C:Program FilesHijackthis Version Française
2008-09-04 05:42 --------- d-----w C:Program FilesESTsoft
2008-09-04 05:42 --------- d-----w C:Documents and SettingsPropriétaireApplication DataESTsoft
2008-09-03 16:55 --------- d--h--w C:Program FilesInstallShield Installation Information
2008-09-03 16:55 --------- d-----w C:Program FilesSamsung
2008-09-03 16:44 --------- d-----w C:Program FilesALCATEL PC Suite
2008-09-03 16:09 --------- d-----w C:Program FilesuTorrent
2008-08-06 10:27 --------- d-----w C:Program FilesFichiers communsAdobe
2008-07-18 18:10 94,920 ----a-w C:WINDOWSsystem32cdm.dll
2008-07-18 18:10 53,448 ----a-w C:WINDOWSsystem32wuauclt.exe
2008-07-18 18:10 45,768 ----a-w C:WINDOWSsystem32wups2.dll
2008-07-18 18:10 36,552 ----a-w C:WINDOWSsystem32wups.dll
2008-07-18 18:09 563,912 ----a-w C:WINDOWSsystem32wuapi.dll
2008-07-18 18:09 325,832 ----a-w C:WINDOWSsystem32wucltui.dll
2008-07-18 18:09 205,000 ----a-w C:WINDOWSsystem32wuweb.dll
2008-07-18 18:09 1,811,656 ----a-w C:WINDOWSsystem32wuaueng.dll
2008-07-07 20:31 253,952 ----a-w C:WINDOWSsystem32es.dll
2008-06-24 16:23 74,240 ----a-w C:WINDOWSsystem32mscms.dll
2008-06-23 16:15 671,232 ----a-w C:WINDOWSsystem32Wininet.dll
2008-06-20 17:41 247,808 ----a-w C:WINDOWSsystem32mswsock.dll
.

------- Sigcheck -------

2008-04-14 06:34 512000 dd73d6b9f6b4cb630cf35b438b540174 C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865afwinlogon.exe
2004-08-05 16:00 546304 bdbd27fa935d482a3d6890c69913f8a4 C:WINDOWSsystem32winlogon.exe
2004-08-05 16:00 546304 bdbd27fa935d482a3d6890c69913f8a4 C:WINDOWSsystem32dllcachewinlogon.exe
2004-08-05 16:00 506368 d2de785aeab0bb8ca4c14a8a199dbe4e C:WINDOWSVistaMizeroldwinlogon.exe

2005-03-02 13:13 2059008 5311776074b6c13f983dc75baeac9c0c C:WINDOWS$hf_mig$KB890859SP2QFE
tkrnlpa.exe
2005-09-29 22:28 2017792 7a319c9e0c14ed6410e8b2753e3a32ce C:WINDOWS$NtUninstallKB929338$
tkrnlpa.exe
2006-12-19 22:45 2019328 c46168890982d41fb8accdbac8e0a56c C:WINDOWS$NtUninstallKB931784$
tkrnlpa.exe
2007-02-28 20:08 2061440 7a56a64eb50399613587e90292dd2aab C:WINDOWSDriver Cachei386
tkrnlpa.exe
2008-04-14 06:07 2067968 b71a8f101cefaf82fc5ec16130a54a3f C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865af
tkrnlpa.exe
2007-02-28 20:08 2278912 5ca4ef71ebb4def93fb671c8d4be8689 C:WINDOWSsystem32
tkrnlpa.exe
2007-02-28 20:08 2278912 5ca4ef71ebb4def93fb671c8d4be8689 C:WINDOWSsystem32dllcache
tkrnlpa.exe
2007-02-28 20:08 2019328 3e3df9f5d56b719f055e7d652e79f96b C:WINDOWSVistaMizerold
tkrnlpa.exe

2005-03-02 22:13 2181632 3e2a0a4a0c0b19fc113618a9562a3b2a C:WINDOWS$hf_mig$KB890859SP2QFE
toskrnl.exe
2005-09-29 22:28 2138112 cd6a9f81c8b9baf1e4393c6c476d17e7 C:WINDOWS$NtUninstallKB929338$
toskrnl.exe
2006-12-19 22:45 2139648 d9f5291648962a1733f8d3e59da47bee C:WINDOWS$NtUninstallKB931784$
toskrnl.exe
2007-02-28 20:08 2184192 8e244108562e0e452eb68dff64cb08a9 C:WINDOWSDriver Cachei386
toskrnl.exe
2008-04-14 06:08 2191104 099d639da1ef6968d4e41795bb507e6b C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865af
toskrnl.exe
2007-02-28 20:08 2399232 2595e01cbdf4d3a2257952e15c353325 C:WINDOWSsystem32
toskrnl.exe
2007-02-28 20:08 2399232 2595e01cbdf4d3a2257952e15c353325 C:WINDOWSsystem32dllcache
toskrnl.exe
2007-02-28 20:08 2139648 de41f3b43b9f15e08ccd4b98a7bb2ca3 C:WINDOWSVistaMizerold
toskrnl.exe

2007-06-13 17:22 1555968 b9dd2a11ec8414088970c8c46a2e6668 C:WINDOWSexplorer.exe
2007-06-13 17:10 1037312 b795475444d6d57a572c14b9e1a29839 C:WINDOWS$hf_mig$KB938828SP2QFEexplorer.exe
2004-08-05 16:00 1036288 4c33e5b9a6197b6ed215f6cfba0a2daa C:WINDOWS$NtUninstallKB938828$explorer.exe
2008-04-14 06:34 1037824 f2317622d29f9ff0f88aeecd5f60f0dd C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865afexplorer.exe
2007-06-13 17:22 3192832 f39d8e0f795d7937910593b9ed4250ad C:WINDOWSsystem32dllcacheexplorer.exe
2007-06-13 17:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:WINDOWSVistaMizeroldexplorer.exe

2008-04-14 06:33 15360 59dc5bb82e4c8e0b3eadcfdbc44ba6e4 C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865afctfmon.exe
2004-08-05 16:00 25088 af699a4a5f2fb5e3d73e931c2e6bedc4 C:WINDOWSsystem32ctfmon.exe
2004-08-05 16:00 25088 af699a4a5f2fb5e3d73e931c2e6bedc4 C:WINDOWSsystem32dllcachectfmon.exe
2004-08-05 16:00 15360 5584247b568c2e53934873f4b655fe6a C:WINDOWSVistaMizeroldctfmon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-09-05_18.46.14.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-05 15:32:36 16,384 ----atw C:WINDOWSTempPerflib_Perfdata_5d8.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="C:WINDOWSsystem32ctfmon.exe" [2004-08-05 25088]
"µTorrent"="C:Program FilesuTorrentutorrent.exe" [2008-08-14 267056]
"SuperCopier2.exe"="C:Program FilesSuperCopier2SuperCopier2.exe" [2006-07-07 1052672]
"MediaDico"="C:Program FilesMicro ApplicationMediaDICOLanceMediaDICO.exe" [2002-01-09 197632]
"SpybotSD TeaTimer"="C:Program FilesSpybot - Search & DestroyTeaTimer.exe" [2008-01-28 2097488]
"CursorXP"="C:Program FilesCursorXPCursorXP.exe" [2005-01-19 128000]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"SunJavaUpdateSched"="C:Program FilesJavajre1.6.0_03injusched.exe" [2007-09-25 132496]
"FuncKey"="C:Program FilesHotkey ManagementFuncKey.exe" [2006-09-05 139264]
"NvCplDaemon"="C:WINDOWSsystem32NvCpl.dll" [2006-08-16 7585792]
"fscp"="C:Program FilesAVC Finger-sensing Pad Driverfscp.exe" [2006-08-31 995328]
"SSBkgdUpdate"="C:Program FilesFichiers communsScansoft SharedSSBkgdUpdateSSBkgdupdate.exe" [2003-09-30 155648]
"OpwareSE4"="C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe" [2006-03-21 69632]
"PVR Agent"="C:Program FilesKWorld MultimediaPVR PlusTVRScheduled.exe" [2005-12-21 754176]
"NeroFilterCheck"="C:WINDOWSsystem32NeroCheck.exe" [2001-07-09 155648]
"snpstd"="C:WINDOWSvsnpstd.exe" [2004-06-10 286720]
"avast!"="C:PROGRA~1ALWILS~1Avast4ashDisp.exe" [2008-07-19 78008]
"QuickTime Task"="C:Program FilesQuickTimeqttask.exe" [2007-06-29 286720]
"Easy-PrintToolBox"="C:Program FilesCanonEasy-PrintToolBoxBJPSMAIN.EXE" [2006-10-17 398944]
"nwiz"="nwiz.exe" [2006-08-16 C:WINDOWSsystem32
wiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 C:WINDOWSRTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 C:WINDOWSSkyTel.exe]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="C:WINDOWSsystem32CTFMON.EXE" [2004-08-05 25088]

C:Documents and SettingsPropri,taireMenu D,marrerProgrammesD,marrage
OpenOffice.org 2.3.lnk - C:Program FilesOpenOffice.org 2.3programquickstart.exe [2007-08-17 393216]

C:Documents and SettingsAll UsersMenu D,marrerProgrammesD,marrage
Adobe Gamma Loader.lnk - C:Program FilesFichiers communsAdobeCalibrationAdobe Gamma Loader.exe [2007-07-03 113664]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.MJPG"= mtkjpeg.dll
"msacm.l3codec"= l3codecp.acm

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
"%windir%\system32\sessmgr.exe"=
"C:\Program Files\eMule\emule.exe"=
"C:\Program Files\Mozilla Firefox\firefox.exe"=
"C:\Program Files\MSN Messenger\msnmsgr.exe"=
"C:\Program Files\MSN Messenger\livecall.exe"=
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"C:\Program Files\Messenger\msmsgs.exe"=
"C:\Program Files\uTorrent\utorrent.exe"=
"C:\Program Files\Skype\Phone\Skype.exe"=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
"13463:TCP"= 13463:TCP:µ

R1 aswSP;avast! Self Protection;C:WINDOWSsystem32driversaswSP.sys [2008-07-19 78416]
R1 fwdrv;Firewall Driver;C:WINDOWSsystem32driversfwdrv.sys [2007-04-26 302000]
R1 khips;Kerio HIPS Driver;C:WINDOWSsystem32driverskhips.sys [2007-04-26 72624]
R2 aswFsBlk;aswFsBlk;C:WINDOWSsystem32DRIVERSaswFsBlk.sys [2008-07-19 20560]
R2 FspadSvc;FspadSvc;C:Program FilesAVC Finger-sensing Pad DriverFspadSvr.exe [2006-08-23 520704]
R3 fspad;AVC Finger-sensing Pad Driver for Windows 2000/XP;C:WINDOWSsystem32DRIVERSfspad.sys [2006-09-01 22912]
S2 SPF4;Sunbelt Personal Firewall 4;C:Program FilesSunbelt SoftwarePersonal Firewallkpf4ss.exe [ ]
S3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:WINDOWSsystem32DRIVERSCnxEtP.sys [ ]
S3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:WINDOWSsystem32DRIVERSCnxEtU.sys [ ]
S3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:WINDOWSsystem32DRIVERSCnxTgNW.sys [ ]
S3 ComFiltr;Panda Anti-Dialer;C:WINDOWSsystem32DRIVERSCOMFiltr.sys [ ]
S3 odysseyIM4;Odyssey Network Agent Miniport;C:WINDOWSsystem32DRIVERSodysseyIM4.sys [2005-05-18 173056]
S3 PavSRK.sys;PavSRK.sys;C:WINDOWSsystem32PavSRK.sys [ ]
S3 PavTPK.sys;PavTPK.sys;C:WINDOWSsystem32PavTPK.sys [ ]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;C:WINDOWSsystem32DRIVERSsis163u.sys [2006-07-03 217600]
S3 USB28xxBGA;USB 2861 Device;C:WINDOWSsystem32DRIVERSemBDA.sys [2006-02-08 217216]
S3 USB28xxOEM;USB 28xx OEM Filter;C:WINDOWSsystem32DRIVERSemOEM.sys [2006-02-08 17792]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{4535be56-1b64-11dd-8f85-00140b01f7c2}]
ShellAutoRuncommand - G:setupSNK.exe
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-05 19:44:35
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINEsystemControlSet001ServicesmchInjDrv]
"ImagePath"="??C:DOCUME~1PROPRI~1LOCALS~1Tempmc21.tmp"
.
Temps d'accomplissement: 2008-09-05 19:48:32
ComboFix-quarantined-files.txt 2008-09-05 15:48:24
ComboFix2.txt 2008-09-05 14:47:46

Pre-Run: 7,909,126,144 octets libres
Post-Run: 7,890,608,128 octets libres

195 --- E O F --- 2008-08-24 23:03:34

[r@in | b0w]

Ok.

Tu refais un scan HiJackThis maintenant.

Pas de signes de ton smart antivirus 2009?

[lionel974]

Firefox et internet explorer semblent refonctionner correctement. Par contre, j'ai réactiver avast, et il m'a trouver un 'dropper' nommé Win32:Bravix [Drp], c'est quoi? Voilà le hijackthis:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:07:51, on 05/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:Program FilesJavajre1.6.0_03injusched.exe
C:Program FilesHotkey ManagementFuncKey.exe
C:WINDOWSRTHDCPL.EXE
C:Program FilesAVC Finger-sensing Pad Driverfscp.exe
C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe
C:Program FilesKWorld MultimediaPVR PlusTVRScheduled.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesSuperCopier2SuperCopier2.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesMicro ApplicationMediaDICOMediaDICO.EXE
C:Program FilesGrisoftAVG Anti-Spyware 7.5guard.exe
C:Program FilesAVC Finger-sensing Pad DriverFspadSvr.exe
C:Program FilesOpenOffice.org 2.3programsoffice.exe
C:WINDOWSsystem32
vsvc32.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesMicro ApplicationMediaDICORac.EXE
C:Program FilesOpenOffice.org 2.3programsoffice.BIN
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSsystem32CF29952.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesSpybot - Search & DestroyTeaTimer.exe
C:WINDOWSexplorer.exe
G:ArtHuros.exe
C:WINDOWSsystem32wbemwmiprvse.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.fr/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:Program FilesFichiers communsAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:Program FilesCanonEasy-WebPrintEWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_03inssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:Program FilesCanonEasy-WebPrintToolband.dll
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_03injusched.exe"
O4 - HKLM..Run: [FuncKey] "C:Program FilesHotkey ManagementFuncKey.exe"
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [SkyTel] SkyTel.EXE
O4 - HKLM..Run: [fscp] C:Program FilesAVC Finger-sensing Pad Driverfscp.exe
O4 - HKLM..Run: [SSBkgdUpdate] "C:Program FilesFichiers communsScansoft SharedSSBkgdUpdateSSBkgdupdate.exe" -Embedding -boot
O4 - HKLM..Run: [OpwareSE4] "C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe"
O4 - HKLM..Run: [PVR Agent] C:Program FilesKWorld MultimediaPVR PlusTVRScheduled.exe
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [snpstd] C:WINDOWSvsnpstd.exe
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [Easy-PrintToolBox] C:Program FilesCanonEasy-PrintToolBoxBJPSMAIN.EXE /logon
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [µTorrent] "C:Program FilesuTorrentutorrent.exe"
O4 - HKCU..Run: [SuperCopier2.exe] C:Program FilesSuperCopier2SuperCopier2.exe
O4 - HKCU..Run: [MediaDico] C:Program FilesMicro ApplicationMediaDICOLanceMediaDICO.exe Lancement
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - HKCU..Run: [CursorXP] "C:Program FilesCursorXPCursorXP.exe" -s
O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SYSTEM')
O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:Program FilesOpenOffice.org 2.3programquickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:Program FilesFichiers communsAdobeCalibrationAdobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_03inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_03inssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-U ... E_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 9211569109
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1FICHIE~1SkypeSKYPE4~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:Program FilesFichiers communsAdobe Systems SharedServiceAdobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:Program FilesGrisoftAVG Anti-Spyware 7.5guard.exe
O23 - Service: FspadSvc - Unknown owner - C:Program FilesAVC Finger-sensing Pad DriverFspadSvr.exe
O23 - Service: Service de l'iPod (iPod Service) - Unknown owner - C:Program FilesiPodiniPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Unknown owner - C:Program FilesSunbelt SoftwarePersonal Firewallkpf4ss.exe (file missing)

--
End of file - 9234 bytes

[r@in | b0w]

1_

Pas de signes de ton smart antivirus 2009?

Car tu disais à l'origine être infecté par ce rogue.
Il provoque des fenêtres d'avertissement indiquant que tu es faussement infecté par un spyware.

2_

J'ai réactiver avast, et il m'a trouver un 'dropper' nommé Win32:Bravix [Drp], c'est quoi?

A coup sûr, c'est ComboFix qui a fait réagir ton antivirus.
Tu désactives ton antivirus & ta connexion puis tu désinstalles l'utilitaire en cliquant sur Démarrer puis Exécuter et tu copies-colles la ligne suivante:

Code: Tout sélectionner

ComboFix /u

Tu supprimes ensuite les dossiers C:qoobox, C:ug & C:combofix.

3_ Via HiJackThis, tu supprimes la ligne:

C:WINDOWSsystem32CF29952.exe

Tu vas sur http://www.virustotal.com/fr/ puis tu cliques sur Parcourir.
Tu sélectionnes le fichier C:WINDOWSsystem32CF29952.exe et tu cliques sur Ouvrir.

Tu cliques ensuite sur Envoyer le fichier.

A la fin de l'analyse, tu cliques sur Formaté en haut à gauche puis, dans la nouvelle fenêtre, tu cliques sur le bouton pour faire apparaître le rapport dans la fenêtre en question.

Tu sélectionnes ce rapport puis fais un copier-coller et tu le colles dans ton prochain message.

4_ Tu as deux anti-spywares installés, AVG Antispyware & Spybot.
Tu en désinstalles un.

[lionel974]

Non, plus de signe du virus pour le moment. Je désinstalle un des 2 anti spywares définitivement? Si oui, selon toi, lequel est le meilleur?

[r@in | b0w]

Je n'apprécie pas AVG mais c'est une histoire de goût.

Spybot a le mérite d'avoir une sentinelle qui indique quand des modifications du registre sont exécutées.

A toi de faire ton choix.

Désinstalles ComboFix & fais le scan en ligne sur VirusTotal, tu as encore une infection!

[lionel974]

Je n'ai pas trouvé C:WINDOWSsystem32CF29952.exe ni avec hijeckthis, ni avec virustotal!

[r@in | b0w]

Re.

Fais une recherche sur ton disque dur pour le trouver et, dans les options avancées, indiques que la recherche se fasse aussi avec les fichiers & dossiers cachés.

Cette application introuvable est plus que suspecte!

A faire aussi, tu vas effectuer une analyse antivirus en ligne avec Internet Explorer via TrendMicro ou BitDefender.

[lionel974]

Voilà tout ce que j'ai trouvé avec la recherche:
CF29952.EXE-27B64CA0 dans C:WINDOWSPrefetch modifié le 05/09/2008[/img]

[r@in | b0w]

Ok, cela veut juste dire que cette application a été utilisée au moins aujourd'hui.

Fais une analyse antivirus en ligne.

[r@in | b0w]

Je viens de me dire qu'on va l'avoir autrement.

Récupères ComboFix comme précédemment.

Tu ouvres le Bloc-notes en cliquant sur Démarrer puis Tous les programmes, Accessoires et finalement Bloc-notes.

Tu copies-colles le texte suivant dans le Bloc-notes:

Code: Tout sélectionner

file::
C:WINDOWSsystem32CF29952.exe


Tu enregistres ce fichier sur le Bureau sous le nom CFScript et tu mets comme type de fichier Tous les fichiers puis tu fermes le Bloc-notes.

Tu sélectionnes ensuite le fichier CFScript et tu exécutes un glisser/déposer comme sur cette image.

Le glisser/déposer va lancer à nouveau ComboFix.

Tu tapes ensuite sur la touche [1] pour continuer.

L'analyse se lancera par la suite avec création d'un point de restauration et sauvegarde des fichiers Windows.
Patientes, ComboFix nettoie en 41 étapes.

Tu ne t'inquiètes surtout pas, il se charge de tout.

Si le Bureau vient à disparaître une ou plusieurs fois, ne t'inquiète pas.

Laisse faire l'utilitaire et suis bien les instructions à l'écran, il est possible qu'il te demande de redémarrer.

Surtout, tant que tu n'as pas un message de ComboFix t'informant que le ménage est terminé, tu ne fais rien de plus que ce que l'utilitaire t'indique, c'est important car il peut être long mais travaille efficacement.

Quand tout sera fini, tu liras:

Code: Tout sélectionner

Almost done... This window will close in a short while
Please wait a few seconds for the report log to pop up

ComboFix's log shall be located at C:ComboFix.txt

Normalement, le rapport s'ouvrira dans le Bloc-notes, tu nous copies-colles l'intégralité du fichier.
Si le Bloc-notes ne s'ouvre pas, tu iras chercher le rapport ici: C:ComboFix.txt et tu nous le colles dans ton prochain message.

Tu fais ensuite un nouveau scan HiJackThis et tu postes le rapport dans ton prochain message.

[lionel974]

Voilà le combofix:

ComboFix 08-09-04.09 - Propriétaire 2008-09-05 21:59:07.3 - NTFSx86
Microsoft Windows XP Edition familiale 5.1.2600.2.1252.1.1036.18.580 [GMT 4:00]
Endroit: C:Documents and SettingsPropriétaireBureauComboFix.exe
Command switches used :: C:Documents and SettingsPropriétaireBureauCFScript.txt.txt
* Création d'un nouveau point de restauration
.

((((((((((((((((((((((((((((( Fichiers créés 2008-08-05 to 2008-09-05 ))))))))))))))))))))))))))))))))))))
.

2008-09-05 21:43 . 2008-09-05 21:52 <REP> d-------- C:WINDOWSBDOSCAN8
2008-09-05 21:42 . 2008-09-05 21:43 <REP> d-------- C:WINDOWSLastGood
2008-09-05 21:37 . 2008-09-05 21:49 <REP> d-------- C:Documents and SettingsPropriétaire.housecall6.6
2008-09-05 21:37 . 2008-09-05 21:49 <REP> d-------- C:Documents and SettingsPropriétaire.housecall6.6
2008-09-05 18:23 . 2008-09-05 18:23 <REP> d-------- C:e0a26d8ed2089d225e
2008-09-04 07:16 . 2004-06-18 16:07 656,542 --a------ C:271_icol.dll
2008-09-03 22:15 . 2008-09-03 22:15 <REP> d-------- C:Documents and SettingsPropriétaireApplication DataFindeXer
2008-09-03 22:10 . 2008-09-03 22:10 152,695 --a------ C:WINDOWSBricoPackUninst.cmd
2008-09-03 22:04 . 2008-09-03 22:04 <REP> d-------- C:Program FilesRK Launcher
2008-09-03 22:04 . 2008-09-04 07:16 <REP> d-------- C:Program FilesCursorXP
2008-09-03 22:03 . 2008-09-04 07:38 <REP> d-------- C:Program FilesMacSearch_v.1.4.3
2008-09-03 22:02 . 2008-09-03 22:13 <REP> d-------- C:Program FilesiColorFolder
2008-09-03 22:01 . 2008-09-03 22:01 3,936,310 --a------ C:WINDOWSBricoPack Wallpaper.bmp
2008-09-03 21:56 . 2008-09-03 22:10 7,915 --a------ C:WINDOWSBricoPackFoldersDelete.cmd
2008-09-03 21:55 . 2008-09-03 21:55 <REP> d-------- C:WINDOWSBricoPacks
2008-09-03 20:46 . 2006-09-05 23:28 38,480 --------- C:WINDOWSsystem32IJRMF.exe
2008-08-29 00:55 . 2008-08-29 17:06 <REP> d-------- C:WINDOWSsystem32CatRoot_bak
2008-08-08 03:04 . 2008-08-08 03:04 <REP> d-------- C:Program FilesMicrosoft CAPICOM 2.1.0.2
2008-08-07 09:07 . 2008-08-07 09:07 <REP> d-------- C:Documents and SettingsPropriétaireApplication DataAmbient Design
2008-08-07 07:33 . 2008-07-18 22:07 270,880 --a------ C:WINDOWSsystem32mucltui.dll
2008-08-07 07:33 . 2008-07-18 22:07 210,976 --a------ C:WINDOWSsystem32muweb.dll
2008-08-07 07:33 . 2008-07-18 22:07 29,728 --a------ C:WINDOWSsystem32mucltui.dll.mui
2008-08-06 14:19 . 2008-08-06 14:19 <REP> d--hsc--- C:Program FilesFichiers communsWindowsLiveInstaller
2008-08-06 14:19 . 2008-08-06 14:19 <REP> d-------- C:Documents and SettingsAll UsersApplication DataWLInstaller

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-05 17:52 392,604 ----a-w C:WINDOWSsystem32driversfwdrv.err
2008-09-05 17:29 --------- d-----w C:Documents and SettingsPropriétaireApplication DatauTorrent
2008-09-05 17:28 --------- d-----w C:Documents and SettingsPropriétaireApplication DataOpenOffice.org2
2008-09-05 13:21 --------- d-----w C:Documents and SettingsPropriétaireApplication DataSkype
2008-09-05 13:19 --------- d-----w C:Documents and SettingsPropriétaireApplication DataskypePM
2008-09-04 16:03 --------- d-----w C:Documents and SettingsAll UsersApplication DataSpybot - Search & Destroy
2008-09-04 15:22 --------- d-----w C:Program FileseMule
2008-09-04 15:02 --------- d-----w C:Program FilesHijackthis Version Française
2008-09-04 05:42 --------- d-----w C:Program FilesESTsoft
2008-09-04 05:42 --------- d-----w C:Documents and SettingsPropriétaireApplication DataESTsoft
2008-09-03 16:55 --------- d--h--w C:Program FilesInstallShield Installation Information
2008-09-03 16:55 --------- d-----w C:Program FilesSamsung
2008-09-03 16:44 --------- d-----w C:Program FilesALCATEL PC Suite
2008-09-03 16:09 --------- d-----w C:Program FilesuTorrent
2008-08-06 10:27 --------- d-----w C:Program FilesFichiers communsAdobe
2008-07-18 18:10 94,920 ----a-w C:WINDOWSsystem32cdm.dll
2008-07-18 18:10 53,448 ----a-w C:WINDOWSsystem32wuauclt.exe
2008-07-18 18:10 45,768 ----a-w C:WINDOWSsystem32wups2.dll
2008-07-18 18:10 36,552 ----a-w C:WINDOWSsystem32wups.dll
2008-07-18 18:09 563,912 ----a-w C:WINDOWSsystem32wuapi.dll
2008-07-18 18:09 325,832 ----a-w C:WINDOWSsystem32wucltui.dll
2008-07-18 18:09 205,000 ----a-w C:WINDOWSsystem32wuweb.dll
2008-07-18 18:09 1,811,656 ----a-w C:WINDOWSsystem32wuaueng.dll
2008-07-07 20:31 253,952 ----a-w C:WINDOWSsystem32es.dll
2008-06-24 16:23 74,240 ----a-w C:WINDOWSsystem32mscms.dll
2008-06-23 16:15 671,232 ----a-w C:WINDOWSsystem32Wininet.dll
2008-06-20 17:41 247,808 ----a-w C:WINDOWSsystem32mswsock.dll
.

------- Sigcheck -------

2008-04-14 06:34 512000 dd73d6b9f6b4cb630cf35b438b540174 C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865afwinlogon.exe
2004-08-05 16:00 546304 bdbd27fa935d482a3d6890c69913f8a4 C:WINDOWSsystem32winlogon.exe
2004-08-05 16:00 546304 bdbd27fa935d482a3d6890c69913f8a4 C:WINDOWSsystem32dllcachewinlogon.exe
2004-08-05 16:00 506368 d2de785aeab0bb8ca4c14a8a199dbe4e C:WINDOWSVistaMizeroldwinlogon.exe

2005-03-02 13:13 2059008 5311776074b6c13f983dc75baeac9c0c C:WINDOWS$hf_mig$KB890859SP2QFE
tkrnlpa.exe
2005-09-29 22:28 2017792 7a319c9e0c14ed6410e8b2753e3a32ce C:WINDOWS$NtUninstallKB929338$
tkrnlpa.exe
2006-12-19 22:45 2019328 c46168890982d41fb8accdbac8e0a56c C:WINDOWS$NtUninstallKB931784$
tkrnlpa.exe
2007-02-28 20:08 2061440 7a56a64eb50399613587e90292dd2aab C:WINDOWSDriver Cachei386
tkrnlpa.exe
2008-04-14 06:07 2067968 b71a8f101cefaf82fc5ec16130a54a3f C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865af
tkrnlpa.exe
2007-02-28 20:08 2278912 5ca4ef71ebb4def93fb671c8d4be8689 C:WINDOWSsystem32
tkrnlpa.exe
2007-02-28 20:08 2278912 5ca4ef71ebb4def93fb671c8d4be8689 C:WINDOWSsystem32dllcache
tkrnlpa.exe
2007-02-28 20:08 2019328 3e3df9f5d56b719f055e7d652e79f96b C:WINDOWSVistaMizerold
tkrnlpa.exe

2005-03-02 22:13 2181632 3e2a0a4a0c0b19fc113618a9562a3b2a C:WINDOWS$hf_mig$KB890859SP2QFE
toskrnl.exe
2005-09-29 22:28 2138112 cd6a9f81c8b9baf1e4393c6c476d17e7 C:WINDOWS$NtUninstallKB929338$
toskrnl.exe
2006-12-19 22:45 2139648 d9f5291648962a1733f8d3e59da47bee C:WINDOWS$NtUninstallKB931784$
toskrnl.exe
2007-02-28 20:08 2184192 8e244108562e0e452eb68dff64cb08a9 C:WINDOWSDriver Cachei386
toskrnl.exe
2008-04-14 06:08 2191104 099d639da1ef6968d4e41795bb507e6b C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865af
toskrnl.exe
2007-02-28 20:08 2399232 2595e01cbdf4d3a2257952e15c353325 C:WINDOWSsystem32
toskrnl.exe
2007-02-28 20:08 2399232 2595e01cbdf4d3a2257952e15c353325 C:WINDOWSsystem32dllcache
toskrnl.exe
2007-02-28 20:08 2139648 de41f3b43b9f15e08ccd4b98a7bb2ca3 C:WINDOWSVistaMizerold
toskrnl.exe

2007-06-13 17:22 1555968 b9dd2a11ec8414088970c8c46a2e6668 C:WINDOWSexplorer.exe
2007-06-13 17:10 1037312 b795475444d6d57a572c14b9e1a29839 C:WINDOWS$hf_mig$KB938828SP2QFEexplorer.exe
2004-08-05 16:00 1036288 4c33e5b9a6197b6ed215f6cfba0a2daa C:WINDOWS$NtUninstallKB938828$explorer.exe
2008-04-14 06:34 1037824 f2317622d29f9ff0f88aeecd5f60f0dd C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865afexplorer.exe
2007-06-13 17:22 3192832 f39d8e0f795d7937910593b9ed4250ad C:WINDOWSsystem32dllcacheexplorer.exe
2007-06-13 17:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:WINDOWSVistaMizeroldexplorer.exe

2008-04-14 06:33 15360 59dc5bb82e4c8e0b3eadcfdbc44ba6e4 C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865afctfmon.exe
2004-08-05 16:00 25088 af699a4a5f2fb5e3d73e931c2e6bedc4 C:WINDOWSsystem32ctfmon.exe
2004-08-05 16:00 25088 af699a4a5f2fb5e3d73e931c2e6bedc4 C:WINDOWSsystem32dllcachectfmon.exe
2004-08-05 16:00 15360 5584247b568c2e53934873f4b655fe6a C:WINDOWSVistaMizeroldctfmon.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="C:WINDOWSsystem32ctfmon.exe" [2004-08-05 25088]
"µTorrent"="C:Program FilesuTorrentutorrent.exe" [2008-08-14 267056]
"SuperCopier2.exe"="C:Program FilesSuperCopier2SuperCopier2.exe" [2006-07-07 1052672]
"MediaDico"="C:Program FilesMicro ApplicationMediaDICOLanceMediaDICO.exe" [2002-01-09 197632]
"SpybotSD TeaTimer"="C:Program FilesSpybot - Search & DestroyTeaTimer.exe" [2008-01-28 2097488]
"CursorXP"="C:Program FilesCursorXPCursorXP.exe" [2005-01-19 128000]
"msnmsgr"="C:Program FilesMSN Messengermsnmsgr.exe" [2007-01-19 5674352]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"SunJavaUpdateSched"="C:Program FilesJavajre1.6.0_03injusched.exe" [2007-09-25 132496]
"FuncKey"="C:Program FilesHotkey ManagementFuncKey.exe" [2006-09-05 139264]
"NvCplDaemon"="C:WINDOWSsystem32NvCpl.dll" [2006-08-16 7585792]
"fscp"="C:Program FilesAVC Finger-sensing Pad Driverfscp.exe" [2006-08-31 995328]
"SSBkgdUpdate"="C:Program FilesFichiers communsScansoft SharedSSBkgdUpdateSSBkgdupdate.exe" [2003-09-30 155648]
"OpwareSE4"="C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe" [2006-03-21 69632]
"PVR Agent"="C:Program FilesKWorld MultimediaPVR PlusTVRScheduled.exe" [2005-12-21 754176]
"NeroFilterCheck"="C:WINDOWSsystem32NeroCheck.exe" [2001-07-09 155648]
"snpstd"="C:WINDOWSvsnpstd.exe" [2004-06-10 286720]
"avast!"="C:PROGRA~1ALWILS~1Avast4ashDisp.exe" [2008-07-19 78008]
"QuickTime Task"="C:Program FilesQuickTimeqttask.exe" [2007-06-29 286720]
"Easy-PrintToolBox"="C:Program FilesCanonEasy-PrintToolBoxBJPSMAIN.EXE" [2006-10-17 398944]
"nwiz"="nwiz.exe" [2006-08-16 C:WINDOWSsystem32
wiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 C:WINDOWSRTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 C:WINDOWSSkyTel.exe]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="C:WINDOWSsystem32CTFMON.EXE" [2004-08-05 25088]

C:Documents and SettingsPropri,taireMenu D,marrerProgrammesD,marrage
OpenOffice.org 2.3.lnk - C:Program FilesOpenOffice.org 2.3programquickstart.exe [2007-08-17 393216]

C:Documents and SettingsAll UsersMenu D,marrerProgrammesD,marrage
Adobe Gamma Loader.lnk - C:Program FilesFichiers communsAdobeCalibrationAdobe Gamma Loader.exe [2007-07-03 113664]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.MJPG"= mtkjpeg.dll
"msacm.l3codec"= l3codecp.acm

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
"%windir%\system32\sessmgr.exe"=
"C:\Program Files\eMule\emule.exe"=
"C:\Program Files\Mozilla Firefox\firefox.exe"=
"C:\Program Files\MSN Messenger\msnmsgr.exe"=
"C:\Program Files\MSN Messenger\livecall.exe"=
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"C:\Program Files\Messenger\msmsgs.exe"=
"C:\Program Files\uTorrent\utorrent.exe"=
"C:\Program Files\Skype\Phone\Skype.exe"=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
"13463:TCP"= 13463:TCP:µ

R1 aswSP;avast! Self Protection;C:WINDOWSsystem32driversaswSP.sys [2008-07-19 78416]
R1 fwdrv;Firewall Driver;C:WINDOWSsystem32driversfwdrv.sys [2007-04-26 302000]
R1 khips;Kerio HIPS Driver;C:WINDOWSsystem32driverskhips.sys [2007-04-26 72624]
R2 aswFsBlk;aswFsBlk;C:WINDOWSsystem32DRIVERSaswFsBlk.sys [2008-07-19 20560]
R2 FspadSvc;FspadSvc;C:Program FilesAVC Finger-sensing Pad DriverFspadSvr.exe [2006-08-23 520704]
R3 fspad;AVC Finger-sensing Pad Driver for Windows 2000/XP;C:WINDOWSsystem32DRIVERSfspad.sys [2006-09-01 22912]
S2 SPF4;Sunbelt Personal Firewall 4;C:Program FilesSunbelt SoftwarePersonal Firewallkpf4ss.exe [ ]
S3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:WINDOWSsystem32DRIVERSCnxEtP.sys [ ]
S3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:WINDOWSsystem32DRIVERSCnxEtU.sys [ ]
S3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:WINDOWSsystem32DRIVERSCnxTgNW.sys [ ]
S3 ComFiltr;Panda Anti-Dialer;C:WINDOWSsystem32DRIVERSCOMFiltr.sys [ ]
S3 odysseyIM4;Odyssey Network Agent Miniport;C:WINDOWSsystem32DRIVERSodysseyIM4.sys [2005-05-18 173056]
S3 PavSRK.sys;PavSRK.sys;C:WINDOWSsystem32PavSRK.sys [ ]
S3 PavTPK.sys;PavTPK.sys;C:WINDOWSsystem32PavTPK.sys [ ]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;C:WINDOWSsystem32DRIVERSsis163u.sys [2006-07-03 217600]
S3 USB28xxBGA;USB 2861 Device;C:WINDOWSsystem32DRIVERSemBDA.sys [2006-02-08 217216]
S3 USB28xxOEM;USB 28xx OEM Filter;C:WINDOWSsystem32DRIVERSemOEM.sys [2006-02-08 17792]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{4535be56-1b64-11dd-8f85-00140b01f7c2}]
ShellAutoRuncommand - G:setupSNK.exe
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-05 22:06:00
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINEsystemControlSet001ServicesmchInjDrv]
"ImagePath"="??C:DOCUME~1PROPRI~1LOCALS~1Tempmc21.tmp"
.
Temps d'accomplissement: 2008-09-05 22:09:41
ComboFix-quarantined-files.txt 2008-09-05 18:09:33

Pre-Run: 7,337,603,072 octets libres
Post-Run: 7,331,475,456 octets libres

184 --- E O F --- 2008-08-24 23:03:34







et voilà le hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:10:48, on 05/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:Program FilesJavajre1.6.0_03injusched.exe
C:Program FilesHotkey ManagementFuncKey.exe
C:WINDOWSRTHDCPL.EXE
C:Program FilesAVC Finger-sensing Pad Driverfscp.exe
C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe
C:Program FilesKWorld MultimediaPVR PlusTVRScheduled.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesSuperCopier2SuperCopier2.exe
C:Program FilesMicro ApplicationMediaDICOMediaDICO.EXE
C:Program FilesOpenOffice.org 2.3programsoffice.exe
C:Program FilesOpenOffice.org 2.3programsoffice.BIN
C:Program FilesMicro ApplicationMediaDICORac.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesGrisoftAVG Anti-Spyware 7.5guard.exe
C:Program FilesAVC Finger-sensing Pad DriverFspadSvr.exe
C:WINDOWSsystem32
vsvc32.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:WINDOWSSystem32alg.exe
C:Program FilesMSN Messengerusnsvc.exe
C:Program FilesJavajre1.6.0_03injucheck.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSexplorer.exe
C:Program FilesSpybot - Search & DestroyTeaTimer.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesMSN Messengermsnmsgr.exe
G:ArtHuros.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSsystem32NOTEPAD.EXE

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:Program FilesFichiers communsAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:Program FilesCanonEasy-WebPrintEWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_03inssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:Program FilesCanonEasy-WebPrintToolband.dll
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_03injusched.exe"
O4 - HKLM..Run: [FuncKey] "C:Program FilesHotkey ManagementFuncKey.exe"
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [SkyTel] SkyTel.EXE
O4 - HKLM..Run: [fscp] C:Program FilesAVC Finger-sensing Pad Driverfscp.exe
O4 - HKLM..Run: [SSBkgdUpdate] "C:Program FilesFichiers communsScansoft SharedSSBkgdUpdateSSBkgdupdate.exe" -Embedding -boot
O4 - HKLM..Run: [OpwareSE4] "C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe"
O4 - HKLM..Run: [PVR Agent] C:Program FilesKWorld MultimediaPVR PlusTVRScheduled.exe
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [snpstd] C:WINDOWSvsnpstd.exe
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [Easy-PrintToolBox] C:Program FilesCanonEasy-PrintToolBoxBJPSMAIN.EXE /logon
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [µTorrent] "C:Program FilesuTorrentutorrent.exe"
O4 - HKCU..Run: [SuperCopier2.exe] C:Program FilesSuperCopier2SuperCopier2.exe
O4 - HKCU..Run: [MediaDico] C:Program FilesMicro ApplicationMediaDICOLanceMediaDICO.exe Lancement
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - HKCU..Run: [CursorXP] "C:Program FilesCursorXPCursorXP.exe" -s
O4 - HKCU..Run: [msnmsgr] "C:Program FilesMSN Messengermsnmsgr.exe" /background
O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SYSTEM')
O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:Program FilesOpenOffice.org 2.3programquickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:Program FilesFichiers communsAdobeCalibrationAdobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_03inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_03inssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:WINDOWSdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:WINDOWSdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-U ... E_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 9211569109
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install ... stallX.CAB
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1FICHIE~1SkypeSKYPE4~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:Program FilesFichiers communsAdobe Systems SharedServiceAdobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:Program FilesGrisoftAVG Anti-Spyware 7.5guard.exe
O23 - Service: FspadSvc - Unknown owner - C:Program FilesAVC Finger-sensing Pad DriverFspadSvr.exe
O23 - Service: Service de l'iPod (iPod Service) - Unknown owner - C:Program FilesiPodiniPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Unknown owner - C:Program FilesSunbelt SoftwarePersonal Firewallkpf4ss.exe (file missing)

--
End of file - 9930 bytes

[r@in | b0w]

Tu as oublié de faire le CFScript.txt car il n'apparait pas dans le rapport.

Tu copies-colles le texte suivant dans le Bloc-notes:

Code: Tout sélectionner

file::
C:WINDOWSsystem32CF29952.exe


Tu enregistres ce fichier sur le Bureau sous le nom CFScript et tu mets comme type de fichier Tous les fichiers puis tu fermes le Bloc-notes.

Tu sélectionnes ensuite le fichier CFScript et tu exécutes un glisser/déposer comme sur cette image.

Le glisser/déposer va lancer à nouveau ComboFix.

Tu tapes ensuite sur la touche [1] pour continuer.

L'analyse se lancera par la suite avec création d'un point de restauration et sauvegarde des fichiers Windows.
Patientes, ComboFix nettoie en 41 étapes.

Tu ne t'inquiètes surtout pas, il se charge de tout.

Si le Bureau vient à disparaître une ou plusieurs fois, ne t'inquiète pas.

Laisse faire l'utilitaire et suis bien les instructions à l'écran, il est possible qu'il te demande de redémarrer.

Surtout, tant que tu n'as pas un message de ComboFix t'informant que le ménage est terminé, tu ne fais rien de plus que ce que l'utilitaire t'indique, c'est important car il peut être long mais travaille efficacement.

Quand tout sera fini, tu liras:

Code: Tout sélectionner

Almost done... This window will close in a short while
Please wait a few seconds for the report log to pop up

ComboFix's log shall be located at C:ComboFix.txt

Normalement, le rapport s'ouvrira dans le Bloc-notes, tu nous copies-colles l'intégralité du fichier.
Si le Bloc-notes ne s'ouvre pas, tu iras chercher le rapport ici: C:ComboFix.txt et tu nous le colles dans ton prochain message.

Tu fais ensuite un nouveau scan HiJackThis et tu postes le rapport dans ton prochain message.[/quote]

[lionel974]

Il me semblait l'avoir pourtant fait, mais voilà les nouveaux résultats. Je te dis à demain, je bosse demain, et il se fait tard ici, merci pour ton aide.

combofix:



ComboFix 08-09-04.09 - Propriétaire 2008-09-05 22:52:12.4 - NTFSx86
Microsoft Windows XP Edition familiale 5.1.2600.2.1252.1.1036.18.559 [GMT 4:00]
Endroit: C:Documents and SettingsPropriétaireBureauComboFix.exe
Command switches used :: C:Documents and SettingsPropriétaireBureauCFScript.txt.txt
* Création d'un nouveau point de restauration
.

((((((((((((((((((((((((((((( Fichiers créés 2008-08-05 to 2008-09-05 ))))))))))))))))))))))))))))))))))))
.

2008-09-05 21:43 . 2008-09-05 21:52 <REP> d-------- C:WINDOWSBDOSCAN8
2008-09-05 21:42 . 2008-09-05 21:43 <REP> d-------- C:WINDOWSLastGood
2008-09-05 21:37 . 2008-09-05 21:49 <REP> d-------- C:Documents and SettingsPropriétaire.housecall6.6
2008-09-05 21:37 . 2008-09-05 21:49 <REP> d-------- C:Documents and SettingsPropriétaire.housecall6.6
2008-09-05 18:23 . 2008-09-05 18:23 <REP> d-------- C:e0a26d8ed2089d225e
2008-09-04 07:16 . 2004-06-18 16:07 656,542 --a------ C:271_icol.dll
2008-09-03 22:15 . 2008-09-03 22:15 <REP> d-------- C:Documents and SettingsPropriétaireApplication DataFindeXer
2008-09-03 22:10 . 2008-09-03 22:10 152,695 --a------ C:WINDOWSBricoPackUninst.cmd
2008-09-03 22:04 . 2008-09-03 22:04 <REP> d-------- C:Program FilesRK Launcher
2008-09-03 22:04 . 2008-09-04 07:16 <REP> d-------- C:Program FilesCursorXP
2008-09-03 22:03 . 2008-09-04 07:38 <REP> d-------- C:Program FilesMacSearch_v.1.4.3
2008-09-03 22:02 . 2008-09-03 22:13 <REP> d-------- C:Program FilesiColorFolder
2008-09-03 22:01 . 2008-09-03 22:01 3,936,310 --a------ C:WINDOWSBricoPack Wallpaper.bmp
2008-09-03 21:56 . 2008-09-03 22:10 7,915 --a------ C:WINDOWSBricoPackFoldersDelete.cmd
2008-09-03 21:55 . 2008-09-03 21:55 <REP> d-------- C:WINDOWSBricoPacks
2008-09-03 20:46 . 2006-09-05 23:28 38,480 --------- C:WINDOWSsystem32IJRMF.exe
2008-08-29 00:55 . 2008-08-29 17:06 <REP> d-------- C:WINDOWSsystem32CatRoot_bak
2008-08-08 03:04 . 2008-08-08 03:04 <REP> d-------- C:Program FilesMicrosoft CAPICOM 2.1.0.2
2008-08-07 09:07 . 2008-08-07 09:07 <REP> d-------- C:Documents and SettingsPropriétaireApplication DataAmbient Design
2008-08-07 07:33 . 2008-07-18 22:07 270,880 --a------ C:WINDOWSsystem32mucltui.dll
2008-08-07 07:33 . 2008-07-18 22:07 210,976 --a------ C:WINDOWSsystem32muweb.dll
2008-08-07 07:33 . 2008-07-18 22:07 29,728 --a------ C:WINDOWSsystem32mucltui.dll.mui
2008-08-06 14:19 . 2008-08-06 14:19 <REP> d--hsc--- C:Program FilesFichiers communsWindowsLiveInstaller
2008-08-06 14:19 . 2008-08-06 14:19 <REP> d-------- C:Documents and SettingsAll UsersApplication DataWLInstaller

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-05 18:45 392,867 ----a-w C:WINDOWSsystem32driversfwdrv.err
2008-09-05 17:29 --------- d-----w C:Documents and SettingsPropriétaireApplication DatauTorrent
2008-09-05 17:28 --------- d-----w C:Documents and SettingsPropriétaireApplication DataOpenOffice.org2
2008-09-05 13:21 --------- d-----w C:Documents and SettingsPropriétaireApplication DataSkype
2008-09-05 13:19 --------- d-----w C:Documents and SettingsPropriétaireApplication DataskypePM
2008-09-04 16:03 --------- d-----w C:Documents and SettingsAll UsersApplication DataSpybot - Search & Destroy
2008-09-04 15:22 --------- d-----w C:Program FileseMule
2008-09-04 15:02 --------- d-----w C:Program FilesHijackthis Version Française
2008-09-04 05:42 --------- d-----w C:Program FilesESTsoft
2008-09-04 05:42 --------- d-----w C:Documents and SettingsPropriétaireApplication DataESTsoft
2008-09-03 16:55 --------- d--h--w C:Program FilesInstallShield Installation Information
2008-09-03 16:55 --------- d-----w C:Program FilesSamsung
2008-09-03 16:44 --------- d-----w C:Program FilesALCATEL PC Suite
2008-09-03 16:09 --------- d-----w C:Program FilesuTorrent
2008-08-06 10:27 --------- d-----w C:Program FilesFichiers communsAdobe
2008-07-18 18:10 94,920 ----a-w C:WINDOWSsystem32cdm.dll
2008-07-18 18:10 53,448 ----a-w C:WINDOWSsystem32wuauclt.exe
2008-07-18 18:10 45,768 ----a-w C:WINDOWSsystem32wups2.dll
2008-07-18 18:10 36,552 ----a-w C:WINDOWSsystem32wups.dll
2008-07-18 18:09 563,912 ----a-w C:WINDOWSsystem32wuapi.dll
2008-07-18 18:09 325,832 ----a-w C:WINDOWSsystem32wucltui.dll
2008-07-18 18:09 205,000 ----a-w C:WINDOWSsystem32wuweb.dll
2008-07-18 18:09 1,811,656 ----a-w C:WINDOWSsystem32wuaueng.dll
2008-07-07 20:31 253,952 ----a-w C:WINDOWSsystem32es.dll
2008-06-24 16:23 74,240 ----a-w C:WINDOWSsystem32mscms.dll
2008-06-23 16:15 671,232 ----a-w C:WINDOWSsystem32Wininet.dll
2008-06-20 17:41 247,808 ----a-w C:WINDOWSsystem32mswsock.dll
.

------- Sigcheck -------

2008-04-14 06:34 512000 dd73d6b9f6b4cb630cf35b438b540174 C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865afwinlogon.exe
2004-08-05 16:00 546304 bdbd27fa935d482a3d6890c69913f8a4 C:WINDOWSsystem32winlogon.exe
2004-08-05 16:00 546304 bdbd27fa935d482a3d6890c69913f8a4 C:WINDOWSsystem32dllcachewinlogon.exe
2004-08-05 16:00 506368 d2de785aeab0bb8ca4c14a8a199dbe4e C:WINDOWSVistaMizeroldwinlogon.exe

2005-03-02 13:13 2059008 5311776074b6c13f983dc75baeac9c0c C:WINDOWS$hf_mig$KB890859SP2QFE
tkrnlpa.exe
2005-09-29 22:28 2017792 7a319c9e0c14ed6410e8b2753e3a32ce C:WINDOWS$NtUninstallKB929338$
tkrnlpa.exe
2006-12-19 22:45 2019328 c46168890982d41fb8accdbac8e0a56c C:WINDOWS$NtUninstallKB931784$
tkrnlpa.exe
2007-02-28 20:08 2061440 7a56a64eb50399613587e90292dd2aab C:WINDOWSDriver Cachei386
tkrnlpa.exe
2008-04-14 06:07 2067968 b71a8f101cefaf82fc5ec16130a54a3f C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865af
tkrnlpa.exe
2007-02-28 20:08 2278912 5ca4ef71ebb4def93fb671c8d4be8689 C:WINDOWSsystem32
tkrnlpa.exe
2007-02-28 20:08 2278912 5ca4ef71ebb4def93fb671c8d4be8689 C:WINDOWSsystem32dllcache
tkrnlpa.exe
2007-02-28 20:08 2019328 3e3df9f5d56b719f055e7d652e79f96b C:WINDOWSVistaMizerold
tkrnlpa.exe

2005-03-02 22:13 2181632 3e2a0a4a0c0b19fc113618a9562a3b2a C:WINDOWS$hf_mig$KB890859SP2QFE
toskrnl.exe
2005-09-29 22:28 2138112 cd6a9f81c8b9baf1e4393c6c476d17e7 C:WINDOWS$NtUninstallKB929338$
toskrnl.exe
2006-12-19 22:45 2139648 d9f5291648962a1733f8d3e59da47bee C:WINDOWS$NtUninstallKB931784$
toskrnl.exe
2007-02-28 20:08 2184192 8e244108562e0e452eb68dff64cb08a9 C:WINDOWSDriver Cachei386
toskrnl.exe
2008-04-14 06:08 2191104 099d639da1ef6968d4e41795bb507e6b C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865af
toskrnl.exe
2007-02-28 20:08 2399232 2595e01cbdf4d3a2257952e15c353325 C:WINDOWSsystem32
toskrnl.exe
2007-02-28 20:08 2399232 2595e01cbdf4d3a2257952e15c353325 C:WINDOWSsystem32dllcache
toskrnl.exe
2007-02-28 20:08 2139648 de41f3b43b9f15e08ccd4b98a7bb2ca3 C:WINDOWSVistaMizerold
toskrnl.exe

2007-06-13 17:22 1555968 b9dd2a11ec8414088970c8c46a2e6668 C:WINDOWSexplorer.exe
2007-06-13 17:10 1037312 b795475444d6d57a572c14b9e1a29839 C:WINDOWS$hf_mig$KB938828SP2QFEexplorer.exe
2004-08-05 16:00 1036288 4c33e5b9a6197b6ed215f6cfba0a2daa C:WINDOWS$NtUninstallKB938828$explorer.exe
2008-04-14 06:34 1037824 f2317622d29f9ff0f88aeecd5f60f0dd C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865afexplorer.exe
2007-06-13 17:22 3192832 f39d8e0f795d7937910593b9ed4250ad C:WINDOWSsystem32dllcacheexplorer.exe
2007-06-13 17:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:WINDOWSVistaMizeroldexplorer.exe

2008-04-14 06:33 15360 59dc5bb82e4c8e0b3eadcfdbc44ba6e4 C:WINDOWSSoftwareDistributionDownload23ec66f2314a80d718b5483ab6e865afctfmon.exe
2004-08-05 16:00 25088 af699a4a5f2fb5e3d73e931c2e6bedc4 C:WINDOWSsystem32ctfmon.exe
2004-08-05 16:00 25088 af699a4a5f2fb5e3d73e931c2e6bedc4 C:WINDOWSsystem32dllcachectfmon.exe
2004-08-05 16:00 15360 5584247b568c2e53934873f4b655fe6a C:WINDOWSVistaMizeroldctfmon.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="C:WINDOWSsystem32ctfmon.exe" [2004-08-05 25088]
"µTorrent"="C:Program FilesuTorrentutorrent.exe" [2008-08-14 267056]
"SuperCopier2.exe"="C:Program FilesSuperCopier2SuperCopier2.exe" [2006-07-07 1052672]
"MediaDico"="C:Program FilesMicro ApplicationMediaDICOLanceMediaDICO.exe" [2002-01-09 197632]
"SpybotSD TeaTimer"="C:Program FilesSpybot - Search & DestroyTeaTimer.exe" [2008-01-28 2097488]
"CursorXP"="C:Program FilesCursorXPCursorXP.exe" [2005-01-19 128000]
"msnmsgr"="C:Program FilesMSN Messengermsnmsgr.exe" [2007-01-19 5674352]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"SunJavaUpdateSched"="C:Program FilesJavajre1.6.0_03injusched.exe" [2007-09-25 132496]
"FuncKey"="C:Program FilesHotkey ManagementFuncKey.exe" [2006-09-05 139264]
"NvCplDaemon"="C:WINDOWSsystem32NvCpl.dll" [2006-08-16 7585792]
"fscp"="C:Program FilesAVC Finger-sensing Pad Driverfscp.exe" [2006-08-31 995328]
"SSBkgdUpdate"="C:Program FilesFichiers communsScansoft SharedSSBkgdUpdateSSBkgdupdate.exe" [2003-09-30 155648]
"OpwareSE4"="C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe" [2006-03-21 69632]
"PVR Agent"="C:Program FilesKWorld MultimediaPVR PlusTVRScheduled.exe" [2005-12-21 754176]
"NeroFilterCheck"="C:WINDOWSsystem32NeroCheck.exe" [2001-07-09 155648]
"snpstd"="C:WINDOWSvsnpstd.exe" [2004-06-10 286720]
"avast!"="C:PROGRA~1ALWILS~1Avast4ashDisp.exe" [2008-07-19 78008]
"QuickTime Task"="C:Program FilesQuickTimeqttask.exe" [2007-06-29 286720]
"Easy-PrintToolBox"="C:Program FilesCanonEasy-PrintToolBoxBJPSMAIN.EXE" [2006-10-17 398944]
"nwiz"="nwiz.exe" [2006-08-16 C:WINDOWSsystem32
wiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 C:WINDOWSRTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 C:WINDOWSSkyTel.exe]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="C:WINDOWSsystem32CTFMON.EXE" [2004-08-05 25088]

C:Documents and SettingsPropri,taireMenu D,marrerProgrammesD,marrage
OpenOffice.org 2.3.lnk - C:Program FilesOpenOffice.org 2.3programquickstart.exe [2007-08-17 393216]

C:Documents and SettingsAll UsersMenu D,marrerProgrammesD,marrage
Adobe Gamma Loader.lnk - C:Program FilesFichiers communsAdobeCalibrationAdobe Gamma Loader.exe [2007-07-03 113664]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.MJPG"= mtkjpeg.dll
"msacm.l3codec"= l3codecp.acm

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
"%windir%\system32\sessmgr.exe"=
"C:\Program Files\eMule\emule.exe"=
"C:\Program Files\Mozilla Firefox\firefox.exe"=
"C:\Program Files\MSN Messenger\msnmsgr.exe"=
"C:\Program Files\MSN Messenger\livecall.exe"=
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"C:\Program Files\Messenger\msmsgs.exe"=
"C:\Program Files\uTorrent\utorrent.exe"=
"C:\Program Files\Skype\Phone\Skype.exe"=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
"13463:TCP"= 13463:TCP:µ

R1 aswSP;avast! Self Protection;C:WINDOWSsystem32driversaswSP.sys [2008-07-19 78416]
R1 fwdrv;Firewall Driver;C:WINDOWSsystem32driversfwdrv.sys [2007-04-26 302000]
R1 khips;Kerio HIPS Driver;C:WINDOWSsystem32driverskhips.sys [2007-04-26 72624]
R2 aswFsBlk;aswFsBlk;C:WINDOWSsystem32DRIVERSaswFsBlk.sys [2008-07-19 20560]
R2 FspadSvc;FspadSvc;C:Program FilesAVC Finger-sensing Pad DriverFspadSvr.exe [2006-08-23 520704]
R3 fspad;AVC Finger-sensing Pad Driver for Windows 2000/XP;C:WINDOWSsystem32DRIVERSfspad.sys [2006-09-01 22912]
S2 SPF4;Sunbelt Personal Firewall 4;C:Program FilesSunbelt SoftwarePersonal Firewallkpf4ss.exe [ ]
S3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:WINDOWSsystem32DRIVERSCnxEtP.sys [ ]
S3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:WINDOWSsystem32DRIVERSCnxEtU.sys [ ]
S3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:WINDOWSsystem32DRIVERSCnxTgNW.sys [ ]
S3 ComFiltr;Panda Anti-Dialer;C:WINDOWSsystem32DRIVERSCOMFiltr.sys [ ]
S3 odysseyIM4;Odyssey Network Agent Miniport;C:WINDOWSsystem32DRIVERSodysseyIM4.sys [2005-05-18 173056]
S3 PavSRK.sys;PavSRK.sys;C:WINDOWSsystem32PavSRK.sys [ ]
S3 PavTPK.sys;PavTPK.sys;C:WINDOWSsystem32PavTPK.sys [ ]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;C:WINDOWSsystem32DRIVERSsis163u.sys [2006-07-03 217600]
S3 USB28xxBGA;USB 2861 Device;C:WINDOWSsystem32DRIVERSemBDA.sys [2006-02-08 217216]
S3 USB28xxOEM;USB 28xx OEM Filter;C:WINDOWSsystem32DRIVERSemOEM.sys [2006-02-08 17792]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{4535be56-1b64-11dd-8f85-00140b01f7c2}]
ShellAutoRuncommand - G:setupSNK.exe
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-05 22:58:46
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINEsystemControlSet001ServicesmchInjDrv]
"ImagePath"="??C:DOCUME~1PROPRI~1LOCALS~1Tempmc21.tmp"
.
Temps d'accomplissement: 2008-09-05 23:02:27
ComboFix-quarantined-files.txt 2008-09-05 19:02:16
ComboFix2.txt 2008-09-05 18:09:44

Pre-Run: 7,322,112,000 octets libres
Post-Run: 7,308,955,648 octets libres

185 --- E O F --- 2008-08-24 23:03:34






Hijackthis:




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:02:56, on 05/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:Program FilesJavajre1.6.0_03injusched.exe
C:Program FilesHotkey ManagementFuncKey.exe
C:WINDOWSRTHDCPL.EXE
C:Program FilesAVC Finger-sensing Pad Driverfscp.exe
C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe
C:Program FilesKWorld MultimediaPVR PlusTVRScheduled.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesSuperCopier2SuperCopier2.exe
C:Program FilesMicro ApplicationMediaDICOMediaDICO.EXE
C:Program FilesOpenOffice.org 2.3programsoffice.exe
C:Program FilesOpenOffice.org 2.3programsoffice.BIN
C:Program FilesMicro ApplicationMediaDICORac.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesGrisoftAVG Anti-Spyware 7.5guard.exe
C:Program FilesAVC Finger-sensing Pad DriverFspadSvr.exe
C:WINDOWSsystem32
vsvc32.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:WINDOWSSystem32alg.exe
C:Program FilesMSN Messengerusnsvc.exe
C:Program FilesJavajre1.6.0_03injucheck.exe
C:WINDOWSsystem32CF2598.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSexplorer.exe
C:Program FilesSpybot - Search & DestroyTeaTimer.exe
G:ArtHuros.exe

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:Program FilesFichiers communsAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:Program FilesCanonEasy-WebPrintEWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_03inssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:Program FilesCanonEasy-WebPrintToolband.dll
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_03injusched.exe"
O4 - HKLM..Run: [FuncKey] "C:Program FilesHotkey ManagementFuncKey.exe"
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [SkyTel] SkyTel.EXE
O4 - HKLM..Run: [fscp] C:Program FilesAVC Finger-sensing Pad Driverfscp.exe
O4 - HKLM..Run: [SSBkgdUpdate] "C:Program FilesFichiers communsScansoft SharedSSBkgdUpdateSSBkgdupdate.exe" -Embedding -boot
O4 - HKLM..Run: [OpwareSE4] "C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe"
O4 - HKLM..Run: [PVR Agent] C:Program FilesKWorld MultimediaPVR PlusTVRScheduled.exe
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [snpstd] C:WINDOWSvsnpstd.exe
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [Easy-PrintToolBox] C:Program FilesCanonEasy-PrintToolBoxBJPSMAIN.EXE /logon
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [µTorrent] "C:Program FilesuTorrentutorrent.exe"
O4 - HKCU..Run: [SuperCopier2.exe] C:Program FilesSuperCopier2SuperCopier2.exe
O4 - HKCU..Run: [MediaDico] C:Program FilesMicro ApplicationMediaDICOLanceMediaDICO.exe Lancement
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - HKCU..Run: [CursorXP] "C:Program FilesCursorXPCursorXP.exe" -s
O4 - HKCU..Run: [msnmsgr] "C:Program FilesMSN Messengermsnmsgr.exe" /background
O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SYSTEM')
O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:Program FilesOpenOffice.org 2.3programquickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:Program FilesFichiers communsAdobeCalibrationAdobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_03inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_03inssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:WINDOWSdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:WINDOWSdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-U ... E_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 9211569109
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install ... stallX.CAB
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1FICHIE~1SkypeSKYPE4~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:Program FilesFichiers communsAdobe Systems SharedServiceAdobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:Program FilesGrisoftAVG Anti-Spyware 7.5guard.exe
O23 - Service: FspadSvc - Unknown owner - C:Program FilesAVC Finger-sensing Pad DriverFspadSvr.exe
O23 - Service: Service de l'iPod (iPod Service) - Unknown owner - C:Program FilesiPodiniPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Unknown owner - C:Program FilesSunbelt SoftwarePersonal Firewallkpf4ss.exe (file missing)

--
End of file - 9839 bytes